Homomorphic encryption-based multi-party privacy set operation method and system

Abstract

The application discloses a kind of multi-party privacy set operation method and system based on homomorphic encryption, comprising: obtaining public key and private key;Each participant's private key is generated;Determine the parameters of Bloom filter;Each participant uses public key to encrypt the Bloom filter structure, obtains ciphertext, and sends to cloud server;Cloud server receives the request of specified participant, carries out secret computation, and sends to other participants;Other participants calculate decryption share, and send to cloud server, and cloud server makes power operation to the decryption share of other participants after multiplication, obtains the intermediate value required for decryption of specified participant, and sends the intermediate value and secret computation result to specified participant;Specified participant decrypts, obtains Bloom filter plaintext, and uses Bloom filter query to obtain the set required by specified participant.The application can guarantee not to leak information except the result, and expand the application scenario of privacy set intersection protocol.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, specifically relating to a multi-party privacy set operation method and system based on homomorphic encryption. Background Technology

[0002] In the era of big data and artificial intelligence, various applications possess diverse user data. This data flows between different applications, and various parties mine it to create greater value and improve user experience. However, this also leads to massive leaks of user privacy data, jeopardizing the protection of citizens' personal information. How to effectively leverage data value while protecting user privacy has become the most important reason for the rise of secure multi-party computation.

[0003] In existing technologies, polynomial methods are commonly used, but due to the computational burden of high-order polynomial interpolation and factorization, they are not suitable for the current big data environment. Schemes that require the entire set to be known will result in all participants spending a lot of costs in determining the entire set in the early stages, and will also lead to some unnecessary information leakage. At the same time, existing technical solutions require a lot of interaction between participants, and require participants to perform a lot of dense state calculations locally.

[0004] Therefore, it is urgent to improve the aforementioned defects in the existing technology. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a method and system for multi-party privacy set computation based on homomorphic encryption. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] In a first aspect, the present invention provides a method for multi-party privacy set operation based on homomorphic encryption, comprising:

[0007] Use a parameter generation mechanism to generate initial parameters, and obtain the public and private keys based on the initial parameters;

[0008] Generate the private keys of each participant according to the Shamir(t,n) threshold secret sharing scheme;

[0009] The parameter generation mechanism interacts with all participants to determine the parameters of the Bloom filter;

[0010] Each participant represents its corresponding set elements as a Bloom filter structure, encrypts the Bloom filter structure using a public key, obtains the ciphertext, and sends the ciphertext to the cloud server;

[0011] The designated participant sends a request to the cloud server. Upon receiving the request, the cloud server performs a secret calculation and sends the result to the other participants.

[0012] The cloud server interacts with other participants. The other participants calculate the decryption share and send it to the cloud server. The cloud server performs an exponentiation operation on the decryption shares of the other participants and multiplies them to obtain the intermediate value required for the specified participant to decrypt. The cloud server then sends the intermediate value and the encrypted calculation result to the specified participant.

[0013] The designated participant decrypts the intermediate values ​​and the results of the encrypted calculation to obtain the plaintext of the Bloom filter, and uses the Bloom filter query to obtain the set required by the designated participant.

[0014] Secondly, the present invention also provides a multi-party privacy set operation system based on homomorphic encryption, comprising:

[0015] Parameter generation module one is used to generate parameters using a parameter generation mechanism, and obtain the public and private keys based on the parameters;

[0016] The second parameter generation module is used to generate the private keys of each participant according to the Shamir(t,n) threshold secret sharing scheme.

[0017] The parameter determination module of the Bloom filter is used by the parameter generation mechanism to interact with all participants to determine the parameters of the Bloom filter;

[0018] Interaction Module 1 is used by each participant to represent their corresponding set elements as a Bloom filter structure, encrypt the Bloom filter structure using a public key, obtain the ciphertext, and send the ciphertext to the cloud server.

[0019] Interaction module two is used to specify the participants to send requests to the cloud server. Upon receiving the request, the cloud server performs encrypted calculations and sends the results to other participants.

[0020] Interaction Module 3 is used for the cloud server to interact with other participants. Other participants calculate the decryption share and send it to the cloud server. The cloud server performs an exponentiation operation on the decryption shares of other participants and multiplies them to obtain the intermediate value required for decryption by the specified participant. The intermediate value and the secret state calculation result are then sent to the specified participant.

[0021] The result acquisition module is used to specify the participant to decrypt the intermediate values ​​and the encrypted calculation results to obtain the plaintext of the Bloom filter, and use the Bloom filter to query and obtain the set required by the specified participant.

[0022] The beneficial effects of this invention are:

[0023] This invention provides a method and system for multi-party privacy set computation based on homomorphic encryption. Using the BGN encryption algorithm, and leveraging the characteristics of multiple additions and single multiplications of homomorphic sets, it achieves the function of finding the intersection of the union and intersection of the multi-party privacy set, avoiding the use of vectors representing the elements of the universal set. This makes the invention more flexible and avoids the process of all parties mutually confirming the universal set before executing the protocol. It uses a Bloom filter data structure, avoiding the use of polynomial representations of the set, and due to the characteristics of Bloom filters, the invention can adapt to large-scale data. Using a cloud server allows participants to interact only with the cloud server, eliminating the need for interaction between participants. Simultaneously, a large amount of computation is delegated to the cloud server, reducing the amount of data requiring local computation and making it user-friendly for lightweight users.

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0025] Figure 1 This is a flowchart of a multi-party privacy set operation method based on homomorphic encryption provided in an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram of a multi-party privacy set operation system based on homomorphic encryption provided in an embodiment of the present invention. Detailed Implementation

[0027] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0028] In existing technologies, Freedman first proposed the concept of privacy set intersection protocols in 2004. Over the past two decades, privacy set intersection techniques have matured, with two-party privacy set intersection protocols achieving near-optimal efficiency. Current privacy set intersections are mostly constructed using methods such as unintended transmission, homomorphic cryptography, and multinomials. Privacy-preserving set intersection techniques perform intersection calculations without revealing other information about the participating parties. However, simple intersection calculations are insufficient for some practical scenarios. For example, in infectious disease control, disease control agencies collaborate with manufacturers of electronic devices (such as smartphones, tablets, vehicles, or wearable devices) or telecommunications companies that can provide geolocation to identify vulnerable populations. Since user geographic information is considered personal privacy, and multiple servers typically store user geographic location information, a technique for finding the intersection of multiple privacy sets is needed in this application scenario.

[0029] Currently, most privacy set intersection and union techniques are difficult to naturally extend to finding intersections with the unions of multiple privacy sets. Kissner and Song's paper, *Privacy-Preserving Set Operations*, proposes finding the intersection of a specified party's privacy set with the union of all other parties' privacy sets. In this scheme, set elements are used as roots of a polynomial, with each polynomial representing a set. Intersections and unions are found securely by computing polynomial multiplication and addition. However, precisely because the participating sets are based on polynomial representations, this technique requires high-order interpolation and factorization on large-scale data, resulting in excessive computational overhead and making it unsuitable for current big data environments.

[0030] In their paper "Estimating Incidental Collection in Foreign Intelligence Surveillance: Large-Scale Multiparty Private Set Intersection with Union and Sum", Anunay Kulshrestha et al. proposed a multiparty privacy set intersection protocol and extended it to a protocol for intersection with the union of multiparty privacy sets. This scheme mainly utilizes the properties of DH tuples, but it requires a lot of communication between the participants and all computations must be undertaken by each participant, which is not user-friendly for lightweight users.

[0031] In addition, there are some general techniques for achieving privacy-preserving mixed set operations. For example, Wang et al. proposed a new technique for achieving privacy-preserving mixed set operations in *Privacy-Preserving Mixed Set Operations*. This scheme maintains a vector representing the universal set (the universal set should be a set that contains the union of the privacy sets of all participants). Participants perform corresponding calculations on the corresponding components based on whether an element in the universal set is in their own set, thus obtaining a vector representing the target set. Since the universal set is known to all parties in this scheme, all participants must determine a universal set beforehand through communication or other means, making this scheme less flexible. Furthermore, this scheme requires extensive interaction between participants during execution.

[0032] Firstly, in the era of big data and artificial intelligence, data has become a fundamental resource, with various applications possessing diverse user data. Through data sharing, parties gain access to more resources, extracting a wealth of valuable information, leading to a better user experience and creating greater value. However, massive data mining has resulted in the leakage of sensitive user information, compromising citizen privacy. Furthermore, intersection and union operations on sets are the simplest methods for processing set data; in some application scenarios, only the technique of finding the intersection with the union of multiple privacy sets is needed. Therefore, to ensure data security while simultaneously unlocking the value inherent in data, this invention proposes an algorithm capable of finding the intersection with the union of multiple privacy sets.

[0033] Secondly, most similar solutions currently do not incorporate cloud computing technology, which requires participants to have certain computing power. Furthermore, in the era of massive data, dealing with large-scale datasets often necessitates addressing these demands, further increasing the computational requirements for participants. Therefore, this invention incorporates a cloud server in its protocol design. Participants only need to encrypt and upload their data. After sending a dataset operation request, the cloud server will perform the computation, and participants simply wait for the cloud server to return the encrypted result.

[0034] In summary, to address the shortcomings of the existing technologies, this invention proposes a multi-party privacy set operation method and system based on homomorphic encryption. This method ensures that no information other than the desired result is disclosed, and it migrates the computation to a cloud server, expanding the applicable scenarios of the privacy set intersection protocol and better serving real-world needs.

[0035] Please see Figure 1 As shown, Figure 1 This is a flowchart of a multi-party privacy set operation method based on homomorphic encryption provided in an embodiment of the present invention. The multi-party privacy set operation method based on homomorphic encryption provided by the present invention includes:

[0036] S101. Use the parameter generation mechanism to generate initial parameters, and obtain the public key and private key based on the parameters.

[0037] Specifically, in this embodiment, the public key and private key are obtained through the following process.

[0038] S1011, Parameter generation mechanism PG selects safety parameters And use the safety parameter τ to generate composite bilinear mapping parameters. Where q1 and q2 are two prime numbers, and These are two N-order cyclic groups, N = q1q2, and e is a mapping, optionally, e:

[0039] S1012, Randomly select an Nth-order cyclic group Given two generators g and u, obtain the Nth-order cyclic group. The random generator h of a subgroup of order q1 is expressed as:

[0040]

[0041] S1013, Based on the composite bilinear mapping parameters Nth-order cyclic group The generator g and the Nth order cyclic group Find the generator h of the q1-order subgroup and obtain the public key. and private key The public key is made public, while the private key is kept secret.

[0042] S102. Generate the private keys of each participant according to the Shamir(t,n) threshold secret sharing scheme.

[0043] Specifically, in this embodiment, the private key of the participant is obtained through the following process.

[0044] S1021. The parameter generation mechanism PG randomly selects parameter a from {0,…,N-1}. j Construct a polynomial function f(X) with the following expression:

[0045]

[0046] Where n is the total number of participants, j is the index, and X is the index. j The unknown part of a term in a polynomial function is the constant term a0 = q1 in the polynomial function f(X);

[0047] S1022. Based on the polynomial function, the parameter generating mechanism PG assigns parameters to each participant P. i Sending shares s i =f(i), generating each participant P i private key sk i =s i , where j = 1, ..., n-1, i = 1, ..., n, and i is the i-th participant.

[0048] S103. The parameter generation mechanism interacts with all participants to determine the parameters of the Bloom filter.

[0049] Specifically, in this embodiment, the parameters of the Bloom filter are determined through the following process.

[0050] S1031, various participating parties P i Use public key For parameters Encryption is performed, and the encrypted result is obtained. The encrypted result is then sent to the parameter generation organization PG; whereby, For participant P i The upper limit of the size of the privacy set held, i = 1, ..., n, where r is a parameter randomly selected from {0, 1, ..., N-1};

[0051] S1032. The parameter generation mechanism PG first decrypts the encryption result to obtain the parameters. Next, select the false positive rate fpp of the Bloom filter, determine the size m of the Bloom filter and the number of hash functions k of the Bloom filter, and their expressions are as follows:

[0052]

[0053]

[0054]

[0055] S1033, The parameter generation mechanism PG selects k hash functions h from the Bloom filter. l Determine and disclose the parameters of the Bloom filter. The parameters of the Bloom filter include v. max fpp, m, k and h l l = 1, ..., k, where l is an index used to identify k hash functions.

[0056] S104. Each participant represents its corresponding set elements as a Bloom filter structure, encrypts the Bloom filter structure using a public key, obtains the ciphertext, and sends the ciphertext to the cloud server.

[0057] Specifically, in this embodiment, the ciphertext of the Bloom filter structure corresponding to each participant is obtained through the following process.

[0058] S1041, Each Participating Party P i Generate the initial Bloom filter BF i Initial Bloom filter BF i The value at each position is initialized to 0;

[0059] S1042, Obtain P from each participant. i element x in the privacy set i,j The k hash function values, i.e., h1(x i.j ),...,h2(x i,j ),...,h k (x i,j );x i,j ∈X i X i For participant P iThe privacy set, i = 1, ..., n, where n is the total number of participants, j = 1, ..., v i v i For participant P i Privacy collection X i The size of h1, h2, ..., h k Let k be the hash function of the Bloom filter, and k be the number of hash functions in the Bloom filter.

[0060] S1043, All participating parties P i element x in the privacy set i,j Using the k hash function values ​​as indexes, retrieve the values ​​of each participant P. i Corresponding Bloom filter by Indicates Bloom filter The value at the γth position, γ = 1, ..., m, where m is the size of the Bloom filter:

[0061] S1044, various participating parties P i Use the public key to its corresponding Bloom filter Encryption is performed to obtain the encrypted Bloom filter. That is, to obtain the ciphertext, the expression is:

[0062]

[0063] in, For encrypted Bloom filters The ciphertext at the j-th position, r i,j To be randomly selected The parameters, The additive group of residue classes modulo N;

[0064] S1045, Participant P i Send the encrypted message to the cloud server.

[0065] S105. The designated participant sends a request to the cloud server. Upon receiving the request, the cloud server performs a secret calculation and sends the result of the secret calculation to the other participants.

[0066] Specifically, in this embodiment, the dense state calculation result is obtained through the following process and then sent to other participants.

[0067] S1051, Designated participant P1 sends a message to the cloud server. Send a request; wherein, the designated participant P1 sends a request to the cloud server. Send your ID to initiate the request;

[0068] S1052, cloud server Select other participants Pi Corresponding ciphertext i = 2, 3, ..., n, and using the additive homomorphism of the encryption algorithm, we obtain X′. res The corresponding ciphertext of the Bloom filter:

[0069]

[0070]

[0071] Among them, C' j Let X′ res The corresponding ciphertext at position j of the encrypted Bloom filter, r′ i,j To be randomly selected The parameters, j = 1, ..., m,

[0072] S1053, cloud server The ciphertext of designated participant P1 With X r ' es The corresponding ciphertext of the Bloom filter is multiplied by a homomorphic form to obtain X. res The corresponding ciphertext of the Bloom filter is expressed as:

[0073]

[0074]

[0075]

[0076] Among them, C j For X res The ciphertext at position j of the corresponding encrypted Bloom filter, αq2 satisfies r j To be randomly selected The parameters, j = 1, ..., m, The intermediate parameter is used to refer to the parameter.

[0077] S1054, cloud server The set X required by the specified participants res The corresponding Bloom filter ciphertext is sent to other participant P. i .

[0078] S106. The cloud server interacts with other participants. The other participants calculate the decryption share and send it to the cloud server. The cloud server performs an exponentiation operation on the decryption shares of the other participants and multiplies them to obtain the intermediate value required for the specified participant to decrypt. The intermediate value and the encrypted state calculation result are then sent to the specified participant.

[0079] Specifically, in this embodiment, the intermediate value required for decryption by the designated participant is obtained through the following process.

[0080] S1061, Other Participating Parties P i Use its corresponding private key sk i , obtain And Send to cloud server in, The expression is:

[0081]

[0082] in, To decrypt the share,

[0083] S1062, cloud server Obtain the decryption of X by the specified participant P1 res The corresponding ciphertext of the Bloom filter The required intermediate value SC is expressed as follows:

[0084] SC = (SC1, SC2, ..., SC) m );

[0085]

[0086] Where Δ = n!, i' is the index, and modulo operation is used;

[0087] S1063, cloud server The set X required by the specified participants res The corresponding Bloom filter ciphertext The intermediate value SC is sent to the designated participant P1.

[0088] S107. The designated participant decrypts the intermediate value and the encrypted state calculation result to obtain the plaintext of the Bloom filter, and uses the Bloom filter query to obtain the set required by the designated participant.

[0089] Specifically, in this embodiment, the set required by the specified participants is obtained through the following process.

[0090] S1071, Designated participant P1 uses its corresponding private key sk1 to... Each C in j Perform exponentiation to obtain Its expression is:

[0091]

[0092] in, for Bloom filters;

[0093] S1072. The designated participant P1 receives the intermediate value SC, decrypts it, and obtains the plaintext M of the Bloom filter. j Its expression is:

[0094]

[0095] Where j = 1, ..., m are the corresponding positions in the ciphertext, and Δ = n!; if M j =1, then otherwise, I represents the set of metrics for all participants;

[0096] S1073, Designated participant P1, according to the plaintext M of the Bloom filter. j Using a Bloom filter to perform a query, we obtain the set X required by the specified participants. res .

[0097] In summary, this invention provides a multi-party privacy set operation method based on homomorphic encryption. Using the BGN encryption algorithm, and leveraging the characteristics of multiple additions and single multiplications of homomorphic sets, it achieves the function of finding the intersection of the union and intersection of the multi-party privacy sets, avoiding the use of vectors representing the elements of the universal set. This makes the invention more flexible and avoids the process of all parties mutually confirming the universal set before executing the protocol. The use of a Bloom filter data structure avoids the use of polynomial representations of sets, and due to the characteristics of Bloom filters, the invention can adapt to large-scale data. The use of a cloud server allows participants to interact only with the cloud server, eliminating the need for interaction between participants. Simultaneously, a large amount of computation is delegated to the cloud server, reducing the amount of data requiring local computation and making it user-friendly for lightweight users.

[0098] Based on the same inventive concept, please refer to Figure 2 As shown, Figure 2 This is a schematic diagram of a multi-party privacy set operation system based on homomorphic encryption provided in an embodiment of the present invention. The present invention also provides a multi-party privacy set operation system based on homomorphic encryption, comprising:

[0099] Parameter generation module 101 is used to generate initial parameters using a parameter generation mechanism, and obtain the public and private keys based on the parameters;

[0100] Parameter generation module 202 is used to generate the private keys of each participant according to the Shamir(t,n) threshold secret sharing scheme;

[0101] The parameter determination module 203 of the Bloom filter is used by the parameter generation mechanism to interact with all participants to determine the parameters of the Bloom filter;

[0102] Interaction Module 1 204 is used by each participant to represent their corresponding set elements as a Bloom filter structure, encrypt the Bloom filter structure using a public key, obtain the ciphertext, and send the ciphertext to the cloud server;

[0103] Interaction module 205 is used to specify the participants to send requests to the cloud server. Upon receiving the request, the cloud server performs secret calculation and sends the result of the secret calculation to other participants.

[0104] Interaction Module 3 206 is used for the cloud server to interact with other participants. Other participants calculate the decryption share and send it to the cloud server. The cloud server performs an exponentiation operation on the decryption shares of other participants and multiplies them to obtain the intermediate value required for decryption by the specified participant. The intermediate value and the secret state calculation result are then sent to the specified participant.

[0105] The result acquisition module 207 is used to specify the participant to decrypt the intermediate values ​​and the encrypted calculation results to obtain the plaintext of the Bloom filter, and use the Bloom filter to query and obtain the set required by the specified participant.

[0106] Specifically, the multi-party privacy set computation system based on homomorphic encryption provided by this invention can be applied to any scenario that requires calculating the intersection of the union of multi-party privacy sets, such as the scenario mentioned above for tracking contacts of infectious diseases or susceptible and sensitive populations.

[0107] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0108] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0109] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for multi-party privacy set operation based on homomorphic encryption, characterized in that, include: Use a parameter generation mechanism to generate initial parameters, and obtain the public and private keys based on the parameters; According to Shamir A threshold secret sharing scheme generates private keys for each participant; The parameter generation mechanism interacts with all the participants to determine the parameters of the Bloom filter; Each participating party represents its corresponding set elements as a Bloom filter structure, encrypts the Bloom filter structure using the public key to obtain ciphertext, and sends the ciphertext to the cloud server; The designated participant sends a request to the cloud server. Upon receiving the request, the cloud server performs a secret calculation and sends the result of the secret calculation to the other participants. The cloud server interacts with other participants, who calculate the decryption share and send it to the cloud server. The cloud server then exponentiates the decryption shares of the other participants and multiplies them to obtain the intermediate value required for decryption by the designated participant. The cloud server then sends the intermediate value and the cryptographic calculation result to the designated participant. The designated participant decrypts the intermediate value and the encrypted calculation result to obtain the plaintext of the Bloom filter, and uses the Bloom filter to query and obtain the set required by the designated participant; According to Shamir The threshold secret sharing scheme generates private keys for each participant, specifically including: Parameter generation mechanism PG Randomly select parameters Constructing polynomial functions Its expression is: ； in, The total number of the participating parties. For indexing, The unknown part of a term in a polynomial function, the polynomial function constant term in ; According to the polynomial function, the parameter generation mechanism PG provides parameters to each of the participating parties. Sending Share Generate each of the aforementioned participants. private key ,in, , , For the first One participating party; The process of the cloud server interacting with other participants, who calculate their decryption shares and send them to the cloud server, and the cloud server exponentiating and multiplying the decryption shares of the other participants to obtain the intermediate value required for decryption by the designated participant, and then sending the intermediate value and the cryptographic calculation result to the designated participant, includes: The other participating parties Use its corresponding private key , obtain and will Send to the cloud server ;in, The expression is: ； in, Indicates the decryption share. , , ; The cloud server Obtain the specified participant Decryption The corresponding Bloom filter ciphertext Required intermediate value Its expression is: ； ； in, , For indexing, Modular operation; The cloud server The required set of the specified participants The corresponding Bloom filter ciphertext and the intermediate value Send to the designated participant .

2. The multi-party privacy set operation method based on homomorphic encryption according to claim 1, characterized in that, The process of generating initial parameters using a parameter generation mechanism and obtaining the public and private keys based on the parameters includes: Parameter generation mechanism PG selects safety parameters and using the security parameters Generate composite bilinear mapping parameters ;in, and They are two prime numbers, and There are two respectively Cyclic group of order 1 , For mapping; Random selection Cyclic group The two generators in and , obtain Cyclic group One Random generator of order subgroup Its expression is: ； According to the composite bilinear mapping parameters , Cyclic group generator and Cyclic group of Generators of order subgroups Obtain the public key and the private key The public key is made public, while the private key is kept private.

3. The method for multi-party privacy set operation based on homomorphic encryption according to claim 1, characterized in that, The process by which the parameter generation mechanism interacts with all the participating parties to determine the parameters of the Bloom filter includes: Each of the aforementioned participants Using the public key For parameters Encryption is performed, and the encrypted result is obtained. The encryption result is then sent to the parameter generation organization PG; wherein, For the participating parties The upper limit on the size of the privacy collection held. , From Randomly selected parameters; The parameter generation mechanism PG first decrypts the encryption result to obtain the parameters. Then select the false positive rate of the Bloom filter. Determine the size of the Bloom filter. The number of hash functions in a Bloom filter Their expressions are as follows: ； ； ； The parameter generation mechanism PG selects a Bloom filter. hash functions The parameters of the Bloom filter are determined and disclosed, including... , , , and , , For indexing, used for identification A hash function.

4. The method for multi-party privacy set operation based on homomorphic encryption according to claim 1, characterized in that, The process by which each participating party represents its corresponding set elements as a Bloom filter structure, encrypts the Bloom filter structure using the public key to obtain ciphertext, and sends the ciphertext to the cloud server includes: Each of the aforementioned participants Generate initial Bloom filter The initial Bloom filter The value at each position is initialized to 0; Obtain each of the aforementioned participants Elements in the privacy set of Each hash function value, i.e. ; , For the participating parties Privacy collection, , The total number of the participating parties. , For the participating parties Privacy collection Size, The hash function for the Bloom filter. The number of hash functions in the Bloom filter; Each of the aforementioned participants Elements in the privacy set of Using a hash function value as an index, retrieve the values ​​of each participant. Corresponding Bloom filter ,by Indicates Bloom filter No. The value at each position, , The size of the Bloom filter; Each of the aforementioned participants Use the public key to its corresponding Bloom filter Encryption is performed to obtain the encrypted Bloom filter. To obtain the ciphertext, the expression is: ； in, For encrypted Bloom filters The The ciphertext at each location, To be randomly selected The parameters, mold The remaining classes are grouped together; The participating parties The encrypted text is sent to the cloud server.

5. The method for multi-party privacy set operation based on homomorphic encryption according to claim 1, characterized in that, The process of the designated participant sending a request to the cloud server, the cloud server receiving the request, performing encrypted computation, and sending the encrypted computation result to other participants includes: Designated participants To the cloud server Send a request; The cloud server Select other participants Corresponding ciphertext , And using the additive homomorphism of the encryption algorithm, we obtain The corresponding ciphertext of the Bloom filter: ； ； in, for The corresponding encrypted Bloom filter number The ciphertext at each location, To be randomly selected The parameters, , ; The cloud server Designate participants The ciphertext and The corresponding ciphertext of the Bloom filter is multiplied by a homomorphic form to obtain... The corresponding ciphertext of the Bloom filter is expressed as: ； ； ； in, for The corresponding encrypted Bloom filter number The ciphertext at each location, satisfy , To be randomly selected The parameters, , The intermediate parameter is used to refer to the parameter. ; The cloud server The required set of the specified participants The corresponding Bloom filter's ciphertext is sent to other participants. .

6. The method for multi-party privacy set operation based on homomorphic encryption according to claim 1, characterized in that, The process by which the designated participant decrypts the intermediate value and the encrypted calculation result to obtain the plaintext of the Bloom filter, and uses the Bloom filter to query and obtain the set required by the designated participant includes: The designated participants Use its corresponding private key right Each Perform exponentiation to obtain Its expression is: ； in, for Bloom filters, The designated participants Received the intermediate value Decryption is performed to obtain the plaintext of the Bloom filter. Its expression is: in, The corresponding position in the ciphertext. ;if ,but ;otherwise, , A set of metrics for all participants; The designated participants According to the plaintext of the Bloom filter A Bloom filter is used to perform a query to obtain the required set of the specified participants. .

7. A multi-party privacy set operation system based on homomorphic encryption, characterized in that, include: Parameter generation module one is used to generate initial parameters using a parameter generation mechanism, and obtain the public key and private key based on the parameters; Parameter generation module two is used to generate parameters according to Shamir. A threshold secret sharing scheme generates private keys for each participant; A parameter determination module for the Bloom filter is used for the parameter generation mechanism to interact with all the participants to determine the parameters of the Bloom filter; Interaction module one is used by each of the participating parties to represent their corresponding set elements as a Bloom filter structure, encrypt the Bloom filter structure using the public key, obtain the ciphertext, and send the ciphertext to the cloud server; Interaction module two is used to specify the participants to send a request to the cloud server. Upon receiving the request, the cloud server performs a secret calculation and sends the result of the secret calculation to other participants. Interaction module three is used for the cloud server to interact with other participants. The other participants calculate the decryption share and send it to the cloud server. The cloud server performs an exponentiation operation on the decryption share of the other participants and multiplies it to obtain the intermediate value required for decryption by the designated participant. The intermediate value and the cryptographic calculation result are then sent to the designated participant. The result acquisition module is used by the designated participant to decrypt the intermediate value and the secret state calculation result to obtain the plaintext of the Bloom filter, and use the Bloom filter to query and obtain the set required by the designated participant; The parameter generation module two is specifically used for: the parameter generation mechanism PG in... Randomly select parameters Constructing polynomial functions Its expression is: ； in, The total number of the participating parties. For indexing, The unknown part of a term in a polynomial function, the polynomial function constant term in ; According to the polynomial function, the parameter generation mechanism PG provides parameters to each of the participating parties. Sending Share Generate each of the aforementioned participants. private key ,in, , , For the first One participating party; The third interaction module is specifically used for: the other participating parties Use its corresponding private key , obtain and will Send to the cloud server ;in, The expression is: ； in, Indicates the decryption share. , , ; The cloud server Obtain the specified participant Decryption The corresponding Bloom filter ciphertext Required intermediate value Its expression is: ； ； in, , For indexing, Modular operation; The cloud server The required set of the specified participants The corresponding Bloom filter ciphertext and the intermediate value Send to the designated participant .

Images