A privacy intersection method and apparatus

Abstract

A privacy intersection method and device are used for privacy intersection of two data sets, wherein the privacy intersection method comprises: adjusting a first encrypted item of each first data in the first data set by using a pre-acquired first adjustment key to obtain a first adjustment item; and performing privacy intersection of the first data set and the second data set based on the first adjustment item and a second encrypted item of each second data in the second data set. The first adjustment key is determined based on a first encryption key corresponding to the first encrypted item and a second encryption key corresponding to the second encrypted item.

Description

Technical Field

[0001] The embodiments in this specification pertain to the field of data security, and particularly relate to a privacy-preserving intersection method and apparatus. Background Technology

[0002] Private Set Intersection (PSI) refers to a method where one or both participating parties can obtain the intersection of their sets without revealing any additional information, but neither party can know any information about the other party's sets outside the intersection. Its core principle is to allow data flow and generate data value while protecting the security of personal and corporate data.

[0003] Privacy set intersection (also known as privacy intersection) has significant use cases in the current environment where data security is increasingly valued, such as privacy-preserving social network relationship discovery, federated learning sample alignment, and consortium whitelist calculation. When data is held by different administrators, privacy set intersection achieves a win-win situation of protecting privacy and information sharing. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy-preserving intersection method and apparatus that can safely and efficiently achieve privacy-preserving intersection of data from all parties.

[0005] The first aspect of this specification provides a privacy-preserving intersection method, including:

[0006] Using the pre-acquired first adjustment key, the first encryption item of each first data in the first data set is adjusted to obtain the first adjustment item;

[0007] Based on the first adjustment term and the second encryption term of each second data in the second data set, a privacy intersection is performed on the first data set and the second data set;

[0008] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item and the second encryption key corresponding to the second encryption item.

[0009] The second aspect of this specification provides a privacy-preserving intersection method, including:

[0010] Using a pre-acquired first adjustment key, the first encryption item of each first data in the first data set is adjusted to obtain a first adjustment item; and using a pre-acquired second adjustment key, the second encryption item of each second data in the second data set is adjusted to obtain a second adjustment item.

[0011] Based on the first adjustment term and the second adjustment term, perform privacy intersection on the first data set and the second data set;

[0012] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item; the second adjustment key is determined based on the first encryption key and the second encryption key corresponding to the second encryption item.

[0013] A third aspect of this specification provides a privacy-based intersection device, comprising:

[0014] The adjustment unit is used to adjust the first encrypted item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item;

[0015] The privacy intersection unit is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second encryption term of each second data in the second data set;

[0016] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item and the second encryption key corresponding to the second encryption item.

[0017] The fourth aspect of this specification provides a privacy-based intersection device, comprising:

[0018] The first adjustment unit is used to adjust the first encrypted item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item;

[0019] The second adjustment unit is used to adjust the second encryption item of each second data in the second data set using the pre-acquired second adjustment key to obtain the second adjustment item;

[0020] The privacy intersection unit is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second adjustment term;

[0021] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item; the second adjustment key is determined based on the first encryption key and the second encryption key corresponding to the second encryption item.

[0022] This specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in any one of the first to fourth aspects.

[0023] A sixth aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any one of the first to fourth aspects. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of a data encryption method in one embodiment of this specification;

[0026] Figure 2 This is a flowchart of a privacy intersection method in one embodiment of this specification;

[0027] Figure 3 This is a flowchart of a data encryption method in another embodiment of this specification;

[0028] Figure 4 This is a flowchart of a privacy intersection method in another embodiment of this specification;

[0029] Figure 5 This is a schematic diagram of a privacy intersection method in another embodiment of this specification;

[0030] Figure 6 This is a structural diagram of a privacy intersection device in one embodiment of this specification;

[0031] Figure 7 This is a structural diagram of a privacy intersection device in another embodiment of this specification. Detailed Implementation

[0032] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0033] Traditional privacy-preserving methods for requesting interactions include the following:

[0034] 1. The naive hash method. In this method, both parties involved in the privacy intersection calculation use the same hash function to calculate the hash value of their respective data, and then send their calculated hash values ​​to each other. The intersection is then obtained. While this method is simple and fast, it carries the risk of privacy breaches. For example, if the intersection involves only the data itself, and the data space is relatively small, a malicious party could use hash collisions to quickly find the hash value sent by the other party within a limited time, thus stealing additional information.

[0035] 2. Homomorphic Encryption-Based Method. In this method, the plaintext set from the receiver is fully homomorphically encrypted (FHE), and the resulting ciphertext is provided to the sender. The sender uses FHE to perform polynomial calculations on this ciphertext and returns the result to the receiver. The receiver uses FHE to decrypt the result; if the decryption result is 0, it indicates that the corresponding receiver value exists in the set, thus obtaining the result of the intersection operation.

[0036] 3. Elliptic Curve Based Method. This method requires mapping the elements of the receiver's and sender's sets onto a pre-defined elliptic curve. After the receiver selects an element *sa*, it maps it to a point *sa'* on the elliptic curve and sends it to the sender. The sender then performs the following calculations after selecting an element *sb*:

[0037] First, the element sb is mapped to a point sb' on the elliptic curve, and sb'·sa' is calculated. Then, both sb' and sb'·sa' are sent to the receiver. Upon receiving these two parts, the receiver calculates sa'·sb' and compares the calculated sa'·sb' with the received sb'·sa'. If they match, the element is considered an element in the intersection set.

[0038] It should be noted that the above-mentioned elliptic curve-based method takes advantage of the difficulty in performing reverse dot products on elliptic curves, thereby ensuring that the communication process cannot be eavesdropped on. However, this method has the problems of high computational overhead and large communication volume.

[0039] 4. The Garbled Circuits (GC) approach. This method compiles the functions involved in the computation into corresponding Boolean circuits, then garbles the circuits before computation, offering high versatility. However, the GC approach requires storing the entire circuit in memory, resulting in significant memory consumption. Furthermore, it necessitates symmetric encryption and unintended computation transmission for each gate, leading to poor performance.

[0040] 5. The Oblivious Transfer (OT) method. In this method, the receiver performs two hash calculations on each element using two hash functions, resulting in two hash values ​​for each element. One of these hash values ​​is then selected and associated with a bin. The sender performs the same calculation on each element, associating both hash values ​​with bins. Here, bin represents a function calculation method. The sender performs bin calculations on the two hash values ​​of all elements and sends the bin result to the receiver. The receiver compares its own bin calculation result with the received bin calculation result. If a result exists, it means the received element is in the intersection. In this method, the sender obfuscates the element content by mapping the two hash values ​​of an element to the bin calculation function, thus ensuring that the set data is not leaked. The sender also does not obtain the elements from the receiver. However, this method suffers from high computational overhead and high communication volume due to the need to perform multiple hash and function calculations.

[0041] 6. Privacy-preserving intersection method based on trusted execution environment. This method constructs a secure region within the central processing unit (CPU) using both hardware and software methods, ensuring the confidentiality and integrity of programs and data loaded within it. This method requires the use of technologies provided by mainstream computing chip manufacturers, such as SGX technology for the x86 instruction set, AMD SEV (Secure Encrypted Virtualization) technology, and TrustZone technology based on the ARM instruction set architecture. Its advantage lies in providing a secure execution environment where both parties can place ciphertext within this environment for intersection calculations without worrying about information leakage. Besides privacy-preserving intersection, this method supports more operators and complex algorithms, enabling greater expressiveness of upper-layer business logic. However, because the trusted hardware requires specific hardware, this increases costs and necessitates trust in the hardware manufacturer.

[0042] In view of the defects or deficiencies of the aforementioned privacy intersection methods, the inventors of this application propose a privacy intersection method in which the two parties participating in the privacy intersection each use different encryption keys to encrypt and store the data items used for comparison in their respective datasets. Here, the encrypted data items of each party (hereinafter referred to as encrypted items) cannot be directly compared. Subsequently, when privacy intersection is required for the data of both parties, the encrypted items of one or both parties are adjusted using an adjustment key, and privacy intersection is performed based on the adjusted encrypted items (hereinafter referred to as adjusted items).

[0043] The following section will first explain the situation where only one party's encryption items are adjusted during the privacy request process.

[0044] It should be noted that in the following description of this specification, the two parties participating in the privacy-sensitive intersection will be referred to as the first party and the second party, respectively; the data set held by the first party will be referred to as the first data set; the data in the first data set will be referred to as the first data; and the data item used for comparison will be referred to as the first data item. Furthermore, the data set held by the second party will be referred to as the second data set; the data in the second data set will be referred to as the second data; and the data item used for comparison will be referred to as the second data item.

[0045] Since the encryption processes for the data items of the first party and the second party are similar, the following explanation will focus on the first party and describe its data item encryption process.

[0046] Figure 1 This is a flowchart of a data encryption method in one embodiment of this specification, as follows: Figure 1 As shown, the method may include the following steps:

[0047] Step S102: Determine the first encryption key ska'.

[0048] In one embodiment, the first encryption key ska' described above can be generated randomly.

[0049] In another embodiment, a first encryption key ska' can be generated based on a first initial key ska. Here, the first initial key ska has a corresponding decryption key. For example, it can be a symmetric encryption key.

[0050] In one example, a portion of the bits in the bit string corresponding to the first initial key ska can be modified or reversed to obtain the first encryption key ska'.

[0051] Step S104: Based on the first encryption key ska' and agreed parameters, encrypt the first data item ItemA of each first data in the first data set.

[0052] The agreed-upon parameters here include the first value g or the elliptic curve and the base point.

[0053] In one example, the aforementioned first data item can be a unique identifier for the first data, meaning each piece of first data has one first data item, resulting in a multiple number of first data items. Since the encryption method is the same for all first data items, no distinction will be made between the individual first data items below.

[0054] In one embodiment, the hash value of the first data item ItemA and the first encryption key ska' can be calculated first to obtain: h(ItemA)*ska', where h() is the hash operation. Then, the first value g agreed upon with the second party can be used as the base, and the calculated product as the exponent, to perform a power operation, resulting in the first encrypted item ItemA' = g.h(ItemA)*ska＇ .

[0055] In another embodiment, the first encrypted item can be calculated based on the elliptic curve and base points agreed upon with the second party. Specifically, the product is used as a multiplier, and scalar multiplication is performed on the base points on the agreed elliptic curve to obtain the first encrypted item ItemA' = h(ItemA)*ska'*G.

[0056] Because elliptic curves are difficult to multiply in reverse (explained later), the security of the first data item can be ensured when encrypting the first data item based on the elliptic curve and the base point.

[0057] It should be understood that, similar to the method for determining the first encrypted item described above, the second party can also obtain the second encrypted item corresponding to the second data item ItemB: ItemB' = g h(ItemB)*skb＇ Alternatively, ItemB' = h(ItemB) * skb' * G, where skb' is the second encryption key determined by the second party, g is the first value mentioned above, and G is the base point on the elliptic curve.

[0058] The characteristics of elliptic curves are described below.

[0059] An elliptic curve is a mathematical curve that can generally be represented by the following two-variable third-order equation:

[0060] y 2 =x 3 +ax+b (Formula 1)

[0061] Where a and b are both coefficients.

[0062] Addition and multiplication operations can be defined for points on an elliptic curve.

[0063] Take two points, P and Q, on the elliptic curve. Draw a straight line L connecting P and Q. This line will intersect the elliptic curve at a third point S. Draw a line perpendicular to the x-axis through point S, which will pass through another point R on the elliptic curve (usually the point symmetric to S about the x-axis). Point R is defined as the sum of the sums of P and Q, i.e., P + Q = R. This is the process of addition.

[0064] When points P and Q are the same point, the line L is the tangent to the elliptic curve at point P. The resulting point R can be written as: R = P + P = 2 * P. By performing multiple addition operations, we can obtain the result of multiplying point P: m * P = P + P… + P.

[0065] To facilitate the use of elliptic curves for data encryption and decryption, they can be constrained to a finite field Fp. A finite field Fp is a field containing a finite number of prime elements p. This prime number p is also called the order of the finite field. Operations within a finite field are defined based on modulo p.

[0066] An elliptic curve represented by formula (1) over a finite field Fp is often denoted as Ep(a,b). By choosing coefficients a, b and the finite field p, an elliptic curve can be uniquely defined. Different elliptic curves have different safety characteristics. Common elliptic curves include P-256, secp256k1, Curve25519, etc.

[0067] After restricting an elliptic curve to a finite field, the points contained in the elliptic curve change from an infinite number of continuous points on the curve to a point set T containing a finite number of discrete points. Based on the operational rules for points on the elliptic curve, this point set T constitutes a cyclic group, namely an abelian group. The number of points in this point set is the order of the cyclic group.

[0068] Specifically, the cyclic group formed by elliptic curves in a finite field has the following characteristics:

[0069] (1) The summation operation, or addition operation, is performed on any point P and point Q in the cyclic group. The resulting point R = P + Q is still in the cyclic group. The definition of the addition operation is the same as that of the conventional elliptic curve mentioned above.

[0070] (2) Perform a multiplication operation on any point P in the cyclic group and the resulting point Q = m * P = P + P + ... + P is still in the cyclic group, where m belongs to the above finite field. The definition of the multiplication operation is consistent with that of the regular elliptic curve.

[0071] (3) There exists a generator G in the cyclic group, or the base point G of the elliptic curve, and there also exists an infinity point O of the elliptic curve, satisfying n*G=O. The role of this infinity point O in the operation is similar to that of zero in conventional mathematical operations.

[0072] (4) Addition and multiplication operations in a cyclic group satisfy the distributive and commutative laws, that is:

[0073] x*P+y*P=(x+y)*P;

[0074] x*(y*P)=y*(x*P);

[0075] Another important characteristic of elliptic curves is that, according to the multiplication rule in (2), it is easy to find point Q given m and P, but it is almost impossible to reverse the value of m given points Q and P (i.e., it is difficult to perform reverse dot product). This characteristic of elliptic curves in finite fields has led to their application in various encryption algorithms.

[0076] In the embodiments of this specification, the first party uses the characteristics of elliptic curves to encrypt the first data item, and the second party uses the characteristics of elliptic curves to encrypt the second data item. This can ensure the security of the privacy data of both parties participating in the privacy intersection, save storage resources, and improve transmission efficiency.

[0077] According to the embodiments of this specification, in order to perform privacy-preserving intersection of the data sets of the first party and the second party, it is necessary to agree on a specific finite field p and an elliptic curve in that finite field between the first party and the second party. That is, agree on the parameter p (order of the finite field) and the parameters a and b of the elliptic curve in formula (1) to obtain the agreed elliptic curve Ep(a,b). In addition, it is also necessary for both parties to agree on a base point G.

[0078] It should be noted that after the first party encrypts each first data item ItemA to obtain the corresponding first encrypted item ItemA′, it can add this first encrypted item ItemA′ to the first data set, thus obtaining an updated first data set. This updated first data set can then be stored in a trusted third party or a database for other participating parties to query. It should be understood that when this updated first data set is stored in a database, each first data item can be recorded in a table format.

[0079] Furthermore, in the updated first data set, the first data item ItemA of each first data set can be stored either encrypted or in plaintext. Taking encrypted storage as an example, the corresponding encryption result can be called the third encryption item. This third encryption item is obtained by encrypting the first data item ItemA using the first initial key ska. It should be understood that in the result of the privacy intersection, the third encryption item can be used to replace the first encryption item ItemA′ in order to facilitate its decryption.

[0080] Other data items in the first data set mentioned above can be encrypted or stored in plaintext; this specification does not impose any restrictions on this.

[0081] Similarly, the second party may also store its updated second data set in a trusted third party or database, and the updated second data set may include a fourth encryption item, which is obtained by encrypting the second data item ItemB using the second initial key skb.

[0082] After the first and second parties store their respective datasets in a trusted third party or database, either party can initiate a privacy intersection request to the trusted third party or database, which will then perform the privacy intersection on the datasets of both parties. The following explanation uses the second party initiating the request as an example to illustrate the privacy intersection process.

[0083] Figure 2 This is a flowchart of a privacy intersection method in one embodiment of this specification. Figure 2 As shown, the method may include the following steps:

[0084] Step S202: Using the pre-acquired first adjustment key ska″, adjust the first encrypted item ItemA' of each first data in the first data set to obtain the first adjustment item ItemA″.

[0085] In one embodiment, the first adjustment key ska″ described above is obtained from the key custodian by a trusted third party or database.

[0086] In another embodiment, the aforementioned first adjustment key ska″ is received from a second party by a trusted third party or database.

[0087] The aforementioned first adjustment key ska″ is determined based on the first encryption key ska″ corresponding to the first encryption item ItemA' and the second encryption key skb″ corresponding to the second encryption item ItemB'.

[0088] In one example, the first adjustment key ska″ mentioned above can be obtained through the following steps:

[0089] Using the mapping algorithm agreed upon by the first and second parties, the first encryption key ska' is mapped to a first mapping value, and the second encryption key skb' is mapped to a second mapping value. The quotient of the second mapping value and the first mapping value is calculated, and the resulting quotient is used as the first adjustment key ska''. In the following text, the first adjustment key ska'' is represented as: skb' / ska'.

[0090] In one example, the mapping algorithm described above includes applying a preset hash function to map the encryption key onto an elliptic curve agreed upon by the first and second parties.

[0091] It should be noted that when the first adjustment key ska″ is obtained from the key custodian, the aforementioned first encryption key ska and second encryption key skb can be actively custodied by both the first party and the second party to the key custodian. However, when the first adjustment key ska″ is received from the second party, the aforementioned first encryption key ska can be obtained by the second party with the authorization of the first party.

[0092] In step S202, when the first encrypted item ItemA' and the second encrypted item ItemB' are ciphertexts obtained by encrypting based on the same elliptic curve and base point, that is, when determining the first encrypted item ItemA' based on one embodiment in step S104, the first encrypted item ItemA' can be encrypted based on the agreed elliptic curve and the first adjustment key ska″ to obtain the first adjustment item ItemA″, wherein the first adjustment item ItemA″ uses the first encrypted item ItemA' as the base point and the first adjustment key ska″ as a multiple. Specifically, it can be expressed as: ItemA″=(skb' / ska')*h(ItemA)*ska'*G=skb'*h(ItemA)*G.

[0093] When the first encrypted item ItemA' and the second encrypted item ItemB' are ciphertexts obtained by exponentiation based on the same base, that is, when determining the first encrypted item ItemA' based on another embodiment in step S104, the first encrypted item ItemA' can be used as the base and the first adjustment key ska″ as the exponent to perform exponentiation, and the target operation result can be used as the first adjustment item ItemA″. Specifically, it can be expressed as: ItemA″ = (g h(ItemA)*ska＇ ) skb＇ / ska＇ =g h(ItemA)*skb＇ .

[0094] Step S204: Based on the first adjustment item ItemA″ and the second encrypted item ItemB' of each second data in the second data set, perform privacy intersection on the first data set and the second data set.

[0095] That is, by comparing skb'*h(ItemA)*G and h(ItemB)*skb'*G, or by comparing g h(ItemA)*skb＇ and g h (ItemB)*skb＇ Perform privacy-preserving intersection on the first and second data sets.

[0096] It should be noted that, through the above-described embodiments of this specification, it is possible to perform privacy-preserving intersection of the data sets of both parties without disclosing the plaintext data items of each party.

[0097] Of course, in practical applications, the request for privacy intersection can also be initiated by the first party. When the request is initiated by the first party, the second adjustment key skb″ (i.e., ska’ / skb’) can be used to adjust the second encrypted item ItemB’ of each second data in the second data set to obtain the second adjusted item ItemB″. Based on the second adjusted item ItemB″ and the first encrypted item ItemA’ of each first data in the first data set, privacy intersection is performed on the first data set and the second data set.

[0098] The method for obtaining the second adjustment key skb″ and the method for adjusting the first encrypted item ItemA' can be found in steps S202-S204, and will not be repeated here.

[0099] The above describes the scenario where only one party's encryption is adjusted. As can be seen, in this case, each data item in both parties' datasets is encrypted using a single key. To further enhance data security, these data items can be encrypted using multiple keys. In this case, if privacy intersection is performed, the encryption items of both parties need to be adjusted. The following explains the encryption method based on multiple encryption keys and the corresponding privacy intersection process.

[0100] Figure 3 This is a flowchart of a data encryption method in another embodiment of this specification, such as... Figure 3 As shown, the method may include the following steps:

[0101] Step S302: Based on the first encryption key ska' and using the agreed hash function, determine the first derived key ska1'.

[0102] The hash functions mentioned here include, but are not limited to, SM3, SHA-256, or SHA-512 functions, etc.

[0103] Taking the SM3 function as an example, the first encryption key ska' can be padded with a message whose length is a multiple of 512, and then some bits can be modified (for example, the first 8 bits from the last bit forward, i.e., one byte) to obtain the modified message. The modified message is then input into the SM3 function, and the output 256-bit digest value is used as the first derived key ska1'.

[0104] Similarly, the second party can also determine the second derived key skb1' based on the second encryption key skb' and using the hash function described above.

[0105] Step S304: Based on the first derived key ska1' and agreed parameters, encrypt the first data item ItemA, and split the resulting first ciphertext into two first original parts.

[0106] The agreed-upon parameters here include the first value g or the elliptic curve and the base point.

[0107] In one embodiment, the hash value of the first data item ItemA and the first derived key ska1' can be calculated first to obtain: h(ItemA)*ska1', where h() is the hash operation. Then, the first value g agreed upon with the second party can be used as the base, and the calculated product as the exponent, to perform a power operation to obtain the first ciphertext: g h(ItemA)*ska1＇ .

[0108] In another embodiment, the first encrypted item can be calculated based on an elliptic curve and base points agreed upon with the second party. Specifically, the product is used as a multiplier, and a dot product operation is performed on the base points on the agreed elliptic curve to obtain the first ciphertext: h(ItemA)*ska1'*G.

[0109] After obtaining the first ciphertext, it can be divided into two first original parts: g h(ItemA)*ska1＇ The first half and g h(ItemA)*ska1＇ The latter half, or, equally divided into two first original parts: the first half of h(ItemA)*ska1'*G and the second half of h(ItemA)*ska1'*G.

[0110] Similarly, the second party can also obtain the second ciphertext corresponding to the second data item ItemB: g h(ItemB)*skb1＇ And the second ciphertext can be divided into two second original parts: g h(ItemB)*skb1＇ The first half and g h(ItemB)*skb1＇ The latter half. Or, we get the second ciphertext: h(ItemB)*skb1'*G, which is divided into two second original parts: the first half of h(ItemB)*skb1'*G and the second half of h(ItemB)*skb1'*G.

[0111] Step S306: Encrypt the two first original parts respectively to obtain two first encrypted parts, which are used to form the first encrypted item ItemA'.

[0112] In one embodiment, the first original part of two first original parts can be encrypted using a first intermediate key, and the second original part can be encrypted using a second intermediate key, wherein the first intermediate key is determined based on a third derived key ska2' of the first encryption key ska', and the second intermediate key is determined based on a fourth derived key ska3' of the first encryption key ska'.

[0113] The method for determining the third derived key ska2' and the fourth derived key ska3' is similar to that for the first derived key ska1'. Specifically, several bits in the bit string corresponding to the first encryption key ska' are modified twice to obtain the first modification result and the second modification result. Finally, these two modification results are input into a hash function to obtain two different digest values, which serve as the third derived key ska2' and the fourth derived key ska3'.

[0114] In one example, the first party can use the hash value of the concatenation result of the third derived key ska2' and the first random number IV1 as the first intermediate key. Thus, the first intermediate key can be represented as: H(ska2', IV1). The hash value of the concatenation result of the first original part and the fourth derived key ska3', and the hash value of the concatenation result of the first intermediate key, is used as the second intermediate key. Thus, the second intermediate key can be represented as: H(H(g) h(ItemA)*ska1＇ The first half, ska3'), H(ska2', IV1)), or, represented as: H(H(h(ItemA)*ska1'*G first half, ska3'), H(ska2', IV1)).

[0115] It should be understood that the above is only an illustrative example. In practical applications, the hash value of the third derived key ska2' can be directly used as the first intermediate key, or the hash value of the concatenation result of the first original part and the fourth derived key ska3' can be directly used as the second intermediate key, etc. This specification does not limit this.

[0116] After obtaining the first and second intermediate keys, the first party performs an XOR operation between the first intermediate key and the preceding first original part to obtain one of the two first encrypted parts, and performs an XOR operation between the second intermediate key and the following first original part to obtain the other first encrypted part. Then, by combining or concatenating the two first encrypted parts, the complete first encrypted item ItemA' can be obtained.

[0117] Similarly, the second party can also obtain the fifth derived key skb2' and the sixth derived key skb3' by making two different modifications to the second encryption key skb' and inputting the results of these two modifications into the hash function agreed upon above. Then, the second party can determine the third intermediate key H(skb2', IV2) based on the fifth derived key skb2', where IV2 is the second random number. And based on the sixth derived key skb3', determine the fourth intermediate key H(H(g h(ItemB)*skb1＇The first half, skb3'), H(skb2', IV2) (or, H(H(h(ItemB)*skb1'*G first half, skb3'), H(skb2', IV2))). Finally, the second party performs an XOR operation on the third intermediate key and the preceding second original part to obtain one of the two second encrypted parts, and performs an XOR operation on the fourth intermediate key and the following second original part to obtain the other second encrypted part. Then, by combining or concatenating the two second encrypted parts, the complete second encrypted item ItemB' can be obtained.

[0118] As described above, both the first and second parties can add their respective encrypted items to their respective datasets and store the datasets with the added encrypted items in a trusted third party or database. Then, either the first or second party can initiate a privacy intersection request to the trusted third party or database, which will then perform the privacy intersection on the datasets of both parties. The following explanation uses the second party initiating the request as an example to illustrate the privacy intersection process.

[0119] Figure 4 This is a flowchart of a privacy intersection method in another embodiment of this specification. For example... Figure 4 As shown, the method may include the following steps:

[0120] In step S402, the first encrypted item ItemA' of each first data in the first data set is adjusted using the pre-acquired first adjustment key ska″ to obtain the first adjustment item ItemA″, and the second encrypted item ItemB' of each second data in the second data set is adjusted using the pre-acquired second adjustment key skb″ to obtain the second adjustment item ItemB″.

[0121] In one embodiment, the first adjustment key "ska" and the second adjustment key "skb" are obtained from the key custodian by a trusted third party or database.

[0122] In another embodiment, the first adjustment key ska″ and the second adjustment key skb″ mentioned above are received from a second party by a trusted third party or database.

[0123] The first adjustment key ska″ is determined based on the first encryption key ska″ corresponding to the first encrypted item ItemA', and the second adjustment key skb″ is based on the first encryption key ska' and the second encryption key skb″ corresponding to the second encrypted item ItemB'.

[0124] And that's certain.

[0125] Taking receiving from a second party as an example, the second party obtains the first adjustment key ska″ and the second adjustment 0 key skb″ through the following steps:

[0126] The second party, based on the first encryption key ska' received in advance from the first party, and using an agreed hash function, determines the first derived key ska1', the third derived key ska2', and the fourth derived key ska3'. Based on the second encryption key skb',

[0127] Using the hash function described above, the second derived key skb1', the fifth derived key skb2', and the sixth derived key skb3' are determined.

[0128] The first adjustment key ska″ is the result of concatenating the ratios of the third derived key ska2', the fourth derived key ska3', and the second derived key skb1' to the first derived key ska1'5. The second adjustment key skb″ is the result of concatenating the fifth derived key skb2' and the sixth derived key skb3'.

[0129] It should be understood that the methods for determining ska1', ska2', ska3', skb1', skb2', and skb3' here can be referred to the above description, and will not be repeated here.

[0130] Furthermore, the method for calculating the aforementioned ratio may include: mapping the first encryption key 'ska' to a first mapping value using a mapping algorithm agreed upon by the first and second parties, and mapping the second encryption key 'skb' to a second mapping value. Regarding the second mapping value...

[0131] The ratio is obtained by dividing the first mapping value by the first mapping value: skb' / ska'.

[0132] In one example, the mapping algorithm described above includes applying a preset hash function to map the encryption key onto an elliptic curve agreed upon by the first and second parties.

[0133] The specific steps of S402 above are:

[0134] 5. Split the first adjustment key ska″ into the third derived key ska2', the fourth derived key ska3', and the ratio skb'.

[0135] / ska'. A first intermediate key is determined based on the third derived key ska2', and a second intermediate key is determined based on the fourth derived key ska3' and the first intermediate key. Based on the first and second intermediate keys, the two first encrypted parts obtained by splitting the first encrypted item ItemA' are adjusted accordingly, resulting in two first adjusted parts. Based on the concatenation result of the two first adjusted parts and the aforementioned ratio, the first adjusted item ItemA'' is determined.

[0136] The methods for determining the first and second intermediate keys here can be referred to the above. Specifically, the first intermediate key...

[0137] The key can be represented as: H(ska2', IV1). The second intermediate key can be represented as: H(g h(ItemA)*ska1＇ The first half, ska3'), H(ska2', IV1)), or expressed as: H(H(h(ItemA)*ska1'*G first half, ska3'), H(ska2', IV1)).

[0138] Then we can work on H(ska2',IV1) and H(g) h(ItemA)*ska1＇ The first half, ska3')(or H(h(ItemA)*ska1'*G first half, ska3')), H(ska2',IV1)) are XORed with the two first encrypted parts of the first encrypted item ItemA' respectively to obtain two first adjustment parts.

[0139] It should be understood that the two first adjustment parts here are the same as the two first original parts mentioned above. The principle is that after a number is XORed twice with the same number, the result is still the same number. Therefore, the concatenation of the two first adjustment parts is the first ciphertext mentioned above: g h(ItemA)*ska1＇ , or h(ItemA)*ska1'*G.

[0140] Subsequently, when the first ciphertext and the second ciphertext are ciphertexts obtained by encrypting based on the same elliptic curve and base point, that is, when determining the first ciphertext based on an embodiment in step S304, the first ciphertext can be encrypted based on the agreed elliptic curve and the first adjustment key ska″ to obtain the first adjustment item ItemA″, wherein the first adjustment item ItemA″ uses the first ciphertext as the base point and the first adjustment key ska″ as a multiple.

[0141] In the case where the first ciphertext and the second ciphertext are ciphertexts obtained by exponentiation based on the same base, that is, when determining the first ciphertext based on another embodiment in step S304, the first ciphertext can be used as the base and the first adjustment key ska″ as the exponent to perform exponentiation to obtain the target operation result, which is used as the first adjustment item ItemA″.

[0142] The first adjustment item determined above is expressed as: ItemA″=(skb1' / ska1')*h(ItemA)*ska1'*G=skb1'*h(ItemA)*G. Or it can be expressed as: ItemA″=(g h(ItemA)*ska1＇ ) skb1＇ / ska1＇ =g h(ItemA)*skb1＇ .

[0143] Next, the adjustment process for the second adjustment item, ItemB", is as follows:

[0144] The second adjustment key skb″ is split into a fifth derived key skb2″ and a sixth derived key skb3″. A third intermediate key is determined based on the fifth derived key skb2″, and a fourth intermediate key is determined based on the sixth derived key skb3″ and the third intermediate key. Based on the third and fourth intermediate keys, the two second encryption parts obtained from splitting the second encryption item ItemB″ are adjusted accordingly, resulting in two second adjustment parts used to form the second adjustment item ItemB″.

[0145] The methods for determining the third and fourth intermediate keys can be referred to above. Specifically, the third intermediate key can be represented as: H(skb2',IV2). The fourth intermediate key can be represented as: H(H(g h(ItemB)*skb1＇ The first half, skb3'), H(skb2', IV2)), or expressed as: H(H(h(ItemB)*skb1'*G first half, skb3'), H(skb2', IV1)).

[0146] Then we can work on H(skb2',IV2) and H(H(g) h(ItemB)*skb1＇ The first half, skb3')(or H(h(ItemB)*skb1'*G first half, skb3'),), H(skb2',IV2)) are XORed with the two second encrypted parts of the second encrypted item ItemB' respectively to obtain two second adjustment parts. The two second adjustment parts are concatenated to obtain the second adjustment item ItemB″.

[0147] It should be understood that the two second adjustment parts here are the same as the two second original parts described above, and thus the resulting second adjustment term is the aforementioned second ciphertext. The principle is that after a number is XORed twice with the same number, the result is still the same number. Therefore, the second adjustment term ItemB″ = g h(ItemB)*skb1＇ Alternatively, ItemB″ = h(ItemB) * skb1' * G.

[0148] Step S404: Based on the first adjustment item ItemA″ and the second adjustment item ItemB″, perform privacy intersection on the first data set and the second data set.

[0149] That is, by using skb1'*h(ItemA)*G and h(ItemB)*skb1'*G, or by comparing g. h(ItemA)*skb1＇ and g h(ItemB )*skb1＇ Perform privacy-preserving intersection on the first and second data sets.

[0150] It should be noted that, through the above embodiments of this specification, it is possible to perform privacy-preserving intersection of the data sets of both parties without disclosing the plaintext data items of each party.

[0151] Of course, in practical applications, the request for privacy intersection can also be initiated by the first party. When the request is initiated by the first party, the methods for determining the first adjustment key and the second adjustment key can be interchanged, as can the adjustment process for the encrypted item. This will not be elaborated further here.

[0152] In summary, the privacy intersection method provided in one or more embodiments of this specification has the following advantages:

[0153] 1. Compared with privacy-preserving intersection methods based on feasible execution environments, this solution does not require additional hardware, thus reducing usage costs.

[0154] 2. Employing a pure software approach, it can be combined with the storage capabilities of a database, supporting not only privacy-preserving intersection capabilities but also utilizing encrypted data storage, resulting in high security.

[0155] 3. Both parties negotiate to generate an adjustment key and use the adjustment key to adjust the comparison values ​​(i.e., the data items used for comparison) within the set, instead of simply performing a hash comparison. This avoids the security drawback of hash values ​​being easily cracked by brute force when using a naive hash method.

[0156] 4. Compared with other privacy-preserving intersection methods, it has lower complexity, lower computational overhead, and lower memory usage.

[0157] The above describes the encryption of data from both parties participating in a privacy intersection using multiple encryption keys, and the corresponding privacy intersection method. The following describes the process of storing the data sets of both parties in a database, and having the database perform the privacy intersection.

[0158] Figure 5 This is a schematic diagram of a privacy intersection method in another embodiment of this specification. Figure 5 The database stores a first data set and a second data set. The first data set includes a first encrypted item ItemA', a third encrypted item SM4A, and other data items; the second data set includes a second encrypted item ItemB', a fourth encrypted item SM4B, and other data items. Furthermore, the database also maintains a first adjustment key ska' corresponding to the first data set and a second adjustment key skb' corresponding to the second data set.

[0159] Specifically, the database can receive database query statements sent by a first party or a second party (collectively referred to as the querying party). The `from` clause in these query statements includes a first data table (i.e., the table corresponding to the first data set) and a second data table (i.e., the table corresponding to the second data set), and the `join` field consists of the aforementioned first and second encrypted items. Then, the database can use the first adjustment key `ska″` to adjust the first encrypted item `ItemA″` in the first data set (or the first data table), obtaining the first adjusted item `ItemA″`, and can use the second adjustment key `skb″` to adjust the second encrypted item `ItemB″` in the second data set (or the second data table), obtaining the second adjusted item `ItemB″`. Finally, based on the first adjusted item `ItemA″` and the second adjusted item `ItemB″`, a join query is performed to determine the join query result of the two data tables, that is, to determine the privacy intersection result of the two data sets.

[0160] Specifically, join or nestloop mechanisms can be used for join queries.

[0161] The hashjoin mechanism involves creating a hash table for the table with the fewest rows. For example, a hash table is created for the first table, including the hash value of the first adjustment item "ItemA". Then, by calculating the hash value of the join field in the other table (i.e., the hash value of the second adjustment item "ItemB"), it is determined whether the rows in the two tables match. If they match, the corresponding rows from the two tables are joined together.

[0162] The nestloop mechanism reads a row from the preceding table (the table mentioned earlier in the FROM clause) and matches it row by row from the following table. If a match is found, the row from both tables is concatenated. This execution method is similar to a nested loop.

[0163] It should be noted that when the select clause of the above database query statement includes the first and second encryption items, then if these two items match, the privacy intersection result will include the third encryption item SM4A and the fourth encryption item SM4B, so that the querying party can decrypt one of them. For example, the first party can decrypt SM4A, and the second party can decrypt SM4B.

[0164] Furthermore, when the result of the aforementioned privacy intersection includes other encrypted data items, only the party holding those other data items can decrypt them, thereby ensuring that information outside the intersection is not leaked.

[0165] In summary, the aforementioned database provides a ciphertext-based join operator and supports ciphertext-based join queries on data tables, thereby obtaining the intersection of two data tables containing ciphertext. This combines the database's own data management and privacy protection capabilities, providing a new paradigm for finding intersections of privacy sets.

[0166] Figure 6 This is a structural diagram of a privacy intersection device in one embodiment of this specification. The device specifically performs the following... Figure 2 The method shown implements privacy-preserving intersection, which includes:

[0167] The adjustment unit 602 is used to adjust the first encryption item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item.

[0168] The privacy intersection unit 604 is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second encryption term of each second data in the second data set;

[0169] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item and the second encryption key corresponding to the second encryption item.

[0170] Figure 7 This is a structural diagram of a privacy intersection device in another embodiment of this specification. Specifically, this device performs the following... Figure 4 The method shown implements privacy-preserving intersection, which includes:

[0171] The first adjustment unit 702 is used to adjust the first encryption item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item.

[0172] The second adjustment unit 704 is used to adjust the second encryption item of each second data in the second data set using the pre-acquired second adjustment key to obtain the second adjustment item.

[0173] Privacy intersection unit 706 is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second adjustment term;

[0174] The first adjustment key is determined based on the first encryption key corresponding to the first encryption item, and the second adjustment key is determined based on the first encryption key and the second encryption key corresponding to the second encryption item.

[0175] This specification also provides a computer-readable storage medium storing a computer program thereon, which, when executed in a computer, causes the computer to perform actions such as... Figures 1-5 Any of the methods shown.

[0176] This specification also provides a blockchain node, including a memory and a processor. The memory stores executable code, and when the processor executes the executable code, it implements... Figures 1-5 Any of the methods shown.

[0177] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0178] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0179] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0180] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0181] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0182] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a...

[0183] A machine that causes instructions, executed by a processor of a computer or other programmable data processing device, to generate instructions for implementing the process in the flow. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0184] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0185] 0 These computer program instructions may also be loaded onto a computer or other programmable data processing equipment, enabling the computer or

[0186] A series of operational steps are executed on other programmable devices to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable devices for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0187] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0188] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0189] Computer-readable media, including permanent and non-permanent, removable and non-removable media, can be produced by any method or technology.

[0190] This is used to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), and dynamic random-access memory (DRAM).

[0191] Random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic cassette tape, magnetic disk storage, graphene storage or other magnetic storage devices.

[0192] Computer-readable media, or any other non-transfer medium, can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0193] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of one or more of...

[0194] The form of a computer program product implemented on a computer-usable storage medium (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0195] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0196] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0197] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A privacy-preserving intersection method, comprising: Using the pre-acquired first adjustment key, the first encryption item of each first data in the first data set is adjusted to obtain the first adjustment item; Based on the first adjustment term and the second encryption term of each second data in the second data set, a privacy intersection is performed on the first data set and the second data set; The first adjustment key is determined based on the first encryption key corresponding to the first encryption item and the second encryption key corresponding to the second encryption item.

2. The method according to claim 1, wherein, The first adjustment key is obtained through the following steps: Using an agreed-upon mapping algorithm, the first encryption key is mapped to a first mapping value, and the second encryption key is mapped to a second mapping value; The second mapping value is divided by the first mapping value, and the resulting quotient is used as the first adjustment key.

3. The method according to claim 2, wherein, The first encryption item and the second encryption item are ciphertexts obtained by encryption based on the same elliptic curve and base point. The adjustment of the first encryption item for each piece of first data in the first data set includes: The first adjustment term is obtained by encrypting the first encryption term based on the elliptic curve and the first adjustment key, wherein the first adjustment term uses the first encryption term as the base point and the first adjustment key as a multiple.

4. The method according to claim 2, wherein, The first encryption item and the second encryption item are ciphertexts obtained by exponentiation based on the same base. The adjustment of the first encryption item for each piece of first data in the first data set includes: The first encryption term is used as the base and the first adjustment key is used as the exponent to perform a power operation to obtain the target operation result, which is then used as the first adjustment term.

5. A privacy-preserving intersection method, comprising: Using a pre-acquired first adjustment key, the first encryption item of each first data in the first data set is adjusted to obtain a first adjustment item; and using a pre-acquired second adjustment key, the second encryption item of each second data in the second data set is adjusted to obtain a second adjustment item. Based on the first adjustment term and the second adjustment term, perform privacy intersection on the first data set and the second data set; The first adjustment key is determined based on the first encryption key corresponding to the first encryption item; the second adjustment key is determined based on the first encryption key and the second encryption key corresponding to the second encryption item.

6. The method according to claim 5, wherein, The first data set is held by the first party, and the second data set is held by the second party; the first encrypted item is obtained through the following steps: The first party determines a first derived key based on the first encryption key and using an agreed hash function; based on the first derived key, it encrypts the first data item corresponding to the first encryption item, and splits the resulting first ciphertext into two first original parts; it encrypts the two first original parts respectively to obtain two first encrypted parts, which are used to form the first encryption item; The second encrypted item is obtained through the following steps: The second party determines a second derived key based on the second encryption key and using the hash function; based on the second derived key, it encrypts the second data item corresponding to the second encryption item, and splits the resulting second ciphertext into two second original parts; it encrypts the two original parts respectively to obtain two second encrypted parts, which are used to form the second encryption item.

7. The method according to claim 6, wherein, The step of encrypting the first data item corresponding to the first encryption item includes: The first ciphertext is obtained by multiplying the hash value of the first data item and the first derived key by a multiplier and performing a dot product operation on the base points of the agreed elliptic curve. The encryption of the second data item corresponding to the second encryption item includes: The second ciphertext is obtained by multiplying the hash value of the second data item and the product of the second derived key by the base point.

8. The method according to claim 6, wherein, The step of encrypting the first data item corresponding to the first encryption item includes: Using the agreed first value as the base, and the product of the hash value of the first data item and the first derived key as the exponent, the first ciphertext is obtained by exponentiation. The encryption of the second data item corresponding to the second encryption item includes: The second ciphertext is obtained by exponentiation of the product of the second data item and the second derived key, with the first value as the base.

9. The method according to claim 6, wherein, The encryption of the two first original parts includes: The first original part of the two first original parts is encrypted using a first intermediate key, and the second original part is encrypted using a second intermediate key; the first intermediate key is determined based on a third derived key of the first encryption key; the second intermediate key is determined based on a fourth derived key of the first encryption key. The encryption of the two second original parts includes: The first of the two second original parts is encrypted using a third intermediate key, and the second original part is encrypted using a fourth intermediate key; the third intermediate key is determined based on a fifth derived key of the second encryption key; the fourth intermediate key is determined based on a sixth derived key of the second encryption key.

10. The method according to claim 9, wherein, The first intermediate key and the second intermediate key are obtained through the following steps: The first party uses the hash value of the concatenation result of the third derived key and the first random number as the first intermediate key; and uses the hash value of the concatenation result of the first original part and the fourth derived key, and the hash value of the concatenation result of the first intermediate key as the second intermediate key. The fourth intermediate key and the third intermediate key are obtained through the following steps: The second party uses the hash value of the concatenation result of the fifth derived key and the second random number as the third intermediate key; and uses the hash value of the concatenation result of the first second original part and the sixth derived key, and the hash value of the concatenation result of the third intermediate key as the fourth intermediate key.

11. The method according to claim 9, wherein, The step of encrypting the first original part of the two first original parts using the first intermediate key, and encrypting the second original part using the second intermediate key, includes: Perform an XOR operation between the first intermediate key and the preceding first original part to obtain one of the two first encrypted parts; perform an XOR operation between the second intermediate key and the following first original part to obtain the other first encrypted part; The step of encrypting the first of the two second original parts using the third intermediate key, and encrypting the second original part using the fourth intermediate key, includes: The third intermediate key is XORed with the preceding second original part to obtain one of the two second encrypted parts; the fourth intermediate key is XORed with the following second original part to obtain the other second encrypted part.

12. The method according to claim 5, wherein, The first adjustment key and the second adjustment key are obtained through the following steps: The second party determines the first derived key, the third derived key, and the fourth derived key based on the first encryption key received in advance from the first party and using an agreed hash function. Based on the second encryption key and using the hash function, the second derived key, the fifth derived key, and the sixth derived key are determined. The first adjustment key is the result of concatenating the third derived key, the fourth derived key, and the ratio of the second derived key to the first derived key. The concatenation result of the fifth derived key and the sixth derived key is used as the second adjustment key.

13. The method according to claim 12, wherein, The adjustment of the first encryption item of each first data in the first data set includes: The first adjustment key is split into the third derived key, the fourth derived key, and the ratio; a first intermediate key is determined based on the third derived key, and a second intermediate key is determined based on the fourth derived key and the first intermediate key; based on the first intermediate key and the second intermediate key, the two first encryption parts obtained from the splitting of the first encryption item are adjusted accordingly to obtain two first adjustment parts; based on the splicing result of the two first adjustment parts and the ratio, the first adjustment item is determined. The adjustment of the second encryption item for each piece of second data in the second data set includes: The second adjustment key is split into the fifth derived key and the sixth derived key; a third intermediate key is determined based on the fifth derived key, and a fourth intermediate key is determined based on the sixth derived key and the third intermediate key; based on the third intermediate key and the fourth intermediate key, the two second encryption parts obtained from the splitting of the second encryption item are adjusted accordingly to obtain two second adjustment parts, which are used to form the second adjustment item.

14. The method according to claim 13, wherein, Determining the first adjustment item includes: The first adjustment term is obtained by encrypting the splicing result based on the agreed elliptic curve and the ratio, wherein the first adjustment term uses the splicing result as the base point and the ratio as the multiple.

15. The method according to claim 13, wherein, Determining the first adjustment item includes: Using the splicing result as the base and the ratio as the exponent, a power operation is performed to obtain the target operation result, which is used as the first adjustment term.

16. The method according to claim 5, wherein, The result of the privacy intersection includes: a third encryption item and / or a fourth encryption item; wherein, the third encryption item is obtained by encrypting the first data item corresponding to the first encryption item using a first initial key; the fourth encryption item is obtained by encrypting the second data item corresponding to the second encryption item using a second initial key; the first initial key and the second initial key each have a corresponding decryption key.

17. The method according to claim 16, wherein, The first encryption key is obtained by modifying or reversing a portion of the bits in the bit string corresponding to the first initial key; The second encryption key is obtained by modifying or reversing a portion of the bits in the bit string corresponding to the second initial key.

18. The method according to claim 5, wherein, The first data set includes a first data table, and the second data set includes a second data table; the privacy-preserving intersection of the first data set and the second data set includes: Perform a join query on the first data table and the second data table, and use the result of the join query as the result of the privacy intersection.

19. A privacy-based interaction device, comprising: The adjustment unit is used to adjust the first encrypted item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item; The privacy intersection unit is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second encryption term of each second data in the second data set; The first adjustment key is determined based on the first encryption key corresponding to the first encryption item and the second encryption key corresponding to the second encryption item.

20. A privacy-based interaction device, comprising: The first adjustment unit is used to adjust the first encrypted item of each first data in the first data set using a pre-acquired first adjustment key to obtain the first adjustment item; The second adjustment unit is used to adjust the second encryption item of each second data in the second data set using the pre-acquired second adjustment key to obtain the second adjustment item; The privacy intersection unit is used to perform privacy intersection on the first data set and the second data set based on the first adjustment term and the second adjustment term; The first adjustment key is determined based on the first encryption key corresponding to the first encryption item; the second adjustment key is determined based on the first encryption key and the second encryption key corresponding to the second encryption item.

21. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-18.

22. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-18.

Images