A privacy protection entity identification tool based on secure multi-party computation technology

Abstract

The application realizes a privacy protection entity identification tool based on secure multi-party computing technology through the method in the network security field. It contains three modules of embedded matrix sharing, high sensitive module optimization and privacy protection pre-blocking. The embedded matrix sharing module obtains a high-dimensional word matrix; the high sensitive module optimization module optimizes the existing four high sensitive modules; the privacy protection pre-blocking module obtains the corresponding half results A and B of two computing participants, and obtains the complete plaintext result "0" or "1" through the decryption algorithm of the secret sharing protocol, that is, the entity "matches" or "does not match". The method provided by the application proposes a privacy protection entity identification framework PRIBER with stability and robustness, which can perform entity identification binary classification tasks on the Bert model by using secure multi-party computing technology, and does not sacrifice the accuracy of entity identification itself.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a privacy protection entity identification tool based on secure multi-party computing technology. BACKGROUND

[0002] Privacy protection entity identification aims to match whether two records from different databases belong to the same entity in the real world without exposing sensitive information. With the support of large-scale pre-training language model Bert, the similarity discrimination between entity records can not only be limited to the text level, but also benefit from deep neural network architecture that can capture semantics, so the efficiency of entity identification itself has been greatly improved. However, how to efficiently complete the entity identification task on Bert under the condition of protecting privacy information has become a problem to be solved.

[0003] Existing solutions are either suitable for small models with few nonlinear operations or for inefficient entity identification solutions that are not machine learning. Introducing secure multi-party computing technology into the entity identification task is a novel solution that allows each participant to independently complete the entity identification computation task on the Bert model without obtaining any plaintext information. We use the secret sharing technology in secure multi-party computing, which has dual protection of information theory security and cryptographic security. In this technology, random numbers and corresponding encryption algorithms are used so that each participant has a part of the ciphertext share of the original data, and the original plaintext can be correctly recovered only when all the ciphertext shares are obtained.

[0004] There is a tool Crypten that applies secure multi-party computing technology to machine learning models in the prior art, which provides basic secure multi-party computing and communication primitives, and some polynomial approximation algorithms for nonlinear functions in neural networks. Crypten provides two modules of model encryption and data encryption, and the model is realized through secure registration and parameter secret sharing, and the data is realized through direct secret sharing. Since the secret sharing protocol only has homomorphism, for the nonlinear modules such as e exponential, reciprocal and square root in neural networks, Newton-Raphson iteration, Householder iteration and other algorithms are used for approximation.

[0005] However, the technology has the following problems:

[0006] Firstly, the Bert model contains a word embedding module that requires plaintext indexing, and the existing Crypten technology is difficult to apply to it, so that the secret sharing shares can match the input end of the encrypted model. Secondly, because the dimension of the Bert model is large and the number of layers is deep, many approximation algorithms in Crypten do not converge in the process of Bert model calculation, resulting in incorrect results of the entire model output. Finally, Crypten does not cover a complete entity recognition task process, and lacks the pre-blocking step in the entity recognition task.

[0007] The problem solved by the present application is: how to correctly and stably apply secure multi-party computation method on large-scale language model Bert to complete the privacy protection entity recognition task without losing the accuracy of entity recognition.

[0008] Specifically, the matching of the plaintext word embedding module in the Bert model and the secure multi-party computation technology, the optimization of the high sensitive module (HSM) which is not easy to converge, and the design of the entity recognition pre-blocking module with privacy protection are realized. SUMMARY

[0009] To this end, the present application first proposes a privacy protection entity recognition tool based on secure multi-party computation technology,

[0010] Containing embedding matrix sharing, high sensitive module optimization and privacy protection pre-blocking three modules;

[0011] The embedding matrix sharing module uses embedding sharing algorithm to process the model, indexes the shared embedding matrix provided by the e-commerce platform as the model owner, and obtains a high-dimensional word matrix;

[0012] The high sensitive module optimization module optimizes the four high sensitive modules in the existing bert model, and uses the secret sharing protocol to encrypt the data and the model, and each participant obtains half of the ciphertext of the data and the model, and through the ciphertext reasoning stage, each participant independently calculates the ciphertext on the ciphertext operation.

[0013] The privacy protection pre-blocking module obtains the corresponding half result A and result B of the two computing participants, and obtains the complete plaintext result "0" or "1" through the decryption algorithm of the secret sharing protocol, that is, in the case that the e-commerce activity parties do not expose their own information, through similarity calculation, it is concluded that the entity is "matched" or "not matched", that is, whether it belongs to the same entity.

[0014] The public algorithm processing model, when there is a data pair s and a fine-tuned model M, the model owner first shares its Embedding layer parameters with the data owner, and the data owner uses a specific word segmenter to divide the data pair into tokens. Then, for each token, a lookup table is used to obtain the Embedding matrix obtained in the training phase, as well as other Embeddings unique to the Bert model. After the embedding part, the layer is normalized, and finally, the secret sharing technology is applied to generate a secret sharing share for each of the data owner and the model owner; after obtaining the data sharing share from the Embedding of the encrypted data set, the model is encrypted to obtain an encrypted model.

[0015] The other embeddings specific to the Bert model include position and tag type.

[0016] The optimization of the four existing highly sensitive modules specifically includes: first, optimizing the Softmax function. When the input of the previous layer enters the Softmax module, it is first decrypted, allowing the data owner and the model owner to obtain the plaintext input of the Softmax, and then independently perform the Softmax calculation on the plaintext. Finally, the result is re-encrypted using the secret sharing protocol;

[0017] Next, we optimize the square root function by introducing a factor r, which is used to reduce the original value to the corresponding convergence range. After processing the square root approximation function within a small range, the result is multiplied by the factor r to obtain the final result. We first perform a max operation on the input value to determine whether the maximum value exceeds the upper convergence bound when the number of iterations is 6. If so, we set the factor r to a multiple of 10, thereby dynamically expanding the convergence range of the approximate function.

[0018] Then the polynomial approximation of the reciprocal is optimized using the Newton-Raphson iteration method:

[0019]

[0020] First, in the initialization stage, since the convergence condition of this approximate algorithm is: 0 < y0 < , and set the initial value ;

[0021] Finally, the activation function in Bert is optimized, using GELU as the default activation function, which includes the Gaussian error function erf:

[0022]

[0023] And set the approximation of the GELU function: .

[0024] The privacy protection pre-blocking module adopts PrivBlocking algorithm, and saves an original database or table for each data owner, which is scheme-aware or scheme-aware, is pre-processed first, so that each record is a pure text, removes attribute boundaries, and the remaining part will be synchronized on different data owners using the same method, for each record, Token list is generated using Bert's Tokenizer, and a Bloom filter structure is created, then, for each Token, "1" is generated to the corresponding Bloom filter position through different hash functions, at the end of this iteration, each piece of data will hold a Bloom filter with only "1" and "0";

[0025] After each data owner obtains its private Bloom filter, Cartesian product is performed, and the possible matching index pair [x, y] is obtained without leaking sensitive information, finally, by checking how many "1"s are in the same corresponding position, and using a threshold s, the reduced candidate pair index is locked.

[0026] The technical effect to be achieved by the present application is that:

[0027] A privacy protection entity recognition framework PRIBER with stability and robustness is proposed, which can perform entity recognition binary classification task on the BERT model using secure multi-party computing technology, and does not sacrifice the accuracy of entity recognition itself. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 Privacy protection entity recognition framework PRIBER;

[0029] Figure 2 4 record processing diagrams of two different e-commerce data platforms

[0030] Figure 3 Square root function and its polynomial approximation

[0031] Figure 4 Dynamic square root approximation algorithm

[0032] Figure 5 Comparison of reciprocal and its polynomial approximation when iteration parameter is 6

[0033] Figure 6 Privacy protection pre-blocking based on Bloom filter

[0034] Figure 7 Results on 14 entity recognition data sets DETAILED DESCRIPTION

[0035] The following is a preferred embodiment of the present application and further describes the technical solutions of the present application in conjunction with the drawings, but the present application is not limited to this embodiment.

[0036] The present application proposes a privacy protection entity identification tool based on secure multi-party computing technology. It is applied to the privacy protection of e-commerce data.

[0037] The framework PRIBER is adopted, and the framework PRIBER supports two or three participants, each participant represents a data owner or a model owner, such as Figure 1 As shown in the figure. In the case of two participants, PRIBER can skip the PrivBlocking module and directly perform the inference operation of the model on the data. For Figure 1 Three participants as shown in the figure, PRIBER can realize the entity identification problem of matching the same record from different data sets. Except for the third party providing random seeds for multiplication triples, there is only one machine from the model owner and one machine from the data owner in PRIBER participating in the ciphertext calculation process. Finally, only when all the shared shares of the participants are collected, the real plaintext result can be obtained. Due to the characteristics of secret sharing protocol, the data owner and the model owner are in an equal relationship, and they can independently perform calculation in the encrypted Bert model at the same time. Similar to other related researches, our framework is based on a semi-honest model environment, in which no participant maliciously attacks.

[0038] As shown in Figure 2 The 4 records from two different e-commerce data platforms are not exposed to each other's information, and through similarity calculation, it is concluded that the first pair is not the same entity, and the second pair belongs to the same entity.

[0039] The input of PRIBER can be divided into data input and model input, where the data input comes from one of the two participants A1, A2 or a single participant A. Through the PrivBlocking privacy pre-blocking module, each data owner can obtain a candidate index pair of the two original data sets. The actual data pair to be matched is also obtained through the index pair. For model input, we first designed an embedding sharing algorithm to process the model. By indexing the shared embedding matrix provided by the model owner, we obtain a high-dimensional word matrix. Then, the data and model are encrypted using the secret sharing protocol. After this operation, the participants can each obtain half of the ciphertext of the data and the model. In the next ciphertext reasoning phase, each participant can independently calculate their own ciphertext. Due to the limitations of the ciphertext operation, the support of the multiplication triple and the polynomial approximation algorithm is needed, for which we designed and optimized the high sensitive module (HSM). Finally, the two computing participants get their respective corresponding half results A and B, and through the decryption algorithm of the secret sharing protocol, they get the complete plaintext result "0" or "1", i.e. the entity "match" or "not match".

[0040] Within the framework, specifically, our invention contains three key modules: embedding matrix sharing, high sensitive module optimization and privacy protection pre-blocking.

[0041] Embedding matrix sharing:

[0042] Under the environment of privacy protection, the first problem of the Bert model is that for a pre-trained language model applied to natural language processing tasks, the embedding layer Embedding is necessary, and its core is a lookup table-like operation. Because this operation needs to index the plaintext, we cannot directly perform it on the ciphertext after secret sharing, otherwise the plaintext information will be exposed.

[0043] An algorithm is designed to let the model owner train a model on the plaintext training set first and share the embedding matrix with the data owner. This Embedding layer is also the only small part that the model owner needs to share. The specific algorithm is as follows:

[0044] When there is a data pair s and a fine-tuned plaintext model M, the model owner first extracts the Embedding layer parameters from M using a separation function, and shares them with the data owner. And encapsulate the remaining Encoder part for later use. The data owner uses a specific tokenizer to divide the data pair into a list of subwords. Then, for each subword, the plaintext lookup table of the Embedding layer is iteratively used to obtain the Embedding matrix required for the next calculation stage, as well as other BERT model-specific Embedding (position, token type, etc.) parameters. After the above embedding part, the intra-layer normalization operation is performed. Finally, the secret sharing technique is applied to generate secret sharing shares of the data part for the data owner and the model owner respectively.

[0045] After the Embedding of the encrypted data set obtains the data sharing share (EE), through the security class registration (registering the classes existing in the Bert model to prevent malicious classes from being mixed) module required for model encryption and parameter encryption operation, an encrypted model (EM) is obtained, which is also shared by the data owner and the model owner.

[0046] High sensitivity module (HSM) optimization:

[0047] With an encrypted data pair and an encrypted model, ideally each participant can independently evaluate them. However, due to the limitations of the ciphertext finite field and the instability of the polynomial approximation method, there are some modules that are prone to produce incorrect outputs, which we call high sensitivity modules (HSM). In fact, there are three cases that can cause the ciphertext calculation to produce incorrect results: (1) overflow: when the size of the product or matrix multiplication is very large. Models based on Transformers like BERT are usually particularly large in terms of hidden layer width and depth. (2) non-convergence: each polynomial approximation has its own convergence domain, and when the function is evaluated, the convergence domain does not necessarily contain all possible values. (3) truncation error: when the sum of each shared share exceeds the ring size Q defined before using secret sharing, dividing the secret sharing value by the plaintext value y can cause incorrect results: let be the number of times around, at this time the actual plaintext , the result of dividing the plaintext x by y is

[0048]

[0049] Therefore, the truncation error of the division operation will produce incorrect results at , and in the case of two-party secure computation, this probability is .

[0050] Under the above conditions, we should make reliable design and improvement for high sensitive module HSM to make it applicable to complex model architecture. First of all, in order to prevent ciphertext overflow, we set the fixed-point number encoding scaling factor S as .

[0051] The first HSM is Softmax, which has been proven to be a very time-consuming module in the Transformer attention layer, which contains many exponential operations:

[0052]

[0053] In addition, due to the need for a large number of multiplication operations for the approximation of the exponential (refer to 2.1.2 for the exponential polynomial approximation), the communication cost cannot be ignored. In order to balance the cost and accuracy, we use the iteration number n = 8 to simulate the limit, and the lower bound of convergence is around -500 at this time.

[0054] In our example, we find that the Softmax module here is prone to produce incorrect output, which is caused by the several error conditions described at the beginning of this section. The max operation inside Softmax also makes it very sensitive to large error values.

[0055] Without modifying the softmax layer itself, at most we can only complete the ciphertext calculation containing 4 Transformer encoder depths on a specific dataset, and the maximum hidden layer size is 512. Therefore, for more complex architectures, use the localization technique to improve it. As mentioned earlier, the softmax module not only easily produces incorrect results, but also a very time-consuming part, which is a problem that cannot be ignored for the expensive ciphertext calculation. So when the input of the last layer enters the softmax module, first decrypt it, let the data owner and the model owner get the plaintext input of the softmax, and independently perform the softmax calculation on the plaintext, and finally re-encrypt the result using the secret sharing protocol.

[0056] The second HSM is the square root function. The approximation algorithm first approximates the reciprocal of the square root by the following polynomial approximation method:

[0057]

[0058] First, the initialization stage uses an empirically fast-converging value , then uses Newton-Raphson iteration to repeat n times to get the reciprocal of the square root , and finally gets the real square root by multiplying x itself.

[0059] We find that the above algorithms can converge well in a certain range according to different iteration numbers. But beyond this range, the approximation is no longer effective, as shown in Figure 3 The square root function when the iteration number is 6 is shown in the following figure:

[0060] However, the intermediate layer results of Bert and other complex architecture models have a wide range, which may be several times the convergence domain. To solve this problem, we improve the dynamic square root approximation algorithm. First, we introduce a factor r to reduce the original value to the corresponding convergence range, and then multiply the result by the factor r to get the final result. Considering that the expansion of the convergence domain will cause the approximation error to be larger in the smaller value part, and most of the time the intermediate results of the network will not exceed this convergence range, the improved dynamic square root approximation algorithm is as follows:

[0061] First, we introduce a scaling factor r to reduce the original input value to the corresponding function convergence range, and then multiply the result by the factor r to get the final result. Specifically, we first do the max operation on the input value to determine whether the maximum value m of the input exceeds the convergence upper bound t of the approximation function when the iteration number is 6. If it exceeds, we set the factor r according to the multiples of 10, and use the formula:

[0062]

[0063] Set the size of the factor r, and then divide the input value by r 2 to achieve the scaling effect, thus dynamically expanding the convergence domain of the approximation function;

[0064] The third HSM is the reciprocal polynomial approximation. The reciprocal polynomial approximation uses the Newton-Raphson iteration method, and its formula is as follows:

[0065]

[0066] First, in the initialization phase, the convergence condition of this approximation algorithm is: 0 < y0 < 1 , Crypten uses an empirical formula . Then in the iteration phase, it converges to at a quadratic rate, where the iteration parameter n is selected as 10 under the condition of balancing accuracy and calculation speed. However, this initial value only satisfies the above convergence condition in a very limited range, as shown in Figure 5 , and the approximation function will diverge beyond a certain upper bound.

[0067] For the above problem, the floating range of the intermediate result in the model is very large, and we improve its initial value formula:

[0068]

[0069] This initial assignment formula can converge in any positive number range, so it can work well in our high scalability privacy protection computing system.

[0070] In addition to the above basic polynomial approximation function, it is also worth noting that the activation function in Bert also belongs to a high sensitive module HSM. BERT uses GELU as the default activation function, which contains the Gaussian error function erf:

[0071] GELU =

[0072]

[0073] However, this function does not have a robust polynomial approximation. The existing approximation scheme implemented in Crypten is:

[0074]

[0075] This formula has three shortcomings: (1) the approximation of power operation = requires the approximation of logarithm, and the convergence is weak. (2) The formula is very complex, and the calculation and communication cost is high. (3) When , this approximation method cannot converge well and is prone to produce wrong results. Since we are more concerned about robustness than speed or average deviation, we replace the original GELU function with two simpler approximations:

[0076]

[0077]

[0078] Finally, through experimental verification, the second approximation method has good robustness and can get faster and more stable calculation with very small precision loss.

[0079] Privacy protection pre-blocking:

[0080] In order to cover a complete privacy protection entity identification process, we design a PrivBlocking algorithm that can improve the information protection ability while keeping the original probability features, as shown in the process Figure 6 This algorithm can effectively perform the entity identification pre-blocking step, and it is very easy to use for data owners:

[0081] In PrivBlocking algorithm, each data owner holds a raw database or table, which is schema-aware (with attribute boundaries) or schema-unaware (without attribute boundaries), no matter what kind of data pair we use (A, B) to represent, we need to preprocess the operation to make each record a pure text, remove attribute boundaries. The rest will be synchronized on different data owners using the same method. For each record, use Bert's Tokenizer to generate a Token list, and create a Bloom filter structure. Then, for each Token, generate "1" to the corresponding Bloom filter location through different hash functions. At the end of this iteration, each piece of data will hold a Bloom filter with only "1" and "0".

[0082] After each data owner obtains its private Bloom filter, they can perform a Cartesian product and obtain the possible matching index pair [x, y] without leaking sensitive information. Finally, by checking how many "1"s are in the same corresponding position and using a threshold s, the reduced candidate pair index is locked.

[0083] By adopting our above optimization algorithm, PRIBER can perform binary classification on most entity recognition public datasets on mainstream Bert models, and can be easily extended to other natural language processing tasks and other models.

[0084] We simulate multiple participants through multiple processes on one machine for experiments. We selected 14 public datasets in the field of entity recognition, including different types of structured data, dirty data, and pure text data. Each record is stored in the form of data pair with labels, separated by the separator SEP identified by the Bert model:

[0085] [CLS] Sequence(a) [SEP] Sequence(b) [SEP] Label

[0086] We first train a Bert model with high accuracy and stable performance on plaintext, using the current best entity recognition training framework Ditto [3]. Then use the fine-tuned model to perform entity recognition inference tasks on plaintext and ciphertext respectively. In order to compare the performance of our high scalability privacy protection computing system results and plaintext results, we selected the F1 index which can balance the precision and recall rate:

[0087]

[0088] We test the computation time, communication time on plaintext inference and ciphertext inference, and the total communication data on ciphertext inference, respectively. The current experimental results prove that our high scalability privacy-preserving entity recognition framework can work stably on the 12*768 scale Bert model without too much loss of F1 index, and is not sensitive to the data set. Figure 7 The comparative experiments completed on 16 public data sets are shown, where C* is the ciphertext result and P* is the plaintext result. The experiment uses the mainstream version of Bert, bert-base, which contains 12 layers of Transformer encoder and 768-dimensional hidden layer size. The size of Batch is selected as 256. For each data set, we have done 3 experiments under the same environment, and the final result is the average value. The experimental results show that the ciphertext inference result of our framework has only a small F1 index loss compared with the plaintext inference result. The difference of this loss is related to the pros and cons of the original plaintext inference index. The better the plaintext inference performance, the smaller the F1 loss on the ciphertext. The computation time on the ciphertext is several dozen to 200 times slower than the plaintext, which is roughly consistent with the existing privacy-preserving computation research. For the communication overhead, our experiment shows the communication size and time of each data set. According to the result, the communication rate calculated is not much different from the rate of gigabit network, so our framework can be reproduced without the need for high-performance professional hardware cost.

Claims

1. A privacy-preserving entity identification tool based on secure multi-party computing technology, which inputs data from all parties on an e-commerce platform and calculates whether the participating parties belong to the same entity; When all parties on the e-commerce platform do not disclose their information, similarity calculation shows that the first pair are not the same entity, while the second pair are the same entity. This method is characterized by including three modules: embedding matrix sharing, high-sensitivity module optimization, and privacy-preserving pre-blocking. The embedding matrix sharing module uses the embedding sharing algorithm to process the model, obtaining a high-dimensional word matrix by indexing the shared embedding matrix provided by the e-commerce platform as the owner of the PRIBER framework model. In the case of two participants, the PRIBER framework skips the PrivBlocking module and directly performs the inference operation of the PRIBER framework model on the data. The highly sensitive module optimization module optimizes the existing four highly sensitive modules and uses a secret sharing protocol to encrypt the data and model. Participants each obtain half of the ciphertext of the data and model, and through the ciphertext reasoning phase, each participant independently calculates its own ciphertext and performs calculation operations on the ciphertext. First, the Softmax function is optimized. When the input of the previous layer enters the Softmax module, it is decrypted, allowing the data owner and the model owner to obtain the plaintext input of Softmax. They independently perform Softmax calculations on the plaintext and re-encrypt the result using the secret sharing protocol. Secondly, the square root function is optimized. First, a factor is introduced. , use this factor to reduce the original value to the corresponding convergence range, and then multiply the result by the factor after processing it through the small range square root approximation function. , get the final result, and then first do the max operation on the input value to determine whether the maximum value exceeds the convergence upper bound when the number of iterations is 6. If it exceeds, set the factor according to a multiple of 10 , thereby dynamically expanding the convergence domain of the approximate function; Then the polynomial approximation of the reciprocal is optimized using the Newton-Raphson iterative method ; In the initialization stage, since the convergence condition of this approximate algorithm is: , and set the initial value to ; represents the plaintext vector; Indicates the initial plaintext value; Indicates the natural base The plaintext vector exponential term with base ; Indicates the The plaintext value of the iteration; Indicates that it is located The plaintext value of the subsequent iteration; represents the coefficient of the linear term; Represents the first-order term of Newton-Raphson iteration; Finally, the activation function in Bert is optimized, and GELU is used as the default activation function, which includes the Gaussian error function , and set the approximate value of the GELU function ; The product coefficient that represents the error limit in the Gaussian error function approaches 1; Represents natural base The definite integral of the plaintext exponential term with base ; Indicates mapping the plaintext vector to the range of (0, 1); The privacy-preserving pre-blocking module obtains the corresponding half of the result A and result B for the two computing participants, and obtains the complete plaintext result "0" or "1" through the decryption algorithm of the secret sharing protocol. That is, without revealing any information to any party in the e-commerce activity, the similarity calculation can be used to determine whether the entity "matches" or "does not match", that is, whether it belongs to the same entity.

2. The privacy-preserving entity identification tool based on secure multi-party computing technology according to claim 1, characterized in that: When there is a data s and a model M in the embedding sharing algorithm processing model, the model owner first shares its embedding layer parameters with the data owner. The data owner uses a specific word segmenter to divide the data pair into tokens. Then, for each token, a lookup table is used to obtain the embedding matrix obtained in the training phase, as well as other embeddings unique to the Bert model. After the embedding part, the layer is normalized, and finally, the secret sharing technology is applied to generate a secret sharing share for each of the data owner and the model owner. After obtaining the data sharing share from the embedding of the encrypted data set, the model is encrypted to obtain an encrypted model.

3. The privacy-preserving entity identification tool based on secure multi-party computing technology according to claim 2, characterized in that: The other embeddings specific to the Bert model include position and tag type.

4. The privacy-preserving entity identification tool based on secure multi-party computing technology according to claim 1, characterized in that: The privacy-preserving pre-blocking module adopts the PrivBlocking algorithm and saves an original database or table for each data owner. These databases or tables are scheme-aware or scheme-aware. First, preprocessing is performed to make each record a plain text, removing attribute boundaries. The rest will be executed synchronously on different data owners using the same method. For each record, Bert's Tokenizer is used to generate a token list and create a Bloom filter structure. Then, for each token, "1" is generated to the corresponding Bloom filter position through different hash functions. At the end of this iteration, each data will hold a Bloom filter with only "1" and "0"; after each data owner obtains its private Bloom filter, a Cartesian product is performed and a matching index pair is obtained. , without leaking sensitive information, and finally, by checking how many "1"s there are in the same corresponding positions and using the threshold , lock the candidate pair index for reduction.

Images