Homomorphic encryption-based privacy set intersection method and device, equipment and medium

Abstract

The disclosure provides a homomorphic encryption-based privacy set intersection method and device and electronic equipment, belonging to the technical field of computers. The method comprises the following steps: in response to receiving an instruction to obtain a data intersection of first participant data, using an inadvertent pseudo-random function to obtain random numbers of each element in the first participant data; homomorphically encrypting the random numbers of each element in the first participant data to obtain encrypted random numbers of each element in the first participant data, and sending the encrypted random numbers to a second participant; receiving a processing result of the encrypted random numbers and random numbers of each element in second participant data by the second participant, and homomorphically decrypting the processing result; determining a data intersection of the first participant data and the second participant data based on the homomorphically decrypted processing result, and outputting the data intersection.

Description

Technical Field

[0001] The present disclosure belongs to the field of computer technology, and in particular relates to a method, apparatus, device and medium for obtaining intersection of privacy sets based on homomorphic encryption. Background Art

[0002] In multi-party secure computing scenarios such as data alignment, data discovery, and joint risk control, it is necessary to obtain shared sample data without leaking private data. Specifically, each participant must obtain the intersection of their data without leaking their local data. This is why the PSI (Private Set Intersection) protocol was born. PSI allows each participant to obtain the intersection of their data without leaking any additional information. Here, additional information refers to any information beyond the data intersection of each participant.

[0003] However, existing solutions for calculating the data intersection between multiple participants usually use the plaintext of the data to obtain the data intersection. This results in participants other than the data holder obtaining the plaintext data during the intersection process, and even the plaintext data being intercepted by individuals other than the participants during the data transmission process, thereby causing the private data of the participants to be leaked and threatening the security of the private data.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0005] The present disclosure provides a method, device, and electronic device for finding the intersection of private sets based on homomorphic encryption.

[0006] Some embodiments of the present disclosure provide a method for intersecting private sets based on homomorphic encryption, the method comprising:

[0007] In response to receiving an instruction to obtain a data intersection for the first party's data, obtaining a random number for each element in the first party's data using an oblivious pseudorandom function;

[0008] Homomorphically encrypt the random number of each element in the first party's data to obtain an encrypted random number for each element in the first party's data, and send the encrypted random number to the second party;

[0009] receiving a processing result of the second party on the encrypted random number and the random number of each element in the second party's data, and performing homomorphic decryption on the processing result;

[0010] Based on the processing result after homomorphic decryption, a data intersection of the first participant data and the second participant data is determined, and the data intersection is output.

[0011] Optionally, performing homomorphic encryption on the random number of each element in the first party's data to obtain the encrypted random number of each element in the first party's data, and sending the encrypted random number to the second party includes:

[0012] Homomorphically encrypt the random number of each element in the first party's data to obtain an encrypted random number for each element in the first party's data;

[0013] Calculating the encrypted random number raised to a power of a predetermined positive integer, where the predetermined positive integer is determined based on the number of elements in the first participant's data and the number of elements in the second participant's data;

[0014] Obtaining a power value vector of the encrypted random number based on the natural number power;

[0015] The power value vector of the encrypted random number is sent to the second participant.

[0016] Optionally, the receiving, by the second party, a processing result of the encrypted random number and the random number of each element in the second party data includes:

[0017] receiving the inner product compressed by modulo switching sent by the second participant;

[0018] In which, the processing result is the inner product without module switching compression, the inner product is calculated by the second participant based on the power value vector and the coefficient vector of the second participant data, and the coefficient vector is obtained by the second participant based on the random numbers of each element in the second participant data.

[0019] Optionally, performing homomorphic decryption on the processing result includes:

[0020] Aggregating the inner products to obtain an aggregation result;

[0021] The aggregation result is homomorphically decrypted.

[0022] Optionally, the aggregation result corresponds one-to-one to the elements in the first participant data;

[0023] The determining the data intersection of the first participant's data and the second participant's data based on the processing result after homomorphic decryption includes:

[0024] When the aggregation result is 0, the element corresponding to the aggregation result is determined as the data intersection;

[0025] In a case where the aggregation result is not 0, an element corresponding to the aggregation result is determined as a non-data intersection.

[0026] Optionally, the receiving the processing result of the second participant on the encrypted random number and the random number of each element in the second participant data comprises:

[0027] receiving the inner product compressed by the modulo switching and sent by the second participant;

[0028] The processing result is an inner product that is not compressed by the modulo switching, and the inner product is calculated by the second participant based on a power value vector and a coefficient vector of the second participant data, the power value vector is each natural number power of the random number of each element in the second participant data in a preset positive integer number range, and the coefficient vector is obtained by the second participant based on the random number of each element in the second participant data.

[0029] Optionally, after the data intersection of the first participant data and the second participant data is determined based on the processing result after the homomorphic decryption and the data intersection is output, the method further comprises:

[0030] generating a key associated with a target participant in response to receiving an acquisition instruction of the data intersection sent by the target participant;

[0031] encrypting the data intersection by using the key;

[0032] sending the encrypted data intersection to the target participant, and sending a public key in the key to the target participant.

[0033] Some embodiments of the present disclosure provide a device for intersection calculation of multi-party data, and the device comprises:

[0034] an acquisition module configured to acquire a random number of each element in first participant data by using an oblivious pseudo-random function in response to receiving an instruction of acquiring a data intersection of the first participant data;

[0035] a sending module configured to homomorphically encrypt the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data, and send the encrypted random number to a second participant;

[0036] a receiving module configured to receive a processing result of the second participant on the encrypted random number and a random number of each element in second participant data, and homomorphically decrypt the processing result;

[0037] An output module is configured to determine a data intersection of the first participant data and the second participant data based on a processing result after homomorphic decryption, and output the data intersection.

[0038] Optionally, the sending module is further configured to:

[0039] homomorphically encrypt random numbers of each element in the first participant data to obtain encrypted random numbers of each element in the first participant data;

[0040] calculate each natural number power of the encrypted random numbers within a preset positive integer number of times, the preset positive integer being determined based on the number of elements of the first participant data and the number of elements of the second participant data;

[0041] obtain a power value vector of the encrypted random numbers based on the natural number powers;

[0042] send the power value vector of the encrypted random numbers to the second participant.

[0043] Optionally, the receiving module is further configured to:

[0044] receive the inner product compressed by using module switching and sent by the second participant;

[0045] wherein the processing result is an inner product that is not compressed by using module switching, the inner product being calculated by the second participant based on the power value vector and a coefficient vector of the second participant data, and the coefficient vector being obtained by the second participant based on random numbers of each element in the second participant data.

[0046] Optionally, the receiving module is further configured to:

[0047] aggregate the inner product to obtain an aggregation result;

[0048] homomorphically decrypt the aggregation result.

[0049] Optionally, the aggregation result corresponds to each element in the first participant data one by one, and the receiving module is further configured to:

[0050] in a case where the aggregation result is 0, determine the element corresponding to the aggregation result as the data intersection;

[0051] in a case where the aggregation result is not 0, determine the element corresponding to the aggregation result as a non-data intersection.

[0052] Optionally, the receiving module is further configured to:

[0053] receive the inner product compressed by using module switching and sent by the second participant;

[0054] The processing result is an inner product compressed by a switching modulus, and the inner product is calculated by the second participant based on a power vector and a coefficient vector of the second participant data, the power vector is each natural number power of a random number of each element after homomorphic encryption by the second participant within a preset positive integer number of times, and the coefficient vector is obtained by the second participant based on a random number of each element in the second participant data.

[0055] Optionally, the output module is further configured to:

[0056] In response to receiving an acquisition instruction for the data intersection sent by a target participant, generating a key associated with the target participant;

[0057] Encrypting the data intersection by using the key;

[0058] Sending the encrypted data intersection to the target participant, and sending a public key in the key to the target participant.

[0059] Some embodiments of the present disclosure provide an electronic device, comprising:

[0060] a memory, wherein computer readable code is stored in the memory;

[0061] one or more processors, when the computer readable code is executed by the one or more processors, the electronic device performs a privacy set intersection method based on homomorphic encryption as described above.

[0062] Some embodiments of the present disclosure provide a computer program comprising computer readable code, which when executed on an electronic device causes the electronic device to perform a privacy set intersection method based on homomorphic encryption as described above.

[0063] Some embodiments of the present disclosure provide a storage medium, wherein a privacy set intersection method based on homomorphic encryption as described above is stored in the storage medium.

[0064] The privacy set intersection method based on homomorphic encryption provided by some embodiments of the present disclosure hides and compresses data when obtaining the data intersection of multiple users by using the OPRF algorithm, and realizes ciphertext calculation by using the homomorphic encryption technology in the whole process of obtaining the data intersection, without leaking the plaintext of the data. Therefore, the intersection of the private data of multiple parties can be accurately obtained under the premise of ensuring the privacy and security of local data, and the security of the data is ensured.

[0065] The above description is only a summary of the technical solutions of the present disclosure. In order to enable one skilled in the art to better understand the technical means of the present disclosure, the contents of the specification can be implemented, and in order to enable the above and other purposes, features and advantages of the present disclosure to be more apparent and easy to understand, the specific embodiments of the present disclosure are described below. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present disclosure, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0067] Figure 1 An equipment interaction schematic diagram of a privacy set intersection method based on homomorphic encryption provided by the present disclosure is schematically shown;

[0068] Figure 2 A flowchart of a privacy set intersection method based on homomorphic encryption provided by the present disclosure is schematically shown;

[0069] Figure 3 A flowchart of a method for obtaining a power value vector of data provided by the present disclosure is schematically shown;

[0070] Figure 4 A flowchart of a method for homomorphic decryption of a processing result provided by some embodiments of the present disclosure is schematically shown;

[0071] Figure 5 A flowchart of a method for determining whether an element is a data intersection provided by the present disclosure is schematically shown;

[0072] Figure 6 A flowchart of a method for sending a data intersection to a target participant provided by the present disclosure is schematically shown;

[0073] Figure 7 A structural schematic diagram of a device for intersection calculation of multi-party data provided by some embodiments of the present disclosure is schematically shown;

[0074] Figure 8 A block diagram of an electronic device for executing a method according to some embodiments of the present disclosure is schematically shown;

[0075] Figure 9 A storage unit for holding or carrying program code for implementing a method according to some embodiments of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0076] To make the purposes, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are some but not all of the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

[0077] The PSI protocol is a basic function in multi-party secure computation, and needs to ensure that the intersection of all participant data is obtained finally under the premise that local data is not leaked. Since it has great application potential in dating services, data mining, recommendation systems, law enforcement, and the like, many efficient multi-party private set intersection protocols have been generated. At present, two network models are mostly used for the multi-party PSI protocol: one is a star topology network structure. Since this network structure is managed by a central node to perform centralized access control, the communication between nodes needs to pass through the central node, which reduces the exchange between nodes of all participants except the central node. However, it brings a high workload to the designated central node, not only increasing the burden of the central node, but also wasting the processing resources of the nodes of all participants, so that the resource utilization rate in the network is seriously unbalanced. The other is a star path network structure. In this network structure, each node is deployed with a dedicated communication link, so the communication volume and the calculation complexity of the participant nodes depend on the size of their own input set. The communication volume and the calculation complexity will increase with the increase of the data source, which will cause the node load to be too large in a network with too many nodes, and is obviously not suitable for a network with too many nodes.

[0078] The present disclosure provides a homomorphic encryption-based private set intersection method capable of ensuring that the intersection of all participant data is obtained finally under the premise that local data is not leaked.

[0079] Before the homomorphic encryption-based private set intersection method provided by the present disclosure is described in detail, the application scenario of the method is exemplarily introduced.

[0080] Exemplarily, Figure 1 An equipment interaction schematic diagram of the homomorphic encryption-based private set intersection method provided by the present disclosure is schematically shown.

[0081] Reference Figure 1, including a first participant 11, a plurality of second participants 12, and data 13 transmitted between the first participant 11 and the second participants 12. The data 13 can include first participant data carried by the first participant 11 or second participant data carried by the second participants 12. The selection of the first participant includes but is not limited to randomly selecting one participant from the plurality of participants as the first participant 11 or selecting the participant with the strongest computing power from the plurality of participants as the first participant 11. The first participant 11 and the second participants 12 transmit the data 13 through wired communication or wireless communication.

[0082] Figure 2 A flowchart of a homomorphic encryption-based private set intersection method provided by the present disclosure is schematically shown. The method includes:

[0083] In step 101, in response to receiving an instruction to obtain a data intersection of first participant data, a random number of each element in the first participant data is obtained by using an oblivious pseudo-random function.

[0084] In an embodiment of the present disclosure, in response to receiving an instruction to obtain a data intersection of first participant data, the first participant 11 obtains a random number of each element in the first participant data by using an oblivious pseudo-random function. For example, assuming that the first participant data is X1 and X1 has m elements. The first participant 11 selects a random number K, performs OPRF on X1 based on the random number K, and obtains a random number X'1=(F k (x 1,1 ),…,F k (x 1,m )) of each element in the first participant data; wherein F k (x 1,m ) is a random number of the mth element in X1, and m is a positive integer.

[0085] Optionally, the embodiments of the present disclosure can be applied to scenarios such as dating services, data mining, recommendation systems, law enforcement, etc.

[0086] Optionally, the triggering manner of the instruction to obtain a data intersection of first participant data includes but is not limited to voice triggering or clicking a software control or hardware control configured for the first participant. The oblivious pseudo-random function refers to OPRF, which stands for Oblivious Pseudo Random Function.

[0087] In step 102, the random number of each element in the first participant data is homomorphic encrypted to obtain an encrypted random number of each element in the first participant data, and the encrypted random number is sent to the second participant.

[0088] In the embodiments of the present disclosure, the first participant 11 homomorphically encrypts the random numbers of each element in the first participant data to obtain encrypted random numbers of each element in the first participant data, and sends the encrypted random numbers to the second participant 12.

[0089] For example, assuming that the key pair used for homomorphic encryption is (pk, sk), the first participant 11 encrypts X'1 using pk (public key) to obtain the encrypted random number Y1 of X'1, that is, Y1 = Enc(pk, X'1) = (Enc(pk, F k (x 1,1 )), …, Enc(pk, F k (x 1,m )), where Enc denotes a homomorphic encryption function.

[0090] Optionally, the manner of homomorphically encrypting the random numbers of each element in the first participant data includes but is not limited to the following:

[0091] (1) Full homomorphic encryption (FHE):

[0092] FHE (Fully HE) supports unlimited number of calculations of any type on ciphertext. The advantage is that the supported operators are many and the number of operations is not limited, and the disadvantage is that the efficiency is very low, and currently it cannot support large-scale calculations.

[0093] (2) Leveled homomorphic encryption (LHE):

[0094] LHE (Leveled HE) supports limited number of addition and multiplication operations. The advantage is that it supports both addition and multiplication, and the efficiency is generally much higher than FHE, and the disadvantage is that the number of supported calculations is limited.

[0095] Step 103, receiving the processing result of the encrypted random numbers and the random numbers of each element in the second participant data by the second participant, and homomorphically decrypting the processing result.

[0096] In the embodiments of the present disclosure, the processing result refers to the data obtained by the second participant 12 based on the encrypted random numbers and the random numbers of each element in the second participant data. The first participant 11 receives the processing result of the encrypted random numbers and the random numbers of each element in the second participant data by the second participant 12, and then homomorphically decrypts the processing result using sk (secret key).

[0097] Step 104, determining the data intersection of the first participant data and the second participant data based on the homomorphically decrypted processing result, and outputting the data intersection.

[0098] In the embodiments of the present disclosure, the first participant 11 determines the data intersection of the first participant data and the second participant data based on the processing result after homomorphic decryption, and outputs the data intersection.

[0099] The embodiments of the present disclosure hide and compress data when obtaining the data intersection of the data of the multiple users by using the OPRF algorithm, and realize ciphertext calculation in the whole process of obtaining the data intersection by using the homomorphic encryption technology, without leaking the plaintext of the data, so that the intersection of the private data of the multiple users can be accurately obtained on the premise that the non-intersection data is not obtained by the individual other than the data holder, and the security of the data is ensured.

[0100] Exemplarily, Figure 3 A method flowchart for obtaining a power value vector of data provided by the present disclosure is schematically shown.

[0101] Referring to Figure 3 , including steps 101, 1021-1024.

[0102] The step 101 is consistent with the specific implementation of the step 101 in the previous embodiment and the specific implementation of the step 101 in the embodiment of the present disclosure, and will not be described here.

[0103] The steps 1021-1024 are specific implementations of the step 102, and specifically:

[0104] In step 1021, the random number of each element in the first participant data is homomorphic encrypted to obtain the encrypted random number of each element in the first participant data.

[0105] In the embodiments of the present disclosure, the first participant 11 homomorphic encrypts the random number of each element in the first participant data to obtain the encrypted random number of each element in the first participant data.

[0106] In step 1022, the powers of each natural number in the range of a preset positive integer are calculated for the encrypted random number, and the preset positive integer is determined based on the number of elements of the first participant data and the number of elements of the second participant data.

[0107] In the embodiments of the present disclosure, the first participant 11 calculates the powers of each natural number in the range of a preset positive integer for the encrypted random number, and the preset positive integer is determined based on the number of elements of the first participant data and the number of elements of the second participant data. The first participant 11 uses homomorphic multiplication to calculate the powers of each natural number in the range of the preset positive integer for the encrypted random number.

[0108] Optionally, the preset positive integer is the maximum number of the number of elements in the first participant's data and the number of elements in the second participant's data. For example, assuming that the number of elements in the first participant's data is 8 and the number of elements in the second participant's data is 10, the preset positive integer is determined to be 10, and the first participant 11 calculates the 0th power, 1st power, 2nd power, ..., 10th power of the encrypted random number; assuming that the encrypted random number of X'1 is

[0109] Y1=Enc(pk,X'1)=(Enc(pk,F k (x 1,1 )),…,Enc(pk,F k (x 1,10 )));

[0110] Then each power of Y1 within 10 is Y j =(Y1[j] 0 ,Y1[j] 1 …,Y1[j] 10 ),(j∈[1,10]).

[0111] Alternatively, assuming that the number of elements in the first participant's data is 11 and the number of elements in the second participant's data is 8, the preset positive integer is determined to be 11, and the first participant 11 calculates the 0th power, 1st power, 2nd power, ..., 11th power of the encrypted random number. Assume that the encrypted random number of X'1 is

[0112] Y1=Enc(pk,X'1)=(Enc(pk,F k (x 1,1 )),…,Enc(pk,F k (x 1,11 )));

[0113] Then each power of Y1 within 11 is Y j =(Y1[j] 0 ,Y1[j] 1 …,Y1[j] 11 ),(j∈[1,11]).

[0114] Step 1023: Obtain a power value vector of the encrypted random number based on the natural number power.

[0115] In the disclosed embodiment, the first party 11 obtains a power value vector of the encrypted random number based on the natural number power. The power value vector refers to a vector in which the power values ​​of the powers of the powers of the encrypted random numbers are arranged according to a preset rule. For example, the power value vector may be a vector in which the power values ​​of the powers of the powers of the encrypted random numbers are arranged from high to low power, or a vector in which the power values ​​of the powers of the powers of the encrypted random numbers are arranged from low to high power.

[0116] Step 1024, sending the power value vector of the encrypted random number to the second participant.

[0117] In the embodiment of the present disclosure, the first participant 11 sends the power value vector of the encrypted random number to the second participant 12.

[0118] The embodiment of the present disclosure calculates the power value of the data of the first participant by the first participant, and then sends the calculated power value vector to the second participant, so that in the case that the second participant has multiple terminal devices, the calculation amount of the second participant can be reduced, and the efficiency of obtaining the data intersection can be improved.

[0119] Optionally, referring to Figure 4 , step 103 includes:

[0120] Step 1031, receiving the inner product compressed by modulus switching sent by the second participant; wherein the processing result is the inner product which is not compressed by modulus switching, the inner product is calculated by the second participant based on the power value vector and the coefficient vector of the second participant data, and the coefficient vector is obtained by the second participant based on the random number of each element in the second participant data.

[0121] In the embodiment of the present disclosure, modulus switching refers to Modulus Switching, which is derived from BGV12 (BGV12 is a homomorphic encryption scheme, which uses modulus switching to reduce the absolute noise of the ciphertext, and makes the encryption have more layers of homomorphic multiplication operation), which can effectively reduce the size of the ciphertext. The first participant 11 receives the inner product compressed by modulus switching sent by the second participant 12; wherein the processing result of the encrypted random number and the random number of each element in the second participant data by the second participant is the inner product which is not compressed by modulus switching, the inner product is calculated by the second participant 12 based on the power value vector and the coefficient vector of the second participant data, and the coefficient vector is obtained by the second participant 12 based on the random number of each element in the second participant data. The second participant uses homomorphic multiplication and homomorphic addition when calculating the power value vector and the coefficient vector.

[0122] Wherein, the way that the second participant 12 obtains the random number of each element based on each element in the second participant data is also obtained by using OPRF technology, which will not be repeated here.

[0123] Optionally, assuming that the second participant data is X i =(x i,1 ,…x i,m )(i∈[2,n]), the second participant 12 converts X i into a polynomial S i(x) = (x - x i,1 )…(x - x i,m ) = a i,m x m +…+a i,1 x+a i,0 , and a coefficient vector wherein n is a positive integer, and n is greater than or equal to 2.

[0124] Optionally, the second participant 12 obtains an inner product based on the power value vector and the coefficient vector of the second participant data For example, the inner product of Y1 and is z 1,2 , and the inner product of Y1 and is z 1,3 .

[0125] In step 1032, the inner product is aggregated to obtain an aggregation result.

[0126] In the embodiment of the present disclosure, the first participant 11 aggregates the inner product to obtain an aggregation result. Wherein, aggregation refers to the first participant 11 adding up each element in the inner product sent by the second participant 12 to obtain the aggregation result Z m = ((z 2,1 +…+z n,1 ),…,(z 2,m +…+z n,m )) = (Z1, Z2, …, Z m ). Wherein, Zm refers to the aggregation result corresponding to the mth element.

[0127] In step 1033, the aggregation result is homomorphically decrypted.

[0128] In the embodiment of the present disclosure, the first participant 11 determines the data intersection of the first participant data and the second participant data according to the aggregation result.

[0129] The embodiment of the present disclosure compresses the inner product by using the modulus switching technology before the second participant sends the inner product to the first participant, and in the case of multiple devices of the second participant, the data receiving amount of the first participant can be greatly reduced. Further, combined with the OPRF technology to reduce the complexity of calculation, the data intersection can be obtained faster.

[0130] Exemplarily, Figure 5 The method for determining whether an element is in the data intersection provided by the present disclosure is schematically shown, wherein steps 1041 and 1042 can be specific embodiments of step 104, and the method comprises:

[0131] Step 1031', receiving the inner product compressed by the module switching sent by the second participant; wherein the processing result is the inner product which is not compressed by the module switching, and the inner product is calculated by the second participant based on the power value vector and the coefficient vector of the second participant data, the power value vector is each natural number power of the random number of each element after the homomorphic encryption by the second participant within a preset positive integer number of times, and the coefficient vector is obtained by the second participant based on the random number of each element in the second participant data.

[0132] In the embodiment of the present disclosure, the first participant 11 receives the inner product compressed by the module switching sent by the second participant 12; wherein the processing result of the encrypted random number and the random number of each element in the second participant data by the second participant is the inner product which is not compressed by the module switching, and the inner product is calculated by the second participant based on the power value vector and the coefficient vector of the second participant data, the power value vector is each natural number power of the random number of each element after the homomorphic encryption by the second participant within a preset positive integer number of times, and the coefficient vector is obtained by the second participant based on the random number of each element in the second participant data.

[0133] Step 1032, aggregating the inner product to obtain an aggregation result.

[0134] Step 1033, homomorphic decryption is performed on the aggregation result.

[0135] In the embodiment of the present disclosure, the specific implementation of steps 1032 and 1033 is consistent with the specific implementation of step 1032 in the previous embodiment, and will not be repeated here.

[0136] Step 1041, in the case that the aggregation result is 0, determining the element corresponding to the aggregation result as the data intersection.

[0137] In the embodiment of the present disclosure, the aggregation result z = ((z 2,1 +…+z n,1 ),…,(z 2,m +…+z n,m )) = (Z1, Z2, …, Z m ), the first participant 11 performs homomorphic decryption on z to obtain the decryption result R j The expression of R j is as follows:

[0138] R m = Dec (sk, z) = (Dec (sk, z1), …, Dec (sk, z j );

[0139] Wherein, Dec represents a homomorphic decryption function. If the decryption result of the jth item is Z jis 0, the first participant 11 determines the data X corresponding to the decryption result of the item as the data intersection j is determined as the data intersection. Wherein, j is a positive integer greater than or equal to 1 and less than or equal to m.

[0140] Step 1042, in the case that the aggregation result is not 0, the element corresponding to the aggregation result is determined as the non-data intersection.

[0141] In the embodiment of the present disclosure, the first participant 11 homomorphically decrypts z to obtain a decryption result R j If the decryption result Z j of the jth item is not 0, the first participant 11 determines the data X corresponding to the decryption result of the item as the non-data intersection. j

[0142] The embodiment of the present disclosure utilizes the second participant to calculate the power value vector of the data of the first participant. When the first participant has weak computing capability and the second participant is a plurality of terminal devices with strong computing capability, the computing pressure of the first participant can be reduced, and the efficiency of obtaining the data intersection when the data volume is large can be ensured.

[0143] Optionally, with reference to Figure 6 After the step 104, the method further includes:

[0144] Step 201, in response to receiving the obtaining instruction of the data intersection sent by the target participant, a key associated with the target participant is generated.

[0145] In the embodiment of the present disclosure, the target participant refers to one or more terminal devices in the second participant, and the key associated with the target participant refers to the key owned by the target participant and the first participant 11. In response to the instruction of the target participant for securely sending the data intersection, the first participant 11 generates the key associated with the target participant.

[0146] Optionally, the types of the key generated by the first participant include but are not limited to: a key for symmetric encryption, or a key for asymmetric encryption.

[0147] Step 202, the data intersection is encrypted by using the key.

[0148] In the embodiment of the present disclosure, the first participant 11 encrypts the data intersection by using the key.

[0149] Optionally, the encryption manner of the first participant 11 for the data intersection includes but is not limited to: symmetric encryption or asymmetric encryption.

[0150] ​Step 203, sending the encrypted data intersection to the target participant, and sending the public key in the key to the target participant.

[0151] In the embodiments of the present disclosure, the first participant 11 sends the encrypted data intersection to the target participant, and sends the public key in the key to the target participant, so that the target participant decrypts the data intersection by using the key.

[0152] Some embodiments of the present disclosure can avoid the data intersection being leaked in the transmission process and improve the security of the data intersection by the above scheme, which requests the first participant to encrypt the data intersection before sending the data intersection to the target participant.

[0153] Figure 7 An apparatus 30 for computing intersection of multi-party data provided by the present disclosure is schematically shown, and the apparatus comprises:

[0154] The obtaining module 301 is configured to obtain a random number of each element in the first participant data by using an oblivious pseudo-random function in response to receiving an instruction of obtaining a data intersection of the first participant data;

[0155] The sending module 302 is configured to homomorphically encrypt the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data, and send the encrypted random number to the second participant;

[0156] The receiving module 303 is configured to receive a processing result of the encrypted random number and a random number of each element in the second participant data by the second participant, and homomorphically decrypt the processing result;

[0157] The output module 304 is configured to determine a data intersection of the first participant data and the second participant data based on the homomorphically decrypted processing result, and output the data intersection.

[0158] Optionally, the sending module 302 is further configured to:

[0159] homomorphically encrypt the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data;

[0160] calculate each natural number power of the encrypted random number within a preset positive integer number of times, the preset positive integer number being determined based on the element number of the first participant data and the element number of the second participant data;

[0161] obtain a power value vector of the encrypted random number based on the natural number power;

[0162] sending the vector of power values of the encrypted random number to the second participant.

[0163] Optionally, the receiving module 303 is further configured to:

[0164] receive the inner product compressed by the modulo switching and sent by the second participant;

[0165] The processing result is an inner product that is not compressed by the modulo switching, and the inner product is calculated by the second participant based on a power value vector and a coefficient vector of the second participant data, and the coefficient vector is obtained by the second participant based on random numbers of each element in the second participant data.

[0166] Optionally, the receiving module 303 is further configured to:

[0167] aggregate the inner products to obtain an aggregated result;

[0168] homomorphically decrypt the aggregated result.

[0169] Optionally, the aggregated result corresponds to each element in the first participant data in a one-to-one manner, and the receiving module 303 is further configured to:

[0170] in a case where the aggregated result is 0, determine the element corresponding to the aggregated result as the data intersection;

[0171] in a case where the aggregated result is not 0, determine the element corresponding to the aggregated result as a non-data intersection.

[0172] Optionally, the receiving module 303 is further configured to:

[0173] receive the inner product compressed by the modulo switching and sent by the second participant;

[0174] The processing result is an inner product that is not compressed by the modulo switching, and the inner product is calculated by the second participant based on a power value vector and a coefficient vector of the second participant data, and the power value vector is each natural number power of a random number of each element in the second participant data in a preset positive integer number range, and the coefficient vector is obtained by the second participant based on random numbers of each element in the second participant data.

[0175] Optionally, the output module 304 is further configured to:

[0176] in response to receiving an acquisition instruction for the data intersection sent by a target participant, generate a key associated with the target participant;

[0177] encrypt the data intersection using the key;

[0178] send the encrypted data intersection to the target participant and send the public key in the key to the target participant.

[0179] The embodiments of the present disclosure hide and compress data when obtaining the data intersection in the data of the multi-party users by using the OPRF algorithm, and realize ciphertext calculation by using homomorphic encryption technology in the whole process of obtaining the data intersection, without leaking the plaintext of the data. The intersection of the multi-party private data can be accurately obtained on the premise that the non-intersection data is not obtained by the individual other than the data holder, and the security of the data is ensured.

[0180] The various component embodiments of the present disclosure can be implemented in a server, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the electronic device according to the embodiments of the present disclosure. The present disclosure can also be implemented as a device or apparatus program (for example, a computer program and a computer program product) for performing part or all of the methods described herein. Such a program implementing the present disclosure can be stored on a storage medium or can have one or more signals in the form. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0181] For example, Figure 8 An electronic device that can implement the methods according to the present disclosure is shown. The electronic device traditionally comprises a processor 410 and a computer program product or storage medium in the form of a memory 420. The memory 420 can be an electronic memory such as a flash memory, EEPROM (electrically erasable programmable read-only memory), EPROM, hard disk, or ROM. The memory 420 has a storage space 430 for program code 431 for performing any of the method steps in the methods described above. For example, the storage space 430 for program code can comprise individual program codes 431 for implementing the various steps in the above methods, respectively. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically portable or stationary storage units as referred to in Figure 9 The storage unit can have a storage space for program code for performing any of the method steps in the methods described above. For example, the storage space for program code can comprise individual program codes for implementing the various steps in the above methods, respectively. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically portable or stationary storage units as referred to in Figure 8The memory 420 in the electronic device is arranged similarly to a storage segment, a storage space, etc. The program code can be compressed, for example, in a suitable form. Typically, the storage unit comprises computer-readable code 431', i.e. code which can be read by a processor, such as 410, which, when a program is run by the electronic device, causes the electronic device to carry out the individual steps in the methods described above.

[0182] It should be appreciated that, although the individual steps in the flowcharts of the figures are shown in a sequence following the direction of the arrows, the steps are not necessarily executed in the order of the arrows. Unless explicitly stated otherwise in the text, the execution of the steps is not strictly limited in order, and they can be executed in other orders. Furthermore, at least some of the steps in the flowcharts of the figures can comprise several sub-steps or several phases, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of which is not necessarily sequential, but can be alternating or alternating with at least some of the other steps or sub-steps or phases of other steps.

[0183] The terms "one embodiment", "an embodiment" or "one or more embodiments" as used herein contemplate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the disclosure. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment.

[0184] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the disclosure can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order not to obscure the understanding of this description.

[0185] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps other than those listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The disclosure can be implemented by means of both hardware and software, and any combination thereof. In a unit claim, several devices can be listed with a comma. The use of "first", "second", and "third" etc. does not indicate any order. These designations can be used interchangeably.

[0186] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present disclosure, but not to limit them; although the present disclosure has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A privacy set intersection method based on homomorphic encryption, characterized in that, The method applied to a first participant comprises: In response to receiving an instruction to acquire a data intersection of the first participant data, acquiring a random number of each element in the first participant data by using an inadvertent pseudo-random function; Homomorphically encrypting the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data, and sending the encrypted random number to a second participant; Receiving a processing result of the second participant on the encrypted random number and a random number of each element in second participant data, and homomorphically decrypting the processing result; Determining a data intersection of the first participant data and the second participant data based on the homomorphically decrypted processing result, and outputting the data intersection; The homomorphically encrypting the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data, and sending the encrypted random number to a second participant, comprises: Homomorphically encrypting the random number of each element in the first participant data to obtain an encrypted random number of each element in the first participant data; Calculating each natural number power of the encrypted random number within a preset positive integer number of times, the preset positive integer being determined based on the element number of the first participant data and the element number of the second participant data; Obtaining a power value vector of the encrypted random number based on the natural number power; Sending the power value vector of the encrypted random number to the second participant; The receiving the processing result of the second participant on the encrypted random number and a random number of each element in second participant data, comprises: Receiving an inner product compressed by using module switching sent by the second participant; Wherein, the processing result is obtained by the second participant by compressing the inner product that is not compressed by using module switching before sending, the inner product is calculated by the second participant based on the power value vector and a coefficient vector of the second participant data, and the coefficient vector is obtained by the second participant based on the random number of each element in the second participant data.

2. The privacy set intersection method based on homomorphic encryption according to claim 1, characterized in that, The homomorphically decrypting the processing result, comprises: Aggregating the inner product to obtain an aggregation result; Homomorphically decrypting the aggregation result.

3. The privacy set intersection method based on homomorphic encryption of claim 2, wherein, The aggregation result corresponds to an element in the first participant data one by one; The determining the data intersection of the first participant data and the second participant data based on the homomorphically decrypted processing result, comprises: In the case that the aggregation result is 0, determining the element corresponding to the aggregation result as the data intersection; In the case that the aggregation result is not 0, determining the element corresponding to the aggregation result as a non-data intersection.

4. The privacy set intersection method based on homomorphic encryption according to claim 1, characterized in that, The receiving the processing result of the second participant on the encrypted random number and a random number of each element in second participant data, comprises: Receiving an inner product compressed by using module switching sent by the second participant; The processing result is obtained by performing modulo switching compression on the inner product of the second participant before sending, the inner product is calculated by the second participant based on a power value vector and a coefficient vector of the second participant data, the power value vector is each natural number power of a random number of each element of the second participant to the homomorphic encryption within a preset positive integer number of times, and the coefficient vector is obtained by the second participant based on a random number of each element in the second participant data.

5. The privacy set intersection method based on homomorphic encryption according to any one of claims 1-4, characterized in that, After the homomorphic decryption-based processing result is used to determine the data intersection of the first participant data and the second participant data, and the data intersection is output, the method further includes: In response to receiving an acquisition instruction for the data intersection sent by a target participant, a key associated with the target participant is generated; The data intersection is encrypted by using the key; The encrypted data intersection is sent to the target participant, and a public key in the key is sent to the target participant.

6. An apparatus for intersection computation of multi-party data, the apparatus comprising: Comprise: The acquisition module is configured to, in response to receiving an instruction for acquiring a data intersection of the first participant data, acquire a random number of each element in the first participant data by using an oblivious pseudo-random function; The sending module is configured to homomorphically encrypt the random number of each element in the first participant data to obtain encrypted random numbers of each element in the first participant data, and send the encrypted random numbers to a second participant; The receiving module is configured to receive a processing result of the second participant on the encrypted random numbers and random numbers of each element in second participant data, and homomorphically decrypt the processing result; The output module is configured to determine a data intersection of the first participant data and the second participant data based on the homomorphic decryption-based processing result, and output the data intersection; The homomorphic encryption of the random number of each element in the first participant data to obtain the encrypted random numbers of each element in the first participant data, and the sending of the encrypted random numbers to a second participant, comprise: The homomorphic encryption of the random number of each element in the first participant data to obtain the encrypted random numbers of each element in the first participant data; The calculation of each natural number power of the encrypted random numbers within a preset positive integer number of times, wherein the preset positive integer is determined based on the number of elements in the first participant data and the number of elements in the second participant data; Based on the natural number power, a power value vector of the encrypted random numbers is obtained; The power value vector of the encrypted random numbers is sent to the second participant; The receiving of the processing result of the second participant on the encrypted random numbers and random numbers of each element in second participant data, comprise: Receiving the inner product compressed by using modulo switching sent by the second participant; The processing result is obtained by performing modulo switching compression on the inner product of the second participant before sending, and the inner product is calculated based on the power value vector and a coefficient vector of the second participant data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor implements the method for privacy set intersection based on homomorphic encryption according to any one of claims 1-5 when executing the computer program.

8. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the method for privacy set intersection based on homomorphic encryption according to any one of claims 1-5.

Images