Client authorization method and device, privacy protection set intersection calculation method and device

Abstract

The present application provides a method and device for customer authorization, and a method and device for calculating the intersection of privacy-protected sets. The method for customer authorization includes: obtaining the customer's authorization information, the authorization information includes the authorization object corresponding to the customer; signing the authorization information through a signature algorithm to obtain the customer's authorization signature; sending the authorization signature to a privacy-protected set intersection calculation platform, so that the privacy-protected set intersection calculation platform performs privacy-protected set intersection calculation according to the authorization signature. By signing the customer's authorization information to obtain the customer's authorization signature, and performing privacy-protected set intersection calculation according to the authorization tag, it is ensured that both institutions involved in the privacy-protected set intersection calculation are authorized by the customer, avoiding the situation where the customer has not authorized both parties but may perform privacy-protected set intersection through the customer ID, thereby improving the security of privacy-protected set intersection calculation.

Description

Technical Field

[0001] The present application relates to the field of data privacy protection, and more specifically, to a method and device for client authorization, and a method and device for calculating the intersection of privacy-preserving sets. Background Art

[0002] Privacy-preserving set intersection (PSI) allows multiple parties holding their own sets to jointly calculate the intersection of the sets. At the end of the calculation, each participating party can only obtain the correct intersection, but will not obtain any information from the other party's set other than the intersection.

[0003] In some application scenarios, ID alignment is required between different institutions or departments. When the two parties intersect the privacy protection sets, it is usually based on the customer ID, which may cause the leakage of customer information. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method and device for customer authorization, and a method and device for calculating the intersection of privacy-preserving sets. The method and device obtain the customer's authorization signature by signing the customer's authorization information, and replace the customer identification information with an authorization tag when calculating the privacy-preserving set. The intersection of privacy-preserving sets is calculated based on the authorization tag to ensure that both parties involved in the calculation of the intersection of privacy-preserving sets are authorized by the customer, thereby avoiding the situation where the customer has not authorized both parties but may use the customer ID to calculate the intersection of privacy-preserving sets, thereby improving the security of the calculation of the intersection of privacy-preserving sets.

[0005] In a first aspect, an embodiment of the present application provides a customer authorization method, including: obtaining the customer's authorization information, the authorization information including the authorization object corresponding to the customer; signing the authorization information through a signature algorithm to obtain the customer's authorization signature; sending the authorization signature to a privacy protection set intersection calculation platform, so that the privacy protection set intersection calculation platform performs privacy protection set intersection calculation based on the authorization signature.

[0006] In the above implementation process, authorization information including the customer's authorized object is obtained, and the authorization information is signed to obtain the authorization signature and send it to the privacy-preserving set intersection calculation platform. The privacy-preserving set intersection calculation platform performs intersection calculation based on the authorization signature, ensuring that both institutions performing the calculation are authorized by the customer, thereby improving the security and accuracy of privacy intersection calculation.

[0007] Optionally, in an embodiment of the present application, the signature algorithm includes a deterministic signature algorithm; signing the authorization information through the signature algorithm to obtain the customer's authorization signature, including: obtaining a first prime number and a second prime number for signing; obtaining a private key based on the first prime number and the second prime number through the Euler function; signing the authorization information through the private key to obtain the customer's authorization signature.

[0008] In the above implementation process, the authorization information is signed by a deterministic signature algorithm to prevent the customer's authorization information from being tampered with and to achieve the unforgeability of the authorization information.

[0009] Optionally, in an embodiment of the present application, the authorization information is signed by a private key to obtain the customer's authorization signature, including: generating a message digest of the authorization information by a digest algorithm; and signing the message digest by a private key to obtain the customer's authorization signature.

[0010] In the above implementation process, a message digest is generated by a digest algorithm, and the digest message is signed by a private key to ensure the uniqueness of the customer's signature.

[0011] Optionally, in an embodiment of the present application, the authorization information is signed through a signature algorithm to obtain the customer's authorization signature, including: if there are multiple authorization objects corresponding to the customer, determining the order of the multiple authorization objects; through a signature algorithm, according to the order of the multiple authorization objects, signing the authorization information to obtain the customer's authorization signature.

[0012] In the above implementation process, when there are multiple authorization objects, it is necessary to determine the order of the multiple authorization objects and sign the authorization information according to the order of the authorization objects, so that the authorization information of each customer is unique.

[0013] In the second aspect, an embodiment of the present application provides a method for calculating the intersection of privacy-preserving sets, including: obtaining an authorization signature corresponding to a customer; wherein the authorization signature is obtained by signing the customer's authorization information, and the authorization information includes the authorization object corresponding to the customer; based on the authorization signature of each customer, determining sample customers for calculating the intersection of privacy-preserving sets; and performing the intersection of privacy-preserving sets based on the sample customers.

[0014] In the above implementation process, after receiving the corresponding authorization signature of the customer, the sample customer for the privacy-preserving set intersection calculation is determined according to the authorization signature, and the privacy-preserving set intersection calculation is performed according to the sample customer. This ensures that the sample customer authorizes both parties performing the calculation, thereby improving the security and accuracy of the privacy intersection calculation.

[0015] Optionally, in an embodiment of the present application, sample customers for privacy-preserving set intersection calculation are determined based on the authorization signature of each customer, including: parsing the authorization signature to obtain the authorization object corresponding to the customer; judging whether the first institution and the second institution for performing the privacy-preserving set intersection calculation are authorization objects; if the first institution and the second institution are both authorization objects, determining the customer as a sample customer for privacy-preserving set intersection calculation performed by the first institution and the second institution.

[0016] In the above implementation process, the authorization object corresponding to the customer is obtained according to the authorization signature, and it is determined whether the first institution and the second institution participating in the intersection calculation of the privacy-preserving set are both authorized by the customer. If yes, the customer is used as a sample customer for the intersection calculation of the privacy-preserving set to participate in the intersection calculation. This avoids using customers who have not authorized both institutions as sample customers, thereby improving the security and accuracy of the privacy intersection calculation.

[0017] On the third aspect, an embodiment of the present application also provides a customer authorization device, including: an acquisition module, used to obtain the customer's authorization information, the authorization information includes the authorization object corresponding to the customer; a signature module, used to sign the authorization information through a signature algorithm to obtain the customer's authorization signature; a processing module, used to send the authorization signature to a privacy protection set intersection calculation platform, so that the privacy protection set intersection calculation platform performs privacy protection set intersection calculation according to the authorization signature.

[0018] Optionally, in an embodiment of the present application, the customer authorization device, wherein the signature module is specifically used to obtain a first prime number and a second prime number for signing; obtain a private key based on the first prime number and the second prime number through the Euler function; sign the authorization information through the private key to obtain the customer's authorization signature.

[0019] Optionally, in an embodiment of the present application, the customer authorization device, the signature module is also used to generate a message digest of the authorization information through a digest algorithm; the message digest is signed by a private key to obtain the customer's authorization signature.

[0020] Optionally, in an embodiment of the present application, the customer authorization device, the signature module is also used to determine the order of multiple authorization objects if there are multiple authorization objects corresponding to the customer; through the signature algorithm, the authorization information is signed according to the order of multiple authorization objects to obtain the customer's authorization signature.

[0021] In a fourth aspect, an embodiment of the present application also provides a privacy-preserving set intersection calculation device, including: a signature acquisition module, used to obtain the authorization signature corresponding to the customer; wherein the authorization signature is obtained by signing the customer's authorization information, and the authorization information includes the authorization object corresponding to the customer; a determination module, used to determine the sample customers for privacy-preserving set intersection calculation based on the authorization signature of each customer; and a calculation module, used to perform privacy-preserving set intersection calculation based on the sample customers.

[0022] In a fifth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor and a memory, the memory storing machine-readable instructions executable by the processor, and the machine-readable instructions executing the method described above when executed by the processor.

[0023] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described above is executed.

[0024] By adopting the client authorization method and device, and the privacy-preserving set intersection calculation method and device provided in this application, the client identifier for the privacy-preserving set intersection calculation is replaced with the authorization signature, and the privacy-preserving set intersection calculation is performed according to the authorization tag to ensure that both institutions participating in the privacy-preserving set intersection calculation are authorized by the client. And by signing the authorization information, it is ensured that the authorization information of each client is unique and cannot be tampered with. The security of the privacy-preserving set intersection calculation is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A flowchart of a client authorization method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of a privacy-preserving set intersection calculation method provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of a flow chart of a privacy protection set intersection calculation authorized by a customer provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of a client authorization device provided by an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of a privacy-preserving set intersection calculation device provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0034] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0035] See also Figure 1 A flow chart of a customer authorization method provided in an embodiment of the present application is shown.

[0036] Step S110: Obtain the customer's authorization information, which includes the authorization object corresponding to the customer.

[0037] The implementation method of the above step S110 includes: the customer authorization system obtains the customer's authorization information, the authorization information includes the authorization object corresponding to the customer, and the authorization information may also include the customer information and the corresponding authorization object and the authorization scope; the customer information may be the customer's name, ID number, account information, etc. Each customer information may correspond to one or more authorization objects. For example, the customer authorization system receives the authorization information of Zhang San, including Zhang San, ID number, and mobile phone number; authorizes the first institution to use Zhang San's ID number; and authorizes the first institution and the second institution to use Zhang San's mobile phone number.

[0038] Step S120: Sign the authorization information through a signature algorithm to obtain the customer's authorization signature.

[0039] The implementation method of the above step S120 includes: the customer authorization system signs the authorization information and obtains the customer's authorization signature. For example, the customer's authorization message is processed through a one-way function to generate a digital string that cannot be forged by others, which is used to authenticate the source of the authorization message and detect whether the authorization message has been modified. The hash function and the public key encryption algorithm are combined through the signature algorithm to ensure the integrity and authenticity of the authorization information; the integrity check ensures that the authorization information has not been changed, and the authenticity check ensures that the authorization signature is generated by the customer authorization system that generates the hash value, rather than forged by other institutions or individuals.

[0040] Step S130: Send the authorization signature to the privacy-preserving set intersection calculation platform, so that the privacy-preserving set intersection calculation platform performs privacy-preserving set intersection calculation according to the authorization signature.

[0041] The implementation method of the above step S130 includes: the customer authorization system sends the authorization signature of each customer to the privacy-preserving set intersection calculation platform. After receiving the authorization signature of the customer, the privacy-preserving set intersection calculation platform replaces the identification information of the customer used for the privacy-preserving set intersection calculation with the authorization signature corresponding to the customer, and performs the privacy-preserving set intersection calculation based on the authorization signature.

[0042] In the above implementation process, authorization information including the customer's authorized object is obtained, and the authorization information is signed to obtain the authorization signature and send it to the privacy-preserving set intersection calculation platform. The privacy-preserving set intersection calculation platform performs calculations based on the authorization signature, ensuring that both institutions performing the intersection calculation are authorized by the customer, thereby improving the security and accuracy of the privacy intersection.

[0043] Optionally, in an embodiment of the present application, the signature algorithm includes a deterministic signature algorithm; signing the authorization information through the signature algorithm to obtain the customer's authorized signature, including: obtaining a first prime number and a second prime number for signing; obtaining a private key based on the first prime number and the second prime number through the Euler function; signing the authorization information through the private key to obtain the customer's authorized signature.

[0044] An example of an implementation method of the above steps is as follows: the signature algorithm includes a deterministic signature algorithm, such as the RSA encryption algorithm, the DSA-data signature algorithm, and the ECDSA elliptic curve data signature algorithm. In this solution, there is no restriction on the type of deterministic signature algorithm when signing the authorization information. Any signature algorithm can be used to sign the authorization information. This embodiment takes the RSA algorithm as an example to illustrate the steps of obtaining the customer's authorization signature.

[0045] In the RSA algorithm, the signed authorization message, the key, and the final generated signature are all represented in digital form. When signing the authorization message, the text needs to be encoded into numbers first.

[0046] The RSA algorithm is an asymmetric cryptographic algorithm. Usually, a pair of RSA keys is generated first, namely a private key (SK) and a public key (PK). The private key is not disclosed to the public and is saved by the customer or the customer-authorized system. The public key can be disclosed to the public or registered in a network server. The encryption algorithm and decryption algorithm can also be selected according to actual needs.

[0047] The encryption system of the RSA algorithm uses the mod n multiplication group and randomly selects two unequal prime numbers, namely the first prime number p and the second prime number q. A prime number refers to a natural number greater than 1 that has no other factors except 1 and itself. The first prime number and the second prime number can be prime numbers with larger values ​​to ensure the security of the generated key pair.

[0048] According to the first prime number p and the second prime number q, the private key is obtained through the Euler function. Euler function: For a positive integer n, the Euler function is the number of positive integers less than or equal to n that are relatively prime to n. In order to understand the principle more intuitively, only the special case of the Euler function is explained here, that is, if n can be decomposed into the product of two relatively prime integers, that is, n = p*q (where p and q are both prime numbers), then Among them, the first prime number p and the second prime number q are not public, but n can be public.

[0049] Calculate the product n of the first prime number p and the second prime number q, according to Compute the Euler function for n Randomly select an integer e as the public key (PK), the condition is And e and Calculate e for The modular inverse element d of is used as the private key (SK), and the modular element is inverted, and there is an integer d such that the remainder after dividing ed is 1, and n and e are encapsulated into a public key (n, e), and n and d are encapsulated into a private key (n, d). You can get the private key and the public key at the same time.

[0050] The authorization information is signed with the private key to obtain the customer's authorization signature. The authenticity of the authorization signature can also be verified with the public key. If the verified authorization signature is consistent with the received authorization signature, the signature verification is successful. People who do not have the private key cannot imitate the authorization signature. The signature method can be signature = m^SK, and the verification method is m = signature^PK.

[0051] Optionally, in an embodiment of the present application, the authorization information is signed by a private key to obtain the customer's authorization signature, including: generating a message digest of the authorization information by a digest algorithm; signing the message digest by a private key to obtain the customer's authorization signature. When signing the authorization information, a message digest of the authorization information is first generated by a digest algorithm, and the digest message is signed by a private key to ensure the uniqueness of the customer's signature.

[0052] Optionally, in an embodiment of the present application, the authorization information is signed through a signature algorithm to obtain the customer's authorization signature, including: if there are multiple authorization objects corresponding to the customer, determining the order of the multiple authorization objects; through a signature algorithm, according to the order of the multiple authorization objects, signing the authorization information to obtain the customer's authorization signature.

[0053] The implementation method of the above steps is, for example: if there are multiple authorization objects corresponding to the customer, the order of the multiple authorization objects is determined, for example, Zhang San, mobile phone number; the first institution and the second institution are authorized to use Zhang San's mobile phone number. Among them, Zhang San authorizes the mobile phone number to the first institution and the second institution at the same time, then the order of the first institution in the authorization message is determined to be the first, and the order of the second institution is the second. This ensures that the authorization information is signed and the uniqueness of the customer's authorization signature is obtained.

[0054] In the above implementation process, when there are multiple authorization objects, it is necessary to determine the order of the multiple authorization objects and sign the authorization information according to the order of the authorization objects, so that the authorization information of each customer is unique.

[0055] See also Figure 2 A flowchart of a privacy-preserving set intersection calculation method provided in an embodiment of the present application is shown.

[0056] The present application embodiment provides a privacy-preserving set intersection calculation method, including:

[0057] Step S210: Obtain the authorization signature corresponding to the customer; wherein the authorization signature is obtained by signing the customer's authorization information, and the authorization information includes the authorization object corresponding to the customer.

[0058] The implementation method of the above-mentioned step S210 includes: the privacy protection set intersection computing platform receives the authorization signature corresponding to the customer, and the authorization signature can be sent by the customer authorization system to the privacy protection set intersection computing platform. Among them, the authorization signature is obtained by signing the customer's authorization information, and the authorization signature is unique. For example, the customer's authorization message is processed by a one-way function to generate a digital string that cannot be forged by others, which is used to authenticate the source of the authorization message and detect whether the authorization message has been modified. The hash function and the public key encryption algorithm are combined through the signature algorithm to ensure the integrity and authenticity of the authorization information; the integrity check ensures that the authorization information has not been changed, and the authenticity check ensures that the authorization signature is generated by the customer authorization system that generates the hash value, and is not forged by other institutions or individuals.

[0059] The authorization information includes the authorization object corresponding to the customer, and the authorization information may also include the customer information and the corresponding authorization object; the customer information may be the customer's name, ID number, account information, etc. Each customer information may correspond to one or more authorization objects. For example, the customer authorization system receives the authorization information of Zhang San, including Zhang San, ID number, and mobile phone number; authorizes the first institution to use Zhang San's ID number; and authorizes both the first institution and the second institution to use Zhang San's mobile phone number.

[0060] Step S220: Determine sample customers for privacy protection set intersection calculation based on the authorization signature of each customer.

[0061] The implementation method of the above step S220 includes: the privacy-preserving set intersection calculation platform determines the sample customers for the privacy-preserving set intersection calculation according to the authorization signature of each customer. For example, according to the customer's authorization signature, it is determined whether the customer has authorized both institutions for the privacy-preserving set intersection calculation. If so, the customer is used as a sample customer. The sample customer is a customer who has authorized both institutions for the privacy-preserving set intersection calculation.

[0062] Step S230: Calculate the intersection of privacy-preserving sets based on sample customers.

[0063] The implementation method of the above-mentioned step S230 includes: the privacy-preserving set intersection calculation platform performs privacy-preserving set intersection calculation based on sample customers. If the customer does not authorize both institutions that perform the privacy-preserving set intersection calculation, the customer will not participate in the privacy intersection as a sample customer, thereby avoiding the situation where the customer has not authorized both institutions when both institutions perform the privacy-preserving set intersection calculation, but both institutions may perform the privacy-preserving set intersection through the customer ID, thereby improving the security of the privacy-preserving set intersection calculation.

[0064] In the above implementation process, after receiving the corresponding authorization signature of the customer, the sample customer for the privacy-preserving set intersection calculation is determined according to the authorization signature, and the privacy-preserving set intersection calculation is performed according to the sample customer. This ensures that the sample customer authorizes both parties performing the calculation, thereby improving the security and accuracy of the privacy intersection calculation.

[0065] Optionally, in an embodiment of the present application, sample customers for privacy-preserving set intersection calculation are determined based on the authorization signature of each customer, including: parsing the authorization signature to obtain the authorization object corresponding to the customer; judging whether the first institution and the second institution for performing the privacy-preserving set intersection calculation are authorization objects; if the first institution and the second institution are both authorization objects, determining the customer as a sample customer for privacy-preserving set intersection calculation performed by the first institution and the second institution.

[0066] The implementation method of the above steps is as follows: the privacy protection set intersection computing platform parses the authorization signature to obtain the authorization object corresponding to the customer. In one implementation method, the customer authorization information is obtained by parsing the authorization signature. The authorization information may include customer information and the corresponding authorization object. For example, Zhang San, ID card number, authorizes the first institution to use Zhang San's ID card number. The ID card number is the customer information, and the first institution is the authorization object of the customer's ID card number.

[0067] Determine whether the first institution and the second institution that perform the intersection calculation of the privacy-preserving set are authorized objects. Zhang San authorized the first institution to use Zhang San's ID number, and the second institution did not obtain Zhang San's authorization to use his ID number. If the authorization signature is parsed, the customer information obtained is Zhang San, mobile phone number, and the first institution and the second institution are both authorized to use Zhang San's mobile phone number, then the first institution and the second institution are both authorized objects of the customer.

[0068] If both the first institution and the second institution are authorized objects, the client is determined as a sample client for the first institution and the second institution to perform privacy-preserving set intersection calculation. In one embodiment, the privacy-preserving set intersection calculation platform replaces the client ID originally used for privacy-preserving set intersection calculation with the client's authorization signature to perform privacy-preserving set intersection calculation based on the authorization signature.

[0069] The applicant has discovered that when performing privacy-preserving set intersection calculations, it is usually performed using the customer's identification information (customer ID), and the two institutions performing the privacy-preserving set intersection calculations assume that the other party has obtained the customer's authorization. At this time, if the first institution performing the privacy-preserving set intersection calculation does not obtain the customer's authorization, and the second institution obtains the customer's authorization, and the first institution uses the customer ID and the second institution to perform the privacy-preserving set intersection calculation, then the customer will be considered to be the intersection of both parties, and there is a possibility of data leakage.

[0070] In the above implementation process, the authorization object corresponding to the customer is obtained according to the authorization signature, and it is determined whether the first institution and the second institution participating in the intersection calculation of the privacy-preserving set are both authorized by the customer. If yes, the customer is used as a sample customer for the intersection calculation of the privacy-preserving set to participate in the intersection calculation. When doing the privacy protection level and intersection calculation, attention is paid to the authorization of the customer to both institutions, rather than adopting the customer authorization principle that assumes that the other party has obtained the customer's authorization, thereby preventing unauthorized institutions from using the customer's representation to obtain additional information other than the intersection of the two parties, thereby improving the security and accuracy of the privacy intersection.

[0071] See also Figure 3 A schematic diagram of the flow of the intersection calculation of the privacy-preserving sets authorized by the customer provided in the embodiment of the present application.

[0072] In a preferred embodiment, the customer authorization information (m) includes the name, ID number, and the authorized objects A and B of the customer ID number, that is, the customer authorizes A and B to use the ID number. The customer authorization system signs the customer authorization information using a private key through a deterministic signature algorithm to obtain an authorization signature X, X=sign(m). The customer authorization system sends the authorization signature to the privacy protection set intersection calculation platform, which performs privacy protection set intersection calculation based on the authorization signature X.

[0073] See also Figure 4 The structure diagram of the client authorization device provided in the embodiment of the present application is shown; the embodiment of the present application provides a client authorization device 300, including:

[0074] The acquisition module 310 is used to acquire the authorization information of the client, and the authorization information includes the authorization object corresponding to the client;

[0075] The signature module 320 is used to sign the authorization information through a signature algorithm to obtain the customer's authorization signature;

[0076] The processing module 330 is used to send the authorization signature to the privacy protection set intersection calculation platform, so that the privacy protection set intersection calculation platform performs privacy protection set intersection calculation according to the authorization signature.

[0077] Optionally, in an embodiment of the present application, the customer authorization device 300, wherein the signature module 320 is specifically used to obtain a first prime number and a second prime number for signing; obtain a private key based on the first prime number and the second prime number through the Euler function; sign the authorization information through the private key to obtain the customer's authorization signature.

[0078] Optionally, in an embodiment of the present application, the customer authorization device 300, the signature module 320 is also used to generate a message digest of the authorization information through a digest algorithm; the message digest is signed by a private key to obtain the customer's authorization signature.

[0079] Optionally, in an embodiment of the present application, the customer authorization device 300, the signature module 320 is also used to determine the order of multiple authorization objects if there are multiple authorization objects corresponding to the customer; through the signature algorithm, the authorization information is signed according to the order of multiple authorization objects to obtain the customer's authorization signature.

[0080] It should be understood that the client authorization device 300 corresponds to the above-mentioned client authorization method embodiment and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the operating system (OS) of the device.

[0081] See also Figure 5 The structure diagram of the privacy-preserving set intersection calculation device provided in the embodiment of the present application is shown; the embodiment of the present application provides a privacy-preserving set intersection calculation device 400, including:

[0082] The signature acquisition module 410 is used to acquire the authorization signature corresponding to the customer; wherein the authorization signature is obtained by signing the customer's authorization information, and the authorization information includes the authorization object corresponding to the customer;

[0083] A determination module 420, for determining sample customers for privacy protection set intersection calculation based on the authorization signature of each customer;

[0084] The calculation module 430 is used to perform privacy protection set intersection calculation based on sample customers.

[0085] Optionally, in an embodiment of the present application, a privacy-preserving set intersection calculation device 400, wherein a determination module 420 is specifically used to parse the authorization signature to obtain an authorization object corresponding to the customer; determine whether the first institution and the second institution that perform the privacy-preserving set intersection calculation are authorization objects; if the first institution and the second institution are both authorization objects, the customer is determined as a sample customer for which the first institution and the second institution perform the privacy-preserving set intersection calculation.

[0086] It should be understood that the privacy-preserving set intersection calculation device 400 corresponds to the above-mentioned privacy-preserving set intersection calculation method embodiment, and can execute the various steps involved in the above-mentioned method embodiment. The specific functions of the device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the device.

[0087] See also Figure 6 An electronic device 500 provided in an embodiment of the present application includes: a processor 510 and a memory 520, wherein the memory 520 stores machine-readable instructions executable by the processor 510, and when the machine-readable instructions are executed by the processor 510, the above method is executed.

[0088] An embodiment of the present application further provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above method is executed.

[0089] Among them, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0090] In several embodiments provided by the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0091] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part.

[0092] The above description is only an optional implementation manner of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be covered within the protection scope of the embodiments of the present application.

Claims

1. A method for client authorization, characterized in that: include: Obtaining authorization information of a client, wherein the authorization information includes an authorization object corresponding to the client; Sign the authorization information through a signature algorithm to obtain the customer's authorization signature; Sending the authorization signature to a privacy-preserving set intersection calculation platform, so that the privacy-preserving set intersection calculation platform performs privacy-preserving set intersection calculation according to the authorization signature; The signature algorithm includes a deterministic signature algorithm; The step of signing the authorization information through a signature algorithm to obtain the authorization signature of the customer includes: Obtain a first prime number and a second prime number for signing; Obtaining a private key according to the first prime number and the second prime number through the Euler function; Sign the authorization information using a private key to obtain the customer's authorization signature; The step of signing the authorization information with a private key to obtain the authorization signature of the client includes: Generate a message digest of the authorization information by using a digest algorithm; The message digest is signed by a private key to obtain the authorized signature of the customer.

2. The method according to claim 1, characterized in that The step of signing the authorization information through a signature algorithm to obtain the authorization signature of the customer includes: If there are multiple authorization objects corresponding to the client, determine the order of the multiple authorization objects; The authorization information is signed according to the order of the multiple authorization objects through a signature algorithm to obtain the authorization signature of the customer.

3. A privacy-preserving set intersection calculation method, characterized in that: include: Obtaining the authorization signature corresponding to the customer; wherein the authorization signature is obtained by signing the authorization information of the customer, and the authorization information includes the authorization object corresponding to the customer; the authorization signature corresponding to the customer is obtained by signing the authorization information through a signature algorithm, and the steps include: obtaining a first prime number and a second prime number for signing; obtaining a private key through the Euler function according to the first prime number and the second prime number; generating a message digest of the authorization information through a digest algorithm; signing the message digest through the private key to obtain the authorization signature of the customer; Determine sample customers for privacy protection set intersection calculation based on the authorization signature of each customer; The privacy-preserving set intersection is calculated based on the sample customers.

4. The method according to claim 3, characterized in that The step of determining sample customers for privacy protection set intersection calculation based on the authorization signature of each customer includes: Parse the authorization signature to obtain the authorization object corresponding to the client; Determine whether the first institution and the second institution performing the privacy protection set intersection calculation are the authorized objects; If the first institution and the second institution are both the authorized objects, the client is determined as a sample client for the privacy protection set intersection calculation performed by the first institution and the second institution.

5. A client authorization device, used to implement the method according to claim 1, characterized in that: include: An acquisition module, used to acquire the authorization information of a client, wherein the authorization information includes the authorization object corresponding to the client; A signature module, used to sign the authorization information through a signature algorithm to obtain the authorization signature of the customer; A processing module, configured to send the authorization signature to a privacy-preserving set intersection calculation platform, so that the privacy-preserving set intersection calculation platform performs privacy-preserving set intersection calculation according to the authorization signature; The signature module is specifically used to obtain a first prime number and a second prime number for signing; obtain a private key according to the first prime number and the second prime number through the Euler function; and sign the authorization information through the private key to obtain the authorized signature of the customer; The signature module is further used to generate a message digest of the authorization information through a digest algorithm; and to sign the message digest through a private key to obtain the authorized signature of the customer.

6. A privacy-preserving set intersection calculation device, used to implement the method according to claim 3, characterized in that: include: A signature acquisition module is used to acquire the authorization signature corresponding to the customer; wherein the authorization signature is acquired by signing the authorization information of the customer, and the authorization information includes the authorization object corresponding to the customer; the signature acquisition module is specifically used to acquire a first prime number and a second prime number for signature; a private key is acquired according to the first prime number and the second prime number through the Euler function; a message digest of the authorization information is generated through a digest algorithm; the message digest is signed through the private key to acquire the authorization signature of the customer; A determination module, used to determine sample customers for privacy protection set intersection calculation based on the authorization signature of each customer; A calculation module is used to perform privacy protection set intersection calculation based on the sample customers.

7. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 4 is performed.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is executed.

Images