A labeled privacy set intersection method with information protection enhancement

Abstract

The application discloses a label privacy set intersection method with enhanced information protection, and relates to the technical field of privacy calculation. The method is initiated by a data demander and is executed together with a data and label holder. The method comprises the following steps: the two parties adopt an inverse Diffie-Hellman key agreement protocol variant on an elliptic curve, add a data disordering operation, and obtain matching data indexes after anonymization; the data demander adopts an inverse process of the disordering operation to restore original data indexes of the intersection set; the two parties execute an inadvertent transmission protocol, and the data demander obtains labels corresponding to intersection data. The method can screen data label information meeting certain characteristics without leaking any data participating in the intersection to the participants, and can maintain the privacy of data other than the labels.

Description

Technical Field

[0001] This invention relates to the field of privacy computing, and more particularly to a method for finding the intersection of labeled privacy sets with enhanced information protection. Background Technology

[0002] The explosive growth of data has brought convenience to the internet industry, but it has also brought the risk of data privacy breaches. Private Set Intersection (PSI) technology aims to solve the privacy problem in the process of two data holders finding common data. Its function is to allow the participants in a protocol to calculate the intersection between their respective data sets, while ensuring the privacy of data outside the intersection. PSI technology is widely used in scenarios such as private contact discovery, federated learning data alignment, and advertising conversion rate analysis.

[0003] Traditional privacy set intersection techniques can only find the intersection of data within the same dimension, without considering other usable features of the intersection data. Labeled Privacy Set Intersection (LPSI) provides a new function: the labeled data holder has a tuple consisting of data and labels, while the data requester only has unlabeled data. The protocol allows the data requester to obtain the data-label tuples from the intersection, where the intersection is determined by the unlabeled data.

[0004] LPSI, proposed by Chen et al. in 2018, has been applied in fields such as biometrics and malicious content detection. However, in these applications, the data requester only needs to obtain the labels; the intersection data (i.e., unlabeled data) is unnecessary. Intersection data constitutes additional information leakage and can pose privacy risks in some cases (for example, Apple's image detection system can use this intersection data to create a backdoor to obtain arbitrary images from users, which is a major reason why some LPSI systems are difficult to deploy in practice). Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing LPSI technology by providing a method for finding intersections of labeled privacy sets with enhanced information protection.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] A first aspect of this invention provides a method for finding the intersection of labeled privacy sets with enhanced information protection, comprising the following steps:

[0008] (1) According to the privacy set intersection protocol variant of Diffie-Hellman key negotiation, the data requester generates random permutation π locally and sends it back to the tag data holder after scrambling the intermediate data of the tag data holder.

[0009] (2) The data demander uses the full permutation information π to perform the reverse process of disordered index information after the label data holder has processed it, and obtains the original index corresponding to the intersection element;

[0010] (3) Using the unintentional transmission protocol, the data requester obtains the label corresponding to the intersection data based on the index obtained in step (2).

[0011] Further, step (1) includes the following sub-steps:

[0012] (1.1) The data requester and the tagged data holder preprocess their respective original datasets X and Y, with the tagged data holder only processing the intersection data x. i ∈X to obtain H(x) i The result H(x) is obtained. i Multiplying the local private key α by α gives αH(x) i ), αH(x i Send the data to the data requester; the data requester processes the data. j ∈Y multiplied by the local private key k yields kH(y) j ), and kH(y j Place it in the Bloom filter BF;

[0013] (1.2) The data requester generates a full permutation π based on the amount of data received in step (1.2), and then applies the αH(x) received in step (1.2) to the permutation π. i ) Randomized order yields αH(x) π(i) Multiplying by one's own private key yields kαH(x) π(i) ), and kαH(x π(i) The Bloom filter (BF) generated in step (1.2) is sent to the tag holder together with the Bloom filter (BF) generated in step (1.2).

[0014] (1.3) The tag holder receives kαH(x) in step (1.2). π(i) ) x-coordinate, then reconstruct the y-coordinate and calculate kH(x) π(i) )=α -1 kαH(x π(i) ), which is the result of key negotiation after the key is out of order.

[0015] Furthermore, in step (1.1), the data requester and the tagged data holder respectively preprocess their original data sets X and Y, including:

[0016] Map the original input to the elliptic curve group E(F) p For each element s in a data set S: iThe hash is broken down using the secure hash function SHA-256 and mapped to the field F using a modulo-p operation. p In the middle, the result is denoted as x. i Use Euler's criterion to determine x i Can it be the x-coordinate of an elliptic curve? If so, it indicates the existence of a corresponding y-coordinate. i Make (x) i ,y i The equation of the elliptic curve is satisfied, and the elliptic curve point H(s) is output. i )=(x i ,y i If not, for x i Increment by 1 and repeat the Euler criterion until a point on the curve is returned, or until the preset attempt limit is reached and the curve fails.

[0017] Furthermore, step (2) includes the following sub-steps:

[0018] (2.1) The disordered data kαH(x) received in step (1.2) π(i) The tag data holder multiplies the private key inverse α. -1 We obtain kH(x) π(i) Based on the Bloom filter BF from step (1.2), find all cases that satisfy kH(x) π(i) The index π(i) of ∈ BF is sent to the data requester;

[0019] (2.2) Based on the disordered index π(i) obtained in step (2.1), the data requester restores the original disordered index i = π according to the generated permutation π. -1 °π(i).

[0020] Further, step (3) includes:

[0021] Based on the original index i obtained in step (2.2), the data requester and the tag data holder jointly execute the unintentional transmission protocol, and the data requester obtains the corresponding tag l. i .

[0022] A second aspect of the present invention provides an information protection enhanced labeled privacy set intersection apparatus, including one or more processors, for implementing the above-described information protection enhanced labeled privacy set intersection method.

[0023] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-described method for finding intersections of labeled privacy sets with enhanced information protection.

[0024] Compared to existing technologies, this invention restricts the data requester's access to both intersection data and tag data, limiting their information acquisition scope and permissions. Meanwhile, the tag data holder receives non-privacy information about the intersection size. This relaxation operation contributes to improved protocol efficiency.

[0025] The beneficial effect of this invention is that it minimizes information leakage while allowing data requesters to obtain the data they need.

[0026] This invention addresses the potential privacy leakage issue in real-world scenarios when finding intersections of labeled privacy sets. It proposes an enhanced method for finding intersections of labeled privacy sets, ensuring that label holders only receive the size of the intersection set and data requesters only receive the labels corresponding to the intersection data. The permutation calculations introduced in this method have minimal computational overhead, resulting in a protocol with high computational efficiency and acceptable communication overhead.

[0027] This invention addresses the issue of additional information leakage. For example, when applied to malicious content detection, by setting the tag data as the cloud storage location, the detection party (data requester) can obtain the location of malicious content and delete it without compromising the privacy of the user (tag data holder). Furthermore, this invention demonstrates good practicality for image detection and monitoring, as well as other real-world scenarios requiring similar functionality. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of the method of the present invention;

[0030] Figure 2 This is a flowchart of the protocol of the present invention;

[0031] Figure 3 This is a schematic diagram of an electronic device provided by the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0034] The core of this invention is to add a result out-of-order function to the Diffie-Hellman key negotiation and, in conjunction with the Unintentional Transmission Protocol, provide a label-based privacy set intersection method with enhanced information protection to solve the problem of additional information leakage in real-world application scenarios.

[0035] like Figure 1 and Figure 2 As shown, this invention provides a labeled privacy set intersection method with enhanced information protection. The method includes: both parties using a variant of the inverse Diffie-Hellman key negotiation protocol on elliptic curves, adding a data reordering operation to obtain the indices of the anonymized matching data; the data requester using the inverse process of the reordering operation to restore the original data indices of the intersection; both parties executing an unintentional transmission protocol, and the data requester obtaining the labels corresponding to the intersection data.

[0036] Specifically, the method includes the following steps:

[0037] (1) Disordering operation of key negotiation results: Based on the privacy set intersection protocol based on Diffie-Hellman key negotiation, the data requester generates random permutation π locally, and sends the intermediate data of the tag data holder back to the tag data holder after disordering the data.

[0038] Specifically, step (1) includes the following steps:

[0039] (1.1) The data held by the tag holder is X = {(x1,l1),(x2,l2),...,(x m ,l m According to the data from the demand side, Y = {y1, y2, ..., y} n The data requester and the tagged data holder each preprocess their respective raw datasets, with the tag holder only processing the intersection data x. i ,i∈[m] to obtain H(x) i ), i∈[m], the result number multiplied by the local private key α yields αH(x i ), αH(x i The x-coordinate of y is sent to the data requester; the data requester processes y. j ,j∈[n] and multiply by the local private key k to obtain kH(y) j ),j∈[n], let kH(y j The x-coordinate of the hash function is stored in the Bloom filter (BF). Let k be the number of hash functions in the Bloom filter. BGiven a table of length b, a data volume n to be inserted, and a Bloom filter (BF) false positive rate of ε, the following relationship exists between them when ε reaches its minimum value:

[0040]

[0041] Choose k B The value is equal to the statistical security parameter λ, and the table length b can be determined using the above formula. Since the original data has already been hashed in (1.1), the hash method of the Bloom filter is set to kH(y j The x-axis is cyclically truncated, meaning each time starting from the k-th axis... B Truncate data of length log2b bits until k bytes are extracted. B Up to the last segment of data.

[0042] The data requester and the tagged data holder each preprocess their respective raw data sets, including:

[0043] Map the original input to the elliptic curve group E(F) p For each element s in a data set S: i The hash is broken down using the secure hash function SHA-256, and the hash output is modulo p to map it to the field F. p In the middle, the result is denoted as x. i Use Euler's criterion to determine x i Whether it can become the x-coordinate of an elliptic curve, i.e., testing x... 3 Is the result of the calculation F + Ax + B? p The quadratic residue in the equation is given by A and B, where A and B are elliptic curve parameters. If the test passes, it indicates the existence of a corresponding ordinate y. i Make (x) i ,y i The equation satisfies the equation of an elliptic curve, and the Cipolla algorithm is used to solve for y. i The value of H(s) is output as the point H(s) of the elliptic curve. i )=(x i ,y i If the test fails, for x i Increment by 1 and apply Euler's criterion again. Repeat this increment operation until the test passes and returns a point on the curve, or the preset attempt limit is reached and a message indicating failure to hash to the curve is returned.

[0044] (1.2) The data requester generates a full permutation π based on the amount of data received in step (1.1), and processes the αH(x) received in step (1.1). i The x-coordinates are used to reconstruct the y-coordinates to obtain the elliptic curve points, which are then randomly ordered to obtain αH(x). π(i) Multiplying by one's own private key yields kαH(x)π(i) ), and send its x-coordinate together with the BF generated in step (1.1) to the tag holder;

[0045] (1.3) The tag data holder, based on the kαH(x) received in step (1.2) π(i) The horizontal axis represents the tag data holder multiplied by the private key inverse α. -1 After restoring the ordinate, calculate kH(x) π(i) )=α -1 kαH(x π(i) This result is the key negotiation result after the key is out of order.

[0046] (2) Restoration of disordered operation: The data demander uses the full permutation information π to perform the reverse process of disordered subscript information after processing by the label data holder, and obtains the original subscripts corresponding to the intersection elements.

[0047] Furthermore, step (2) specifically includes the following sub-steps:

[0048] (2.1) The tag holder uses the Bloom filter BF received in step (1.2) and the kH(x) calculated in step (1.3) π(i) Find all cases that satisfy kH(x) π(i) Let I be the set of subscripts π(i) of x-coordinates ∈ BF, and send I to the data requester.

[0049] (2.2) The data requester calculates the value of the inverse function of π for each element in the set I received in step (2.1), that is, restores the original index i = π. -1 °π(i), where π(i)∈I.

[0050] Using the method described above, the data requester obtains the true index corresponding to the intersection data of the tag data holder.

[0051] (3) Tag acquisition: Using the unintentional transmission protocol, the data requester obtains the tag corresponding to the intersection data according to the index in step (2).

[0052] Furthermore, step (3) specifically includes the following sub-steps:

[0053] Based on the original index i obtained in step (2.2), the data requester and the tag data holder jointly execute the (m selects |I|)-unintentional transmission protocol, and the tag data holder transmits its own tag data l i The data requester takes the original index i, π(i) ∈ I as input and obtains the corresponding label l. i .

[0054] For example, taking Simplest OT as an example, the tag data holder generates a random number s and a pair of data (u,v) = (g s ,g s^2 The public parameter g is a generator of a cyclic group. u is published as the public key to the data requester, and v is kept as the private key. After receiving u, the data requester multiplies it by its index i and masks it with their own random number t to obtain w = u. i ·g t The data is sent to the tag data holder. The tag data holder uses their private key v to decrypt w, i.e., calculate w. s ·v -j ,j∈[m](its value is equal to g) (j-i)s^2+st The hashed data is then used as the key for symmetric encryption (such as the AES-256 symmetric encryption algorithm) to encrypt the input, resulting in ciphertext c. i =Enc(Hash(w s ·v -j ),l j ), j∈[m], and send these ciphertexts to the data requester. The data requester attempts to decrypt the received ciphertexts. The above operation ensures that only the data satisfying j=i can be successfully decrypted, i.e., l i =Dec(Hash(u t ),c i ).

[0055] Simplest OT can achieve (m-choose-1) unintentional transmission. By executing Simplest OT in parallel |I| times, (m-choose-|I|) unintentional transmission can be achieved. The data requester ultimately obtains the labels corresponding to the intersection data, but does not obtain any other useful information; while the label data holder can only obtain the size of the intersection set.

[0056] Example 1:

[0057] An implementation example of this invention is carried out on a machine equipped with an Intel Xeon Gold 6248 CPU @ 2.50GHz 20 cores × 4, 256GB of memory, and running the Ubuntu 18.04.5LTS operating system. A randomly generated simulated dataset is used as the input set for both parties. Based on the real-world application scenario, the data format is set to a 16-byte string. The data requester's dataset is separated by newlines; the label data holder also generates corresponding labels, which are also 16-byte strings, combined with the intersection data into a tuple, separated by commas within the tuple and by newlines between tuples.

[0058] Strictly in accordance with Figure 1The computation process is implemented using the C++ language to implement the protocol. The elliptic curve is the secp256r1 curve provided by NIST, and the private key generation, scalar multiplication, quadratic residue calculation algorithm, and Sha256 hash algorithm are all implemented using the open-source library OpenSSL. Based on this, a Bloom filter with a truncated hash algorithm, as well as scalar multiplication, dot addition, and AES-256 symmetric encryption from SimplestOT are implemented.

[0059] Experiments showed that each piece of data entering the protocol from the tag data holder resulted in 288.3 bytes of upload communication and 305.9 bytes of download communication, with the communication from the data requester being symmetrical. In a real-world scenario (data requester as server, tag data holder as client, computing power 30:1), the data volume for both parties is n=2. 20 m=2 10 In this case, the total overhead of the protocol is approximately 2 seconds, with a 100% accuracy rate.

[0060] Accordingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; and when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the information protection-enhanced labeled privacy set intersection method as described above. Figure 3 The diagram shown illustrates a hardware structure of any device with data processing capabilities for the information protection-enhanced labeled privacy set intersection method provided in this embodiment of the invention. (Except for...) Figure 3 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0061] Accordingly, this application also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the information protection-enhanced labeled privacy set intersection method described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0062] In summary, this invention proposes a method of scrambling the key negotiation results using a full permutation. This method achieves anonymity of the intersection data through a full permutation, preventing the tag data holder from knowing the true intersection information while manipulating the matching data, thus enhancing information protection. The one-to-one correspondence property of the full permutation allows the true index to be restored using its inverse function and the scrambled indexes.

[0063] This invention achieves a more privacy-preserving labeled privacy set intersection by combining key negotiation out-of-order operations with unintentional transmission. The input of the label holder in the unintentional transmission protocol ensures that the data requester only receives the label, while the label holder only receives the size of the intersection set, thus achieving a more privacy-preserving labeled privacy set intersection.

[0064] For those skilled in the art, the present invention is not limited to the details of the above exemplary embodiments. Without departing from the spirit or basic characteristics of the present invention, the present invention can be implemented in any other specific form. For example, the Bloom filter can be replaced with other filters or a series of compression and fast set search algorithms such as hash + binary search, and the inadvertent transmission protocol can be replaced with any other protocol that can implement the (m select |I|)-inadvertent transmission function.

[0065] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for finding the intersection of labeled privacy sets with enhanced information protection, characterized in that, Includes the following steps: (1) According to the privacy set intersection protocol variant of Diffie-Hellman key negotiation, the data requester generates random permutation π locally and sends it back to the tag data holder after scrambling the intermediate data of the tag data holder. (2) The data demander uses the permutation information π to perform the reverse process of disordered index information after the label data holder has processed it, and obtains the original index corresponding to the intersection element; (3) Using the unintentional transmission protocol, the data requester obtains the tag corresponding to the intersection data according to the index obtained in step (2); Further, step (1) includes the following sub-steps: (1.1) The data requester and the tagged data holder preprocess their respective original datasets X and Y, with the tagged data holder only processing the intersection data x. i ∈X to obtain H(x) i ), where the function H() represents hash to elliptic curve, and the result H(x) is obtained. i Multiplying the local private key α by scalars yields αH(x) i ), αH(x i Send the data to the data requester; the data requester processes the data. j ∈Y multiplied by the local private key k yields kH(y) j ), and kH(y j Place it in the Bloom filter BF; (1.2) The data requester generates a full permutation π based on the amount of data received in step (1.2), and applies the αH(x) received in step (1.2) to the permutation π. i ) Randomized order yields αH(x) π(i) Multiplying by one's own private key yields kαH(x) π(i) ), and kαH(x π(i) The Bloom filter (BF) generated in step (1.2) is sent to the tag holder together with the Bloom filter (BF). (1.3) The tag holder receives kαH(x) in step (1.2). π(i) ) x-coordinate, then reconstruct the y-coordinate and calculate kH(x) π(i) ) = α -1 kαH(x π(i) This is the result of key negotiation after the key is out of order; Furthermore, step (2) includes the following sub-steps: (2.1) The tag holder uses the Bloom filter BF received in step (1.2) and the kH(x) calculated in step (1.3) π(i) Find all cases that satisfy kH(x) π(i) Find the index π(i) of the x-coordinate ∈ BF and send the found π(i) to the data requester. (2.2) Based on the disordered index π(i) obtained in step (2.1), the data requester restores the original non-disordered index according to the generated permutation π. .

2. The method for finding the intersection of labeled privacy sets with enhanced information protection according to claim 1, characterized in that, In step (1.1), the data requester and the tagged data holder respectively preprocess their original datasets X and Y, including: Map the original input to the elliptic curve group E(F) p For each element s in a data set S: i The hash is broken down using the secure hash function SHA-256 and mapped to the field F using a modulo-p operation. p In the middle, the result is denoted as x. i Use Euler's criterion to determine x i Can it be the x-coordinate of an elliptic curve? If so, it indicates the existence of a corresponding y-coordinate. i Make (x) i , y i If the equation of an elliptic curve is satisfied, output the elliptic curve point H(s). i ) = (x i , y i If not, for x i Increment by 1 and repeat the Euler criterion until a point on the curve is returned, or until the preset attempt limit is reached and the curve fails.

3. The method for finding the intersection of labeled privacy sets with enhanced information protection according to claim 1, characterized in that, Step (3) includes: Based on the original index i obtained in step (2.2), the data requester and the tag data holder jointly execute the unintentional transmission protocol, and the data requester obtains the corresponding tag l. i .

4. A tagged privacy set intersection device with enhanced information protection, characterized in that, It includes one or more processors for implementing the information protection-enhanced labeled privacy set intersection method according to any one of claims 1-3.

5. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by the processor, the program is used to implement the information protection-enhanced labeled privacy set intersection method according to any one of claims 1-3.

Images