A method, apparatus, and product for finding the intersection of multi-party privacy sets that supports retrieval.

Abstract

This application provides a method, apparatus, and product for finding the intersection of multiple privacy sets that supports retrieval. The method includes: obtaining at least one set of commitment values ​​for each data holder among multiple data holders; filtering out a subset of privacy data that meets the retrieval conditions from all privacy data subsets corresponding to each data holder based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each set of commitment values; generating a first set of data to be compared based on the subsets of privacy data retrieved from each data holder except for a first data holder; performing an intersection operation on all retrieved subsets corresponding to the first data holder and the first set of data to be compared to obtain an initial intersection result; and sending the data set carrying the initial intersection result to the first data holder. This application provides a simple and efficient proxy intersection scheme while ensuring the security of the intersection process.

Description

Technical Field

[0001] This application relates to the field of data security, and specifically, the embodiments of this application relate to a method, apparatus, and product for finding the intersection of multi-party privacy sets that supports retrieval. Background Technology

[0002] Private Set Intersection (PSI) refers to the process by which two or more parties obtain the intersection of their respective data sets without revealing any additional information. Currently, PSI is mainly categorized into two-party PSI, multi-party PSI, and third-party assisted PSI. PSI technology requires each participating party to obtain the intersection of their private data, but no additional information should be obtained. Therefore, a two-party PSI protocol cannot be directly generalized to a multi-party PSI protocol; a specially designed multi-party PSI protocol is required.

[0003] In real-world scenarios, numerous terminal devices with limited storage and computing resources require large-scale PSI (Power-On-Site) computation, but these devices often cannot meet the performance requirements for PSI with large amounts of data. Generally, third-party assisted PSI schemes achieve higher intersection efficiency compared to PSI schemes without third-party assistance. Therefore, using third-party assisted PSI schemes is an effective way to address PSI in scenarios with limited storage and computing resources. However, in traditional third-party assisted PSI protocols, participants often need to engage in extensive interactions and computations, and key management issues may arise to ensure that participants obtain the intersection of all participants' sets without revealing their private set information. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus and product for finding intersections of multi-party privacy sets that support retrieval. This application provides a simple and efficient proxy intersection scheme that ensures the security of intersection in a third-party assisted PSI scheme.

[0005] In a first aspect, embodiments of this application provide a method for finding the intersection of multiple privacy sets that supports retrieval. The method includes: obtaining at least one set of commitment values ​​for each data holder among multiple data holders, wherein each set of commitment values ​​corresponds to a privacy data subset, the privacy data subset being obtained by partitioning the original privacy data sets of each data holder, and each set of commitment values ​​including keyword commitment values ​​and data element commitment values; selecting a retrieved privacy data subset that meets the retrieval conditions from all privacy data subsets corresponding to each data holder based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each set of commitment values; generating a first set of data to be compared based on the retrieved privacy data subsets of each data holder other than the first data holder; performing an intersection operation on all retrieved subsets corresponding to the first data holder and the first set of data to be compared to obtain an initial intersection result; and sending the data set carrying the initial intersection result to the first data holder, so that the first data holder can map the shared data of each data holder according to the initial intersection result.

[0006] Some embodiments of this application divide the original privacy data set of each data holder into privacy data subsets, then solve for the commitment value set of the privacy data subsets, and then the intersection helper determines the initial intersection based on the commitment value set corresponding to each privacy data subset, which can improve the speed of data processing.

[0007] In some embodiments, the keyword commitment value is obtained by calculating the keywords of the corresponding privacy data subset, and the data element commitment value is obtained by calculating each data element in the corresponding subset.

[0008] In some embodiments, before obtaining at least one set of commitment values ​​for each participant among the multiple data holders, the method further includes: extracting keywords from the original privacy data sets of each data holder, and placing data elements with the same keywords in the same set to obtain multiple privacy data subsets corresponding to the respective data holders.

[0009] Some embodiments of this application provide a method for dividing the original privacy data set of each data holder into multiple privacy data subsets.

[0010] In some embodiments, obtaining at least one set of commitment values ​​for each data holder among a plurality of data holders includes: the first data holder P1 using a random number seed r0 provided by the data retrieval party to generate a pseudo-random number for each of the remaining data holders besides the first data holder, thereby obtaining a set of pseudo-random numbers to be sent, wherein the random number seed r0 takes a different value in each query; and generating a set of commitment values ​​based on the data elements in each privacy data subset of the first data holder P1 and all pseudo-random numbers in the set of pseudo-random numbers.

[0011] In some embodiments of this application, a data holder generates a pseudo-random number sequence based on a random number seed obtained from a data queryer, and then obtains the set of commitment values ​​of the data holder based on the pseudo-random number sequence.

[0012] In some embodiments, the value of the i-th pseudo-random number in the pseudo-random number set is calculated using the following formula:

[0013]

[0014] Here, || represents the operation of concatenating two strings. Characterizing the XOR operation, H r A pre-negotiated hash function.

[0015] Some embodiments of this application provide a method for determining pseudo-random numbers based on a random number seed.

[0016] In some embodiments, generating a commitment value set based on data elements in each privacy data subset of the first data holder P1 and all pseudo-random numbers in the pseudo-random number set includes: obtaining the commitment value set corresponding to the j-th privacy data subset of the first data holder by means of the following steps: calculating the k-th data element in the j-th privacy data subset. The hash value is calculated to obtain the k-th hash value; the k-th hash value is concatenated with each pseudo-random number in the pseudo-random number set to obtain multiple concatenated strings to be processed; the hash values ​​of the multiple concatenated strings to be processed are calculated to obtain multiple hash commitment values; the multiple hash commitment values ​​are XORed to obtain a data element in the data element commitment value set corresponding to the j-th privacy data subset; the first hash value and the second hash value are XORed to obtain the keyword commitment value corresponding to the j-th privacy data subset, wherein the first hash value is the hash value of the keyword corresponding to the j-th privacy data subset, and the second hash value is the hash value corresponding to the keyword fingerprint of the j-th privacy data subset.

[0017] Some embodiments of this application provide a method for generating a set of commitment values ​​corresponding to each privacy data subset of a first data holder. Through this method, the elements in the privacy data subset corresponding to the commitment value set are obfuscated using random numbers and subjected to two hash calculations (the operation of calculating the commitment value of a data element is also a hash operation), thus the privacy data can be effectively protected.

[0018] In some embodiments, the set of commitment values ​​for the j-th privacy data subset with the first data holder is determined by the following formula:

[0019]

[0020] Among them, key j f is used to characterize the keywords corresponding to the j-th privacy data subset. j H1 represents the fingerprint corresponding to the keyword in the j-th privacy data subset, and H1 represents the first hash function negotiated by all data holders, used to calculate the hash value of the data and the keyword fingerprint. H represents the k-th data element in the j-th privacy data subset of the first data holder, m represents the total number of data elements included in the j-th privacy data subset, [m] = {1,2,…,m}, H c A second hash function, negotiated by all data holders, is used to generate the hash commitment value. Represents the XOR operation.

[0021] Some embodiments of this application provide an algorithm for obtaining a set of commitment values ​​corresponding to the j-th privacy data subset of a first data holder.

[0022] In some embodiments, before obtaining at least one set of commitment values ​​for each data holder among the plurality of data holders, the method further includes: the first data holder P1 using a random number seed r0 provided by the data retrieval party to generate a pseudo-random number for each of the remaining data holders among the plurality of data holders other than the first data holder, to obtain a set of pseudo-random numbers to be sent; and encrypting each pseudo-random number in the set of pseudo-random numbers using a public key corresponding to the corresponding data holder and sending it to the corresponding data holder, so that the corresponding data holder generates a set of all corresponding commitment values ​​based on the received pseudo-random numbers.

[0023] Some embodiments of this application provide a method for providing pseudo-random numbers to data holders other than a first data holder, so that the relevant data holders can calculate a commitment value based on the pseudo-random numbers.

[0024] In some embodiments, the i-th data holder belongs to any one of the plurality of data holders other than the first data holder, and the pseudo-random number received by the i-th data holder from the first data holder is the i-th pseudo-random number r. i The step of obtaining at least one set of commitment values ​​for each data holder among multiple data holders includes: obtaining the set of commitment values ​​corresponding to the j-th privacy data subset of the i-th data holder in the following manner: calculating the k-th data element in the j-th privacy data subset. The hash value is used to obtain the k-th hash value; the k-th hash value is concatenated with the i-th pseudo-random number to obtain a concatenated string to be processed, and then the hash value of the concatenated string to be processed is calculated using the second hash function to obtain the commitment value corresponding to the k-th data element; the above process is repeated m times to obtain m commitment values, and the m commitment values ​​are used as the set of data element commitment values ​​corresponding to the j-th privacy data subset; the first hash value and the second hash value are XORed to obtain the keyword commitment value corresponding to the j-th privacy data subset, wherein the first hash value is the hash value of the keyword corresponding to the j-th privacy data subset, and the second hash value is the hash value corresponding to the keyword fingerprint of the j-th privacy data subset.

[0025] Some embodiments of this application provide a method for generating a set of commitment values, in which elements in a privacy data subset corresponding to the set of commitment values ​​are obfuscated using random numbers and subjected to two hash calculations, wherein the algorithm for calculating the commitment value of a data element is also a hash operation.

[0026] In some embodiments, the set of commitment values ​​for the j-th privacy data subset corresponding to the i-th data holder is determined by the following formula:

[0027]

[0028] Among them, key j f is used to characterize the keywords corresponding to the j-th privacy data subset. j H1 represents the fingerprint corresponding to the keyword of the j-th privacy data subset, and H1 represents the first hash function negotiated by all data holders. H represents the k-th data element in the j-th privacy data subset of the i-th data holder, m represents the total number of data elements included in the j-th privacy data subset, [m] = {1,2,…,m}, H c A second hash function, negotiated by all data holders, is used to generate the hash commitment value. Represents the XOR operation.

[0029] Some embodiments of this application provide an algorithm for the set of commitment values ​​for any subset of privacy data of each holder other than the first data holder. This algorithm corresponds to two hash operations, which ensures that the data elements of the corresponding data holder are fully protected.

[0030] In some embodiments, before concatenating the k-th hash value with the i-th pseudo-random number, the method further includes: the i-th data holder decrypting the received initial pseudo-random number using a private key to obtain the i-th pseudo-random number r. i The initial pseudo-random number is obtained by applying the public key of the i-th data holder to the i-th pseudo-random number r. i It was obtained through encryption.

[0031] In order to improve the security of the pseudo-random number transmission process, some embodiments of this application employ an asymmetric encryption algorithm to encrypt the pseudo-random data to be transmitted.

[0032] In some embodiments, obtaining at least one set of commitment values ​​from each of the multiple data holders includes: a requesting assistant receiving all sets of encrypted commitment values ​​from each of the data holders; the requesting assistant using its own private key to decrypt all sets of encrypted commitment values ​​to obtain all sets of commitment values.

[0033] In order to enhance the security of the commitment value set data, some embodiments of this application also employ asymmetric encryption algorithms to process the data, thereby improving the security of the data.

[0034] In some embodiments, the keyword commitment values ​​included in each commitment value set serve as the key values ​​of the corresponding commitment value set. The step of filtering out the retrieved privacy data subsets that meet the retrieval conditions from all privacy data subsets corresponding to each data holder based on the hash values ​​of the keywords and their fingerprints corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set includes: filtering out the retrieved privacy data subsets that meet the retrieval conditions from all privacy data subsets corresponding to each data holder based on the key values ​​in each commitment value set of the at least one commitment value set, and the query keyword hash value H1(key) and query keyword fingerprint hash value H1(f) sent by the data retrieval party.

[0035] In some embodiments, the step of selecting a subset of private data that meets the search criteria from all subsets of private data corresponding to each data holder based on the key values ​​in each set of the at least one set of commitment values, and the query keyword hash value H1(key) and query keyword fingerprint hash value H1(f) sent by the data retrieval party, includes: performing an XOR operation on any key value of any data holder among all data holders with the query keyword fingerprint hash value H1(f) to obtain a matching result; if the matching result matches the query keyword hash value H1(key), then the subset of private data corresponding to any key value is taken as a subset of private data held by any data holder.

[0036] Some embodiments of this application use algorithms to filter the subset of queried privacy data corresponding to each data holder.

[0037] In some embodiments, generating the first set of data to be compared based on the subset of private data to be retrieved from all data holders except the first data holder includes: performing an XOR operation between each data element in the second set and each element in the third set to obtain sets 2-3. The second set is obtained based on all data elements in any retrieved privacy data subset of the second data holder, and the third set is obtained based on all data elements in any retrieved privacy data subset of the third data holder; the second and third sets are then combined. Each data element in set 2 is XORed with each data element in set 4 to obtain sets 2-4. The fourth set is obtained by considering all data elements in any of the retrieved privacy data subsets of the fourth data holder; the second to fourth sets are then combined. Each data element in set 2 is XORed with each data element in set 5 to obtain sets 2-5. Repeat the above process until the (2-n)th set is obtained. The (2-n)th set This serves as the first set of data to be compared.

[0038] Some embodiments of this application provide a method for hiding data elements using XOR operations.

[0039] In some embodiments, the second set is characterized by the following formula:

[0040]

[0041] in, The first hash function is defined as follows: H1 represents the k-th data element in the j-th retrieved privacy data subset of the second data holder; || represents concatenating the two strings located before and after it; m represents that the j-th retrieved privacy data subset includes m data elements; H1 represents the first hash function; H... c The second hash function is represented by r2, which is the second pseudo-random number received by the second data holder from the first data holder.

[0042] The third set is represented by the formula:

[0043]

[0044] in, The j-th retrieved private data subset represents the k-th data element of the third data holder; || represents concatenating the two strings located before and after it; m represents that the j-th retrieved private data subset includes m data elements; H1 represents the first hash function; H c The second hash function is represented by r3, which is the third pseudo-random number received by the third data holder from the first data holder.

[0045] In some embodiments, the 2nd to nth set This can be expressed by the formula:

[0046]

[0047] in, r represents the k-th data element in the j-th retrieved privacy data subset representing the i-th data holder. i The i-th pseudo-random number received by the i-th data holder from the first data holder is represented by ||, which represents concatenating the two strings at the beginning and end, m represents that the j-th retrieved privacy data subset includes m data elements, H1 represents the first hash function, and H c Characterizing the second hash function, Represents the XOR operation.

[0048] In some embodiments, sending the data set carrying the initial intersection result to the first data holder includes: encrypting the initial intersection result using the public key of the first data holder to obtain the data; sending the data to the first data holder, wherein the first data holder decrypts the data using its own private key and completes the mapping based on the decryption result to obtain the shared data of the data holders.

[0049] Some embodiments of this application provide a method for obtaining the intersection of privacy data from multiple parties.

[0050] Secondly, some embodiments of this application provide an apparatus for retrieving the intersection of multiple privacy sets. The apparatus includes: an acquisition module configured to acquire at least one set of commitment values ​​for each data holder among multiple data holders, wherein each set of commitment values ​​corresponds to a privacy data subset, the privacy data subset being obtained by partitioning the original privacy data sets of each data holder, and each set of commitment values ​​including keyword commitment values ​​and data element commitment values; and a query data filtering module configured to, based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each set of commitment values, filter all privacy data subsets corresponding to each data holder. The system filters out a subset of private data that meets the search criteria; a data set generation module is configured to generate a first set of data to be compared based on the subsets of private data of each data holder other than the first data holder; an intersection module is configured to perform an intersection operation on all the subsets of private data corresponding to the first data holder and the first set of data to be compared to obtain an initial intersection result; and a sending module is configured to send the data carrying the initial intersection result to the first data holder so that the first data holder can map the common data of each data holder according to the initial intersection result.

[0051] Thirdly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0052] Fourthly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method as described in any embodiment of the first aspect. Attached Figure Description

[0053] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This application provides an architecture diagram of a multi-party privacy set intersection system that supports retrieval, as illustrated in the embodiments of this application.

[0055] Figure 2 A flowchart illustrating a method for finding the intersection of multiple privacy sets that supports retrieval, as provided in embodiments of this application;

[0056] Figure 3 A block diagram illustrating the components of an apparatus for finding the intersection of multiple privacy sets that supports retrieval, as provided in embodiments of this application.

[0057] Figure 4 This is a schematic diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0058] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0059] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0060] To address the aforementioned issues, this application proposes a multi-party privacy set intersection method that supports retrieval. The intersection process involves only asymmetric encryption, hash operations, and XOR operations, with the PSI process performed by an intersection assistant. The assistant only obtains a set of commitment values ​​for the data. Since the commitment values ​​involve a double hashing process, it ensures that the assistant cannot collude with any data holder, while also resolving the key management problem. Therefore, embodiments of this application can guarantee the security of the intersection process under a semi-honest adversary security setting, while simultaneously achieving efficient multi-party intersection for retrieval.

[0061] Please refer to Figure 1 , Figure 1 The present application provides a multi-party privacy set intersection system that supports retrieval in some embodiments. The system includes: a data retrieval party, an intersection assistant party (for obtaining initial intersection results), and multiple data holders.

[0062] Figure 1 The multiple data holders include data holder 1 (i.e., the first data holder, denoted as P1), data holder 2 (i.e., the second data holder, denoted as P2), ..., up to data holder n (i.e., the nth data holder, denoted as P). n Each data holder corresponds to an original privacy data set, which is used to store multiple sensitive data, such as data representing identity, data representing bank deposits, or privacy data representing other meanings. The embodiments of this application do not limit the specific meaning of the data in the original privacy data set.

[0063] like Figure 1 As shown, the privacy intersection method performed by the multi-party privacy set intersection system supporting retrieval in some embodiments of this application includes:

[0064] The first step is for the data retrieval party to initiate a cross-interaction request (or a query request) to the first data holder, and this request is also used to transmit an accompanying r0 (the specific meaning of this parameter will be explained later).

[0065] The data retrieval direction requests the hash value H1(key) of the keyword key and the hash value H1(f) of the keyword fingerprint sent by the auxiliary party, where f = fingerprint(key) is obtained by taking a certain number of bits from H1(key).

[0066] The second step involves each data holder generating a set of commitment values.

[0067] For example, the first data holder provides a pseudo-random number to each of the other data holders. For instance, the first data holder provides a second pseudo-random number r2, and the third data holder provides a third pseudo-random number r3, etc.

[0068] The third step involves each data holder requesting the assistance party to send the encrypted set of commitment values.

[0069] For example, an asymmetric encryption algorithm can be used to encrypt the set of commitment values.

[0070] The fourth step involves the intersection assisting party obtaining the intersection of commitment values ​​(i.e., the initial intersection result) based on the received set of commitment values, and returning the intersection of commitment values ​​to the first data holder.

[0071] Fifth step: The first data holder returns the encrypted dataset intersection to the data retrieval party.

[0072] It should be noted that, Figure 1 The application architecture described in some embodiments of this application is intended to allow for the understanding that the data retrieval party can be any of the data holders. This application does not limit the specific application architecture diagram. In other words, the data retrieval party in some embodiments of this application (which can be a party other than the data holders, or one of the data holders; if it is another party) first obtains the hash function H1() and fingerprint generation function fingerprint() from the first data holder P1 (or the first participant) and initiates a privacy data intersection request with a pseudo-random number seed r0. Simultaneously, the data retrieval party sends the hash value H1(key) of the keyword key and the hash value H1(f) of the keyword fingerprint to the intersection assistance party, where f = fingerprint(key), which is obtained by taking a certain number of bits from H1(key).

[0073] The following collection Figure 2This paper exemplifies a method for performing multi-party privacy set intersection by a retrieval-enabled multi-party privacy set intersection system.

[0074] like Figure 2 As shown in the figure, an embodiment of this application provides a method for finding the intersection of multi-party privacy sets that supports retrieval. The method includes:

[0075] S101, Obtain at least one set of commitment values ​​from each of the multiple data holders.

[0076] It should be noted that each set of commitment values ​​corresponds to a subset of privacy data. The subset of privacy data is obtained by dividing the original privacy data set of each data holder. Each set of commitment values ​​includes keyword commitment values ​​and data element commitment values. The keyword commitment value is obtained by calculating the keywords of the corresponding privacy data subset, and the data element commitment value is obtained by calculating each data element in the corresponding subset.

[0077] S102, based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set, select the privacy data subsets that meet the search conditions from all privacy data subsets corresponding to each data holder.

[0078] S103, Generate a first set of data to be compared based on the subset of private data to be retrieved from all data holders except the first data holder.

[0079] S104, perform an intersection operation on all retrieved subsets corresponding to the first data holder and the first data set to be compared to obtain an initial intersection result.

[0080] S105, the data set carrying the initial intersection result is sent to the first data holder, so that the first data holder can map according to the initial intersection result to obtain the common data of each data holder.

[0081] It is easy to understand that some embodiments of this application divide the original privacy data set of each data holder into privacy data subsets, then solve for the commitment value set of the privacy data subsets, and then the intersection assisting party determines the initial intersection based on the commitment value set corresponding to each privacy data subset. This can improve the speed of data processing.

[0082] It should be noted that, in some embodiments of this application, in order to obtain the commitment value sets of each data holder, each data holder first needs to divide its original privacy data set into multiple privacy data subsets. Some embodiments of this application provide a method for finding the intersection of multiple privacy sets that supports retrieval. The data holder first groups the data set to generate multiple privacy data subsets, and then generates a commitment value set corresponding to each privacy data subset. Then, based on the keyword query request from the data retrieval party, an intersection assisting party matches the commitment value set corresponding to the keyword, and completes the multi-party privacy set intersection process, obtaining the intersection of the private data sets of each data holder corresponding to the keyword.

[0083] In other words, in some embodiments of this application, before S101, the method further includes a method for grouping the original privacy data set as follows: extracting keywords from the original privacy data sets of each data holder, and placing data elements with the same keywords in the same set to obtain multiple privacy data subsets corresponding to the respective data holders. Some embodiments of this application provide a method for dividing the original privacy data sets of each data holder to obtain multiple privacy data subsets.

[0084] For example, to implement the multi-party privacy set intersection process supporting retrieval described in some embodiments of this application, firstly, each data holder needs to extract keywords from the original privacy data set and place elements with the same keywords in the same set, thereby generating multiple privacy data subsets. As an example, each data holder can implement keyword-based privacy data subset partitioning in the following manner:

[0085] (1) Each data holder assigns a row and column number to the elements in their original privacy data set X, where X = {x} ab}, where subscript a represents the row of the data element and subscript b represents the column of the data element.

[0086] (2) Each data holder places elements with the same key in the same set, thus generating multiple subsets of private data. Assume there are n data holders P1, P2, ..., P... n For data holder i, the subset of privacy data it holds is: Privacy data subset It can be represented as: For a subset of privacy data with a data size of less than m, fill it with random values ​​to form a dataset with a data size of m.

[0087] It should be noted that some embodiments of this application require the data holders to negotiate two ideal hash functions before performing the privacy data intersection: Hc H1:{0,1} * →{0,1} λ And a fingerprint generation function fingerprint(), where H1 is used to calculate the hash value and keyword fingerprint of the data, H c Used to generate hash commitment values, where λ is a system security parameter.

[0088] It is understood that, after completing the dataset grouping and hash function negotiation, some embodiments of this application can be used to perform a method for finding the intersection of multi-party privacy sets that supports retrieval.

[0089] The following example illustrates... Figure 2 The implementation process of each step.

[0090] It should be noted that the commitment value set in some embodiments of this application includes a commitment value set corresponding to the first data holder and a commitment value set corresponding to each data holder other than the first data holder. The acquisition methods of these two types of commitment value sets are different.

[0091] In some embodiments of this application, obtaining at least one set of commitment values ​​from each of the multiple data holders exemplarily includes:

[0092] The first step involves the first data holder P1 using a random number seed r0 provided by the data retrieval party to generate a pseudo-random number for each of the other data holders besides the first data holder, thus obtaining a set of pseudo-random numbers to be sent. The value of the random number seed r0 is different in each query.

[0093] For example, some embodiments of this application provide a method for determining pseudo-random numbers based on a random number seed. The first step described above calculates the i-th pseudo-random number in the set of pseudo-random numbers using the following formula:

[0094]

[0095] Here, || represents the operation of concatenating two strings. Characterizing the XOR operation, H r A pre-negotiated hash function.

[0096] It should be noted that those skilled in the art can design pseudo-random number calculation formulas different from those described above as needed.

[0097] The second step is to generate a commitment value set based on the data elements in each privacy data subset of the first data holder P1 and all pseudo-random numbers in the pseudo-random number set.

[0098] For example, in some embodiments of this application, the process of generating a commitment value set based on data elements in each privacy data subset of the first data holder P1 and all pseudo-random numbers in the pseudo-random number set in the second step includes, for instance, the following steps: obtaining the commitment value set corresponding to the j-th privacy data subset of the first data holder includes: calculating the k-th data element in the j-th privacy data subset. The hash value is calculated to obtain the k-th hash value; the k-th hash value is concatenated with each pseudo-random number in the pseudo-random number set to obtain multiple concatenated strings to be processed; the hash values ​​of the multiple concatenated strings to be processed are calculated to obtain multiple hash commitment values; the multiple hash commitment values ​​are XORed to obtain a data element in the data element commitment value set corresponding to the j-th privacy data subset; the first hash value and the second hash value are XORed to obtain the keyword commitment value corresponding to the j-th privacy data subset, wherein the first hash value is the hash value of the keyword corresponding to the j-th privacy data subset, and the second hash value is the hash value corresponding to the keyword fingerprint of the j-th privacy data subset.

[0099] For example, in some embodiments of this application, the set of commitment values ​​for the j-th privacy data subset with the first data holder is determined by the following formula:

[0100]

[0101] Among them, key j f is used to characterize the keywords corresponding to the j-th privacy data subset. j H1 represents the fingerprint corresponding to the keyword in the j-th privacy data subset, and H1 represents the first hash function negotiated by all data holders, used to calculate the hash value of the data and the keyword fingerprint. H represents the k-th data element in the j-th privacy data subset of the first data holder, m represents the total number of data elements included in the j-th privacy data subset, [m] = {1,2,…,m}, H c A second hash function, negotiated by all data holders, is used to generate the hash commitment value. Represents the XOR operation.

[0102] Some embodiments of this application provide an algorithm for obtaining the set of commitment values ​​of the j-th privacy data subset of a first data holder.

[0103] Some embodiments of this application provide a method for generating a set of commitment values ​​corresponding to each privacy data subset of a first data holder. Using this method, elements in the privacy data subsets corresponding to the commitment value set are obfuscated using random numbers, and after two hash calculations (the calculation of the commitment value of a data element is also a hash calculation), the privacy data can be effectively protected. In some embodiments of this application, a data holder generates a pseudo-random number sequence based on a random number seed obtained from a data query party, and then obtains the data holder's set of commitment values ​​based on the pseudo-random number sequence.

[0104] It should be noted that, apart from the first data holder, each data holder needs to obtain a set of commitment values ​​corresponding to each privacy data subset associated with that data holder based on a pseudo-random number from the first data holder. For example, in some embodiments of this application, before obtaining at least one set of commitment values ​​for each data holder among the multiple data holders, the method further includes: the first data holder P1 using a random number seed r0 provided by the data retrieval party to generate a pseudo-random number for each of the other data holders among the multiple data holders, excluding the first data holder, to obtain a set of pseudo-random numbers to be sent; each pseudo-random number in the set of pseudo-random numbers is encrypted using a public key corresponding to the corresponding data holder and then sent to the corresponding data holder, so that the corresponding data holder generates all corresponding sets of commitment values ​​based on the received pseudo-random numbers. Some embodiments of this application provide a method for providing pseudo-random numbers to data holders other than the first data holder, so that the relevant data holders can calculate commitment values ​​based on the pseudo-random numbers.

[0105] The process of obtaining the set of commitment values ​​is illustrated below using the pseudo-random numbers received by each data holder as an example.

[0106] In some embodiments of this application, the i-th data holder belongs to any one of the plurality of data holders other than the first data holder, and the pseudo-random number received by the i-th data holder from the first data holder is the i-th pseudo-random number r. i S101 includes, for example, the following method for obtaining the commitment value set corresponding to the j-th privacy data subset of the i-th data holder: calculating the k-th data element in the j-th privacy data subset. The hash value is used to obtain the k-th hash value; the k-th hash value is concatenated with the i-th pseudo-random number to obtain a concatenated string to be processed, and then the hash value of the concatenated string to be processed is calculated using the second hash function to obtain the commitment value corresponding to the k-th data element; the above process is repeated m times to obtain m commitment values, and the m commitment values ​​are used as the set of data element commitment values ​​corresponding to the j-th privacy data subset; the first hash value and the second hash value are XORed to obtain the keyword commitment value corresponding to the j-th privacy data subset, wherein the first hash value is the hash value of the keyword corresponding to the j-th privacy data subset, and the second hash value is the hash value corresponding to the keyword fingerprint of the j-th privacy data subset.

[0107] For example, in some embodiments of this application, the set of commitment values ​​for the j-th privacy data subset corresponding to the i-th data holder is determined by the following formula:

[0108]

[0109] Among them, key j f is used to characterize the keywords corresponding to the j-th privacy data subset. j H1 represents the fingerprint corresponding to the keyword of the j-th privacy data subset, and H1 represents the first hash function negotiated by all data holders. H represents the k-th data element in the j-th privacy data subset of the i-th data holder, m represents the total number of data elements included in the j-th privacy data subset, [m] = {1,2,…,m}, H c A second hash function, negotiated by all data holders, is used to generate the hash commitment value. Represents the XOR operation.

[0110] Some embodiments of this application provide a method for generating a set of commitment values. In this method, elements in a privacy data subset corresponding to the set of commitment values ​​are obfuscated using random numbers and subjected to two hash calculations. The algorithm for calculating the commitment value of each data element is also a hash operation. Some embodiments of this application provide an algorithm for generating a set of commitment values ​​for any privacy data subset of each holder other than the first data holder. This algorithm involves two hash operations, ensuring that the data elements of the corresponding data holder are adequately protected.

[0111] It should be noted that, in order to improve the security of data during transmission, in some embodiments of this application, before concatenating the l-th hash value with the i-th pseudo-random number, the method further includes: the i-th data holder decrypting the received initial pseudo-random number using a private key to obtain the i-th pseudo-random number r. iThe initial pseudo-random number is obtained by applying the public key of the i-th data holder to the i-th pseudo-random number r. i The pseudo-random numbers are obtained through encryption. In some embodiments of this application, to enhance the security of the pseudo-random number transmission process, an asymmetric encryption algorithm is used to encrypt the pseudo-random data to be transmitted.

[0112] In other words, the process by which data holders in some embodiments of this application generate their own sets of commitment values ​​includes, for example,:

[0113] First, the first data holder P1 uses the random number seed r0 provided by the data retrieval party to generate random numbers for the second data holder to the nth data holder P2,... n Generate pseudo-random numbers. For example, the rules for generating pseudo-random numbers could be: Where H r :{0,1} * →{0,1} λ It is a third hash function negotiated for all data holders, and r i (i = 2, ..., n) use P2, ..., respectively. n The public key is used to encrypt the data and then sent to the second data holder, and finally to the nth data holder P2,... n .

[0114] Here, public-key encryption is used to encrypt each pseudo-random number to prevent unauthorized parties from obtaining them. Additionally, since r0 is different for each query, the generated pseudo-random number r... i The values ​​(i = 2, ..., n) are also different. This prevents the data retrieval party from obtaining information other than the intersection result after performing multiple queries.

[0115] Then, the first data holder P1 uses elements from its own subset of private data. Based on random number r i (i = 2, ..., n) Generate a set of commitment values (In this set, the part before the colon is the keyword commitment value, and the part after the colon is the XOR calculation result of the data element commitment values. Only the part after the colon is used when finding the intersection, and the same applies below.) and these... Encrypt the data using the public key of the intersection assistant and send it to the intersection assistant. Where f j =fingerprint( j ), is for H1(key jThis is obtained by taking a certain number of bits. Since the elements in the privacy data subset have been obfuscated using random numbers and protected by hash and XOR calculations, the intersection auxiliary party cannot know the data privacy information of the data holder P1.

[0116] From the second data holder to the nth data holder P2,…, n Use elements from your own subset of private data Based on its own random number r i Generate a set of commitment values (In this set, the part before the colon is the keyword commitment value, and the part after the colon is the data element commitment value. Only the part after the colon is used when finding the intersection, and the same applies below.) and these... Encrypt the data using the public key of the intersection assistant and send it to the intersection assistant. Where f j =fingerprint( j ), is for H1(key j This is obtained by taking a certain number of bits. Similarly, since the elements in each privacy data subset have been obfuscated using random numbers and protected by double hash calculations, the intersection auxiliary party cannot know the data holder P. i Data privacy information for (i = 2, ..., n).

[0117] The following example illustrates the implementation process of S101 performed by the intersection assisting party.

[0118] In some embodiments of this application, S101, obtaining at least one set of commitment values ​​from each of the multiple data holders, exemplarily includes: a requesting auxiliary party receiving all encrypted commitment value sets from each of the data holders; the requesting auxiliary party using its own private key to decrypt all encrypted commitment value sets to obtain all commitment value sets (the method for obtaining these commitment value sets can refer to the implementation method of the above embodiments). In order to improve the security of the commitment value set data, some embodiments of this application also employ asymmetric encryption algorithms to process this data, thereby enhancing its security.

[0119] The implementation process of S102 is illustrated below.

[0120] In some embodiments of this application, the keyword commitment values ​​included in each commitment value set are used as the key values ​​of the corresponding commitment value set. The corresponding S102 includes, for example, filtering out the retrieved privacy data subsets that meet the retrieval conditions from all privacy data subsets corresponding to each data holder based on the key values ​​in each commitment value set in the at least one commitment value set, as well as the query keyword hash value H1(key) and query keyword fingerprint hash value H1(f) sent by the data retrieval party.

[0121] For example, in some embodiments of this application, the process of filtering out the retrieved privacy data subsets that meet the retrieval conditions from all privacy data subsets corresponding to each data holder based on the key values ​​in each commitment value set in the at least one commitment value set and the query keyword hash value H1(key) and query keyword fingerprint hash value H1(f) sent by the data retrieval party includes, for example, performing an XOR operation on any key value of any data holder among all data holders with the query keyword fingerprint hash value H1(f) to obtain a matching result; if the matching result matches the query keyword hash value H1(key), then the privacy data subset corresponding to any key value is taken as a retrieved privacy data subset held by any data holder. Some embodiments of this application use algorithms to filter the queried privacy data subsets corresponding to each data holder. In some embodiments of this application, S103 includes, for example,:

[0122] The first step is to perform an XOR operation between each data element in the second set and each element in the third set to obtain the second and third sets. The second set is obtained from all data elements in any of the retrieved privacy data subsets of the second data holder, and the third set is obtained from all data elements in any of the retrieved privacy data subsets of the third data holder.

[0123] For example, in some embodiments of this application, the second set is characterized by the formula:

[0124]

[0125] in, The first hash function is defined as follows: H1 represents the k-th data element in the j-th retrieved privacy data subset of the second data holder; || represents concatenating the two strings located before and after it; m represents that the j-th retrieved privacy data subset includes m data elements; H1 represents the first hash function; H... c The second hash function is represented by r2, which is the second pseudo-random number received by the second data holder from the first data holder.

[0126] For example, in some embodiments of this application, the third set is characterized by the formula:

[0127]

[0128] in, The j-th retrieved private data subset represents the k-th data element of the third data holder; || represents concatenating the two strings located before and after it; m represents that the j-th retrieved private data subset includes m data elements; H1 represents the first hash function; H c The second hash function is represented by r3, which is the third pseudo-random number received by the third data holder from the first data holder.

[0129] The second step is to combine the second and third sets. Each data element in set 2 is XORed with each data element in set 4 to obtain sets 2-4. The fourth set is obtained from all data elements in any of the retrieved privacy data subsets of the fourth data holder.

[0130] The third step is to combine the second to fourth sets. Each data element in set 2 is XORed with each data element in set 5 to obtain sets 2-5.

[0131] Repeat the above process until the (2-n)th set is obtained. The (2-n)th set This serves as the first set of data to be compared.

[0132] For example, in some embodiments of this application, the 2nd to nth set This can be expressed by the formula:

[0133]

[0134] in, r represents the k-th data element in the j-th retrieved privacy data subset representing the i-th data holder. i The i-th pseudo-random number received by the i-th data holder from the first data holder is represented by ||, which represents concatenating the two strings at the beginning and end, m represents that the j-th retrieved privacy data subset includes m data elements, H1 represents the first hash function, and H c Characterizing the second hash function, Represents the XOR operation.

[0135] Some embodiments of this application provide a method for hiding data elements using XOR operations.

[0136] To enhance the security of transmitted data, in some embodiments of this application, the process of sending the data set carrying the initial intersection result to the first data holder includes, for example,: encrypting the initial intersection result using the public key of the first data holder to obtain the data; sending the data to the first data holder, wherein the first data holder decrypts the data using its own private key and completes mapping based on the decryption result to obtain the shared data of all data holders. Some embodiments of this application provide a method for obtaining multi-party intersection data.

[0137] In other words, in some embodiments of this application, after receiving the encrypted set of commitment values ​​sent by each data holder, the intersection assisting party performs set intersection according to the following steps:

[0138] (1) Decrypt the set of all received encrypted commitment values ​​using your own private key;

[0139] (2) Based on the key values ​​in each commitment value set, and the H1(key) and H1(f) sent by the data retrieval party, filter the commitment value sets that meet the following conditions:

[0140]

[0141] in, Let H1(key) be the keyword commitment value in the commitment value set, and H1(f) be the hash value of the query keyword and its fingerprint sent by the data retrieval direction assisting party. When the above formula holds, key = key. j This allows us to filter out the set of commitment values ​​from the first data holder, P1. and the i-th data holder P i The set of commitment values ​​for (i = 2, ..., n) Then use Generate a new dataset (i.e., the first dataset to be compared) as follows:

[0142]

[0143] That is: using sets Each element in the array is respectively and Perform an XOR operation on each element in the array to obtain... Then use Each element in the array is respectively and Perform an XOR operation on each element in the array to obtain... By performing XOR operations on each set separately, we can obtain the final result.

[0144] (3) Comparing sets (i.e., all retrieved subsets corresponding to the first data holder) and the set Obtain the intersection of commitment values and D C The data is encrypted using the public key of the data holder P1 and then sent to P1.

[0145] (4) The first data holder P1 uses its private key to decrypt and obtain D. C and D C Map back to your own subset of private data to obtain the intersection of the subsets of private data of each data holder.

[0146] (5) The first data holder P1 encrypts the data intersection using the public key of the data retrieval party and sends it to the data retrieval party to complete the data retrieval process.

[0147] The following example illustrates how to find the intersection of datasets among multiple participants based on search keywords. As an application example, assume there are three data holders: a bank and two supermarkets in a certain region, whose original private datasets are as follows:

[0148]

[0149] The bank acts as the first data holder P1, supermarket 1 as the second data holder P2, and supermarket 2 as the third data holder P3. The data holders negotiate two ideal hash functions: H... c ,1:{0,1} * →{0,1} λ H1 is used to calculate the hash value of the data, and H... c Used to generate hash commitment values, where λ is a system security parameter.

[0150] The data retrieval party uses "ID number" as the keyword for its query request to obtain the intersection of users from bank 1 and supermarket 2, enabling it to conduct its business in a targeted manner. Here, the data column is directly used as a subset of privacy data. Examples of methods for finding the intersection of multi-party privacy sets that support retrieval, provided in some embodiments of this application, include:

[0151] (1) The data retrieval party initiates a privacy data intersection request to the first data holder P1, along with a pseudo-random number seed r0; the data retrieval party sends the hash value H1(ID_) of the keyword "ID number" and the hash value H1(f) of the keyword fingerprint to the intersection assistant. ID_ ), where f ID_ =fingerprint(ID_ ), where "ID_NUM" represents the ID number.

[0152] (2) The first data holder P1 uses the random number seed r0 provided by the data retrieval party to generate pseudo-random numbers for the second data holder P2 and the third data holder P3. The second pseudo-random number r2 and the third pseudo-random number r3 are encrypted using the public keys of the second data holder P2 and the third data holder P3, respectively, and then sent to the second data holder P2 and the third data holder P3 accordingly.

[0153] Then, the first data holder P1 uses elements from its various privacy data subsets to generate a set of commitment values ​​corresponding to each privacy data subset, based on the second pseudo-random number r2 and the third pseudo-random number r3. Taking the generation of the commitment value set corresponding to the keyword "ID number" as an example, it can be represented as follows:

[0154]

[0155] Then, the first data holder P1 encrypts these sets of commitment values ​​using the public key of the requesting assistant and sends them to the requesting assistant.

[0156] Meanwhile, the second data holder P2 uses elements from its various subsets of private data to generate a set of commitment values ​​based on its own random number r2. Again, taking the generation of the commitment value set corresponding to the keyword "ID number" as an example, it can be represented as follows:

[0157] These commitment value sets are then encrypted using the public key of the intersection assistant and sent to the intersection assistant. Similarly, the third data holder P3 uses elements from its various privacy data subsets to generate a commitment value set based on its third random number r3. Taking the generation of the commitment value set corresponding to the keyword "ID number" as an example, it can represent... These commitment values ​​are then encrypted using the public key of the requesting assistant and sent to the requesting assistant.

[0158] (3) After receiving the set of encrypted commitment values ​​sent by each data holder, the intersection assistant performs the intersection of the sets according to the following steps:

[0159] 1) Decrypt the set of all encrypted commitment values ​​using your own private key;

[0160] 2) Based on the key values ​​in each commitment value set, and the H1(ID_NUM) and H1(f) sent by the data retrieval party. ID_NUM ), filter the set of commitment values ​​that meet the following conditions:

[0161]

[0162] Filter out the set of commitment values ​​for key = ID_NUM and Then use the filtered results and Generate a new dataset as follows:

[0163]

[0164] in,

[0165]

[0166]

[0167]

[0168]

[0169] 3) Comparing sets and set Obtain the intersection of commitment values

[0170] and D C The data is encrypted using the public key of the data holder P1 and then sent to P1.

[0171] (4) The first data holder P1 uses its private key to decrypt and obtain D. C and D C Map back to your own privacy data subset, and you get the intersection of the privacy data subsets of each data holder as DI = {123, 456, 789}.

[0172] (5) The first data holder P1 uses the public key of the data retrieval party to encrypt the intersection data and sends it to the data retrieval party to complete the data retrieval process.

[0173] The beneficial effects of some embodiments of this application are as follows: The data encryption and decryption process is based on the existing asymmetric encryption keys of all parties, and no key synchronization is required during the intersection process, thereby solving the key generation and management problem in the third-party assisted PSI process. Using random numbers to obfuscate the original data and performing double hashing based on two ideal hash functions ensures that the original data is not leaked. During the intersection process, only XOR and comparison operations are needed on the set of commitment values, thus solving the problem of low intersection efficiency in third-party assisted PSI while ensuring data privacy and security.

[0174] The key technical points involved in some embodiments of this application are as follows: (1) A secure hash commitment scheme is used to effectively conceal the data elements in the original privacy data set, thereby ensuring that the original data does not leave the local data holder during the third-party assisted multi-party PSI process, thereby avoiding the leakage of privacy information; (2) The intersection assisting party uses XOR operation and comparison operation based on a secure hash commitment scheme to implement the PSI process of the multi-party commitment value set, thereby reducing the algorithm complexity of the third-party assisted multi-party PSI and effectively improving the intersection efficiency of the third-party assisted multi-party PSI.

[0175] Please refer to Figure 3 , Figure 3 The present application illustrates an apparatus for finding the intersection of multiple privacy sets that supports retrieval, as provided in an embodiment of this application. It should be understood that this apparatus is similar to the one described above. Figure 2 Corresponding to the method embodiments, it can execute the various steps involved in the above method embodiments. The specific functions of the device can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes at least one software function module that can be stored in the memory or embedded in the device's operating system in the form of software or firmware. The device that supports the intersection of retrieved multi-party privacy sets includes: an acquisition module 301, a query data filtering module 302, a data set generation module 303, an intersection module 304, and a sending module 305.

[0176] The acquisition module is configured to acquire at least one set of commitment values ​​from each of the multiple data holders, wherein each set of commitment values ​​corresponds to a privacy data subset, which is obtained by partitioning the original privacy data sets of each data holder. Each set of commitment values ​​includes keyword commitment values ​​and data element commitment values.

[0177] The query data filtering module is configured to filter out the private data subsets that meet the search conditions from all private data subsets corresponding to each data holder, based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set.

[0178] The data set generation module is configured to generate a first data set to be compared based on the retrieved privacy data subsets of all data holders except the first data holder.

[0179] The intersection module is configured to perform an intersection operation on all retrieved subsets corresponding to the first data holder and the first data set to be compared to obtain an initial intersection result.

[0180] The sending module is configured to send data carrying the initial intersection result to the first data holder, so that the first data holder can map the common data of the data holders based on the initial intersection result.

[0181] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0182] Some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any of the embodiments of the above-described method for finding the intersection of multi-party privacy sets that supports retrieval.

[0183] like Figure 4 As shown, some embodiments of this application provide an electronic device 500, including a memory 510, a processor 520, and a computer program stored on the memory 510 and executable on the processor 520, wherein when the processor 520 reads the program from the memory via a bus 530 and executes the program, it can implement any of the methods described in the above-described method for finding the intersection of multiple privacy sets supported for retrieval.

[0184] Processor 520 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 520 can be a microprocessor.

[0185] The memory 510 can be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 520 of the embodiments of this disclosure can be used to execute the instructions in the memory 510 to implement… Figure 2 The method shown. Memory 510 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0187] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0188] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0189] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0190] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0191] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for finding the intersection of multi-party privacy sets that supports retrieval, characterized in that, The method includes: Obtain at least one set of commitment values ​​from each data holder among multiple data holders, wherein each set of commitment values ​​corresponds to a privacy data subset, which is obtained by partitioning the original privacy data sets of each data holder. Each set of commitment values ​​includes keyword commitment values ​​and data element commitment values; the keyword commitment values ​​are obtained by performing calculations on the keywords of the privacy data subset, and the data element commitment values ​​are obtained by performing calculations on each data element in the privacy data subset. Based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set, the retrieved privacy data subsets that meet the search conditions are selected from all privacy data subsets corresponding to each data holder. The first set of data to be compared is generated based on the subset of private data retrieved from all data holders except the first data holder. The initial intersection result is obtained by performing an intersection operation on all retrieved subsets corresponding to the first data holder and the first data set to be compared. The data set carrying the initial intersection result is sent to the first data holder, so that the first data holder can map the data to obtain the common data of each data holder based on the initial intersection result.

2. The method as described in claim 1, characterized in that, Before obtaining at least one set of commitment values ​​from each participant among the multiple data holders, the method further includes: Keywords are extracted from the original privacy data sets of each data holder, and data elements with the same keywords are placed in the same set to obtain multiple privacy data subsets corresponding to the respective data holders.

3. The method according to any one of claims 1-2, characterized in that, The step of obtaining at least one set of commitment values ​​from each data holder among multiple data holders includes: By the first data holder Use the random number seed provided by the data retrieval provider. A pseudo-random number is generated for each of the data holders other than the first data holder, resulting in a set of pseudo-random numbers to be sent, wherein the random number seed... The value varies in each query; According to the first data holder A commitment value set is generated by combining the data elements in each privacy data subset with all pseudo-random numbers in the pseudo-random number set.

4. The method as described in claim 3, characterized in that, The first number in the pseudo-random number set is calculated using the following formula. Pseudo-random numbers: in, This represents the operation of concatenating two strings; Characterize the XOR operation, A pre-negotiated hash function.

5. The method as described in claim 3, characterized in that, According to the first data holder A commitment value set is generated from the data elements in each subset of privacy data and all pseudo-random numbers in the pseudo-random number set, including: With the first data holder The method for obtaining the set of commitment values ​​corresponding to the subset of privacy data includes the following steps: Calculate the first The first in the subset of privacy data Data elements The hash value of the first [item] is obtained. Hash value; The first The hash value is concatenated with each pseudo-random number in the set of pseudo-random numbers to obtain multiple concatenated strings to be processed. Calculate the hash values ​​of the multiple strings to be concatenated, obtaining multiple hash commitment values. XOR these multiple hash commitment values ​​to obtain the result that is the hash of the first string. A data element in the set of commitment values ​​corresponding to the subset of privacy data; XORing the first hash value with the second hash value yields the result equal to the hash value of the first hash value. The keyword commitment value corresponding to the subset of privacy data, wherein the first hash value is the same as the keyword commitment value of the subset of privacy data. The hash value of the keyword corresponding to the privacy data subset, the second hash value being the same as the first... The hash value corresponding to the keyword fingerprint of the privacy data subset.

6. The method as described in claim 5, characterized in that, The following formula is used to determine the first data holder's... The set of commitment values ​​corresponding to the subset of privacy data: in, Used to characterize the first Keywords corresponding to the subset of privacy data Characterizing the first Fingerprints corresponding to keywords in a subset of privacy data. The first hash function, representing the consensus reached by all data holders, The first data holder's The first in the subset of privacy data Data elements, Characterizing the first The total number of data elements included in the privacy data subset. , A second hash function negotiated for all data holders. The XOR operation represents the number of data holders.

7. The method as described in claim 3, characterized in that, Before obtaining at least one set of commitment values ​​from each of the multiple data holders, the method further includes: By the first data holder Use the random number seed provided by the data retrieval provider. A pseudo-random number is generated for each of the data holders other than the first data holder, to obtain a set of pseudo-random numbers to be sent; Each pseudo-random number in the pseudo-random number set is encrypted using the public key corresponding to the corresponding data holder and then sent to the corresponding data holder, so that the corresponding data holder can generate a set of all corresponding commitment values ​​based on the received pseudo-random numbers.

8. The method as described in claim 7, characterized in that, No. The data holder is any one of the plurality of data holders other than the first data holder, the first... The pseudo-random number received by the data holder from the first data holder is the first... Pseudo-random numbers ,in, The step of obtaining at least one set of commitment values ​​from each data holder among multiple data holders includes: With the first The data holder's first The set of commitment values ​​corresponding to the subset of privacy data is obtained as follows: Calculate the first The first in the subset of privacy data Data elements The hash value of the first [item] is obtained. Hash value; The first Hash value and the first Pseudo-random numbers are concatenated to obtain a concatenated string to be processed. Then, a second hash function is used to calculate the hash value of the concatenated string to be processed, obtaining the hash value of the string that is concatenated with the first hash function. The commitment value corresponding to the data element; Repeat all the above processes for a total of Next, get A commitment value, the aforementioned The commitment value is used as the first... The set of committed values ​​for data elements corresponding to the subset of privacy data; XORing the first hash value with the second hash value yields the result equal to the hash value of the first hash value. The keyword commitment value corresponding to the privacy data subset, wherein the first hash value is the same as the first... The hash value of the keyword corresponding to the privacy data subset, the second hash value being the same as the first... The hash value corresponding to the keyword fingerprint of the privacy data subset.

9. The method as described in claim 8, characterized in that, The following formula is used to determine the relationship with the first... The data holder's corresponding first The set of commitment values ​​for the subset of privacy data: in, Used to characterize the first Keywords corresponding to the subset of privacy data Characterizing the first Fingerprints corresponding to keywords in a subset of privacy data. The first hash function, representing the consensus reached by all data holders, Characterizing the first The data holder's first The first in the subset of privacy data Data elements, Characterizing the first The total number of data elements included in the privacy data subset. , A second hash function negotiated for all data holders. Represents the XOR operation.

10. The method according to any one of claims 8-9, characterized in that, In the first Hash value and the first Before concatenating the pseudo-random numbers, the method further includes: The first The data holder decrypts the received initial pseudo-random number using their private key to obtain the first... Pseudo-random numbers Wherein, the initial pseudo-random number is based on the first... The public key of the data holder to the first Pseudo-random numbers It was obtained through encryption.

11. The method as described in claim 1, characterized in that, The step of obtaining at least one set of commitment values ​​from each data holder among multiple data holders includes: The auxiliary party is required to receive a set of all encrypted commitment values ​​from the respective data holders. The assisting party uses its private key to decrypt the set of all encrypted commitment values ​​to obtain the set of all commitment values.

12. The method as described in claim 1, characterized in that, The keyword commitment values ​​included in each commitment value set serve as the keys of the corresponding commitment value set, wherein, The step of selecting the subset of private data that meets the search criteria from all subsets of private data corresponding to each data holder, based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set, includes: Based on the key values ​​in each commitment value set in the at least one commitment value set, and the hash value of the query keywords sent by the data retrieval party. and query keyword fingerprint hash value Select the subset of privacy data that meets the search criteria from all the subsets of privacy data corresponding to each data holder.

13. The method as described in claim 12, characterized in that, The key value is based on the key value in each commitment value set in the at least one commitment value set, and the hash value of the query keyword sent by the data retrieval party. and query keyword fingerprint hash value From all privacy data subsets corresponding to each data holder, select the privacy data subsets that meet the search criteria, including: Combine any key value from any data holder among all the data holders with the fingerprint hash value of the query keyword. Perform an XOR operation to obtain the matching result; If the result to be matched matches the hash value of the query keyword If a match is found, the subset of privacy data corresponding to any one of the key values ​​will be considered as a subset of the retrieved privacy data held by any one of the data holders.

14. The method as described in claim 1, characterized in that, The process of generating the first set of data to be compared based on the subset of private data retrieved from all data holders except the first data holder includes: The second and third sets are obtained by performing an XOR operation between each data element in the second set and each element in the third set. The second set is obtained based on all data elements in any of the retrieved privacy data subsets of the second data holder, and the third set is obtained based on all data elements in any of the retrieved privacy data subsets of the third data holder. The second and third sets Each data element in set 2 is XORed with each data element in set 4 to obtain sets 2-4. The fourth set is obtained from all data elements in any of the retrieved privacy data subsets of the fourth data holder; Sets 2-4 Each data element in set 2 is XORed with each data element in set 5 to obtain sets 2-5. ; Repeat all the above processes until the (2-n)th set is obtained. ; The (2-n)th set This serves as the first set of data to be compared.

15. The method as described in claim 14, characterized in that, The second set is represented by the formula: in, The second data holder's The first subset of retrieved privacy data Data elements, The representation concatenates the two strings located before and after it. Characterizing the first The subset of privacy data being retrieved includes One data element, The first hash function, representing the consensus reached by all data holders, The second hash function represents the consensus reached by all data holders. It is the second pseudo-random number received by the second data holder from the first data holder; The third set is represented by the formula: in, The third data holder The first subset of retrieved privacy data Data elements, The representation concatenates the two strings located before and after it. Characterizing the first The subset of privacy data being retrieved includes One data element, Characterizing the first hash function, Characterizing the second hash function, It is the third pseudo-random number received by the third data holder from the first data holder.

16. The method as described in claim 14, characterized in that, The (2-n)th set This can be expressed by the formula: ； in, Characterizing the first The data holder's first The first in the subset of retrieved privacy data Data elements, Characterizing the first The data holder receives the first data holder's... Pseudo-random numbers, The representation concatenates the two strings located before and after it. Characterizing the first The subset of privacy data being retrieved includes One data element, The first hash function, representing the consensus reached by all data holders, The second hash function represents the consensus reached by all data holders. Represents the XOR operation.

17. The method as described in claim 1, characterized in that, Sending the data set carrying the initial intersection result to the first data holder includes: The initial intersection result is encrypted using the public key of the first data holder to obtain the data; The data is sent to the first data holder, who decrypts the data using their private key and completes the mapping based on the decryption result, thereby obtaining the shared data of all data holders.

18. An apparatus for finding the intersection of multi-party privacy sets that supports retrieval, characterized in that, The device includes: The acquisition module is configured to acquire at least one set of commitment values ​​from each data holder among multiple data holders, wherein each set of commitment values ​​corresponds to a privacy data subset, which is obtained by partitioning the original privacy data sets of each data holder. Each set of commitment values ​​includes keyword commitment values ​​and data element commitment values. The keyword commitment values ​​are obtained by performing calculations on the keywords of the corresponding privacy data subset, and the data element commitment values ​​are obtained by performing calculations on each data element in the corresponding subset. The query data filtering module is configured to filter out the subset of private data that meets the search conditions from all the subsets of private data corresponding to each data holder, based on the keywords corresponding to the query request and the keyword commitment values ​​corresponding to each commitment value set. The data set generation module is configured to generate a first data set to be compared based on the retrieved privacy data subsets of all data holders except the first data holder. The intersection module is configured to perform an intersection operation on all retrieved subsets corresponding to the first data holder and the first data set to be compared to obtain an initial intersection result. The sending module is configured to send data carrying the initial intersection result to the first data holder, so that the first data holder can map the common data of the data holders based on the initial intersection result.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it can implement the method as described in any one of claims 1-17.

20. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the program, it can implement the method as described in any one of claims 1-17.

Images