Updatable private set intersection

Abstract

"updatable" private set intersection (PSI) protocols allow parties each having an updatable private set to determine, after an update, an intersection of their sets without comparing each element of each set and without compromising privacy. In some protocols, a first party can determine an update to an intersection by determining an intersection of elements previously in the first party's set with elements added to the second party's set, and determining an intersection of elements added to the first party's set with elements in the second party's (updated) set. In some protocols, both parties can determine the updated intersection.

Description

[0001] Cross-referencing related applications

[0002] This application claims the benefit of U.S. Application No. 63 / 089,359, filed October 8, 2020, the disclosure of which is incorporated herein by reference. Background Technology

[0003] "Private Set Intersection," or "PSI," refers to a computer-implemented protocol that allows one or both parties to determine the intersection of a first set associated with a first party and a second set associated with a second party. The protocol is designed so that one (or both, depending on the protocol) can learn the intersection without learning any elements from the other party's set that are not in the intersection. For example, in the context of contact tracing to control the spread of a virus, it might be necessary to identify common contacts of two individuals without either individual needing to learn the other's contacts. One known method of PSI involves the parties exchanging versions of elements that have been effectively encrypted (e.g., using decision Diffie-Hellmann or DDH techniques), such that the receiving party cannot decrypt the elements but can compare them to corresponding encrypted versions of elements in the receiving party's own set to detect a match. In this way, the receiving party can determine the intersection without learning any members from the other party's set that are not in the intersection.

[0004] Existing PSI algorithms do not perform well in situations where sets are updated periodically and the intersection of these updates needs to be determined. For example, if a new element is added to one party's set, both parties must process (encrypt, send, and compare) their entire sets again to determine the intersection. Therefore, PSI protocols can become resource-intensive, especially with large sets. For instance, computation time may scale quasi-linearly with the total number of elements in the set, and communication may scale linearly with the total number of elements in the set. Summary of the Invention

[0005] Some embodiments disclosed herein relate to protocols for "updatable PSI" that can reduce the computational effort required to perform PSI in order to update the intersection of two sets in a context where the sets can be updated from time to time. Some updatable PSI techniques disclosed herein retain the property that one (or both, if needed) can learn the intersection without learning any elements in the other set that are not included in the intersection.

[0006] Some embodiments relate to methods for computing the intersection of private sets (PSI), which can be executed on a first computer system. For example, the first computer system may define a first set (A) that is private to the first computer system, wherein the first set A includes a first residual subset A of elements that are not in the intersection (A∩B) with a second set (B) that is private to a second computer system. old The second set B includes a second residual subset (B0) of elements that are not in the intersection A∩B. old The first computer system can add a first new subset (A) with one or more new elements. d The first computer system updates the first set A. Based on the first communication process with the second computer system, the first computer system can determine the first residual subset A. old A second new subset B having one or more new elements that have been added to the second set B. d The first part of the intersection (I A，old =A old ∩B d The first computer system learns only the second new subset B. d The intersection of the first part I A，old The elements in the set. The first computer system can receive the first encrypted set (B′) from the second computer system. d The first encrypted set includes representations of the second new subset B. d The encrypted elements and the second residual subset B old At least some elements. In some embodiments, the first computer system may include elements representing the first new subset A. d A second encrypted set of elements is provided to the second computer system, and the first encrypted set B′ d It may include the second new subset B d With the first new subset A d and the second residual subset B old The intersection (A) d ∩B old The union of ) . In some embodiments, the first encryption set is the first encryption set B′ d It is received as a binary tree structure, the binary tree structure including the second new subset B. d and the second residual subset B old The encrypted elements of the aforementioned elements. Based on the second communication process with the second computer system, the first computer system can determine the first new subset A. d With the first encryption set B′ d The second part of the intersection (I) A，new =Ad ∩B′ d ), wherein the first computer system learns only the first encryption set B′ d The intersection of the second part I A，new The elements in [the first computer system] can be based on the first partial intersection I. A，old Intersection with the second part I A，new Update the intersection A∩B, and update the first residual subset A based on the updated intersection. old In some embodiments, the first computer system may provide the updated intersection A∩B to the second computer system. The operations of updating the first set A, receiving the first encrypted data set, determining the first partial intersection, receiving the first encrypted set, determining the second partial intersection, updating the intersection A∩B, and updating the first residual subset are performed iteratively for each of a plurality of consecutive update cycles.

[0007] Some embodiments relate to a method for computing the intersection of private sets (PSI), which can be executed on a first computer system. The first computer system may define a first set (A) that is private to the first computer system, wherein the first set A includes a first residual subset A of elements that are not in the intersection (A∩B) with a second set (B) that is private to a second computer system. old The second set B includes a second residual subset (B0) of elements that are not in the intersection A∩B. old The first computer system can add a first new subset (A) with one or more new elements (x). d The first computer system can update the first set A. The first computer system can receive from the second computer system a binary tree structure representing the second set B, wherein each element of the second set B is assigned to a node in the binary tree structure based on a hash function, and wherein the binary tree structure is encrypted such that each element of the second set B is represented by ciphertext in the assigned node. The first computer system can process the first new subset A. d For each new element x in the binary tree structure, processing each new element x includes: identifying the corresponding node of the binary tree structure for the new element x; if the corresponding node is not empty, using the ciphertext in the corresponding node and a two-way computation protocol with the second computer system to determine whether the new element x matches any element of the set B assigned to the corresponding node; and if the new element x matches an element of the set B assigned to the corresponding node, adding the new element x to the first partial intersection (I A，new ); and using the first part of the intersection I A，newUpdate the intersection A∩B. In some embodiments, the first computer system may receive a first encrypted data set from the second computer system, the first encrypted data set representing a second new subset (B) having one or more elements added to the second set B. d Using the first encrypted data set and the first residual subset A old The corresponding encrypted representation is used to determine the first residual subset A. old With the second new subset B d The second part of the intersection (I) A，old =A old ∩B d ); and using the second part of the intersection I A，old and the first part of the intersection I A，new Update the intersection A∩B. In some embodiments, updating the first set A, receiving the binary tree structure, and processing the addition of set A are performed iteratively for each of a plurality of consecutive update cycles. d Each new element x in the dataset, receiving the first encrypted data set, and determining the intersection of the second part I. A，old and using the second part of the intersection I A，old and the first part of the intersection I A，new The operation to update the intersection A∩B.

[0008] Some embodiments relate to a method for computing the intersection of private sets (PSI), which can be executed in a first computer system. The first computer system may define a first set (B) that is private to the first computer system, and add a first new subset (B) having one or more new elements. d The first computer system can update the first set B. The first computer system can update the binary tree structure representing the first set B, wherein each element of the second set B is assigned to a node in the binary tree structure based on a hash function (which may be, for example, a level-specific hash function). The first computer system can encrypt the binary tree structure (e.g., using an additive homomorphic encryption scheme) such that each element of the second set B is represented by ciphertext in the assigned node. The first computer system can send the encrypted binary tree structure to a second computer system, wherein the second computer system has a second set A that is private to the second computer system. The first computer system can participate in a secure two-way computation protocol with the second computer system (e.g., using additive homomorphic encryption), the secure two-way computation protocol enabling the second computer system to determine which elements of the first set B are in a second new subset (A) of the second set A. dThe intersection (A∩B) of the two sets is considered. In some embodiments, for each of a plurality of consecutive update cycles, the operations of updating the first set B, updating the binary tree structure, encrypting the binary tree structure, sending the encrypted binary tree structure, and participating in the secure two-party computation protocol are performed iteratively.

[0009] Some embodiments relate to a method for computing the intersection of private sets (PSI), executable in a first computer system. The first computer system may define a first set (A) that is private to the first computer system, wherein the first set A comprises a plurality of subsets (Ai, Aj, Ai). d-t+1 ... A d-1 A d Each subset is associated with a different one of a plurality of update cycles, where t is a constant duration and d is an update cycle counter. The first computer system can execute a first plurality of instances of a process intersecting a private set of a second computer system, wherein the second computer system has a second set (B) private to the second computer system, wherein the second set B comprises a plurality of subsets (Bi, Bj, Bt). d-t+1 ... B d-1 B d Each subset is associated with a different one of the plurality of update loops, and wherein for each of the first plurality of instances of the private set intersection process, the first computer system uses a subset selected from A. d-t+1 ... A d-1 Different subsets (A j As input, the second computer system uses the subset B. d As input, the first computer system can determine a first partial intersection based on the output of the first plurality of instances of the private set intersection process. The first computer system can execute a second plurality of instances of a private set intersection process with the second computer system, wherein for each of the second plurality of instances of the private set intersection process, the first computer system uses the subset A. d As input, and the second computer system uses the subset B d-t+1 ... B d-1 The second computer system determines the second partial intersection based on the output of the second plurality of instances of the private set intersection process, taking one of the different ones as input. The first computer system can execute an additional instance of the private set intersection procedure with the second computer system, wherein for the additional instance of the private set intersection procedure, the first computer system uses the subset A. d As input, and the second computer system uses the subset B...d Intersection with the second part I 1，α The third set (B′). Based on the output of the additional instance of the private set intersection process, the first computer system can determine the third partial intersection. The first computer system can be based on the first partial intersection I 0，α Intersection with the third part I 0，β Determine the intersection A∩B. In some embodiments, for each of a plurality of consecutive update cycles, the following operations are performed iteratively: performing a first plurality of instances of the private set intersection process, determining a first partial intersection, performing a second plurality of instances of the private set intersection process, performing an additional instance of the private set intersection process; determining the third partial intersection; and determining the intersection A∩B, wherein the update cycle counter d is incremented for each update cycle.

[0010] The following detailed description and appendix Figure 1 This will provide a better understanding of the embodiments of the present invention. Attached Figure Description

[0011] Figure 1 A flowchart is shown illustrating the process of determining the private set intersection (PSI) using a DDH-based technique.

[0012] Figure 2A-2C A flowchart is shown for a process of updating PSI according to some embodiments.

[0013] Figure 3 A flowchart is shown for a sender streaming PSI process that can be used in some embodiments.

[0014] Figure 4A and 4B A flowchart illustrating an updatable PSI with weak deletion according to some embodiments is shown.

[0015] Figure 5 An example of a tree update process according to some embodiments is shown.

[0016] Figure 6 and 7A -7C illustrates a flowchart of a process for implementing a one-sided updatable PSI process using a cryptographic tree structure according to some embodiments.

[0017] Figure 8 A flowchart illustrating a process that can be used to update a binary tree structure according to some embodiments is shown.

[0018] the term

[0019] The following terms may be used in this article.

[0020] A "server computer" can include a powerful computer or cluster of computers. For example, a server computer can be a mainframe, a small cluster of computers, or a group of servers operating as a single unit. In one example, a server computer can be a database server coupled to a web server. A server computer can include one or more computing devices and can use any of a variety of computing architectures, arrangements, and compilations to serve requests from one or more client computers.

[0021] "Client" or "client computer" may include a computer system or other electronic device that communicates with the server computer to make requests to the server computer and receive responses. For example, a client may be a laptop or desktop computer, a mobile phone, a tablet computer, a smart speaker, a smart home management device, or any other user-operable electronic device.

[0022] "Memory" can include one or more suitable devices for storing electronic data. Suitable memory can include non-transient computer-readable media storing instructions executable by a processor to implement desired methods. Examples of memory can include one or more memory chips, disk drives, etc. Such memory can be operated using any suitable electrical, optical, and / or magnetic modes of operation.

[0023] "Processor" can include any suitable one or more data computing devices. A processor can include one or more microprocessors that work together to perform the desired function. A processor can include a CPU, which includes at least one high-speed data processor sufficient to execute program components for performing user and / or system-generated requests. A CPU can be a microprocessor, such as AMD's Athlon, Ryzen, and / or EPYC processors; IBM and / or Motorola's PowerPC; IBM and Sony's Cell processors; Intel's Celeron, Pentium, Xeon, and / or Core processors; and / or other commercially available processors.

[0024] "Communication device" can include any electronic device that can provide communication capabilities, including via mobile phone (wireless) networks, wireless data networks (e.g., 3G, 4G, or similar networks), Wi-Fi, Wi-Max, or any other communication medium that provides access to networks such as the Internet or private networks. Examples of communication devices include mobile phones (e.g., cellular phones), PDAs, tablet computers, netbooks, laptop computers, personal music players, handheld dedicated readers, wearable devices (e.g., watches), vehicles (e.g., automobiles), etc. A communication device can include any suitable hardware and software for performing such functions, and can also include multiple devices or components (e.g., two devices combined can be considered a single communication device when the device remotely accesses a network by being attached to another device (i.e., using another device as a repeater)).

[0025] A "set" can refer to a group of data values ​​representing information items stored by a computer system. Data values ​​can be represented as binary numbers with a fixed number of bits. A set can include items of a specific type of information, such as contacts between two people or devices, location information, transaction information, etc. In the following examples, the set is "updatable," meaning that new information items can be added to the set from time to time, and in some embodiments, older information items can be removed from the set after a fixed period of time.

[0026] An "encryption key" can include any data value or other information suitable for encrypting data with a cryptography. A "decryption key" can include any data value or other information suitable for decrypting encrypted data. In some cases, the same key used to encrypt data can also be used to decrypt data. Such keys are called "symmetric encryption keys."

[0027] The term "public / private key pair" (also known as a "key pair") can refer to a pair of linked cryptographic keys generated by or provided to an entity that "owns" the key pair (e.g., a computer, communication device, or other electronic device). Public / private key pairs can be used with asymmetric encryption algorithms, allowing data encrypted using the pair's "public" key to be decrypted using the pair's "private" or "secret" key (and vice versa). The public key of the key pair can be provided to other entities and used for public functions, such as encrypting messages to be sent to the key pair's owner or verifying digital signatures allegedly generated by the key pair's owner. The public key can be authorized or verified by an entity called a Certificate Authority (CA), which stores the public key in a database and distributes it to any entity that requests it. The private key, or key, is typically stored in a secure storage medium and is known only to the owner of the key pair. It should be understood that some cryptographic systems provide key recovery mechanisms to recover lost keys and prevent data loss.

[0028] A "shared secret" can include any data value or other information known only to the authorized party in secure communication. A shared secret can be generated from any suitable data in any appropriate manner. For example, it can be generated using a Diffie-Hellman-based algorithm, such as Elliptic Curve Diffie-Hellman (ECDH).

[0029] "Additive homomorphic encryption" (or "AHE") refers to encryption in message space. The public-key encryption scheme (including the key generation function (pk, sk, ) ← KeyGen(1)) is used to generate the key. λ ), Encryption function ct←Enc pk (m;r) and the decryption function m / ⊥←Dec sk (ct)), the message space exhibits correctness, CPA security (i.e., security against selected plaintext attacks), and linear homomorphism, making it possible for... And for c⊙Enc pk (m)=Enc pk (c·m). As described below, a refresh operation can be performed after each homomorphic evaluation, in which independently generated zero encryption is added to the resulting ciphertext. This ensures that the randomness of the final ciphertext is independent of the randomness used in the original ciphertext set.

[0030] The “Decision Diffie-Hellman Hypothesis” or “DDH Hypothesis” states that if It is a cyclic multiplicative group of prime order q with generator g, and if a, b, c are from... If the sampling is random and uniform, then Among the symbols This indicates that the two distributions are computationally indistinguishable.

[0031] Cuckoo hashing is a hashing process that distributes a certain number (n) of items into a certain number (b) of blocks. The process can be described as follows: First, select random functions H1, H2, H3: {0, 1} * →[b], and initialize empty block groups B[1,...,b]. To hash item x, determine if any of the block groups [H1(x)], B[H2(x)], and B[H3(x)] is empty. If yes, place item x in one of the empty block groups, and the process terminates. If not, select a random number i∈{1,2,3} and evict the item currently in block group B[H1(x)]. iThe evictioned items are selected from the list of items (x) and replaced with item x; then a recursive process is used to insert the evictioned items into another block group. If the process does not terminate after a fixed number of iterations, the final evictioned items are placed in a dedicated block group called a "stash". Detailed Implementation

[0032] The following description of exemplary embodiments of the invention is presented for illustrative and descriptive purposes. The following description is not intended to be exhaustive or to limit the invention to the precise forms described, and those skilled in the art will understand that many modifications and variations are possible. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling others skilled in the art to best utilize the invention in various embodiments and make various modifications to suit a particular intended use.

[0033] Some embodiments disclosed herein relate to protocols for updatable private set intersections (“updatable PSI”), which reduce the computational effort required to repeatedly determine the intersection of two private sets held by different parties when the sets are updated from time to time.

[0034] For example, imagine a scenario where two parties, P0 and P1 (which could be computer systems), each collect information items that can be represented as elements in a set. Information items could be, for example, identifiers of people or entities (or devices) that P0 or P1 has come into contact with. It is also imagined that the information items held by P0 and / or P1 may change over time; for example, each party may encounter new contacts daily. Assume that it is desirable for P0 and / or P1 to be able to determine which information items their sets share (e.g., whether they have come into contact with the same person) without exposing their entire sets of information items to each other, and to update the set of shared information items (the intersection of P0's set and P1's set) from time to time.

[0035] PSI can be performed on two sets. Figure 1 A flowchart is shown for process 100 using a decision-based Diffie-Hellman (“DDH”) PSI technique, which can be implemented in a pair of appropriately configured computer systems (or in different processes within the same computer system that do not share data access). Assume that a first party P0 has a first set A with a certain number (N) of elements, and a second party P1 has a second set B with a certain number (which is not necessarily equal to the number of elements in set A).

[0036] At boxes 102 and 104, each party defines its set: at box 102, P0 defines set A, and at box 104, P1 defines set B. For example, each party can define its set by collecting data during normal operations, such as information provided by various devices or individuals encountered by that party. At boxes 106 and 108, each party generates a secret exponentiation key: P0 generates key k0, and P1 generates key k1. At boxes 110 and 112, each party uses a hash function. To its set (where Hash a group of prime order q with generator g, and raise the result to the power of its exponentiation key. As used in this paper, a "hash set" refers to a set for which the same hash function is applied to each element; that is, H(A) := {H(a) | a∈A} and H(B) := {H(b) | b∈B}. Raising to the power is also performed on each element of the set such that H(A) = {H(a) | a∈A}. k0 :=H(a) k0 |a∈A} and H(B) k1 :=H(b) k1 |b∈B}. At box 114, P0 hashes the set H(A). k0 The message is sent to P1, and at box 116, P1 receives H(A). k0 P1 cannot reverse the exponentiation and hash operations to extract elements of set A. At box 118, P1 extracts each element H(A) by... k0 Calculate H(A) by raising it to the power of k1. k0k1 At box 120, P1 will set H(A) to... k0k1 And H(B) k1 Send to P0.

[0037] At box 122, P0 receives H(A). k0k1 And H(B) k1 P0 cannot reverse the exponentiation and hash operations to extract elements of set B. At box 124, P0 does so by... k1 H(B) is calculated by raising each element to the power of k0. k1k0 At position 126, P0 can assign element H(A) to... k0k1 With element H(B) k1k0 Compare and identify matches. This is only necessary if P0 knows which element H(A) is being matched. k0k1 Which element 'a' in set A does P0 map to, and which element H(A) does P0 map to? k0k1 Match H(B) k1k0 The elements of A∩B are used to determine A∩B. In this process, P0 only learns the elements of the set B that are elements of A∩B.

[0038] In order for P1 to also be able to determine A∩B, at box 128, P0 can determine H(B). k1k0 Send to P1. At box 130, P1 can receive H(B). k1k0 At box 132, P1 can perform the same comparison performed by P0 at box 126 to determine A∩B. In this process, P1 only learns the elements of the set A that are elements of A∩B.

[0039] If sets A and B are updated from time to time, process 100 can be re-executed to allow parties P0 and P1 to update the intersection A∩B. For example, suppose initially (on "day 0"), set A consists of a set A0 with N0 elements, and set B consists of a set B0 with N0 elements. P0 and P1 execute process 100 to determine A0∩B0.

[0040] On day 1, P0 will be determined by N. d A set A1 consisting of N elements is added to its set (therefore A = A0 ∪ A1), and P1 will be composed of N elements. d A set B1 consisting of elements is added to its set (therefore B = B0 ∪ B1). P0 and P1 can be re-executed. Figure 1 The process 100 determines A∩B=(A0∪A1)∩(B0∪B1). By comparing the results of day 0 and day 1, P0 can learn A1∩(B0∪B1) and can also learn A0∩B1. However, P0 will not learn A1∩B1 or A1∩B0. Similarly, P1 can learn B1∩(A0∪A1) and B0∩A1 but will not learn B1∩A1 or B1∩A0.

[0041] Repeated every time the collection is updated Figure 1 The process requires performing operations on all elements of both sets, including elements known to be in the intersection. As elements are added to sets A and B, re-executing the PSI process daily generates an increasingly large computational load. Specifically, the computation time is adjusted to O(N), where N is the total number of elements in each set. If N0 is the number of elements in the set when PSI process 100 is first executed, and N0... d If the number of elements added between iterations is N, then the computation time is adjusted to O(N0 + N1). d The communication load is also adjusted to O(N0 + N0) as each party communicates the representation of each element of its set in each iteration. d ).

[0042] According to some embodiments of the present invention, computational and / or communication loads can be reduced by implementing an "updatable PSI" protocol that does not require operations to be performed on all elements of both sets each time an update is needed. In some embodiments, the updatable PSI protocol does not (to either party) leak information obtained by re-executing on the entire pair of sets. Figure 1 The PSI process can be performed without revealing any information. Therefore, the updatable PSI described herein can provide the same privacy protection as re-performing PSI on all elements of both sets, while reducing computational and / or communication load.

[0043] The embodiments of the updatable PSI protocol described herein involve an iterative process that can be repeated from time to time. An "update cycle" refers to the time between iterations in the iterative process. For simplicity, the update cycle is sometimes referred to as a "day"; however, those skilled in the art will understand that the update cycle can be longer or shorter as needed. At the end of each update cycle, the parties (referred to as P0 and P1) can perform one iteration of the updatable PSI protocol. To learn the update intersection I on each d-th day... [d] Each party, P0 and P1, only needs to learn and update set I. update =I [d] \I [d-1] In the notation used in this article, A d (B d A represents the element added to the set of P0 (of P1) on day d, and A [d] (B [d] () represents the complete set of P0 (of P1) up to day d; that is

[0044] Some of the embodiments described herein utilize I update The observations can be divided into the following two disjoint sets: I A，old =A old ∩B d (where A) old :=A [d-1] \I [d-1] ) and I A，new =A d ∩B [d] Therefore, to enable P0 to learn I A，old and I A，new Both are sufficient. Symmetrically, if B... old :=B [d-1] \I [d-1] , then I update It can also be divided into I B，old =B old ∩A d and I B，new =B d ∩A[d] This allows P1 to compute the intersection. It is also possible to design a system that allows P0 to learn I. A，old and I A，new (And if necessary, P1 is also allowed to learn I) B，old and I B，new The protocol ensures that A is not leaked through the execution process 100. [d-1] ∩B [d-1] Then re-execute process 100 to confirm (A) [d-1] ∪A d )∩(B [d-1] ∪B d Information that cannot be learned.

[0045] An example of a “bidirectional” updatable PSI protocol that allows both parties to learn their intersection daily (or in other update cycles) will now be described. In this example, updates to the sets are “additive”; that is, elements are added to sets A and B, but not removed from them. (An example of deletion is also considered below.) It is also assumed that parties P0 and P1 are semi-honest, and that neither party retains or applies information received from the other unless otherwise specified in the protocol. In this bidirectional protocol, I is observed... A，new =A d ∩B [d] =A d ∩(B d ∪B old ), because by definition, it is not in B. old Or B d B in [d] Any element of I is already in A∩B. Furthermore, since P1 determines I... B,old =B old ∩A d Therefore, P1 can provide set B′ d =B d ∪(B old ∩A d ), for the purpose of determining I A，new The purpose is that the set is equivalent to B. d ∪B old This can reduce the number of elements that need to be encrypted and exchanged between the parties.

[0046] Figure 2A-2C A flowchart of a process 200 for updating a PSI, according to some embodiments, is shown. Process 200 can be implemented in a pair of appropriately configured computer systems (or in different processes within the same computer system that do not share data access). Process 200 includes initialization performed by each party during the first iteration (day 0); the initialization step is omitted in subsequent iterations. Reference Figure 2ADuring initialization, both P0's private set A and P1's private set B are assumed to be empty. Therefore, at box 202, one party P0 can define a "residual" subset A of all elements of set A that are not in the intersection A∩B. old Initialize to an empty set. P0 can also initialize the hash set H to an empty set. A =H(A) old ) k0k1 Initialize to an empty set. P0 can also initialize the intersection A∩B to an empty set. During initialization, P0 can generate and store the secret exponentiation key k0. Similarly, at box 204, one party P1 can define a "residual" subset B of all elements of a set B that is not in the intersection A∩B. old Initialize to an empty set. P1 can also initialize the hash set H. B =H(B old ) k0k1 Initialize to an empty set. P1 can also initialize the intersection A∩B to an empty set. P1 can generate and store the secret exponentiation key k1. When neither party knows the intersection, blocks 202 and 204 can be executed in the first iteration, and subsequent iterations can be omitted. As described below, each iteration can update the residual subset A. old and B old The corresponding hash set H A and H B And the intersection A∩B; therefore, these sets may be empty at the start of a particular iteration of process 200.

[0047] At boxes 206 and 208, each party updates its private collection by adding elements. Therefore, at box 206, a "new" subset A will include one or more elements. d Add to set A, and at box 208, a "new" subset B will include one or more elements. d Add to set B. (In some embodiments, in some iterations, subset A) d Or B d One or both of them can be the empty set.

[0048] As mentioned above, in order to update the intersection A∩B, P0 needs to learn I A，old =A old ∩B d and I A，new =A d ∩(B old ∪B d To learn A for P0. old ∩B d At box 210, P1 can access set B. dHash (the newly added elements to set B) and raise each element to a power of k1. (This can be similar to box 112 of process 100, except that only the newly added elements are presented in the hash set.) At box 212, P1 can hash the set H(B) d ) k1 Send to P0. At box 214, P0 can receive H(B) d ) k1 From P0's perspective, the hash set H(B) d ) k1 B is the set that P0 cannot decrypt. d The encrypted representation. At box 216, P0 can use H(B) to... d ) k1 The hash set H(B) is calculated by raising each element to the power of k0. d ) k1k0 At box 218, P0 can set the hash set G(B) d ) k1k0 With its stored hash set H A =H(A) old ) k0k1 Compare to determine I A，old =A old ∩B d .

[0049] Similarly, in order to update the intersection A∩B, P1 needs to learn I. B，old =B old ∩A d and I B，new =B d ∩(A old ∪A d In order to learn B in P1 old ∩A d At box 220, P0 can set A d Hash (the newly added elements to set A) and raise each element to the power of k0. (This can be similar to box 110 of process 100, except that only the newly added elements are presented in the hash set.) At box 222, P0 can hash the set H(A) d ) k0 Send to P1. At box 224, P1 can receive H(A). d ) k0 At box 226, P1 can achieve this by converting H(A) into H(A). d ) k0 The hash set H(A) is calculated by raising each element to the power of k1. d ) k0k1 At box 218, P1 can convert H(A) d )k0k1 With its stored hash set H B =H(B old ) k1k0 Compare to determine I B，old =B old ∩A d .

[0050] Next, P0 can learn A without studying A. d ∩B old Or A d ∩B new Learning I in the context A，new =A d ∩(B old ∪B d For example, each party can use P1 to determine I at box 228. B，old =A d ∩B old The facts. Reference Figure 2B At box 230, P1 can define the "filled" set B′. d =B d ∪I B，old ∪D B D B It is a set of virtual elements, which can have random values. The number of virtual elements can be chosen such that set B′ d The base is 2N d , where N d This is the number of elements added each day. In some embodiments, N d It can be a fixed value that does not change from one iteration to the next; it can be a fixed value predetermined for a given implementation based on the expectation of the number of elements to be added to the set each day (or other update cycle). Using dummy elements can help hide information about how many elements will be added to the set each day (or other update cycle). The use of dummy elements is optional, and in some embodiments, dummy elements can be omitted (in this case, D). B (It can be an empty set).

[0051] At box 232, P1 can fill set B′ by... d The hash set H(B′) is calculated by hashing the result and raising the result to the power of k1. d ) k1 The same hash function used in box 210 can be used. In box 234, P1 can hash the set H(B′). d ) k1 and hash set H(A) d ) k0k1 (Confirm at box 226) Send to P0.

[0052] At box 236, P0 can receive H(B′) d ) k1 and H(A) d ) k0k1 At box 238, P0 can use the hash set H(B′) d ) k1 and H(A) d ) k0k1 To determine I A，new =B′ d ∩A d For example, P0 can be achieved by converting H(B′) into H(B′). d ) k1 The hash set H(B′) is calculated by raising each element to the power of k1. d ) k1k0 Then, P0 can transfer H(B′) to H(B′). d ) k1k0 Each element is related to H(A) d ) k0k1 The elements are compared. (These operations can be similar to boxes 122 to 126 of procedure 100, except that the input set at box 238 is a subset of sets A and B instead of the entire sets.)

[0053] It should be noted (assuming no false positives due to virtual elements) that the operation at boxes 230-238 produces the same result as if P1 generates B. d ∪B old The encryption indicates that the result obtained is the same as the result obtained, and the result is sent to P0. This is because P0 and P1 have already established... Therefore, B will be added to the intersection A∩B. old The only element is A d ∩B old The elements. By using set B′ d The computational and communication load is reduced because P1 only computes and sends the set H(B′). d ) k1 2N d One element, not B. old All elements of set H(B′). It should also be noted that P0 does not know the set H(B′). d ) k1 The given element is derived from B d A d ∩B old It's still a virtual element, which aligns with the expected privacy protection practices.

[0054] At box 240, P0 can compute the update of the intersection: I update =I A，new ∪I A，old , where IA，old Define at box 218 and I A，new Defined at box 238. At box 242, P0 can... update Send to P1, and at box 244, P1 can receive I. update At points 246 and 248, each party can update the intersection A∩B:=(A∩B)∪I. ubdate .

[0055] In some embodiments, additional processing may be performed to update the residual subset A. old and B old and the corresponding hash set H A =H(A) old ) k0k1 and H B =H(B old ) k1k0 Prepare for the next iteration of process 200. Figure 2C This illustrates updating the residual set A during process 200 according to some embodiments. old and hash set H A An example. It should be understood that a similar process of reversing the roles of P0 and P1 can also be used to update the residual subset B. old and hash set H B In some embodiments, update set A old H A B old and H B It can be executed at the beginning of each iteration, rather than at the end.

[0056] At box 250, P0 can be defined by A d The elements in the intersection update that are not calculated at box 240 are added to the set D containing enough virtual elements. A The set A′ d set A′ d The base is N d That is, A′ d =(A d \I update )∪D A Similar to the virtual set D at box 230. B set D A Virtual elements can have random values.

[0057] At box 252, P0 can choose the parameter α, which can be a secret random positive integer. At box 254, P0 can select the set A′. d Perform hashing and raise the result to the power of αk0 to compute the hash set H(A d ) αk0At box 256, P0 can hash the set H(A) d ) αk0 Send to P1.

[0058] At box 258, P1 can receive the hash set H(A′). d ) αk0 At box 260, P1 can raise each element to the power of k1, thus computing the hash set H(A). d ) αk0k1 At box 262, P1 can hash the set H(A′). d ) αk0k1 Send to P0. (Assume that without changing the order of the elements or in some other way, P1 will hash the set H(A′). d ) αk0k1 Provided to P0 so that P0 can determine H(A′) d ) αk0k1 Which element corresponds to H(A′)? d ) αk0 Which element?

[0059] At box 264, P0 can receive H(A′) d ) αk0k1 At box 266, P0 can be achieved by converting H(A′) into H(A′). d ) αk0k1 Increase to α -1 Calculate H(A′) using exponentiation d ) k0k1 At box 268, P0 can be achieved by removing set A from the intersection A∩B. old Add the elements corresponding to the elements in the set A that are not added to the intersection of A∩B. d Update the hash set H with the corresponding elements of the elements. A For example, the updated hash set can be computed as H(A) old ) k0k1 :=(H(A) old ) k0k1 \H(I A，old ) k0k1 )∪H(A d \I A，old ) k0k1 At box 270, P0 can update set A. old Used for the next iteration of process 200. For example, the update can be computed as A. old :=(A old \I A，old )∪(A d \I update That is, the residual subset A oldIt contains elements of set A that are not in the intersection A∩B.

[0060] Although not explicitly shown, a corresponding set of operations can be performed with the roles of P0 and P1 reversed, so that P1 can update the residual subset B. old and hash set H B After that, process 200 can be executed again starting from boxes 206 and 208 to continue updating the intersection of private sets A and B.

[0061] Process 200 provides the same privacy protection as re-executing the PSI protocol across the entire update set. That is, P0 can learn A d ∩(B d ∪B [d-1] And you can also learn A old ∩B d However, P0 will not learn A. d ∩B d Or A d ∩B [d-1] Similarly, P1 can learn B. d ∩(A d ∪A [d-1] ) and B old ∩A d But I won't learn B. d ∩A d Or B d ∩A [d-1] Therefore, each party can learn whether each newly added element in its own set is in the intersection, but cannot learn whether a newly added element is the same as a "residual" or "new" subset of the other party's set. Each party can also learn whether any element in its residual subset enters the intersection due to the other party adding a new element.

[0062] It should be understood that process 200 is illustrative and may be subject to change and modification. Operations or blocks described in sequence may be executed in parallel, and the order of operations may be changed within the limits of logic. In some embodiments, process 200 may be initialized by executing one iteration of, for example, the PSI protocol of process 100, wherein subsequent iterations are performed according to process 200.

[0063] The iterations of process 200 can be performed at any desired frequency, depending on the useful frequency for determining the updated PSI. For example, in contact tracing applications, daily updates may be appropriate. In other applications, updates may occur at shorter intervals (e.g., hourly), longer intervals (e.g., weekly, monthly), or arbitrary intervals, such as when either party adds N to its set. dAn element may occur at the request of either party. In instances where the parties have intermittent contact, the interval between iterations can be a variable amount of time. Each party may execute another iteration of process 200 at any time, provided that it retains the results of its previous iteration.

[0064] In the example described above, each party uses a hash function raised to a (secret) power to encrypt elements of a private set shared with the other party. As described, the receiver can compare the encrypted elements between the two sets but cannot decrypt the elements of the other party's set. In some embodiments, the hash function can be replaced by any unintentional pseudo-random function (“OPRF”) that creates the encrypted representation of the elements, provided that neither party can decrypt the elements originally encrypted by the other party, and that each party can obtain the corresponding encrypted representations of the elements of both sets (such that if the two encrypted representations are the same, the elements can be assumed to be the same, and if the encrypted representations are different, the elements can be assumed to be different). In some embodiments, the parties can cooperate to provide the corresponding encrypted representations. For example, as described above, in the case where the encrypted representation is a hash function raised to a power, one party can apply its (secret) exponent to the hash set received from the other party and then return the result. Other OPRF implementations may also involve cooperation between the parties.

[0065] As described above, either party can add dummy values ​​to the set being sent to the other party, such that neither party knows how many elements have actually been added to the other party's set during each update cycle. The dummy values ​​can be random numbers generated using any type of random number (or pseudo-random number) generator. In some embodiments, there may be a non-zero probability that a dummy value generated by one party coincides with an element in the other party's set, resulting in "false positives" in the intersection. For example, if one of the dummy values ​​generated by P1 at box 230 coincides with element a of P0's set... q If a match is found, then P0 can place a at box 240. q Included in intersection I update middle. element a q This would result in false positives. By allowing dummy values ​​to have a sufficiently large range of values, the probability of false positives can be reduced to a negligible level. Alternatively, dummy values ​​can be omitted if needed, which would allow one side to learn how many elements are added to the other side's set on a given day, but would prevent dummy values ​​from causing false positives.

[0066] Compared to traditional techniques, process 200 and other similar processes can provide improved computational efficiency, where PSI is performed on the entire set of both sets whenever an update is needed. As mentioned above, the computation time of the full-set PSI protocol is adjusted to O(N0 + N1). d ), where N0 is the initial size of the set, and N dThis is the number of elements added for each update of the PSI. This applies when the sum of the increments is much smaller than the initial size of the set (i.e., where N0 >> N). d The computation time of traditional techniques is adjusted to O(N0), even if the amount of data added is much smaller than N.

[0067] Conversely, process 200 can operate on subsets of both sets. Therefore, the computation time for each update is adjusted to O(N). d Therefore, in N d To a extent smaller than the total set size, process 200 can provide improved computational efficiency with each PSI update. (The initial iteration is not necessarily faster, as all elements of the set will be included in the said iteration. The advantage is only observed in subsequent iterations.)

[0068] Alternatively, process 200 can also reduce communication costs compared to re-executing traditional PSI across the entire set. Re-executing traditional PSI increases communication costs with N0+N. d The communication cost of process 200 typically increases with the increase of N. d The size increases (because communication is needed for added elements), and in the worst case, it grows with log N0. This increases when the initial set size N0 is large and the update size N... d The greatest advantage in communication costs can be obtained when the network is smaller and has lower bandwidth.

[0069] In process 200, it is assumed that sets A and B are updated only by adding elements. In some embodiments, elements can also be deleted from sets A and B. In a scenario known as “weak deletion,” elements are removed from sets A and B via an expiration process. That is, an element added to set A (or set B) at iteration i is removed at iteration i+t, where t represents a fixed duration for a particular application. Therefore, each party can refresh its set every t iterations. The choice of duration t depends on the application and is assumed to be the same for both sets. For example, in some contact tracing applications, contacts who appeared more than two weeks ago may no longer be considered, and duration t could be set to 14 days. Other durations can be defined for other applications.

[0070] According to some embodiments of the present invention, an updatable PSI protocol can be provided for updating the intersection of sets with weak deletions. The updatable PSI protocol may include multiple instances using a sender streaming PSI (“SSPSI”) procedure. An “SSPSI procedure” can be defined as a PSI protocol between two parties referred to as a “sender” and a “receiver”, wherein only the receiver learns the intersection of the receiver’s set and a specific subset of the sender’s set. Assume that the receiver initially knows its entire set Y, while the sender initially only knows a subset X of its set X. i The following assumptions are public information: (1) the size (number of elements) of the receiver set Y; (2) the known subset X of the sender. i The size of the set X; and (3) the upper limit of the number of elements in the sender set X. After the sender has learned the initial subset X0, each party can perform a unilateral PSI process, thereby generating the receiver learning X0∩Y. Subsequently, when the sender learns the additional subset X i At this time, the sender and receiver can perform an additional one-sided PSI process, each time enabling the receiver to learn X. i ∩Y.

[0071] Figure 3 A flowchart of a sender streaming PSI process 300, which may be used in some embodiments, is shown. Process 300 may be implemented in a pair of suitably configured computer systems (or in different processes within the same computer system that do not share data access). At block 302, the sender establishes an input set X. i The input set should be understood as a subset of a larger set X. At box 304, the receiver establishes the input set Y. At boxes 306 and 308, the sender and receiver can perform a key generation process to generate a key K. At box 310, the sender can use the key K and an unintentional pseudo-random function (OPRF) to generate {OPRF(K, x) | x ∈ X}. i The sender transmits the unintentional pseudo-random function to the receiver. (For set X) i OPRF is computed for each element in the dataset. Any unintentional pseudo-random function can be used, provided that if I = X... i If ∩Y, then for any x∈X i The occurrence of OPRF(K, x) is pseudo-random to the receiver, thus not revealing information about element x. The key can be chosen as needed; as long as the sender knows the upper limit Max of the number of elements in the sender set X, a key of appropriate length can be chosen. In some embodiments, the key referenced above can be used. Figure 1The described power-law hash function, in which the key K can be understood as the product of two powers, and the parties cooperate to generate the OPRF set. Other suitable functions can also be used. At box 312, the receiver can receive {OPRF(K, x) | x∈X} i At box 314, the receiver can compute {OPRF(K, y)|y∈Y}. When using a hash function raised to the power of 1, the receiver can hash its element {H(y)}. Kr The information |y∈Y} is provided to the sender so that the sender can compute {H(y)}. KrKs} and return the result to the receiver. At box 316, the receiver can use {OPRF(K, x)|x∈X} i Compare {OPRF(K,y)|y∈Y} to determine the intersection I=X. i ∩Y. If for different subsets X of the sender set i If process 300 is repeated, it is not necessary to recalculate the receiver's encrypted element {OPRF(K,y)|y∈Y}, because the set Y will not change. Therefore, block 314 can be executed once, and the receiver can store {OPRF(K,y)|y∈Y} for subsequent executions of process 300.

[0072] A sender-streamed PSI process, such as process 300, can be represented as the function SSPSI(S, R, i), where S represents the party acting as the sender, R represents the party acting as the receiver, and i represents the stream index to be processed (or a subset X of the set of senders). i ).

[0073] Figure 4A and 4B A flowchart illustrating an updatable PSI with weak deletion according to some embodiments is shown. Process 400 can be implemented in a pair of suitably configured computer systems (or in different processes within the same computer system that do not share data access). Process 400 can utilize... Figure 3 The SSPSI process. Whenever an update to the PSI is needed (e.g., daily), process 400 can be executed iteratively.

[0074] Procedure 400 can begin by updating the input set. P0 adds set A at box 402. d And delete set A at box 404. d-t This updates set A. Therefore, for any given iteration, set A can include a subset A. d-t+1 ... A d-1 A d (For any case where index i ≤ 0, A) i(It can be an empty set.) Similarly, P1 adds set B at box 406. d And delete set B at box 408. d-t This updates set B. Therefore, for any given iteration, set B can include a subset Bi. d-t+1 ... B d-1 B d (For any case where index i < 0, B) i It can be an empty set.

[0075] In boxes 410-414, P0 can determine a partial intersection.

[0076]

[0077] More specifically, at boxes 410 and 412, for each positive integer j in the range from (d-t+1) to (d-1), an example of SSPSI can be performed according to procedure 300, where P1 is the sender and P0 is the receiver. The set of receivers in the given instance is A. j And the subset of senders is B d In this way, P0 can learn A for each j. j ∩B d At box 414, P0 can calculate the union I according to equation (1). 0，α It should be noted that I 0，α Similar to I in process 200 A，old The difference is that it does not include elements from the deleted subset of set A.

[0078] Similarly, in boxes 416-420, P1 can determine a partial intersection.

[0079]

[0080] More specifically, at boxes 416 and 418, for each positive integer j in the range from (d-t+1) to (d-1), an example of SSPSI can be performed according to procedure 300, where P0 is the sender and P1 is the receiver. The set of receivers in the given instance is B. j And the subset of senders is A d In this way, P0 can learn B for each j. i ∩A d At box 420, P1 can calculate the union I according to equation (2). 1，α .

[0081] In boxes 422-428, P0 can determine a partial intersection.

[0082]

[0083] More specifically, at box 422, P1 can generate set B′, which can be defined as

[0084] B′=B d ∪I 1,α ∪D Bd (4)

[0085] Among them I 1，α Given by equation (2), and D Bd B′ is a set of virtual random elements (similar to the virtual random elements used in procedure 200) such that the cardinality of set B′ is equal to 2N. d At boxes 424 and 426, an additional example of SSPSI can be performed according to procedure 300, where P0 is the receiver and P1 is the sender. The set of receivers is A. d And the set of senders is B′. In this way, P0 can learn A. d ∩B′, which (ignoring the virtual element) is the same as equation (3). Therefore, P0 can be determined at box 428. 0，β It should be noted that I 0，β Similar to I in process 200 A，new The difference is that it does not include elements from the deleted subset of set B.

[0086] Similar to blocks 230-238 of process 200 above, the SSPSI process at blocks 424 and 426 produces the same result as if P1 used set B as the sender set, but with reduced computational load, which is possible because P1 has already determined subset B. d-t+1 ... B d-1 B d Which elements are related to A? d intersect.

[0087] Similarly, refer to Figure 4B In boxes 430-436, P1 can determine a partial intersection.

[0088]

[0089] More specifically, at box 430, P0 can generate set A, which can be defined as

[0090] A′=A d ∪I o，α ∪D Ad (6)

[0091] Among them I 0，α Given by equation (1), and D AdLet A' be a set of virtual random elements (similar to the virtual random elements used in procedure 200) such that the cardinality of set A' is equal to 2N. d At boxes 432 and 434, an additional example of SSPSI can be performed according to procedure 300, where P1 is the receiver and P0 is the sender. The set of receivers is B. d And the set of senders is A′. In this way, P1 can learn B. d ∩A′, which (ignoring the virtual element) is the same as equation (5). Therefore, P1 can be determined at box 436. 1，β Similar to the SSPSI procedures in boxes 424 and 426, the SSPSI procedures in boxes 432 and 434 produce the same results as if P0 used set A as the sender set, but with reduced computational load.

[0092] At boxes 438 and 440, P0 and P1 can each determine the intersection I used to update d. d At box 438, P0 determines I. d =I 0，α ∪I 0,β Because I 0，α It is the "new" element (B) of P1 d The intersection of the "old" (but not expired) elements of P0 and I, and 0，β It is the "new" element A of P0. d The intersection of P1 and the universal set B is such that the union of these two sets is the intersection A∩B. At box 440, P1 determines I. d =I 1，α ∪I 1，β Because I 1，α It is the "new" element (A) of P0 d The intersection of the "old" (but not expired) elements of P1 and I, and I 1,α It is the "new" element B in P1. d The intersection of A with the universal set A of P0 is such that the union of these two sets is also the intersection A∩B.

[0093] Process 400 can be executed iteratively (e.g., daily) to repeatedly update the sets and PSI. The keys (or multiple keys) used in each iteration can be generated independently, so the OPRF outputs during the SSPSI process can differ even with the same input. In each iteration, P0 learns which old elements of set A are common to newly added elements of set B, but does not learn which updates to set B are common to elements added to the intersection of set A. d P1 matches any new element. P1 learns the corresponding information. Neither side learns A. d ∩B d-t Or B d ∩Ad-t (That is, none of the parties will learn the intersection of elements removed from either set and elements added to either set.)

[0094] It should be understood that process 400 is illustrative and subject to change and modification. Operations or blocks described in sequence can be executed in parallel, and the order of operations can be changed within the limits of logic. Alternative PSI procedures, allowing one party to determine the PSI, can be used instead. Figure 3 The sender streaming PSI process 300. Iterations can be performed at any desired frequency, depending on the useful frequency for determining the updated PSI. For example, in contact tracing applications, daily updates may be appropriate. In other applications, updates may occur at shorter intervals (e.g., hourly) or longer intervals (e.g., weekly, monthly) or arbitrary intervals, such as when either party adds N to its set. d It occurs when an element is encountered or at the request of either party. In the case of intermittent contact between the parties, the iteration interval can be a variable amount of time (e.g., all updates since the last update of the intersection).

[0095] As mentioned above, dummy values ​​can be used to populate the updated set to a fixed size, so that neither party knows how many elements are actually added to the other's set during each iteration. Dummy values ​​can be random numbers, and a range of values ​​can be chosen such that the probability of false positives is negligible. Alternatively, dummy values ​​can be omitted if desired, which would allow one party to learn how many elements to add to the other's set on a given day, but would prevent false positives due to dummy elements.

[0096] In some embodiments, it may be useful to keep elements in the set for a longer period than the duration t. For example, in the case of contact tracing, P0 (or P1) may encounter the same contact over multiple days. Longer-term retention of elements in the set can be managed, for example, by adding the same contact to P0's set each day the contact is encountered. Other techniques may also be used.

[0097] Similar to process 200, process 400 offers improved computational and communication efficiency compared to conventional techniques, where PSI is performed across the entire set of both sets whenever an update is required. In some embodiments, the computation time and communication cost of each process 400 are adjusted to O(N). d ·t).

[0098] In the example described above, both parties can determine the updated intersection at each iteration. In some embodiments, it may be desirable for only one party to determine the intersection. For example, in some client-server applications, the server may maintain a large private set, and the client may determine the intersection of its (typically smaller) private set with the server's private set. To facilitate comparisons over large sets, the first party P1 (e.g., the server) may provide an encrypted database that it can update without regenerating the entire database. The database may have a tree structure, which the first party can update using techniques that do not provide information about the original content. The second party P0 (e.g., the client) may inadvertently search the encrypted database for matches with its private set. Additive homomorphic encryption protocols may be used.

[0099] In some embodiments, a one-sided updatable PSI protocol can be implemented using fully homomorphic encryption (“FHE”). For example, P1 can use the FHE algorithm to encrypt set B using secret key sk1, and can enc sk1 (B) Provided to P0. P0 can store Enc. sk1 (B) and Enc can be homomorphically computed using set A without knowing sk1. sk1 (A∩B). Then, both parties can run a secure two-way computation (2PC) protocol, where the input of P0 is Enc. sk1 (A∩B), and the input of P1 is the secret key sk1, from which P0 can learn the output A∩B. When by adding set A d When updating set A and updating set B by adding set B, P1 can do so by setting Enc sk1 (B d Sending A to P0 to update the encrypted database, and P0 can learn A d ∩(B∪B d Communication with N d The number of elements added increases with the number of elements in set B. However, the homomorphic computation of P0 increases with N (the total number of elements in set B). Furthermore, the FHE algorithm can be computationally expensive.

[0100] In some embodiments, additional efficiency gains can be achieved. For example, a tree structure can be used to maintain P1's database, where in any given update cycle, P1 updates only one level of the tree, and P0 updates queries only on one path in the tree. The computational cost (amortized through the update cycle) grows with the depth of the tree, which can be logarithmic rather than linear to N. For the 2PC protocol, further efficiency gains are achieved by using additive homomorphic encryption ("AHE") instead of FHE.

[0101] When updating the set by simply adding elements, in order to learn the intersection of updates I for each day d... d P0 only needs to learn to update set I update =I d \I d-1 Similar to the example described above, I update It can be divided into two disjoint sets I′ A，old =A old ∩B d and I′ A，new =A d ∩B [d] P0 can learn I′ using a protocol similar to that of process 200. A，old To learn I' A，new P0 can use the update tree provided by P1 and can query a relatively small set of elements in the update tree that may contain new elements matching the elements added to set A. In a one-sided protocol, it is assumed that P1 does not learn A. d ∩B old Furthermore, the tree structure can represent all elements of set B.

[0102] A binary tree structure can be implemented as follows. Initially, the tree can be empty. Each node in the tree has a maximum capacity of O(σ), where σ can be based on the number of elements N added in a given day. d To select. In some embodiments, N d =σ and the node capacity is 4σ. Each day, when a new element is added to P1's set, P1 inserts the new element into the tree. First, the new element can be inserted into the root (or first) node of the tree. When the root reaches its maximum capacity, P1 pushes the elements in the root along with the new element to the second level of the tree (which has two nodes). If the second level has any complete nodes, P1 pushes all elements down to the third level (which has four nodes). The process can continue: if the first L levels of the tree contain any complete nodes, P1 pushes all elements from the first L levels along with the new element to level (L+1) of the tree and clears the first L levels. For a given level, the element y is placed in a (pseudo)random node of that level, determined by the output of the hash function H2(y).

[0103] To make P0 ignore update process data, P1 can modify its behavior so that it does not push elements to the next level when a node is completely full. Instead, P1 can perform the push operation in a predetermined manner, which depends only on the size of P1's set (which is public to P0), and for the set size, the probability of any node reaching full capacity is negligible. Figure 5An example of a tree update process according to some embodiments is shown. Tree 500 shows the state of the binary tree before the update on day d = 20. White nodes are empty, and gray nodes are non-empty. Therefore, root node 501 and level 1 nodes 511-1, 511-2 contain elements. The next two levels are empty, but level 4 nodes 541-1 to 541-16 contain elements. Updated tree 500' shows the state of the binary tree after the update on day d = 20. All elements from root node 501 have been pushed to level 1 nodes 511-1 and 511-2, and then all elements from level 1 nodes 511-1 and 511-2 have been pushed to the previously empty level 2 nodes 521-1 to 521-4, and no further pushing is required. Elements remain in level 4 nodes 541-1 to 541-16.

[0104] In such Figure 5 After updating the tree structure as shown, P0 can use virtual elements to populate each updated node to its maximum capacity, and then send the updated node to P0 in encrypted form. P0 can use the encrypted tree structure in the updatable PSI protocol. For example, for each x∈A d P0 can locate root-to-leaf paths that may contain x, for example, by computing H2(x) for each level with at least one occupying node. Using additive homomorphic encryption, and with the help of P1, P0 can learn whether any node in the path contains x without learning any other information and without leaking x to P1.

[0105] Figure 6 and 7A -7C illustrates a flowchart of a process for implementing a one-sided updatable PSI process using a cryptographic tree structure according to some embodiments. Figure 6 Figure 600 illustrates an initialization process that can be executed once to prepare the initial set. Figure 7 illustrates an update process 700 that can be executed for each update cycle. Processes 600 and 700 can be implemented in a pair of appropriately configured computer systems (or in different processes within the same computer system that do not share data access).

[0106] refer to Figure 6 Initialization process 600 includes the initialization of parameters that will be used in process 700. For example, at box 602, P1 can initialize the tree structure that will be used to represent set B of P1. Tree structure Can be derived from a set The binary tree is composed of a subtree whose index i represents the level and j represents the node at level i. The number of levels i can be as large as needed (in other words, the range of i can include all non-negative integers), and each level i has 2... iThe number of nodes (in other words, for level i, the range of j can be {0, 1, ..., 2}) i-1 Initially, the tree structure was empty, and each It can be initialized to an empty set. P1 can also initialize the parameter maxL, which represents the current depth of the tree, to zero. P1 can also initialize the update loop counter d to zero and the secondary loop counter d * Initialize to 1.

[0107] At box 604, P0 can store the residual subset A. old (The elements of set A that are not in the intersection A∩B) are initialized to an empty set. P0 can also initialize the hash set H. A Initialize to an empty set. It is obvious that the hash set H... A It can be a hash set H similar to that in the above embodiments. A To define. P0 can also define the intersection I. d＝0 Initializes to an empty set. P0 can also initialize an encrypted tree structure. It is used to store the encrypted tree structure provided by P1. (Compared to) the (unencrypted) tree structure. Similarly, encrypted tree structure It can consist of several sets (nodes) Each set (node) is initialized to an empty set. P0 can also initialize the parameter maxL (which represents the current depth of the tree) to zero. P0 can also initialize the update loop counter d to zero and the secondary loop counter d * Initialize to 1. (Other values ​​can be used, as long as P0 and P1 agree on the current value of d.)

[0108] At box 606, P0 can generate the exponentiation key k0, and at box 608, P1 can generate the exponentiation key k1. The exponentiation keys can be similar to or the same as the exponentiation keys generated in process 200 described above. Each party may consider its exponentiation key a secret.

[0109] At box 610, P0 can generate a key pair (pk0, sk0) for an additive homomorphic public-key encryption scheme, where pk0 is the public key and sk0 is the corresponding secret (private) key. At box 612, P1 can generate a key pair (pk1, sk1) for an additive homomorphic public-key encryption scheme, where pk1 is the public key and sk1 is the corresponding secret (private) key. Any AHE scheme can be used, provided that P0 and P1 use the same scheme (with different key pairs). At boxes 614 and 616, P0 and P1 can exchange public keys. At this point, P0 and P1 are ready to begin using... Figures 7A-7C The process of updating its set is 700.

[0110] refer to Figure 7A Each party adds a number N d =σ elements to update its set daily (or every update cycle of arbitrary length). Therefore, for day d, at box 702, P0 can increment its update cycle counter d (e.g., by incrementing by 1), and can add a new subset A. d (Sometimes also represented as A) new Add it to its private set A. Similarly, at box 704, P1 can increment its update loop counter d (e.g., by incrementing by 1), and can add set B. d Add it to its private collection B. In some embodiments, the number of elements added to either collection may be less than N. d =σ, and either party can use virtual elements (similar to the virtual elements mentioned above) to hide the number of added elements.

[0111] In boxes 706-716, P0 can learn A using a technique similar to the PSI process described above. old ∩B d For example, at box 706, P1 can compute the hash set H1(B). d ) k1 Similar to box 210 in process 200 ( Figure 2A That is, for set B d For each element in the set, apply a hash function and raise the result to the power of k1. At box 708, P1 can hash the set H1(B) to... d ) k1 Send to P0. At box 710, P0 can receive the hash set H1(B) d ) k1 At box 712, P0 can be achieved by converting H1(B) d ) k1 The hash set H1(B) is calculated by raising each element to the power of k0. d ) k1k0 At box 714, P0 can hash set H1(B) d ) k1k0 Its "old" hash set H A Compare them. Note that in the first iteration, H... A It can be an empty set, and elements can be added to H at the end of each update cycle. A As described below. At box 716, P0 can determine a partial intersection I. A，old =A old ∩B d .

[0112] refer to Figure 7BIn boxes 720-756, P0 can use the cryptographic tree structure provided by P1 to learn A. new ∩B (wherein) At box 720, P1 can update its tree structure. Encrypt the updated tree structure and then store the encrypted tree structure. (or its updates) are sent to P0, and P0 can update its (stored) encrypted tree structure at box 728. Figure 8 A flowchart is shown of a process 800 that can be used to update a tree structure according to some embodiments. Process 800 can be applied at blocks 720 and 728.

[0113] At boxes 802 and 804, each party can set the hierarchy counter maxL. d Set to zero. At boxes 806 and 808, use the loop counter t input to process the loop, where t∈{d} * d * +1,..,(d * +N d / σ-1}, at boxes 806 and 808, each party can choose the next value of t. At boxes 810 and 812, each party can determine the number of levels L corresponding to the loop counter t. For example, a function LS1(d) can be defined that returns the least significant bit 1 in the binary representation of d. In other words, if Then LS1(n):=min{i:b i =1{. For example, LS1(7) = 0 and LS1(12) = 2. At boxes 810 and 812, each party can set L = LS1(d), maxL = max{L, maxL} and maxL d =max{L,maxL d}

[0114] At points 814-822, P1 can update the tree structure of its loop counter t. For example, P1 can add element B. d The set is divided into disjoint subsets: If B d Including N d If there are elements, then each subset Y i Both can contain σ elements. At box 814, P1 can define a set. At box 816, P1 can reset the nodes of the tree. For example, for each i∈{0,1,...,L} and each j∈{0,1,...,2} i -1}, P1 can set a set (empty set).

[0115] At box 818, P1 can assign each element b∈S t Nodes added to the tree. For example, P1 can compute a series of hashes j = H2(b). [1..L] Where H2(·) is a level-specific hash function that can be different from H1(·) used in boxes 706-716. In some embodiments, if element b is added to a node Cause node If its size limit is exceeded (e.g., it could be 4σ), then process 800 aborts. It can be seen that for a size limit of 4σ, any node... The probability of the size exceeding the size limit is negligible, provided that the hash function H2(·) is modeled as a random prophet, such that any element b∈S is equally likely to be placed in any node of level L. (To further reduce the probability, a size limit can be increased, but increasing the size limit will increase the amount of data sent from P1 to P0.) If element b is added to a node... It will not cause nodes If the size exceeds its limit, P1 can add element b to the node. In some embodiments, element b can be added to the node. The end of the elements in the array. Alternatively, a cuckoo hash (as defined above) can be used to store the elements in each node. For example, three hash functions (CuH1, CuH2, CuH3) can be chosen. Each node Each is represented as a set of y block groups. Small bins are also associated with each node. Depending on the contents of block groups CuH1(b), CuH2(b), and CuH3(b), each element b can be inserted into one of the y block groups (or bins) of any given node. Similarly, when a set S is defined in box 814... t And set in box 816 At this point, elements from the storage bin can be used. At box 820, P1 can return to box 808 to continue the loop for the next value of counter t, or end the loop and move forward to box 822.

[0116] At box 822, for each j∈{0,1,...,2} L -1}, P1 can be filled with virtual elements (which can be random elements as described above). To construct a node of size 4σ At box 824, P1 can encrypt the tree. For example, P1 can encrypt each node using the public key pk1. To generate encrypted nodes Among them, EncK (m) represents the asymmetric encryption function that encrypts message m using key K. At box 826, P1 can encrypt the node. Send to P0.

[0117] At box 828, P0 can receive encrypted nodes. At box 830, P0 can update its stored encrypted tree. For example, P0 can first be applied to each i∈{0,1,...,L} and each j∈{0,1,...,2}. i -1 { Clear node Then, for each j∈{0,1,...,2} L -1}, P0 can be set

[0118] Refer again Figure 7B At box 732, P0 can partially intersect I. A，new Initialize to an empty set. At this point, P0 and P1 begin processing the loop (boxes 734-758) to determine which set A will be used. d Which elements are added to the partial intersection I? A，new The processing loop can be driven by P0, where P1 acts as the server. At box 734, P0 can obtain data from set A. d Select the element x to be tested. At box 736, P0 can map element x to the cryptographic tree to which element x is mapped. One or more nodes. For example, for each i ∈ {0, 1, ..., maxL{, P0}, the hash function j = H2(x) can be computed. [1..i] .if If it is empty, then a match has been found. Note that P0 does not have a decryption node. The secret key is sk1. However, encryption does not affect whether the nodes of the tree are empty or not, so P0 can determine whether element x matches an occupied node without knowing any elements in the node.

[0119] Without further information, matching the occupied nodes cannot determine whether element x should be added to the partial intersection I. A，new Therefore, the parties can use an AHE-based protocol to enable P0 to determine whether element x should be added to the partial intersection I. A,new This avoids leaking element x to P1 or elements of P1's set to P0. For example, at box 738, for each matching node found, P0 can compute one or more ciphertext pairs to test element x. For example, nodes matching element x Contains a ciphertext ct corresponding to each element in the set P1 assigned to the node. (Depending on the implementation, there may be any position in the node containing 1 to 4σ ciphertexts.) For each ciphertext... P0 can sample a random value α and calculate ct. α :=Enc pk0 (α), At box 740, the ciphertext pair (ct) of element x can be obtained. α ct β The set C0 is sent to P1.

[0120] At box 742, P1 can receive the ciphertext pair (ct). α ct β The set C0 of ). (See reference) Figure 7C At box 744, for each ciphertext pair (ct) α ct β P1 can calculate the ciphertext ct of the response. r For example, for each ciphertext pair (ct... α ct β P1 can sample random values ​​γ and calculate... In this way, P1 can generate a ciphertext pair (ct) containing each ciphertext pair. α ct β A response ciphertext ct r The set C1. At box 746, P1 can randomly arrange the ciphertext ct in set C1. r The order of the permutations, and at box 748, P1 can send the permutation set C1 to P0.

[0121] At box 750, P0 can receive the permutation set C1. At box 752, for each ciphertext ct in set C1... r P0 can decrypt ct using its private key sk0. r To calculate the residual parameter r. That is, r := Dec sko (ct r Due to the AHE protocol, a result r = 0 indicates a match between element x and elements of set P1, while r ≠ 0 indicates a mismatch. Therefore, at box 754, if box 752 is true for any ct... r If r = 0, then element x is added to the partial intersection I. A，new At box 756, P0 can return to box 734 to process set A. d The next element. As shown in box 758, P1 can return to box 742 to process the additional ciphertext pair that can be received from P0.

[0122] Once set A has been processed according to the processing loop in boxes 734-758... d Once all elements are obtained, the loop can end. At this point, P0 has learned I. A，new Therefore, at box 760, P0 can determine the (cumulative) intersection I. d =I d-1 ∪I A，old ∪I A，new .

[0123] At box 762, P0 can update set A. old and hash set H A Used for the next iteration of process 700. The update process can be similar to or equivalent to the above reference. Figure 2C The process described is shown in boxes 200-250-272.

[0124] Process 700 can be executed iteratively (e.g., daily) to repeatedly update the sets and PSI. Similar to the other processes described above, in each iteration, P0 learns which old elements of set A are common to newly added elements of set B in P1, but does not learn which updates to set B are common to elements added to the intersection of set A. d Any new element matched. P1 does not learn any element of set A from process 700. In some embodiments, if it is desired that P1 also learns the PSI, process 700 can be repeated with the roles of P1 and P0 reversed. Alternatively, after the updated PSI is determined (at box 760), P0 can communicate the updated PSI to P1.

[0125] It should be understood that the unilaterally updatable PSI protocols of processes 600, 700, and 800 are illustrative and subject to change and modification. Operations or blocks described as sequential can be executed in parallel, and their order can be changed within logically permissible limits. Iterations of process 700 can be performed at any desired frequency, depending on the useful frequency for determining the updated PSI. For example, daily updates may be appropriate in contact tracing applications. In other applications, updates may occur at shorter intervals (e.g., hourly), longer intervals (e.g., weekly, monthly), or arbitrary intervals, such as when either party adds N to its set. d It occurs when an element is encountered or at the request of either party. In the case of intermittent contact between the parties, the iteration interval can be a variable amount of time (e.g., all updates since the last update of the intersection).

[0126] As mentioned above, dummy values ​​can be used to populate the updated set to a fixed size, so that neither side knows how many elements are actually added to the other's set during each iteration. Dummy values ​​can be random numbers, and a range of values ​​can be chosen such that the probability of false positives is negligible. Alternatively, dummy values ​​can be omitted if needed, which would allow one side to learn how many elements to add to the other's set on a given day, but would prevent false positives due to dummy variables.

[0127] A different procedure than procedure 800 can be used to update the binary tree. In procedure 800, elements are "pushed" to the next level based on a counter, rather than on whether any node is full. As mentioned above, this prevents information from leaking to P0 based on when a push to the next level occurs.

[0128] Similar to other processes described herein, process 700 offers improved computational and communication efficiency compared to conventional techniques, where PSI is performed across the entire set of both sets whenever an update is required. In some embodiments, computation time and communication costs vary with each iteration, depending on how many nodes in the tree structure are populated. Over a large number of iterations, both amortized computation time and communication costs are adjusted to O(N). d log N).

[0129] It should be noted that process 700 includes a protocol in which one party (P1) inadvertently updates the encrypted database (tree structure) and the other party (P0) may inadvertently search the encrypted database. Those skilled in the art will understand that this technique can be applied to various contexts requiring inadvertent database searches, and is not limited to updatable PSIs.

[0130] In the embodiments described above, party P0 has a set A that is kept secret by party P0, and party P1 has a set B that is kept secret by party P1. Conceptually, when updating the sets by adding elements, in each iteration of the updatable PSI protocol, set A can be understood as including three disjoint subsets: (1) elements that are in A∩B due to previous iterations; (2) “residual” elements that are not in A∩B due to previous iterations (denoted as A∩B). old (3) The newly added element (denoted as A) d Or A new Similarly, set B can be understood as comprising three disjoint subsets: (1) elements that are in A∩B due to previous iterations; (2) “new” elements that are not in A∩B due to previous iterations (denoted as B). old (3) The newly added element (denoted as B) d Or B newThe updatable PSI protocol described herein (e.g., procedure 200 or procedure 700) comprises a first phase and a second phase, in which P0 learns a first partial intersection A. old ∩B new (without learning B) new (any other element), in the second stage, P0 learns the second part of the intersection A. new ∩(B new ∪B old (and not learning A) new ∩B new Or A new ∩B old The first phase may include P1 providing P0 with the newly added element B. new The encrypted representation, P0 can combine the encrypted representation with the old element A old The corresponding encrypted representations are compared to identify a match. In a bilateral process, such as process 200, the second phase may include P0 providing P1 with the newly added element A. new The encrypted representation, P1 can combine the encrypted representation with the old element B old The corresponding encrypted representations are compared to determine A. new ∩B old Then, P1 can construct a system that includes the new element B. new And A new ∩B old The set B′ of (and optionally virtual elements) a and set B′ d The encrypted representation is sent to P0. P0 can use the encrypted representation to determine A. new ∩(B new ∪B old Then, P0 can update A∩B based on the partial intersection learned in the first and second stages. The efficiency gain can be achieved through the iterative nature of the process, which eliminates the need to consider elements known in A∩B and to determine A through P1. new ∩B old The information is used to reduce the amount of B encrypted by P1 and sent to P0 in the second phase. old The number of elements. In a one-sided process, such as process 700, the second phase may include P1 providing a set B (including the new element B) in a data structure such as a binary tree. d and residual element B old The cryptographic representation of ) facilitates P0 to efficiently identify A that may match elements of set B. new Candidate elements; P0 and P1 can perform a secure 2PC procedure so that P1 can determine A. new Given a candidate element, does it have a matching element in B, while P1 does not learn A?new Any element of B or P0 is not an element of B in the intersection with set A.

[0131] When updates to sets A and B include weak deletions as described above, the possibility of deleting elements from A∩B can be considered using a process such as process 400 described above. Therefore, the intersection can be recalculated on each update, instead of iteratively updating A∩B. The computation is divided into a first phase and a second phase. In the first phase, P0 learns the partial intersection of its elements with the newly added elements in set P1 from previous updates (excluding deleted elements). In the second phase, P0 learns the partial intersection of its newly added elements with all elements in the current set P1.

[0132] Private sets A and B may include data values ​​representing any type of information that one or both parties may wish to compare to identify overlaps. An example will now be described.

[0133] In the first example use case, the Web Service Provider (“WSP”) may have a list of commercial websites maintained by the merchants and accessed by users (or users within certain user groups). The Financial Service Provider (“FSP”) may have a list of financial transactions executed by users (or user groups) with various merchants. The WSP may want to know which websites users transact with, or the FSP may want to know which user transactions correspond to websites accessed by the user. This information is expected to evolve over time as users access additional websites and / or conduct additional transactions. In some embodiments, both parties may perform a bidirectional, updatable PSI process (e.g., as referenced above). Figure 2A-2C The process described is 200, which allows both parties to update their PSI more efficiently. One party (e.g., WSP) can act as P0, having a set A corresponding to a list of business websites; the other party (e.g., FSP) can act as P1, having a set B corresponding to a list of transactions. Since process 200 allows both parties to learn their intersection, either party can act as P0 or P1. In this way, the WSP only learns financial transactions associated with websites on its list, while the FSP only learns the websites where users conduct financial transactions. Similarly, two financial institutions can use an updatable PSI to periodically compare their lists of account holders to determine overlaps.

[0134] In the second example use case, a user can maintain a list of passwords associated with various web-based accounts. The security service provider can maintain a list of passwords known to have been compromised (e.g., based on reported vulnerabilities in various web-based systems). Users may want to learn whether any of their passwords have been compromised without learning any additional information, and users may want to avoid disclosing any passwords to the security service in the process. This information is expected to evolve over time. On the user's side, the user can create additional accounts. On the service provider's side, additional security vulnerabilities may be discovered, leading to other vulnerabilities beyond the compromised password list. In some embodiments, a one-way updatable PSI process (e.g., ...) can be used. Figures 7A-7C The process is described in section 700. The user (or the user's device) can act as P0, where set A corresponds to the password list. The security service provider can act as P1, where set B corresponds to the list of cracked passwords. In this way, the user can learn which of their passwords (if any) have been cracked, without the security service learning any of the user's passwords or the user learning anything other than the cracked passwords.

[0135] In the third example use case, the user can have a list of contacts, and the service provider can have a list of subscribers to the service. (As used herein, a “subscriber” can be anyone who maintains an account or other record with the service provider, and is not limited to paid subscribers.) The user and / or service provider may need to learn whether any of the user’s contacts are also subscribers to the service. This information is expected to evolve over time as the user builds more contacts and new users sign up for the service. In some embodiments, a one-way updatable PSI process (e.g., Figures 7A-7C The process 700 allows users to learn whether their contacts are subscribers of the service without the service provider learning any information about the user's contacts. The user (or the user's device) can act as P0, where set A corresponds to the user's contact list. The service provider can act as P1, where set B corresponds to the subscriber list. In this way, a user can learn whether any of their contacts are subscribers of the service without the service learning any of the user's contacts and without the user learning subscribers not in their contacts. In other embodiments, a bidirectional updatable PSI process (e.g., ...) can be used. Figure 2A-2CThe process 200 allows both the user and the service provider to learn whether any of the user's contacts are also subscribers of the service. For example, the user (or the user's device) can be P0, where set A corresponds to the user's list of contacts. The service provider can be P1, where set B corresponds to the subscriber list. In this way, both parties can learn whether any of the user's contacts are also subscribers of the service without the user needing to learn any other subscribers, and without the service provider needing to learn any contacts of the user who are not subscribers.

[0136] In the fourth example use case, public health services may have a list of individuals diagnosed with an infectious disease. Individual users can have a list of individuals they have been in contact with during the relevant incubation period of the infectious disease (e.g., 14 days, 5 days, or some other cycle). In some embodiments, for contact tracing purposes, individuals can be anonymously represented using a random coding scheme. For example, a user device can periodically send random codes that can be detected and stored by other nearby user devices. (Information such as date, time, and location can also be stored with each received code to eliminate ambiguity.) If an individual is diagnosed with an infectious disease, the random code sent by their device during the incubation period can be entered into an infected person list. Contact between the user and an infected person can be detected by comparing the random code stored on the user device with the random codes in the infected person list. Users may want to know if they have been in contact with a diagnosed person. As users encounter different people, previous encounters are traced back to past associations with the likelihood of infection, and this information is expected to evolve over time as more people are diagnosed with the infectious disease. In some embodiments, an updatable PSI process with weak deletion (e.g., Figure 4A and 4B The process (400) allows users (and public health services) to learn whether a user has been in contact with any infected individuals. For example, the user (or the user's device) can act as P0, where set A corresponds to the user's list of contacts. The public health service can act as P1, where set B corresponds to the list of infected individuals. In this way, the user and / or the public health service can learn whether the user has been in contact with an infected individual without the user learning any information about other infected individuals, and without the public health service learning about the user's uninfected contacts.

[0137] While the foregoing description refers to specific embodiments, those skilled in the art will understand that the description is not exhaustive of all embodiments. Many variations and modifications are possible. The semantics of the elements of various sets are not limited to any particular example. For example, elements of a set may represent individuals, device identifiers, financial account information (e.g., account numbers), transaction information, location data, etc., and the intersection of private sets may be determined by or on behalf of an individual, financial institution, school, government agency, or other organization. The techniques described herein can be applied in any context where parties wish to determine and update the intersection of two (or more) sets without disclosing elements not present in the intersection. It should also be understood that embodiments are not limited to actions performed by or on behalf of individuals; parties may be any system or service for which shared identification data or events may be of interest. The protocols described herein assume that parties P0 and P1 are at least semi-honest, and that neither party retains or applies information received from the other party except as specified in the protocol. The embodiments can also be extended to the intersection of two or more sets, since either party knowing A∩B can use the updatable PSI technique described herein to determine (A∩B)∩C. For example, a party that learns A∩B via an updatable PSI protocol and a party that knows C can use A∩B as their private set to perform the updatable PSI protocol to determine (A∩B)∩C.

[0138] The techniques described herein can be implemented through appropriate programming of a general-purpose computer. In some embodiments, the computer system includes a single computer device, wherein a subsystem may be a component of the computer device. The computer device can have various form factors, including, for example, a smartphone, tablet, laptop, desktop computer, etc. In other embodiments, the computer system may include multiple computer devices, each of which is a subsystem with internal components. As described above, the updatable PSI technique can reduce the computational load on a computer system in any environment where the computer system needs to determine the intersection of a first set of data held by the computer system and a second set of data held by different computer systems, without learning elements of the second set that are not in the intersection; this can improve the efficiency of the computer system.

[0139] A computer system may include multiple components or subsystems connected together, for example, by external interfaces or internal interfaces. In some implementations, the computer system, subsystem, or device may communicate via a network. In such cases, one computer may be considered a client, and another computer may be considered a server, where each computer may be part of the same computer system. The client and server may each include multiple systems, subsystems, or components.

[0140] It should be understood that any embodiment of the present invention can be implemented using hardware (e.g., application-specific integrated circuits or field-programmable gate arrays) and / or computer software in the form of control logic, wherein the general-purpose programmable processor is modular or integrated. As used herein, the processor includes a single-core processor, a multi-core processor on the same integrated chip, or multiple processing units on a single circuit board or networked thereon. Based on this disclosure and the teachings provided herein, those skilled in the art will know and understand other ways and / or methods of implementing embodiments of the present invention using hardware and combinations of hardware and software.

[0141] Any software component or function described in this application may be implemented as software code executed by a processor using any suitable computer language such as Java, C, C++, C#, Objective-C, Rust, Golang, Swift, or a scripting language such as Perl or Python, employing techniques such as conventional or object-oriented methods. The software code may be stored as a series of instructions or commands on a computer-readable medium for storage and / or transmission. Suitable media include random access memory (RAM), read-only memory (ROM), magnetic media (e.g., hard disk drives or floppy disks), or optical media (e.g., optical discs (CDs or digital versatile optical discs (DVDs)), flash memory, etc. The computer-readable storage medium may be any combination of such storage devices or other storage devices capable of retaining the stored data.

[0142] Such programs can also be encoded and transmitted using carrier signals suitable for transmission over wired, optical, and / or wireless networks conforming to various protocols, including the Internet. Therefore, a computer-readable transmission medium according to an embodiment of the invention can be created using data signals encoded with such programs. Computer-readable media encoded with program code can be packaged with a compatible device or provided separately from other devices (e.g., downloaded via the Internet). Any such computer-readable medium can reside on or within a single computer product (e.g., a hard disk drive, CD, or an entire computer system) and can exist on or within different computer products within a system or network. The computer system may include a monitor, printer, or other suitable display for providing any results mentioned herein to a user.

[0143] Any method described herein can be performed, wholly or in part, by a computer system including one or more processors configured to perform these steps. Therefore, embodiments may involve computer systems configured to perform steps of any method described herein, possibly having different components that perform corresponding steps or groups of corresponding steps. Although presented as numbered steps, the method steps herein may also be performed simultaneously or in different orders. Furthermore, portions of these steps may be used in conjunction with portions of other steps from other methods. Similarly, all or part of a step may be optional. Additionally, any step of any method may be performed using modules, circuits, or other means for performing these steps.

[0144] Specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of the embodiments of the invention. However, other embodiments of the invention may relate to specific embodiments associated with each individual aspect, or specific combinations of these individual aspects.

[0145] Unless explicitly indicated otherwise, the use of “one” or “the” is intended to mean “one or more”. The use of “or” is intended to mean “inclusive or” rather than “exclusive or” unless explicitly indicated otherwise.

[0146] All patents, patent applications, publications, and descriptions mentioned herein are incorporated herein by reference in their entirety for all purposes. This does not imply an admission that they are prior art.

[0147] The above description is illustrative and not restrictive. Many variations of the invention will become apparent to those skilled in the art upon reading this disclosure. Therefore, the scope of patent protection should not be determined by reference to the above description, but rather by reference to the appended claims and their full scope or equivalents.

Claims

1. A method for computing the intersection of private sets, the method comprising: a first computer system: Define a first set that is private to the first computer system ( The first set A includes a second set that is not private to the second computer system. The intersection of ) The first residual subset of elements in ) The second set Including those not in the intersection The second residual subset of elements in ); By adding a first new subset with one or more new elements ( To update the first set ; Based on the first communication process with the second computer system, the first residual subset is determined. With those already added to the second set A second new subset of one or more new elements The first part of the intersection ( The first computer system learns only the second new subset. The intersection in the first part Elements in; Receive the first encrypted set from the second computer system ( The first encrypted set includes representations of the second new subset. The encrypted elements and the second residual subset At least some of the elements; Based on the second communication process with the second computer system, the first new subset is determined. With the first encrypted set The second part of the intersection ( The first computer system learns only the first encryption set. The intersection in the second part The elements mentioned above; Based on the first part of the intersection Intersection with the second part Update the intersection ; as well as Update the first residual subset based on the updated intersection. .

2. The method of claim 1, wherein updating the first set is performed iteratively for each of a plurality of consecutive update cycles. Receive a first encrypted data set, determine the first partial intersection, receive the first encrypted set, determine the second partial intersection, and update the intersection. And the operation of updating the first residual subset.

3. The method of claim 1, wherein the first partial intersection is determined. include: Receive from the second computer system an array representing the second new subset. The second encrypted set of encrypted elements; as well as Using the first encrypted data set and the first residual subset The corresponding encrypted representation is used to determine the first part of the intersection. .

4. The method of claim 3, wherein the hash function is applied to the second new subset. Each of the elements and each result of applying the hash function is raised to a power that is confidential to the second computer system. (to generate the second encrypted set) 5. The method of claim 4, wherein the first partial intersection is determined. include: Apply the hash function to the first new subset. Each of the elements; Each result of applying the hash function is raised to a power that is kept secret from the first computer system. This results in a third encrypted set; Send the third encrypted set to the second computer system; Receive a first working set from the second computer system, the first working set including the power raised to a value confidential to the second computer system. Each element of the third encrypted set; Raise each element of the second encryption set to the power that is kept secret from the first computer system. This results in a second set of work; as well as Compare the elements of the first working set with the elements of the second working set.

6. The method according to claim 1, further comprising: Generate a representation of the first new subset. The second encrypted set of elements; and Send the second encrypted set to the second computer system. The second computer system uses the second encryption set to generate the first encryption set. .

7. The method of claim 6, wherein the first encryption set Including the second new subset With the first new subset and the second residual subset The intersection ( The union of ).

8. The method of claim 7, wherein the first encryption set It also includes one or more virtual elements, such that the first encrypted set Its size is fixed.

9. The method according to claim 1, wherein the first encryption set It is received as a binary tree structure, the binary tree structure including the second new subset. and the second residual subset The encrypted element of the element.

10. The method of claim 1, wherein the first partial intersection is used as the basis for the method. Intersection with the second part Update the intersection include: Define the update set ( ),in ; as well as Determine the updated intersection .

11. The method of claim 10, further comprising: Update the set It is sent to the second computer system.

12. The method of claim 1, wherein the second communication process with the second computer system comprises: The receiving pair represents the second set. The updated set of the encrypted tree structure.

13. The method of claim 1, wherein the elements of the first set represent individual contacts, and wherein the elements of the second set represent service subscribers.

14. The method of claim 1, wherein the elements of the first set represent websites visited by the user, and wherein the elements of the second set represent the user's financial transactions.

15. The method of claim 1, wherein the elements of the first set represent account holders at a first financial institution, and the elements of the second set represent account holders at a second financial institution.

16. A first computer system, comprising: A communication interface configured to communicate with a second computer system; Memory, the memory being used to store a first set private to the first computer system ( );as well as A processor coupled to the memory and configured to perform the method according to any one of claims 1 to 15.

17. A computer-readable storage medium storing program code instructions that, when executed by a processor of a first computer system, cause the first computer system to perform the method according to any one of claims 1 to 15.

18. A method for computing the intersection of private sets, the method comprising: a first computer system: Define a first set that is private to the first computer system ( The first set A includes a second set that is not private to the second computer system. The intersection of ) The first residual subset of elements in ) The second set Including those not in the intersection The second residual subset of elements in ); By adding one or more new elements ( The first new subset of ) To update the first set ; Receive from the second computer system an representation of the second set A binary tree structure, wherein the second set is hashed based on a hash function. Each element is assigned to a node in the binary tree structure, and the binary tree structure is encrypted such that the second set Each element is represented by ciphertext in the allocation node; Process the first new subset Each new element Each new element is processed. include: Regarding the new element Identify the corresponding nodes of the binary tree structure; If the corresponding node is not empty, the new element is determined using the ciphertext in the corresponding node and the two-way computation protocol with the second computer system. Does it match the set assigned to the corresponding node? any element; and In the new element The set of matching and assignment to the corresponding nodes In the case of elements, the new element Add to the first part of the intersection ( );as well as Using the first part of the intersection Update the intersection .

19. The method of claim 18, wherein updating the first set is performed iteratively for each of a plurality of consecutive update cycles. Receive the binary tree structure and process the addition of the set. Each new element and using the first part of the intersection Update the intersection The operation.

20. The method of claim 18, further comprising: Receives a first encrypted data set from the second computer system, the first encrypted data set representing data that has been added to the second set. A second new subset of one or more elements ( ); Using the first encrypted data set and the first residual subset The corresponding encrypted representation is used to determine the first residual subset. With the second new subset The second part of the intersection ( );as well as Use the second part of the intersection and the first part of the intersection Update the intersection .

21. The method of claim 20, wherein updating the first set is performed iteratively for each of a plurality of consecutive update cycles. Receive the binary tree structure and process the addition of the set. Each new element Receive the first encrypted data set and determine the intersection of the second part. and using the intersection of the second part and the first part of the intersection Update the intersection The operation.

22. The method of claim 18, wherein the new element is... The corresponding nodes identifying the binary tree structure include each level of the binary tree structure: Calculate the new element Hierarchical specific hash functions; and The corresponding node of the binary tree structure is identified based on the level-specific hash function.

23. The method of claim 18, wherein the determination of the new element is performed in conjunction with the second computer system. Does it match the set in the corresponding node? The two-party computation protocol for any element is a secure two-party computation protocol using additive homomorphic encryption.

24. The method of claim 18, wherein the first computer system is a client and the second computer system is a server.

25. The method of claim 24, wherein the first set The elements represent the user's contacts, and the second set therein... The element represents a subscriber to the service.

26. The method of claim 24, wherein the first set The elements represent the user's password, and the second set The element in the text represents a password that has been cracked.

27. A first computer system, comprising: A communication interface configured to communicate with a second computer system; Memory, the memory being used to store a first set private to the first computer system ( );as well as A processor coupled to the memory and configured to perform the method according to any one of claims 18 to 26.

28. A computer-readable storage medium storing program code instructions that, when executed by a processor of a first computer system, cause the first computer system to perform the method according to any one of claims 18 to 26.

29. A method for computing the intersection of private sets, the method comprising: a first computer system: Define a first set that is private to the first computer system ( ); By adding a first new subset with one or more new elements ( To update the first set ; Update indicates the first set A binary tree structure, where the second set is hashed based on a hash function. Each element is assigned to a node in the binary tree structure; Encrypt the binary tree structure so that the second set Each element is represented by ciphertext in the allocation node; An encrypted binary tree structure is sent to a second computer system, wherein the second computer system has a second set A that is private to the second computer system; as well as Participating in a secure two-party computation protocol with the second computer system, the secure two-party computation protocol enabling the second computer system to determine the first set. Which elements are in the second set? The second new subset ( The intersection of ) )middle.

30. The method of claim 29, further comprising: Generate the corresponding first new subset The set of encrypted elements of the aforementioned elements; as well as The set of encrypted elements is sent to the second computer system so that the second computer system can determine the first new subset. With the second set The residual subset ( The intersection of ).

31. The method of claim 29, wherein updating the first set is performed iteratively for each of a plurality of consecutive update cycles. The operations include updating the binary tree structure, encrypting the binary tree structure, sending the encrypted binary tree structure, and participating in the secure two-party computation protocol.

32. The method of claim 31, wherein updating the binary tree structure comprises: Determine the current iteration count; as well as Based on the current iteration count, determine whether to push all elements of the binary tree structure to the next level of the binary tree structure.

33. The method of claim 29, wherein encrypting the binary tree structure is performed using an additive homomorphic encryption scheme, and wherein the secure two-party computation protocol uses additive homomorphic encryption.

34. The method of claim 29, wherein the first computer system is a server and the second computer system is a client.

35. The method of claim 29, wherein the second set The elements represent the user's contacts, and the first set is described above. The element represents a subscriber to the service.

36. The method of claim 29, wherein the second set The elements represent the user's password, and the first set The element in the text represents a password that has been cracked.

37. A first computer system, comprising: A communication interface configured to communicate with a second computer system; Memory, the memory being used to store a first set private to the first computer system ( );as well as A processor coupled to the memory and configured to perform the method according to any one of claims 29 to 36.

38. A computer-readable storage medium storing program code instructions that, when executed by a processor of a first computer system, cause the first computer system to perform the method according to any one of claims 29 to 36.

Images