A method and device for intersection of unbalanced private sets

Abstract

The present application provides a method for unbalanced private set intersection. A first party holds a first data set, and a second party holds a second data set. The method includes: performing data preprocessing on the private data of the first data set to obtain a first mapping data set; fitting a polynomial function based on the first mapping data set; combining the coefficients of each term in the function into a coefficient vector; receiving a public key from the second party, and using the public key to homomorphically encrypt the coefficient vector to obtain an encrypted coefficient vector; receiving a ciphertext input vector from the second party, combining it with the encrypted coefficient vector, and calculating a ciphertext result; transmitting the ciphertext result to the second party, so that the second party obtains the result of unbalanced private set intersection. Accordingly, the present invention discloses a device for unbalanced private set intersection.

Description

Technical Field

[0001] The present application relates to the fields of computer application and information technology, and in particular to a method, device, computer-readable storage medium, and electronic device for intersection of unbalanced privacy sets. Background Art

[0002] With the introduction and improvement of laws and regulations such as the Cybersecurity Law and the Personal Information Protection Law, data compliance and privacy security are receiving increasing attention. Emerging privacy computing technologies provide key support for data privacy security and usability and unidentification. Among them, Private Set Intersection (PSI) is a very important type of algorithm in privacy computing and has been widely used in multiple scenarios such as government affairs, finance, and healthcare. PSI, also known as private set intersection, secure set intersection, or secure intersection, is one of the basic functions of secure multi-party computing (SMPC or MPC). When multiple participating parties each hold a private data set (i.e., a private set), PSI allows any party to obtain the intersection of the private data sets of other parties while protecting the data privacy of each party.

[0003] However, current private data set intersection techniques are primarily designed for balanced scenarios, where each participant holds roughly the same amount of data. For unbalanced scenarios, where the amount of data held by each participant varies significantly, relevant private data set intersection techniques are still under development and refinement. Some existing solutions utilize fully homomorphic encryption to securely intersect private sets in unbalanced scenarios. However, these solutions have inherent drawbacks, such as low ciphertext computation efficiency, large ciphertext sizes, and high algorithm complexity requiring complex optimization implementations. Summary of the Invention

[0004] In response to the above-mentioned defects of the existing methods for finding the intersection of private sets in unbalanced scenarios, the present application provides a method, device, computer-readable storage medium, and electronic device for finding the intersection of unbalanced private sets, which have higher ciphertext calculation efficiency and better compatibility.

[0005] According to one aspect of the present application, a method for unbalanced private set intersection is provided, wherein a first party holds a first data set, and a second party holds a second data set. The method is performed by the first party and includes:

[0006] Performing data preprocessing on the private data of the first data set to obtain a first mapping data set;

[0007] fitting a function in a polynomial form according to the first mapping data set;

[0008] Combining the coefficients of each term in the function into a coefficient vector;

[0009] receiving a public key from the second party, and homomorphically encrypting the coefficient vector using the public key to obtain an encrypted coefficient vector;

[0010] receiving a ciphertext input vector from the second party, and calculating and obtaining a ciphertext result by combining the ciphertext input vector with the encryption coefficient vector;

[0011] The ciphertext result is transmitted to the second party, so that the second party obtains the result of the unbalanced private set intersection.

[0012] In one embodiment, the step of performing data preprocessing on the first data set further includes: performing preprocessing using an oblivious pseudorandom function (OPRF), and the data of the first mapping data set are all pseudorandom numbers.

[0013] In one embodiment, the private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0014] In one embodiment, the ciphertext input vector is obtained based on the following steps:

[0015] Generate a random matrix;

[0016] Generate the identity matrix;

[0017] Generate a pair of reversible matrices;

[0018] The ciphertext input vector is obtained by calculation based on the random matrix, the identity matrix, the reversible matrix pair, and the private key of the second party.

[0019] In one embodiment, the function is obtained by fitting using the least squares method.

[0020] According to one aspect of the present application, a method for unbalanced private set intersection is provided, wherein a first party holds a first data set, and a second party holds a second data set, and the method is performed by the second party, comprising:

[0021] performing data preprocessing on the private data of the second data set to obtain a second mapping data set;

[0022] generating a pair of private and public keys, and sending the public key to the first party;

[0023] Encrypting the data of the second mapping data set based on the private key to generate a ciphertext input vector and a decryption key;

[0024] sending the ciphertext input vector to the first party;

[0025] The ciphertext result based on the ciphertext input vector is received from the first party, and the ciphertext result is decrypted using the decryption key to obtain an unbalanced private set intersection result.

[0026] In one embodiment, an oblivious pseudorandom function (OPRF) is used for preprocessing, and the data of the second mapping data set are all pseudorandom numbers.

[0027] In one embodiment, the ciphertext input vector is obtained based on the following steps:

[0028] Generate a random matrix;

[0029] Generate the identity matrix;

[0030] Generate a pair of reversible matrices;

[0031] The ciphertext input vector is obtained by calculation according to the private key, the random matrix, the identity matrix, and the reversible matrix pair.

[0032] In one embodiment, the decryption key is obtained based on the following steps:

[0033] Generate a random matrix;

[0034] Generate the identity matrix;

[0035] Generate a pair of reversible matrices;

[0036] The decryption key is obtained by calculation according to the random matrix, the identity matrix and the reversible matrix pair.

[0037] In one embodiment, if the decrypted unbalanced private set intersection result is 0, the first party's private data is intersection data; if the decrypted unbalanced private set intersection result is not 0, the first party's private data is not intersection data.

[0038] In one embodiment, the private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0039] According to one aspect of the present application, a device for unbalanced private set intersection is provided, wherein a first party holds a first data set, and a second party holds a second data set. The device is provided at the first party and includes:

[0040] a preprocessing unit, configured to perform data preprocessing on the private data of the first data set to obtain a first mapping data set;

[0041] a fitting unit, configured to fit a function in a polynomial form according to the first mapping data set, and combine coefficients of each term in the function into a coefficient vector;

[0042] an encryption unit, configured to receive a public key from the second party and homomorphically encrypt the coefficient vector using the public key to obtain an encrypted coefficient vector;

[0043] a calculation unit, configured to receive the ciphertext input vector from the second party, and calculate and obtain a ciphertext result in combination with the encryption coefficient vector;

[0044] A sending unit is used to send the ciphertext result to the second party, so that the second party obtains the unbalanced private set intersection result.

[0045] In one embodiment, the pre-processing unit uses an oblivious pseudorandom function (OPRF) for pre-processing, and the data of the first mapping data set are all pseudo-random numbers.

[0046] In one embodiment, the function is obtained by fitting using the least squares method.

[0047] In one embodiment, the private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0048] According to one aspect of the present application, a device for unbalanced private set intersection is provided, wherein a first party holds a first data set, and a second party holds a second data set. The device is provided at the second party and includes:

[0049] a preprocessing unit, configured to perform data preprocessing on the private data of the second data set to obtain a second mapping data set;

[0050] a key generation unit, configured to generate a pair of private and public keys according to a homomorphic encryption algorithm, and send the public key to the first party;

[0051] an encryption unit, configured to encrypt the data of the second mapping data set according to the private key to generate a ciphertext input vector and a decryption key;

[0052] a sending unit, configured to send the ciphertext input vector to the first party;

[0053] A decryption unit is configured to receive a ciphertext result from the first party based on the ciphertext input vector, decrypt the ciphertext result using the decryption key, and obtain an unbalanced private set intersection result.

[0054] In one embodiment, the pre-processing unit uses an oblivious pseudorandom function (OPRF) for pre-processing, and the data of the second mapping data set are all pseudo-random numbers.

[0055] In one embodiment, the encryption unit obtains the ciphertext input vector based on the following steps:

[0056] Generate a random matrix;

[0057] Generate the identity matrix;

[0058] Generate a pair of reversible matrices;

[0059] The ciphertext input vector is obtained by calculation according to the private key, the random matrix, the identity matrix, and the reversible matrix pair.

[0060] In one embodiment, the encryption unit obtains the decryption key based on the following steps:

[0061] Generate a random matrix;

[0062] Generate the identity matrix;

[0063] Generate a pair of reversible matrices;

[0064] The decryption key is obtained by calculation according to the random matrix, the identity matrix and the reversible matrix pair.

[0065] In one embodiment, if the decrypted unbalanced privacy set intersection result is 0, it is determined that the first party's private data is intersection data; if the decrypted unbalanced privacy set intersection result is not 0, it is determined that the first party's private data is not intersection data.

[0066] In one embodiment, the private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0067] According to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, wherein when the instructions are executed on a processor, the method for unbalanced privacy set intersection as described in one aspect of the present application is executed.

[0068] According to one aspect of the present application, an electronic device is provided, comprising: one or more processors; a memory; wherein the memory stores one or more computer programs, and the one or more computer programs include instructions, which, when executed by the processor, cause the processor to execute the method for unbalanced private set intersection as described in one aspect of the present application.

[0069] As can be seen from the above, in the embodiments of this specification, the first party holding the first data set can only obtain the ciphertext input vector obtained by homomorphic encryption from the second party holding the second data set. The first party cannot infer any data included in the second data set through the ciphertext input vector. The first party sends the ciphertext result to the second party. The ciphertext result is also obtained by the first party using two encryption matrices to perform linear transformation calculations. The second party decrypts the ciphertext result using the decryption key. Based on the decrypted ciphertext result, it can only be determined whether the first party's private data belongs to the second data set. It is impossible to reversely deduce and determine the specific location of the data to be queried in the data set, thereby meeting the security requirements of anonymous queries. Compared with the existing technology, the unbalanced privacy set intersection method in this case converts the complex calculation process of privacy set intersection into a simple matrix transformation operation, which not only ensures the efficiency of ciphertext calculation and retrieval, but also achieves many advantages such as batch processing and compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] After reading the detailed description of the present application with reference to the accompanying drawings, readers will have a clearer understanding of various aspects of the present application.

[0071] Figure 1 Schematically shows a flowchart of a method for intersecting unbalanced private sets according to the first embodiment of the present application;

[0072] Figure 2 Schematically shows a flow chart of a method for intersection of unbalanced private sets according to the second embodiment of the present application;

[0073] Figure 3 Schematically shows a system architecture diagram of an apparatus for unbalanced private set intersection according to the third embodiment of the present application;

[0074] Figure 4 Schematically shows a system architecture diagram of an apparatus for unbalanced privacy set intersection according to the fourth embodiment of the present application;

[0075] Figure 5 The structure diagram of a computer-readable storage medium corresponding to an unbalanced privacy set intersection method according to another embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0076] To provide a more detailed and complete understanding of the technical content disclosed in this application, reference is made to the accompanying drawings and the various specific embodiments of this application described below. The same reference numerals in the accompanying drawings represent the same or similar components. However, those skilled in the art will appreciate that the embodiments provided below are not intended to limit the scope of this application. Furthermore, the accompanying drawings are for illustrative purposes only and are not drawn to their original size.

[0077] The specific implementation methods of various aspects of the present application are further described in detail below with reference to the accompanying drawings.

[0078] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determining".

[0079] Flowcharts are used throughout this specification to illustrate the operations performed by systems according to embodiments of this specification. It should be understood that preceding or following operations do not necessarily need to be performed in exact order. Instead, the steps may be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0080] First, the terms involved in one or more embodiments of the present application are explained.

[0081] Private Set Intersection (PSI) is a technique used to find the intersection of user IDs from two financial institutions, while preserving data privacy. This technique, called Private Set Intersection (PSI), is widely used in various scenarios, including finance, government affairs, and healthcare, and is one of the most mature technologies in privacy-preserving computing. For example, Bank A and Financial Institution B have a set of user IDs. PSI can be used to find the intersection of these two institutions' user IDs while preserving data privacy. This technique, called Private Set Intersection (PSI), is used to find the intersection of these two institutions' user IDs without leaking any other information.

[0082] Unbalanced Private Set Intersection: Suppose the size of the ID dataset of Bank A is X, and the size of the ID dataset of financial institution B is Y. When X << Y, the Private Set Intersection in this scenario is called Unbalanced Private Set Intersection. If the existing PSI technology is directly used, then Bank A with less data volume needs the same amount of computation and communication overhead as institution B with a large amount of data.

[0083] Homomorphic Encryption: A special public-key encryption scheme where operations within the ciphertext domain are equivalent to the corresponding operations within the plaintext domain after decryption.

[0084] Somewhat Homomorphic Encryption: A type of homomorphic encryption that supports both ciphertext addition and multiplication operations, but has a limited multiplication depth.

[0085] Oblivious Pseudo-Random Function: Abbreviated as OPRF, a cryptographic protocol with two participating parties, Sender and Receiver. Sender provides the key k and the function F, and Receiver provides the input x. When running this cryptographic protocol, Receiver obtains the output F(k, x), and Sender has no output. During the protocol execution, Sender does not know the input x, and Receiver does not know the function F and the key k.

[0086] Privacy data: including but not limited to personal basic information (personal name, birthday, ethnicity, nationality, family relationship, address, personal telephone number, email address, etc.), personal identity information (ID card, military officer ID, passport, driver's license, work permit, access permit, social security card, residence permit, etc.), personal biometric information (personal genes, fingerprints, voiceprints, eyeprints, palm prints, auricle, iris, facial features, etc.), network identity information (system account, IP address, email address and passwords, passwords, password protection answers, user personal digital certificates, etc.), personal health and physiological information (records related to personal illness and treatment, such as symptoms, hospitalization records, medical orders, test reports, surgery and anesthesia records, nursing records, medication records, drug and food allergy information, fertility information, past medical history, diagnosis and treatment, family medical history, current medical history, infectious disease history, etc., as well as information related to personal physical health, and weight, height, lung capacity, etc.), personal Educational information (personal occupation, position, work unit, academic qualifications, degree, educational experience, work experience, training records, transcripts, etc.), personal property information (bank account number, identification information (password), deposit information (including fund amount, payment and receipt records, etc.), real estate information, credit record, credit information, transaction and consumption records, cash flow records, etc., as well as virtual property information such as virtual currency, virtual transactions, and game redemption codes), personal communication information (communication records and content, SMS, MMS, email, and data describing personal communications (commonly referred to as metadata), etc.), contact information (address book, friend list, group list, email address list, etc.), personal Internet access records (referring to user operation records stored in logs, including website browsing records, software usage records, click records, etc.), personal commonly used device information (referring to hardware serial number, device MAC address, software list, unique device identification code (such as IMEI / Android ID) Information describing the basic situation of personal commonly used devices (including ID / IDFA / OPENUDID / GUID, SIM card IMSI information, etc.), personal location information (including travel routes, precise positioning information, accommodation information, latitude and longitude, etc.) and other information (marital history, beliefs, undisclosed criminal records, etc.).

[0087] In homomorphic encryption, operations in the ciphertext domain are equivalent to the corresponding operations in the plaintext domain after decryption. In other words, the encrypted data can still be used for corresponding calculations, such as addition and multiplication. Therefore, the value obtained after decrypting the ciphertext calculation result is equivalent to the calculation result of the corresponding plaintext data in the plaintext. Generally, homomorphic encryption can be expressed as follows:

[0088] Enc(f(m1,m2))=f(Enc(m1),Enc(m2))

[0089] Wherein, m1 and m2 represent plaintext data, Enc(m1) and Enc(m2) represent ciphertext data, and f represents an operation.

[0090] This formula indicates that encrypting plaintext m1 and m2 first and then performing the calculation is equivalent to performing the calculation first and then encrypting them. This formula demonstrates the fundamental property of homomorphic encryption: it is homomorphic with respect to operations, and the result of a calculation in the ciphertext domain, after decryption, is equal to the result of the calculation in the plaintext domain.

[0091] This application is also based on the basic theory of homomorphic encryption, proposing a method for intersecting unbalanced private sets. It converts the complex calculation process of intersecting private sets into a simple matrix transformation operation, which not only ensures the efficiency of ciphertext calculation and retrieval, but also achieves many advantages such as batch processing and compatibility.

[0092] Figure 1 The flowchart of the method for intersection of unbalanced private sets according to the first embodiment of the present application is schematically shown.

[0093] Reference Figure 1 In this embodiment, the first party holds a first data set Y={y o1 ,y o2 ,…,y on}, the second party holds the second data set X={x o1 ,…,x om The method for intersecting unbalanced private sets is implemented by the first party holding the first data set. In the method of this embodiment, all ciphertext operations involve only multiplication and addition, and are therefore compatible with any somewhat homomorphic encryption scheme.

[0094] like Figure 1 As shown, the method for finding the intersection of unbalanced private sets includes:

[0095] Step S101 : performing data preprocessing on the private data of the first data set to obtain a first mapping data set.

[0096] In some embodiments, the private data of the first party is a user identifier of a user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0097] In some embodiments, to enhance the security of anonymous queries, an oblivious pseudorandom function (OPRF) is used to pre-process the private data in the first dataset, converting the first dataset into a first mapped dataset. Correspondingly, the private data in the first dataset is converted into pseudorandom numbers for the first mapped dataset. Subsequent data processing is performed on the pseudorandom numbers, which have no apparent formal relationship to the original private data.

[0098] Step S103: fitting a polynomial function according to the first mapping data set. For example, fitting the n pieces of data stored by the first party to obtain a polynomial function f(x)=a with the highest degree n n x n +a n-1 x n-1 +…+a1x+a0.

[0099] In a more specific embodiment, the least square method may be used to fit the polynomial with the highest degree of n.

[0100] Step S105: Combining the coefficients of each term in the function into a coefficient vector L.

[0101]

[0102] Step S107: Receive the public key PK from the second party, and use the public key PK to homomorphically encrypt the coefficient vector L to obtain the encrypted coefficient vector L c =Enc(L,PK,e)=PK·(υL)+e.

[0103] In a more specific embodiment, the second party calls the key generator KeyGen(λ) to generate a pair of private key SK and public key PK, and performs homomorphic encryption Enc(L, PK, e) on the coefficient vector L based on the public key PK to obtain the encrypted coefficient vector L c .

[0104] The above steps are based on the fact that the ciphertext and plaintext of vector homomorphic encryption satisfy the following equation: SK·c=vx+e, where e represents the error vector, v represents a large integer, and c and x represent the corresponding ciphertext and plaintext respectively.

[0105] Step S109: Receive the ciphertext input vector X from the second party ic , combined with the encryption coefficient vector L c , calculate the ciphertext result y ic =X ic ·L c .

[0106] In a specific embodiment, the private key generated by calling the key generator KeyGen(λ) can be expressed as SK=[I, T]P s , the generated public key can be expressed as Among them, P s and P m is a pair of reversible matrices, P s ·P m=I, I represents the identity matrix, A and T both represent random matrices, and λ represents the security parameter.

[0107] In a specific embodiment, the ciphertext input vector is obtained based on the following steps:

[0108] Generate random matrices T′ and A′;

[0109] Generate the identity matrix I′;

[0110] Generate a pair of reversible matrices P′ s and P′ m ;

[0111] Based on the random matrices T′ and A′, the identity matrix I′, the reversible matrix P′ m and the second party's private key SK, calculate the ciphertext input vector X ic .

[0112] Step S111: transmit the ciphertext result to the second party, so that the second party obtains the unbalanced private set intersection result.

[0113] Figure 2 The flowchart of the method for intersection of unbalanced private sets according to the second embodiment of the present application is schematically shown.

[0114] Reference Figure 2 In this embodiment, the first party holds a first data set Y={y o1 ,y o2 ,…,y on}, the second party holds the second data set X={x o1 ,…,x on}, the method for intersecting the unbalanced private sets is implemented by the second party holding the second data set.

[0115] like Figure 2 As shown, the method for finding the intersection of unbalanced private sets includes:

[0116] Step S201 : performing data preprocessing on the private data of the second data set to obtain a second mapping data set.

[0117] In some embodiments, the private data of the first party is a user identifier of a user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0118] In some embodiments, to enhance the security of anonymous queries, an oblivious pseudorandom function (OPRF) is used to pre-process the private data in the second dataset, converting the second dataset into a second mapped dataset. Correspondingly, the private data in the second dataset is converted into pseudorandom numbers for the second mapped dataset. Subsequent data processing is performed on the pseudorandom numbers, which have no apparent formal relationship to the original private data.

[0119] Step S203: Generate a pair of private and public keys, and send the public key to the first party.

[0120] In a more specific embodiment, the second party calls the key generator KeyGen(λ) to generate a pair of private key SK and public key PK. The private key generated by calling the key generator KeyGen(λ) can be expressed as SK=[I, T]P s , the generated public key can be expressed as Among them, P s and P m is a pair of reversible matrices, P s ·P m =I, I represents the identity matrix, A and T both represent random matrices, and λ represents the security parameter.

[0121] Step S205 : Encrypt the data of the second mapping data set based on the private key to generate a ciphertext input vector and a decryption key.

[0122] In a specific embodiment, the ciphertext input vector is obtained based on the following steps:

[0123] Generate random matrices T′ and A′;

[0124] Generate the identity matrix I′;

[0125] Generate a pair of reversible matrices P′ s and P′ m ;

[0126] Based on the random matrices T′ and A′, the identity matrix I′, the reversible matrix P′ m and the second party's private key SK, calculate the ciphertext input vector X ic .

[0127] In a specific embodiment, the decryption key is obtained based on the following steps:

[0128] Generate random matrices T′ and A′;

[0129] Generate the identity matrix I′;

[0130] Generate a pair of reversible matrices P′ s and P′ m ;

[0131] According to the random matrix T′, the identity matrix I′ and the reversible matrix P′ s , calculate and obtain the decryption key SK′=[I′,T′]·P′ s .

[0132] Step S207: Send the ciphertext input vector to the first party.

[0133] Step S209: receiving the ciphertext result based on the ciphertext input vector from the first party, decrypting the ciphertext result using the decryption key, and obtaining an unbalanced private set intersection result.

[0134] In a more specific embodiment, according to the ciphertext input vector X ic and the encryption coefficient vector L c , calculate the ciphertext result y ic

[0135] y ic =X ic ·L c

[0136] From the mathematical expression of the above ciphertext result, it can be seen that the ciphertext input vector X ic is the encrypted data matrix, the encryption coefficient vector L c It is also an encrypted data matrix. When calculating the ciphertext result, no polynomials of up to n degrees appear. Therefore, this application can convert any number of polynomial calculations into a linear transformation operation, which not only ensures the efficiency and security of the ciphertext calculation, but also improves the efficiency of retrieval queries.

[0137] According to the principle of unbalanced privacy set intersection, the first party preprocesses the data according to the random pseudo-random function, and establishes an interpolation polynomial f(x) = (x-y1)(x-y2)…(xy n ), the second party's data x i As a query data as the input of the above interpolation polynomial, calculate f(x i ), if f(x i ) is equal to 0, then {y1, y2, ..., y n There must be some data y and x i equal, that is, y and x i The intersection data of a first data set held by the first party and a second data set held by the second party.

[0138] In a more specific embodiment, the second party receives the first party's input vector X based on the ciphertext ic The ciphertext result y ic When the decryption key SK′ is used to calculate the intersection result of the unbalanced private set

[0139]

[0140] If y=0, then the pseudo-random number x of the second mapping data set is i is one of the intersection data, correspondingly, with the pseudo-random number x i The private data x of the second dataset that is mapped to each other oi It is the intersection data;

[0141] If y≠0, then the pseudo-random number x of the second mapping data set is i is not one of the intersection data, correspondingly, with the pseudo-random number x i The private data x of the second dataset that is mapped to each other oi Nor is it intersection data.

[0142] In another embodiment, the method of the present application can also realize batch query of users, that is, the same user can judge multiple data (x1, x2, ..., x m ) is intersection data. In this case, the judgment result of whether multiple data are intersection data can be obtained based on the following steps:

[0143] According to the number of times information [n, n-1, ..., 1, 0] of function f(x) sent by the first party, the vector matrix X is calculated in plain text:

[0144]

[0145] Randomly generate a pair of reversible matrices P′ s ·P′ m =I

[0146] Randomly generate matrices T′ and A′

[0147] Generate decryption key SK′=[I′, T′]·P′ s

[0148] Generate ciphertext query vector

[0149] The ciphertext query vector X c Sent to the first party for batch query.

[0150] Figure 3 The diagram schematically shows the system architecture of the apparatus for unbalanced privacy set intersection according to the third embodiment of the present application.

[0151] Reference Figure 3 In this embodiment, the first party holds a first data set Y={y o1 ,y o2 ,…,y on}, the second party holds the second data set X={x o1 ,…,x om The device for finding the intersection of unbalanced private sets is provided at the first party.

[0152] like Figure 3 As shown, the apparatus includes a pre-processing unit 30 , a fitting unit 32 , an encryption unit 34 , a calculation unit 36 ​​and a sending unit 38 .

[0153] The preprocessing unit 30 is configured to perform data preprocessing on the private data of the first data set to obtain a first mapping data set.

[0154] In some embodiments, the private data of the first party is a user identifier of a user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0155] In some embodiments, to enhance the security of anonymous queries, an oblivious pseudorandom function (OPRF) is used to pre-process the private data in the first dataset, converting the first dataset into a first mapped dataset. Correspondingly, the private data in the first dataset is converted into pseudorandom numbers for the first mapped dataset. Subsequent data processing is performed on the pseudorandom numbers, which have no apparent formal relationship to the original private data.

[0156] The fitting unit 32 is configured to fit a polynomial function according to the first mapping data set and combine the coefficients of each term in the function into a coefficient vector. For example, the fitting unit 32 fits the n data stored by the first party to obtain a polynomial function f(x)=a with the highest degree n. n x n +a n-1 x n- 1+…+a1x+a0.

[0157] In a more specific embodiment, the least square method may be used to fit the polynomial with the highest degree of n.

[0158] The encryption unit 34 is configured to receive the public key PK from the second party and perform homomorphic encryption on the coefficient vector L using the public key PK to obtain the encrypted coefficient vector L c =Enc(L,PK,e)=PK·(υL)+e.

[0159] In a more specific embodiment, the second party calls the key generator KeyGen(λ) to generate a pair of private key SK and public key PK, and performs homomorphic encryption Enc(L, PK, e) on the coefficient vector L based on the public key PK to obtain the encrypted coefficient vector L c .

[0160] The above steps are based on the fact that the ciphertext and plaintext of vector homomorphic encryption satisfy the following equation: SK·c=vx+e, where e represents the error vector, v represents a large integer, and c and x represent the corresponding ciphertext and plaintext respectively.

[0161] The calculation unit 36 ​​is configured to receive the ciphertext input vector X from the second party. ic , combined with the encryption coefficient vector L c , calculate the ciphertext result y ic =X ic ·L c .

[0162] In a specific embodiment, the private key generated by calling the key generator KeyGen(λ) can be expressed as SK=[I, T]P s , the generated public key can be expressed as Among them, P s and P m is a pair of reversible matrices, P s ·P m =I, I represents the identity matrix, A and T both represent random matrices, and λ represents the security parameter.

[0163] In a specific embodiment, the ciphertext input vector is obtained based on the following steps:

[0164] Generate random matrices T′ and A′;

[0165] Generate the identity matrix I′;

[0166] Generate a pair of reversible matrices P′ s and P′ m ;

[0167] Based on the random matrices T′ and A′, the identity matrix I′, the reversible matrix P′ m and the second party's private key SK, calculate the ciphertext input vector X ic .

[0168] The sending unit 38 is configured to send the ciphertext result to the second party, so that the second party obtains the unbalanced private set intersection result.

[0169] Figure 4 The system architecture diagram of the apparatus for unbalanced privacy set intersection according to the fourth embodiment of the present application is schematically shown.

[0170] Reference Figure 4 In this embodiment, the first party holds a first data set Y={y o1 ,y o2 ,…,y on}, the second party holds the second data set X={x o1 ,…,x om The device for finding the intersection of unbalanced private sets is provided on the second party.

[0171] like Figure 4 As shown, the device includes a pre-processing unit 41, a key generating unit 43, an encryption unit 45, a sending unit 47 and a decryption unit 49.

[0172] The preprocessing unit 41 is configured to perform data preprocessing on the private data of the second data set to obtain a second mapping data set.

[0173] In some embodiments, the private data of the first party is a user identifier of a user to be queried, and the private data of the second party is a set of user identifiers having a target category.

[0174] In some embodiments, to enhance the security of anonymous queries, an oblivious pseudorandom function (OPRF) is used to pre-process the private data in the second dataset, converting the second dataset into a second mapped dataset. Correspondingly, the private data in the second dataset is converted into pseudorandom numbers for the second mapped dataset. Subsequent data processing is performed on the pseudorandom numbers, which have no apparent formal relationship to the original private data.

[0175] The key generation unit 43 is used to generate a pair of private keys and public keys according to the homomorphic encryption algorithm, and send the public key to the first party.

[0176] In a more specific embodiment, the second party calls the key generator KeyGen(λ) to generate a pair of private key SK and public key PK. The private key generated by calling the key generator KeyGen(λ) can be expressed as SK=[I, T]P s , the generated public key can be expressed as Among them, P s and P m is a pair of reversible matrices, P s ·P m =I, I represents the identity matrix, A and T both represent random matrices, and λ represents the security parameter.

[0177] The encryption unit 45 is configured to encrypt the data of the second mapping data set according to the private key to generate a ciphertext input vector and a decryption key.

[0178] In a specific embodiment, the ciphertext input vector is obtained based on the following steps:

[0179] Generate random matrices T′ and A′;

[0180] Generate the identity matrix I′;

[0181] Generate a pair of reversible matrices P′ s and P′ m ;

[0182] Based on the random matrices T′ and A′, the identity matrix I′, the reversible matrix P′ m and the second party's private key SK, calculate the ciphertext input vector X ic .

[0183] In a specific embodiment, the decryption key is obtained based on the following steps:

[0184] Generate random matrices T′ and A′;

[0185] Generate the identity matrix I′;

[0186] Generate a pair of reversible matrices P′ s and P′ m ;

[0187] According to the random matrix T′, the identity matrix I′ and the reversible matrix P′ s , calculate and obtain the decryption key SK′=[I′,T′]·P′ s .

[0188] The sending unit 47 is configured to send the ciphertext input vector to the first party.

[0189] The decryption unit 49 is configured to receive the ciphertext result based on the ciphertext input vector from the first party, decrypt the ciphertext result using the decryption key, and obtain an unbalanced private set intersection result.

[0190] In a more specific embodiment, according to the ciphertext input vector X ic and the encryption coefficient vector L c , calculate the ciphertext result y ic

[0191] y ic =X ic ·L c

[0192] From the mathematical expression of the above ciphertext result, it can be seen that the ciphertext input vector X icis the encrypted data matrix, the encryption coefficient vector L c It is also an encrypted data matrix. When calculating the ciphertext result, no polynomials of up to n degrees appear. Therefore, this application can convert any number of polynomial calculations into a linear transformation operation, which not only ensures the efficiency and security of the ciphertext calculation, but also improves the efficiency of retrieval queries.

[0193] According to the principle of unbalanced privacy set intersection, the first party preprocesses the data according to the random pseudo-random function, and establishes an interpolation polynomial f(x) = (x-y1)(x-y2)…(xy n ), the second party's data x i As a query data as the input of the above interpolation polynomial, calculate f(x i ), if f(x i ) is equal to 0, then {y1, y2, ..., y n There must be some data y and x i equal, that is, y and x i The intersection data of a first data set held by the first party and a second data set held by the second party.

[0194] In a more specific embodiment, the second party receives the first party's input vector X based on the ciphertext ic The ciphertext result y ic When the decryption key SK′ is used to calculate the intersection result of the unbalanced private set

[0195]

[0196] If y=0, then the pseudo-random number x of the second mapping data set is i is one of the intersection data, correspondingly, with the pseudo-random number x i The private data x of the second dataset that is mapped to each other oi It is the intersection data;

[0197] If y≠0, then the pseudo-random number x of the second mapping data set is i is not one of the intersection data, correspondingly, with the pseudo-random number x i The private data x of the second dataset that is mapped to each other oi Nor is it intersection data.

[0198] In order to verify the technical effect of the method and apparatus for finding the intersection of unbalanced private sets described in this application, the decryption process is expanded as follows:

[0199]

[0200] In the above formula, e′ represents a small noise.

[0201] Dividing the above result by a large integer υ, we get This is the final decryption result y. It can be seen that the decryption result is equal to the calculation result of the polynomial function under the plaintext, and is also equal to the query result.

[0202] The same method is used to verify the technical effect of determining whether multiple data of the same user are intersection data at one time. The final decryption form is:

[0203]

[0204] The result is equal to:

[0205] From this, it can be seen that when performing a batch query, the decryption result is equal to the calculation result of the polynomial function under the plaintext, and is also equal to the query result. This verification also shows that the batch query is correctly completed using the method and device of the present application.

[0206] Figure 5 The structure diagram of a computer-readable storage medium corresponding to an unbalanced privacy set intersection method according to another embodiment of the present application is schematically shown.

[0207] Reference Figure 5 This embodiment further provides a computer-readable storage medium, which includes one or more computer programs 501. These computer programs 501 store instructions that, when executed on a processor, execute the aforementioned method for finding the intersection of unbalanced private sets. For example, the computer instructions may include computer program code, which may be in source code form, object code form, an executable file, or some intermediate form.

[0208] A processor may include one or more processing units, for example, an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0209] The computer-readable medium described in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0210] As can be seen from the above, in the embodiments of this specification, the first party holding the first data set can only obtain the ciphertext input vector obtained by homomorphic encryption from the second party holding the second data set. The first party cannot infer any data included in the second data set through the ciphertext input vector. The first party sends the ciphertext result to the second party. The ciphertext result is also obtained by the first party using two encryption matrices to perform linear transformation calculations. The second party decrypts the ciphertext result using the decryption key. Based on the decrypted ciphertext result, it can only be determined whether the first party's private data belongs to the second data set. It is impossible to reversely deduce and determine the specific location of the data to be queried in the data set, thereby meeting the security requirements of anonymous queries. Compared with the existing technology, the unbalanced privacy set intersection method in this case converts the complex calculation process of privacy set intersection into a simple matrix transformation operation, which not only ensures the efficiency of ciphertext calculation and retrieval, but also achieves many advantages such as batch processing and compatibility.

[0211] The specific embodiments of the present application have been described above with reference to the accompanying drawings. However, those skilled in the art will appreciate that various modifications and substitutions may be made to the specific embodiments of the present application without departing from the spirit and scope of the present application. Such modifications and substitutions are within the scope of the claims of the present application.

Claims

1. A method for intersection of unbalanced private sets, wherein: A first party holds a first data set, and a second party holds a second data set. The method is performed by the first party and includes: Performing data preprocessing on the private data of the first data set to obtain a first mapping data set; fitting a function in a polynomial form according to the first mapping data set; Combining the coefficients of each term in the function into a coefficient vector; receiving a public key from the second party, and homomorphically encrypting the coefficient vector using the public key to obtain an encrypted coefficient vector; receiving a ciphertext input vector from the second party, and calculating a ciphertext result in combination with the encryption coefficient vector; wherein the ciphertext input vector is generated by encrypting data of a second mapped data set obtained based on the second data set using a private key of the second party; The ciphertext result is transmitted to the second party, so that the second party obtains the unbalanced private set intersection result.

2. The method according to claim 1, wherein The step of performing data preprocessing on the first data set further includes: An inadvertent pseudo-random function is used for preprocessing, and the data of the first mapping data set are all pseudo-random numbers.

3. The method according to claim 1, wherein The private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

4. The method according to claim 1, wherein The ciphertext input vector is obtained based on the following steps: Generate a random matrix; Generate the identity matrix; Generate a pair of reversible matrices; The ciphertext input vector is obtained by calculation based on the random matrix, the identity matrix, the reversible matrix pair, the second mapping data set, and the private key of the second party.

5. The method according to claim 1, wherein The function is obtained by fitting using the least square method.

6. A method for intersection of unbalanced private sets, wherein: A first party holds a first data set, a second party holds a second data set, and the method is performed by the second party, comprising: performing data preprocessing on the private data of the second data set to obtain a second mapping data set; generating a pair of private and public keys, and sending the public key to the first party; Encrypting the data of the second mapping data set based on the private key to generate a ciphertext input vector and a decryption key; sending the ciphertext input vector to the first party; Receive the ciphertext result based on the ciphertext input vector from the first party, decrypt the ciphertext result using the decryption key, and obtain an unbalanced privacy set intersection result; wherein the ciphertext result is calculated based on the ciphertext input vector from the second party in combination with the encryption coefficient vector. 7 . The method according to claim 6 , wherein the preprocessing is performed using an inadvertent pseudo-random function, and the data of the second mapping data set are all pseudo-random numbers.

8. The method according to claim 6, wherein: The ciphertext input vector is obtained based on the following steps: Generate a random matrix; Generate the identity matrix; Generate a pair of reversible matrices; The ciphertext input vector is obtained by calculation according to the private key, the random matrix, the identity matrix, the second mapping data set, and the reversible matrix pair.

9. The method according to claim 6, wherein: The decryption key is obtained based on the following steps: Generate a random matrix; Generate the identity matrix; Generate a pair of reversible matrices; The decryption key is obtained by calculation according to the random matrix, the identity matrix and the reversible matrix pair.

10. The method according to claim 6, wherein: If the decrypted intersection result of the unbalanced private sets is 0, the private data of the first party is intersection data; if the decrypted intersection result of the unbalanced private sets is not 0, the private data of the first party is not intersection data.

11. The method according to claim 6, wherein: The private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

12. A device for intersecting unbalanced private sets, wherein: A first party holds a first data set, a second party holds a second data set, and the apparatus is provided at the first party, comprising: a preprocessing unit, configured to perform data preprocessing on the private data of the first data set to obtain a first mapping data set; a fitting unit, configured to fit a function in a polynomial form according to the first mapping data set, and combine coefficients of each term in the function into a coefficient vector; an encryption unit, configured to receive a public key from the second party and homomorphically encrypt the coefficient vector using the public key to obtain an encrypted coefficient vector; a computing unit, configured to receive a ciphertext input vector from the second party and calculate a ciphertext result in combination with the encryption coefficient vector; wherein the ciphertext input vector is generated by encrypting data of a second mapped data set obtained based on the second data set using a private key of the second party; The sending unit is configured to send the ciphertext result to the second party, so that the second party obtains the result of the unbalanced private set intersection.

13. The device according to claim 12, wherein The preprocessing unit performs preprocessing using an inadvertent pseudo-random function, and the data of the first mapping data set are all pseudo-random numbers.

14. The device according to claim 12, wherein The function is obtained by fitting using the least square method.

15. The device according to claim 12, wherein The private data of the first party is the user identifier of the user to be queried, and the private data of the second party is a set of user identifiers having a target category.

16. A device for intersection of unbalanced private sets, wherein: A first party holds a first data set, a second party holds a second data set, and the apparatus is provided at the second party, comprising: a preprocessing unit, configured to perform data preprocessing on the private data of the second data set to obtain a second mapping data set; a key generation unit, configured to generate a pair of private and public keys according to a homomorphic encryption algorithm, and send the public key to the first party; an encryption unit, configured to encrypt the data of the second mapping data set according to the private key to generate a ciphertext input vector and a decryption key; a sending unit, configured to send the ciphertext input vector to the first party; a decryption unit, configured to receive a ciphertext result from the first party based on the ciphertext input vector, decrypt the ciphertext result using the decryption key, and obtain an unbalanced private set intersection result; wherein the ciphertext result is calculated based on the ciphertext input vector from the second party in combination with the encryption coefficient vector.

17. The device according to claim 16, wherein The preprocessing unit performs preprocessing using an inadvertent pseudo-random function, and the data of the second mapping data set are all pseudo-random numbers.

18. The device according to claim 16, wherein The encryption unit obtains the ciphertext input vector based on the following steps: Generate a random matrix; Generate the identity matrix; Generate a pair of reversible matrices; The ciphertext input vector is obtained by calculation according to the private key, the random matrix, the identity matrix, and the reversible matrix pair.

19. The device according to claim 16, wherein The encryption unit obtains the decryption key based on the following steps: Generate a random matrix; Generate the identity matrix; Generate a pair of reversible matrices; The decryption key is obtained by calculation according to the random matrix, the identity matrix and the reversible matrix pair.

20. The apparatus according to claim 16, wherein If the decrypted unbalanced private set intersection result is 0, it is determined that the first party's private data is intersection data; if the decrypted unbalanced private set intersection result is not 0, it is determined that the first party's private data is not intersection data.

Images