A distributed social graph data subgraph security counting method and system

Abstract

The application provides a kind of distributed social graph data subgraph security counting method and system, it is related to information security technical field, method includes: user node terminal generates initial partition set according to local holding local social graph data, multiple confusion triplets are added in initial partition set, and confusion partition set is obtained;According to the relationship parameter in confusion partition set is encrypted according to replication secret sharing protocol, the secret sharing share combination of confusion partition set is obtained, and is sent to three encryption terminals respectively;Three encryption terminals respectively according to the secret sharing share combination of confusion partition set held locally, determine the secret sharing share of subgraph counting result in global social graph based on replication secret sharing protocol, the secret sharing share of subgraph counting result held locally is sent to demand terminal;Demand terminal obtains the plaintext data of subgraph counting result according to the secret sharing share received.The application can realize the data in the process of social graph data subgraph counting.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a distributed social graph data subgraph security counting method and system. BACKGROUND

[0002] Graph data can describe complex relationships between entities, and various analysis tasks can be performed on information-rich graph data. Graph data analysis is often used in social network analysis. When graph data is in a distributed form, the analysis tasks on the graph become more challenging. The so-called distributed form means that each entity can only obtain partial data about the entire graph (named local graph data). For example, in a social network, each user is a graph node, and each user's social software follow information represents the connection between the user and other users (i.e., edges in the graph data). Obviously, if the social network is modeled as a graph, no entity can directly obtain the information of the entire graph. Instead, each user can only understand a part of the connection (for example, the users they follow). Collecting such distributed graph data for graph task analysis can cause great privacy concerns (for example, people may not want to disclose and share their social network list). Therefore, it is necessary to introduce a privacy protection mechanism in the task analysis on such distributed graph data, so that valuable graph analysis tasks can be performed without compromising the sensitive and private local graph data of each user.

[0003] Subgraph counting is a basic task in graph analysis, which refers to determining the number of subgraphs with a given shape on a large graph. Subgraph counting plays an important role in social graph data analysis and can be used to study social relationship characteristics, discover social roles, and characterize social networks. For example, the probability that two friends of a user in a social network are still friends can be evaluated by the number of k-star subgraphs and triangle subgraphs in the social network graph.

[0004] However, in the prior art, there is only a subgraph counting scheme for privacy protection of centralized graph data. In this scheme, a trusted entity needs to hold complete plaintext graph data. There is no privacy-protected secure subgraph counting method for distributed social graph data. SUMMARY

[0005] The present application provides a distributed social graph data subgraph security counting method and system to solve the defect that there is no privacy-protected subgraph counting scheme on distributed social graph data in the prior art, and to realize distributed social graph data subgraph security counting.

[0006] The present application provides a distributed social graph data subgraph security counting method, comprising:

[0007] The user node terminal generates an initial subset according to local holding partial social graph data, the initial subset includes multiple groups of original triples, each group of original triples includes a first node ID, a second node ID, and a relationship parameter of a connection edge from the first node ID to the second node ID, the first node ID is the node ID corresponding to the user node terminal in the global social graph, the connection edge from the first node ID to the second node ID exists in the partial social graph, and the relationship parameter of the connection edge from the first node ID to the second node ID is 1, the user node terminal adds multiple confusion triples in the initial subset to obtain a confusion subset, each confusion triple includes the first node ID, a confusion node ID, and a relationship parameter of a connection edge from the first node ID to the confusion node ID, the connection edge from the first node ID to the confusion node ID does not exist in the partial social graph, and the relationship parameter of the connection edge from the first node ID to the confusion node ID is 0, the nodes in the social graph data correspond to entities in a social network, and the edges in the social graph data correspond to relationships between the entities in the social network.

[0008] The user node terminal encrypts the relationship parameters in the confusion subset according to a replicated secret sharing protocol to obtain a first secret sharing share combination, a second secret sharing share combination, and a third secret sharing share combination of the confusion subset, sends the first secret sharing share combination to a first encryption terminal, sends the second secret sharing share combination to a second encryption terminal, and sends the third secret sharing share combination to a third encryption terminal, wherein the first secret sharing share combination includes a first secret sharing share and a second secret sharing share of the relationship parameters in the confusion subset, the second secret sharing share combination includes a second secret sharing share and a third secret sharing share of the relationship parameters in the confusion subset, and the third secret sharing share includes a third secret sharing share and a first secret sharing share of the relationship parameters in the confusion subset.

[0009] The first encryption terminal, the second encryption terminal, and the third encryption terminal respectively determine secret sharing shares of subgraph counting results in the global social graph based on the secret sharing share combinations of the confusion subset sent by each user node terminal according to the local holding secret sharing share combinations, and send the secret sharing shares of the subgraph counting results to a demand terminal.

[0010] The demand terminal obtains plaintext data of the subgraph counting results according to the received secret sharing shares of the subgraph counting results.

[0011] The application also provides a distributed social graph data subgraph security counting system, comprising a first encryption terminal, a second encryption terminal, a third encryption terminal and a plurality of user node terminals; the first encryption terminal, the second encryption terminal and the third encryption terminal are respectively in communication connection with the plurality of user node terminals to cooperatively complete the distributed social graph data subgraph security counting method.

[0012] The distributed social graph data subgraph security counting method and system provided by the application add false edges in the connection edge information of the local partial social graph data held by the user node terminal in the partial social graph, and set the relationship parameter of the false edges to 0, then encrypt and send the data to the first encryption terminal, the second encryption terminal and the third encryption terminal through copy secret sharing, and the first encryption terminal, the second encryption terminal and the third encryption terminal obtain the secret sharing shares of the subgraph counting based on the copy secret sharing protocol, since the relationship parameter of the false edges is 0, the result of the subgraph counting will not be affected, and the number of edges in the partial social graph data will not be exposed to other terminals, the first encryption terminal, the second encryption terminal and the third encryption terminal can only obtain the secret sharing shares of the private data to be protected throughout the process, and cannot obtain the plaintext data, and the data privacy protection in the subgraph counting process of the social graph data is realized. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0014] Figure 1 Algorithm diagram of the subgraph counting method for the plaintext domain Figure 1 ;

[0015] Figure 2 Algorithm diagram of the subgraph counting method for the plaintext domain Figure 2 ;

[0016] Figure 3 Example diagram of the subgraph counting task

[0017] Figure 4 Flowchart of the distributed social graph data subgraph security counting method provided by the application

[0018] Figure 5 Schematic diagram of the application scene of the distributed social graph data subgraph security counting method provided by the application

[0019] Figure 6The algorithm schematic diagram of the user node terminal encrypting the local partial social graph in the distributed social graph data subgraph security counting method provided by the application;

[0020] Figure 7 The algorithm schematic diagram of the k-star subgraph counting in the distributed social graph data subgraph security counting method provided by the application Figure 1 ;

[0021] Figure 8 The algorithm schematic diagram of the triangle subgraph counting in the distributed social graph data subgraph security counting method provided by the application Figure 1 ;

[0022] Figure 9 The algorithm schematic diagram of the triangle subgraph counting in the distributed social graph data subgraph security counting method provided by the application Figure 2 ;

[0023] Figure 10 The algorithm schematic diagram of the k-star subgraph counting in the distributed social graph data subgraph security counting method provided by the application Figure 2 ;

[0024] Figure 11 The algorithm schematic diagram of the triangle subgraph counting in the distributed social graph data subgraph security counting method provided by the application Figure 3 ;

[0025] Figure 12 The structure schematic diagram of the distributed social graph data subgraph security counting system provided by the application. DETAILED DESCRIPTION

[0026] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without any creative work fall within the protection scope of the present application.

[0027] In order to facilitate those skilled in the art to understand the technical solutions of the distributed social graph data subgraph security counting method provided by the present application, the technical background of the method provided by the present application is described first.

[0028] 1. Subgraph counting in plaintext

[0029] Social networks are inherently graph data. Each user in a social network can be considered a node in the graph, and the relationships between users can be seen as edges connecting them. For example, when user A follows user B in a social network, it can be viewed as an edge connecting node A to node B in the corresponding social graph. Let G represent a complete graph, which is represented as an N*N adjacency matrix A, where N is the number of graph nodes in G (graph nodes are represented as v). i (i∈[1,N]). Let A[i,j],i≠j,i,j∈[1,N] represent node v. i and node v j The edges between nodes. Specifically, if graph G is a directed graph, then A[i,j] = 1 indicates that there exists an edge between node v. i to node v j The edges, and A[i,j]=0 indicates that there is no follower node v. i to node v j The edges. And if graph G is an undirected graph, then A[i,j]=1 represents node v. i and node v j There exists an edge between them, and A[i,j]=0 represents node v. i and node v j There are no edges between them. Let A[i,:] denote the i-th row of matrix A, which represents node v. i The connection relationships with all other nodes in graph G. With node v i The number of connected edges is called the number of nodes v. i The degree is denoted as d. i The maximum degree in graph G is represented by d. max .

[0030] Given a large graph G and a target subgraph shape, subgraph counting determines the number of all subgraphs in G that have the given shape. We will illustrate subgraph counting with the most basic and popular subgraph counting tasks: k-star subgraph counting and triangle subgraph counting. A k-star subgraph is a subgraph consisting of a central node and its k neighboring nodes, while a triangle subgraph is a subgraph consisting of three interconnected nodes.

[0031] The number of k-star subgraphs in the graph data (denoted as n) k★ It can be calculated using formula (1).

[0032]

[0033] Where d i Represents node v in graph G i The degree of node v in a directed graph, i ∈ [1, N]. It is important to note that for a directed graph, the degree of node v is... i degree di is the sum of the out-degree and in-degree of v i i is the number of k-combinations of d i

[0034]

[0035] The number of triangle subgraphs on graph G is denoted as n △ . Figure 1 and Figure 2 The algorithms shown give the method of counting triangle subgraphs on the plain domain undirected graph and directed graph respectively.

[0036] Figure 3 A undirected graph and a directed graph are given in the paper, and their 2-star subgraph number, 3-star subgraph data and triangle subgraph number are given as examples of subgraph counting.

[0037] 2, Local differential privacy

[0038] Compared with the traditional differential privacy model, which assumes that a trusted data collector can see the original data, there is an updated local differential privacy technology in the prior art. The local differential privacy (LDP) considers that the data collector is untrusted. In LDP, each user only shares his own noisy local data. In the scenario of social graph data, there is also a definition of (∈, δ)-edge LDP about the adjacency list of two adjacent users. The adjacency list of two adjacent users refers to the local graph data A[i, :] and A[j, :] of the two users, which are only different in one element.

[0039] Definition 1: A mechanism M satisfies (∈, δ)-edge LDP if and only if for any two adjacent adjacency lists A[i, :] and A[j, :], there is:

[0040]

[0041] Where Range(M) represents all possible outputs of mechanism M, ε represents the privacy budget, and δ represents the privacy parameter. In addition, the laplace distribution is one of the most popular noise distributions, which can be defined as:

[0042] Definition 2: A discrete random variable obeys the laplace distribution Lap(ε, δ, Δ) if its probability density function satisfies the formula

[0043] Where μ is the mean of the laplace distribution, ​​

[0044] where Δ denotes the sensitivity of the function, which can be used to measure the extent to which the data of a single entity can change the data output in the worst case.

[0045] 3. Replicated secret sharing

[0046] Given a secret value x Replicated secret sharing (RSS) partitions x into three secret shares <x> 1、 <x>2 and where x= 0 <x> 1+ <x> 2+ <x>3. Three pairs of shares <x> 1, <x> 2)、( <x> 2, <x>3) and ( <x> 3, <x>1) held by three parties P1, P2 and P3 respectively. For ease of description, in the following, the notation i±1 is used to denote the next (+) party (or secret share) or the previous (+) party (or secret share), respectively, i.e. P 3+1 (Or <x> 3+1 ) represents P1(or <x>1), P 1-1 (Or <x> 1-1 ) represents P3( or <x>3). By this representation method, it is possible to use <x> i , <x> i+1 ) represents P i (i∈{1,2,3}) holds, and let the encrypted value x be represented as The basic operations of RSS of a field include the following three:

[0047] (1) Addition / subtraction: Performing addition and subtraction operations on two secret shared values only requires local computation. To compute Each party P i Local computation i ＝ <x> i + <y> i and <x> i ＝ <x> i + <y> i .

[0048] (2) Scalar multiplication: one plain number η and one secret share number of scalar multiplication also requires only local computation. To compute each party P i local computation i = η · <x> i and i+1 = η · <x> i+1 .

[0049] Secret sharing multiplication: To compute Each party P i First locally compute <z> i ＝ <x> i × <y> i + <x> i × <y> i+1 + <x> i+1 × <y> i But this operation will produce additive secret sharing that is each party P i holds only <z> i To obtain replicated secret shares for subsequent computations, P i a re-sharing operation is needed between P i Each party P i+1 a masked share (i.e. masked <z> i +<α> i , where <α> i It is a new (fresh) secret share about 0, i.e., <α>1+<α>2+<α>3=0. Such a new secret share about 0 can be represented by an output field of... The pseudorandom function (PRF) is efficiently generated. Specifically, during the initialization phase, each P... i Sample a PRF key k i And send k i Give P i+1 Then, in order to generate the j-th new secret shared share about 0, each party P... i Local computation<α> i =F(k) i ,j)+F(k i-1 ,j), which satisfies <α>1+<α>2+<α>3=0.

[0050] 4. Function secret sharing

[0051] Function Secret Sharing (FSS) is an extension of Additive Secret Sharing that enables secure function computation with relatively low communication overhead. Therefore, FSS offers significant performance advantages over conventional secret sharing in high-latency networks. In summary, a two-party FSS-based privacy function f consists of the following two abstract algorithms:

[0052] (k1,k2)←Gen(1 λ f): Given a security parameter λ and a function description f, output two FSS keys k1 and k2, each for a computation participant.

[0053] <f(x)> i ←Eval(k i x): Given an FSS key k i Given an evaluation point x, output a secret shared share of the evaluation result.<f(x)> i .

[0054] FSS ensures that if an attacker learns only one of the two FSS keys, they will not gain any sensitive information about the objective function or the computation of the output f(x).

[0055] The following is combined with Figures 4-12 The application discloses a distributed social graph data subgraph security counting method. The application provides a method applied to social network analysis, wherein each node in a global social graph corresponds to a user in a social network, and an edge in the global social graph corresponds to a relationship between users in the social network, for example, when a user A follows a user B, a connection edge from a node corresponding to the user A to a node corresponding to the user B exists in the global social graph. A terminal corresponding to each user is referred to as a user node terminal, and the user node terminal holds a local social graph of the user, wherein the local social graph describes relationships between the user and other users in the global social graph that can be known by the user; and data related to the user stored in the user node terminal can not be complete, because some data can be known by other users but cannot be known by the user, for example, a "stealth following" function provided in a social software, when the user A follows the user B by using the "stealth following" function, a connection edge from the user A to the user B exists in the local social graph held by the user node terminal corresponding to the user A, but a connection edge from the user A to the user B does not exist in the local social graph held by the user node terminal corresponding to the user B. In the prior art, if the global social graph is to be analyzed, local social graphs of all users need to be collected to combine the global social graph in plaintext and then analyze the global social graph, which obviously infringes on the privacy of the users. The distributed social graph data subgraph security counting method provided by the application can realize subgraph counting of the global social graph without infringing on the privacy of the users, so as to realize safe global social graph analysis. The distributed global social graph can be represented in the form of an adjacency matrix A with a size of N*N, wherein each row A[i,:](i∈[1,N]) in the adjacency matrix represents local social graph data held by a user U i A[i,j] = 1 can represent that there is a relationship between the user U i and the user U j . These users allow a cloud server to perform a subgraph counting task on joint data of their local graph data (i.e., the complete graph data), which is a basic and core operation in the field of graph analysis. However, due to privacy concerns, each user U i is unwilling to disclose the private local graph data A[i,:] of the user, because that will leak sensitive information of the user. In the method provided by the application, a participant providing a cloud computing service is a CS {1,2,3} , and the CS {1,2,3} comes from different trust domains. In a real industrial scenario, the CS {1,2,3} can be provided by three cloud service providers in competition. The CS {1,2,3} assists in performing the subgraph counting task, and cannot obtain any sensitive information of the users throughout the process, and cannot obtain the subgraph counting result in plaintext, because the number of subgraphs on the graph data also contains sensitive information.

[0056] The method provided by the present application considers a non-collusion, majority honest threat model, i.e. CS {1,2,3} Each of the users U

[0057] As mentioned above, the local graph data A[i, :] of each user U i (i∈[1, N]) reflects the sensitive connection relationship of the user U i with other users. Therefore, under the threat model mentioned above, the sensitive information that the method provided by the present application aims to protect is the non-zero elements in A[i, :] of each user U i , the positions and quantities of the non-zero elements, which respectively reflect which users are friends of the user U i in the social graph data and the number of friends of U i .

[0058] As shown in Figure 4 , the method comprises the steps of:

[0059] S100, a user node terminal generates an initial subset according to the local partial social graph data held by the user node terminal, the initial subset comprising a plurality of groups of original triplets, each group of original triplets comprising a first node ID, a second node ID, and a relationship parameter of a connection edge from the first node ID to the second node ID, the first node ID being a node ID corresponding to the user node terminal in a global social graph, the partial social graph having the connection edge from the first node ID to the second node ID, the relationship parameter of the connection edge from the first node ID to the second node ID being 1, the user node terminal adding a plurality of confusion triplets to the initial subset to obtain a confusion subset, each confusion triplet comprising the first node ID, a confusion node ID, and a relationship parameter of a connection edge from the first node ID to the confusion node ID, the partial social graph not having the connection edge from the first node ID to the confusion node ID, the relationship parameter of the connection edge from the first node ID to the confusion node ID being 0, the nodes in the social graph data corresponding to entities in a social network, and the edges in the social graph data corresponding to relationships between the entities in the social network;

[0060] S200: The user node terminal encrypts the relationship parameters in the obfuscated subset according to the replication secret sharing protocol to obtain a first secret sharing share combination, a second secret sharing share combination, and a third secret sharing share combination of the obfuscated subset. The first secret sharing share combination is sent to a first encryption terminal, the second secret sharing share combination is sent to a second encryption terminal, and the third secret sharing share combination is sent to a third encryption terminal. The first secret sharing share combination includes the first secret sharing share and the second secret sharing share of the relationship parameters in the obfuscated subset. The second secret sharing share combination includes the second secret sharing share and the third secret sharing share of the relationship parameters in the obfuscated subset. The third secret sharing share includes the third secret sharing share and the first secret sharing share of the relationship parameters in the obfuscated subset.

[0061] Specifically, such as Figure 5 As shown, the method provided by this invention involves three types of entities: N users U i (i∈[1,N]), three encryption terminals: the first encryption terminal CS1, the second encryption terminal CS2, and the third encryption terminal CS3 (abbreviated as CS). {1,2,3} The data, belonging to each user and the analyst, is stored on their respective user node terminals. These terminals can be cloud servers, personal computers, or other computing-capable devices. The analyst's terminal is the demand terminal, which needs to obtain the subgraph count results of the global social graph for subsequent analysis tasks. Each user's local social graph data constitutes a complete global social graph. In the social graph, each graph node represents a user in the social network, and the edges represent the relationships between users. The size of each user's local data represents the degree of each node (e.g., the number of contacts each user has in an address book scenario).

[0062] First, each user's corresponding user node terminal encrypts its locally held local social graph and sends it to each encrypted terminal for encryption computation. In the method provided by this invention, each user node terminal encrypts its locally held A[i,:] based on the RSS (Replicated Secret Sharing) protocol. Since distributed graph data is typically sparse, the method provided by this invention uses a triplet encoding method, that is, each user node terminal U... i Only the positions of non-zero elements are explicitly stored, and all triples constitute the initial subset, denoted as E. i = {(i,j,1)}. Each element (i,j,1) in this set is a primitive triple, and the relation parameter 1 indicates the existence of a node (i.e., user) U. i To node U j A connecting edge, i.e., A[i,j]=1. It is worth noting that for an undirected graph, node U... i To node U j If there is a connecting edge between them, then this connecting edge is node U. i To node U j The connecting edge is also node U. j To node U i The connecting edges, and for a directed graph, node U i To node U j Connecting edges and nodes U j To node U i The connection edges are not the same; they may exist simultaneously or separately. In this invention, each user node terminal may hold information about whether there are connection edges from other nodes to the local node, but the initial subset generated by the terminal in each user node only stores the connection edges from the local node to other nodes.

[0063] Subsequently, in one possible implementation, each user U i Each '1' can be encrypted using RSS technology before sending. For CS {1,2,3} However, since the number of non-zero elements represents the number of edges (i.e., degree), this simple encryption method will leak the degree information of each node to the cloud server. Based on this information, existing literature shows that the cloud server can infer the user's degree. i This involves various private information. Furthermore, since the distributed social graph is an unweighted graph (i.e., the elements in its adjacency matrix are either 0 or 1), encrypting only non-zero edges is meaningless, because the edges... The existence of A[i,j] = 1 reveals that A[i,j] = 1, thus allowing the cloud server to obtain the complete graph adjacency matrix. Therefore, while using the triplet encoding method of sparse matrices, it is necessary to protect the integrity of each user U. i The degree information is preserved without affecting the validity of subsequent subgraph counting. To achieve this effect, in the method provided by this invention, each user node terminal adds some spurious edges (i.e., {(i,k,0)}) to random empty positions in {(i,j,1)} for obfuscation. Here, each A[i,k] = 0, meaning that U does not actually exist. i To U k Connect the edges. After adding the fake edges, the resulting confusion set is generated, which can be represented as E′. i ={(i,l,σ i,l )}, where σ i,l Let σ be the relational parameter. i,l = 0 or 1. Then, simultaneously for both real and spurious values ​​σ. i,l Encryption is performed using RSS technology to generate Since in the RSS technology, even if the same (for example, 0) value is encrypted multiple times, the indistinguishability of the ciphertext can be guaranteed, therefore, the method can not only make the cloud server unable to distinguish the real edge and the false edge, but also does not affect the effectiveness of the subsequent secure subgraph counting process. At the same time, since some false edges are added and the encryption terminal cannot identify, the degree information of the user U i can be protected.

[0064] In a possible implementation, the user node terminal can randomly determine the number of added false edges, but too many false edges can weaken the sparsity of the adjacency matrix of the collected social graph data, and increase the calculation overhead, and too few false edges can result in weak privacy protection, in order to balance the sparsity and the privacy, in the method provided by the application, the user node terminal adds a plurality of confusion triples in the initial partition set, comprising:

[0065] The user node terminal samples in the Laplace distribution to obtain noise data, and adds a plurality of confusion triples in the initial partition set based on the noise data;

[0066] When the noise data is greater than 0, the number of confusion triples is equal to the noise data, and when the noise data is less than or equal to 0, the number of confusion triples is 0.

[0067] The user node terminal samples a noise r i from a discrete Laplace distribution, which will be regarded as the number of false edges (that is, (i,j,0)) added to the local local social graph data E i . At the same time, the degree information of the local node in the confusion set of the user node terminal satisfies the local differential privacy, that is, satisfies (e, d)-edgeLDP, and the A in the sampled Laplace distribution, that is, the sensitivity parameter in the local differential privacy, should be set to 1, because adding a false edge to the local social graph data changes the maximum amplitude (that is, the sensitivity A) of the degree of the user U {1,2,3} seen in the ciphertext domain (that is, the cloud server CS i ) by 1. And in order to avoid that when the sampling noise is negative, the user node terminal needs to delete some non-zero elements from the local graph data E i , affecting the accuracy of the subgraph counting, in the method provided by the application, the user U i first samples a noise r i from a Laplace distribution Lap(e, d / 2, 1) instead of Lap(e, d, 1), and then truncates the negative r i , that is, r' i =max(r i ,0). The noise sampled from the Laplace distribution Lap(∈,δ / 2,1) can guarantee the degree to satisfy the (∈,δ)-edge LDP, that is, to satisfy the local differential privacy, even if the truncation is performed. The algorithm pseudocode corresponding to the encryption process of the user node terminal on the local partial social graph data is shown as Figure 6

[0068] It can be seen that the method provided by the application can efficiently collect distributed social graph data, and the collection process does not leak any user sensitive local partial social graph, and the collected ciphertext can also retain the sparsity of the distributed social graph data.

[0069] Referring again to Figure 4 The method provided by the application further includes the steps of:

[0070] S300, the first encryption terminal, the second encryption terminal and the third encryption terminal respectively combine the secret sharing shares of the confusion set sent by each user node terminal according to the local holding, and determine the secret sharing shares of the subgraph counting result in the global social graph based on the replicated secret sharing protocol, and send the secret sharing shares of the subgraph counting result held locally to the demand terminal.

[0071] The method provided by the application can realize the common k-star subgraph and triangle subgraph counting tasks, and the safe counting processes of the two subgraphs are described in detail below.

[0072] When the subgraph counting result is the number of k-star subgraphs of the global social graph, the first encryption terminal, the second encryption terminal and the third encryption terminal respectively determine the secret sharing shares of the subgraph counting result based on the secret sharing shares of the confusion set held locally according to the replicated secret sharing protocol, including:

[0073] S310, the first encryption terminal combines the secret sharing shares of the confusion set with the same sequence number of each user node terminal held locally, obtains the first secret sharing share and the second secret sharing share of the confusion total set, the second encryption terminal combines the secret sharing shares of the confusion set with the same sequence number of each user node terminal held locally, obtains the second secret sharing share and the third secret sharing share of the confusion total set, and the third encryption terminal combines the secret sharing shares of the confusion set with the same sequence number of each user node terminal held locally, obtains the third secret sharing share and the first secret sharing share of the confusion total set.

[0074] ​In the replication of secret sharing, three secret sharing share combinations are generated and sent to three encrypted terminals respectively for ciphertext field calculation. For details, please refer to the technical background section above. For ease of description, each secret sharing share is assigned a serial number. The "first," "second," and "third" in the following text refer to the first, second, and third secret sharing shares to indicate the serial number of the secret sharing share. Taking the first encrypted terminal as an example, it receives the first and second secret sharing shares of the obfuscated sets sent by each of the user node terminals. The first secret sharing shares of the obfuscated sets sent by each user node terminal are combined into one set to obtain the first secret sharing share of the total obfuscated set. Similarly, the second secret sharing shares of the obfuscated sets sent by each user node terminal are combined into one set to obtain the second secret sharing share of the total obfuscated set. After the encrypted terminal combines all the collected obfuscated sets, the resulting total obfuscated set can be represented as: Where σ x,y =1 or 0.

[0075] S320. The first encrypted terminal sums the first secret share and the second secret share of each relation parameter related to the user node terminal in the local obfuscation set to obtain the first secret share and the second secret share of the degree of the user node terminal. The second encrypted terminal sums the second secret share and the third secret share of each relation parameter related to the user node terminal in the local obfuscation set to obtain the second secret share and the third secret share of the degree of the user node terminal. The third encrypted terminal sums the third secret share and the first secret share of each relation parameter related to the user node terminal in the local obfuscation set to obtain the third secret share and the first secret share of the degree of the user node terminal.

[0076] To obtain the number of k-star subgraphs in a graph, the degree information d of each node is needed. i ,i∈[1,N], therefore, the encrypted terminal CS {1,2,3} It is necessary to securely calculate each user's U. i Encryption degree information Specifically, CS {1,2,3} Local aggregation of each user U i Related In When the global social graph is undirected, the relational parameters related to the user node terminal are the relational parameters from the node ID corresponding to the user node terminal to other node IDs. When the global social graph is directed, the relational parameters related to the user node terminal include the relational parameters from the node ID corresponding to the user node terminal to other node IDs and the relational parameters from other node IDs to the node ID corresponding to the user node terminal. That is, if the social graph data is undirected, then CS {1,2,3} Calculate formula (3) safely.

[0077]

[0078] If it is a directed graph, then CS {1,2,3} Calculate formula (4) safely.

[0079]

[0080] S330. The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal respectively obtain the secret sharing share of the comparison result between the degree of the user node terminal and all feasibility degrees based on the secret sharing share of the degree of the user node terminal held locally. When the degree of the user node terminal is equal to the target feasibility degree, the comparison result is 1, otherwise it is 0.

[0081] S340, the first encryption terminal, the second encryption terminal, and the third encryption terminal respectively obtain the product of the secret share of each comparison result corresponding to each feasibility held locally and the number of combinations corresponding to the feasibility, to obtain multiple first product results, wherein the number of combinations corresponding to the feasibility is... Where d is the feasibility degree;

[0082] S350, the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum up all the first product results held locally to obtain the secret shared share of the k-star graph counting results of the global social graph.

[0083] In the encrypted domain, it is unknown what d is. i In this case, calculate This is extremely difficult. To solve this problem, the method provided by this invention employs a roundabout strategy, which involves encrypting the terminal CS... {1,2,3} First of all Perform a safe equality test on every possible degree d, i.e. If d i =d then equality test Otherwise, equality test Next, the equality test results for each encryption will be... Multiplying it by its corresponding (plaintext field) combinatorial number C(d,k), and then aggregating all the encrypted products, yields the result. That is, the first encryption terminal, the second encryption terminal and the third encryption terminal are calculated in the ciphertext field using formula (5).

[0084]

[0085] Where C(d,k) is the number of k combinations of d elements in the plaintext field, and It is an encrypted terminal CS {1,2,3} From the user's perspective i The degree information, that is, all information related to user U i The relevant encrypted tuples The quantity of this information is obfuscated. It must be true, because user U i Instead of deleting real edges, fake edges were added to its local graph data, thus affecting CS. {1,2,3} User U's perspective i degree It must be greater than d i And ciphertext field computation The formula is correct because: Definitely covers user U i The true degree d i , and only if d i =d time For other values, Therefore, only C(d) i ,k) will be retained in the above calculations, therefore the above formula can be calculated safely.

[0086] The following describes the degree of a given encryption. And a feasibility degree d, encrypted terminal CS {1,2,3} How to perform equality tests safely and efficiently The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each obtain a secret share of the comparison result between the degree of the user node terminal and all feasible degrees based on the secret share of the degree of the user node terminal held locally, according to the secret share of the degree held locally, including:

[0087] The third encryption terminal generates a first random number, and generates an offset function for the initial function based on the first random number. The offset function satisfies the following condition: γ is the first random number, f 0,1 (x) is the output of the initial function when the input is x. is the output of the offset function when the input is x+γ; the initial function satisfies the condition: when the input is equal to 0, the output is 1, and when the input is not equal to 0, the output is 0;

[0088] The third encryption terminal generates a key pair of the offset function based on function secret sharing, divides the first random number into two secret sharing shares, sends the first key in the key pair and one secret sharing share of the first random number to the first encryption terminal, and sends the second key in the key pair and another secret sharing share of the first random number to the second encryption terminal;

[0089] The first encryption terminal sums the first secret sharing share of the degree of the user node terminal and the secret sharing share of the first random number, obtains a first summation result and sends it to the second encryption terminal, and the second encryption terminal sums the third secret sharing share of the degree of the user node terminal and the secret sharing share of the first random number, obtains a second summation result and sends it to the first encryption terminal, so that the first encryption terminal and the second encryption terminal both hold a third summation result, which is the sum of the degree of the user node terminal and the first random number;

[0090] The first encryption terminal obtains an additive secret sharing share of the function output result based on the function secret sharing protocol according to the difference between the third summation result and the feasible degree and the first key, and the second encryption terminal obtains another additive secret sharing share of the function output result based on the function secret sharing protocol according to the difference between the third summation result and the feasible degree and the second key, the function output result being the result output by the offset function when the input is the difference between the third summation result and the feasible degree;

[0091] The first encryption terminal, the second encryption terminal and the third encryption terminal respectively obtain a replicated secret sharing share of the comparison result based on the additive secret sharing share of the first output result.

[0092] The method provided by the application constructs an equality test protocol based on a lightweight function secret sharing technology. Specifically, a distributed point function (DPF) based on function secret sharing is used to design the protocol. The so-called DPF refers to a function f α,β (x) that outputs β only when its input x=α, and outputs 0 when the input is other values. First, set the relevant parameters in the DPF to α=0 and β=1, and represent it as f 0,1 wherein that is, if d i = d, output 1, otherwise output 0. Note that the settings of a and b are public, and DPF runs in two parties, so CS3 can be asked to generate DPF keys based on the function secret sharing, and CS1 and CS2 can be asked to use these keys for computation.

[0093] The evaluation process based on FSS requires the encryption terminals to process the same input, but it is obvious that letting the encryption terminals directly disclose the degree information they hold will lead to the leakage of the degree information. To solve this problem, the encryption terminals CS1 and CS2 disclose the encrypted input i.e. with noise, and ask CS3 to customize the generation of DPF keys for evaluating the input with noise. Specifically, given a target function f 0,1 , CS3 generates a pair of DPF keys 0,1 for the offset function of f where γ is a random number. Then CS3 splits γ into two secret shares γ = <γ>1 + <γ>2, and sends and to CS1 and CS2 respectively. In this way, CS1 and CS2 hold and respectively. CS1 sends the noisy secret share <d i >1 + <γ>1 to CS2, and CS2 sends the noisy secret share <d i >3 + <γ>2 to CS1 to securely disclose d i + γ (abbreviated as ), where Finally, computes where d is a feasible degree. If d i = d, the computation will output <1> t , otherwise the computation will output <0> t . Note that the computation only generates additive secret sharing, and CS {1,2,3} can convert it into the form of replicated secret sharing Figure 7 A complete k-star subgraph counting method is shown under the model of a semi-trusted adversary.

[0094] When the subgraph counting result is the number of triangle subgraphs of the global social graph, the first encryption terminal, the second encryption terminal and the third encryption terminal respectively combine the secret shares of the confusion set held locally according to the replicated secret sharing protocol to determine the secret share of the subgraph counting result, including:

[0095] The first encryption terminal combines the secret sharing shares of the same sequence number of the confusion sub-sets of each of the user node terminals held locally to obtain a first secret sharing share and a second secret sharing share of the confusion total set, the second encryption terminal combines the secret sharing shares of the same sequence number of the confusion sub-sets of each of the user node terminals held locally to obtain a second secret sharing share and a third secret sharing share of the confusion total set, and the third encryption terminal combines the secret sharing shares of the same sequence number of the confusion sub-sets of each of the user node terminals held locally to obtain a third secret sharing share and a first secret sharing share of the confusion total set.

[0096] When the global social graph is a directed graph, the first encryption terminal, the second encryption terminal and the third encryption terminal perform the following operations:

[0097] The first encryption terminal, the second encryption terminal and the third encryption terminal determine a first target node, determine a second target node and a third target node based on the first target node, the second target node being a node in the confusion total set having a relationship parameter with the first target node, and the third target node being a node in the confusion total set having a relationship parameter with both the first target node and the second target node.

[0098] The first encryption terminal, the second encryption terminal and the third encryption terminal obtain, based on a replicated secret sharing protocol, a secret sharing share of a product of a first relationship parameter, a second relationship parameter and a third relationship parameter as a secret sharing share of a triangle sub-graph count step value corresponding to the first target node, wherein the first relationship parameter is a relationship parameter from the first target node to the second target node, the second relationship parameter is a relationship parameter from the first target node to the third target node, and the third relationship parameter is a relationship parameter from the third target node to the first target node.

[0099] The first encryption terminal, the second encryption terminal and the third encryption terminal redetermine the first target node until a secret sharing share of a triangle sub-graph count step value corresponding to each node in the confusion total set is obtained.

[0100] The first encryption terminal, the second encryption terminal and the third encryption terminal respectively sum the secret sharing shares of the same sequence number of each of the triangle sub-graph count step values held locally to obtain a secret sharing share of a triangle sub-graph count result of the global social graph.

[0101] When the global social graph is a directed graph, the process of triangle sub-graph counting in a secret sharing domain by an encryption terminal is as shown in Figure 8 encryption terminal CS {1,2,3} Exhaustively enumerate all possible triangles, and then calculate whether each triangle forms a triangular subgraph. Specifically, given each user... First visit Each possible friend (i.e., neighbor node) Right now Because if here There exists This indicates that the user and users There may be edges between them. Then, CS... {1,2,3} Brute force users and users All possible mutual friends Right now and Therefore, users as well as This may have formed a triangular subgraph. Afterwards, CS... {1,2,3} The triangular subgraph counting step value is calculated using formula (6) based on the replication secret sharing.

[0102]

[0103] Then sum the secret shared shares of the count step values ​​of all triangular subgraphs held locally.

[0104] like Figure 9 As shown, when the global social graph is a directed graph, the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal perform the following operations:

[0105] The first encryption terminal, the second encryption terminal, and the third encryption terminal determine a first target node, and determine a second target node and a third target node based on the first target node. The second target node is a node in the total obfuscation set that has a relationship parameter with the first target node, and the third target node is a node in the total obfuscation set that has a relationship parameter with both the first target node and the second target node.

[0106] The first encryption terminal, the second encryption terminal and the third encryption terminal obtain secret sharing shares of a sum of a first intermediate value, a second intermediate value and a third intermediate value based on a replicated secret sharing protocol as secret sharing shares of the triangle subgraph count step value corresponding to the first target node, wherein the first intermediate value is a difference between a sum of the relationship parameter from the first target node to the second target node and the relationship parameter from the second target node to the first target node minus a product of the relationship parameter from the first target node to the second target node and the relationship parameter from the second target node to the first target node, the second intermediate value is a difference between a sum of the relationship parameter from the first target node to the third target node and the relationship parameter from the third target node to the first target node minus a product of the relationship parameter from the first target node to the third target node and the relationship parameter from the third target node to the first target node, and the third intermediate value is a difference between a sum of the relationship parameter from the second target node to the third target node and the relationship parameter from the third target node to the second target node minus a product of the relationship parameter from the second target node to the third target node and the relationship parameter from the third target node to the second target node;

[0107] The first encryption terminal, the second encryption terminal and the third encryption terminal respectively sum the secret sharing shares of the same sequence number of the triangle subgraph count step value held by each of the encryption terminals locally to obtain the secret sharing shares of the triangle subgraph count result of the global social graph.

[0108] When the social global graph is a directed graph, the encryption terminal also exhaustively enumerates all triangles, specifically, as shown in Figure 9 , given each user CS {1,2,3} first visits each possible friend (i.e. neighbor node) of i.e. or After that, the CS {1,2,3} exhaustively enumerates all possible common friends of user and user i.e. or and and or Therefore, user and may constitute a triangle subgraph. Next, if they form a triangle, the CS {1,2,3} inadvertently increases the number of triangle subgraphs n △ by a step value of 1. Unlike the undirected graph, given two users and If σ i,j = 1 or σ j,i = 1, it is considered that there is an edge between them, therefore, one possible method is to let CS {1,2,3} perform the calculation However, if there is a bidirectional edge between two users, this method will lead to an incorrect triangle subgraph count, for example, (1+1)·(1+0)·(1+0) will equal 2. This is incorrect because three users can only form one triangle. In order to solve this problem, the method provided by the present application is that, given two users and If and appear in the encrypted graph data at the same time, CS {1,2,3} performs the following operations:

[0109]

[0110]

[0111]

[0112] and respectively represent the existence of edges between users and . The calculation formula of and satisfies the following truth table:

[0113]

[0114] a = 0, σ1 = 0, σ2 = 0; a = 1, σ1 = 1, σ2 = 0;

[0115] a = 1, σ1 = 0, σ2 = 1; a = 1, σ1 = 1, σ2 = 1.

[0116] Therefore, CS {1,2,3} can obtain the correct step value of the secret sharing share by calculating the triangle subgraph step value through .

[0117] Referring again to Figure 4 , the method provided by the present application further comprises:

[0118] S400, the demand terminal obtains the plaintext data of the subgraph count result according to the secret sharing share of the received subgraph count result.

[0119] The method for generating subgraph counting results described above enables the first encryption terminal, the second encryption terminal, and the third encryption terminal to obtain the secret shared share of the subgraph counting result, send the secret shared share of the subgraph counting result to the requesting terminal, and the requesting terminal to sum the secret shared shares of the subgraph counting result locally to recover the plaintext data of the subgraph counting result.

[0120] Furthermore, the method provided by this invention also considers CS. {1,2,3} One of these is the case of a malicious server, namely CS. {1,2,3} One of the components can arbitrarily deviate from the set protocol, such as performing calculations outside the protocol, providing inconsistent inputs, or using inputs from other cloud servers to replace its own. In short, this malicious server can perform calculations at will. In the method provided by this invention, after receiving the subgraph counting result, the requesting terminal verifies the received information to detect the occurrence of malicious behavior, thereby discarding the subgraph counting result generated by the encrypted terminal.

[0121] The following describes the verification process for the k-star subgraph counting results and the triangular subgraph counting results against malicious adversaries.

[0122] For k-star subgraph counting, the requesting terminal obtains the plaintext data of the subgraph counting result based on the secret sharing share of the received subgraph counting result, including:

[0123] The first encryption terminal generates a second random number so that the second encryption terminal and the third encryption terminal each obtain multiple second product results; the second encryption terminal generates a third random number so that the first encryption terminal and the third encryption terminal each obtain multiple second product results.

[0124] The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum up all the second product results they hold locally to obtain the second secret sharing share of the k-star graph counting result of the global social graph;

[0125] The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum up all the third product results they hold locally to obtain the third secret sharing share of the k-star graph counting result of the global social graph;

[0126] The demand terminal respectively sums three secret sharing shares of the k-star subgraph counting result of the global social graph to obtain three plaintext data of the k-star subgraph counting result of the global social graph, and when the three plaintext data are identical, verification is passed, and the plaintext data of the k-star subgraph counting result of the global social graph is determined.

[0127] The k-star subgraph counting process against malicious adversaries is shown as Figure 10

[0128] For each user CS {1,2,3} First, he locally calculates his encrypted degree information by formula (3) and formula (4) In order to let the CS {1,2,3} safely calculate the combination number Let the CS {1,2,3} perform the "redundant" calculation. That is, the CS {1,2,3} First, three pairs of independent DPF keys are respectively prepared And The parameters are set to α=0 and β=1. {<γ>} is a random number used when the user encrypts the DPF input, γ3 is the first random number, γ1 is the second random number, and γ2 is the third random number. After receiving the secret sharing shares of the random numbers sent by other encrypted terminals, CS1, CS2 and CS3 respectively hold And Then, the CS {1,2,3} discloses the user encrypted degree information in the following way:

[0129] CS1 sends <d i >1+<γ2>2 to CS2; CS2 sends <d i >3+<γ2>1 to CS1 to disclose

[0130] CS2 sends <d i >2+<γ3>2 to CS3; CS3 sends <d i >1+<γ3>1 to CS2 to disclose CS3 sends <d i >3+<γ1>2 to CS1; CS1 sends <d i >2+<γ1>1 to CS3 to disclose

[0131] Then, each CS {1,2,3} locally calculates using the DPF key it holds, specifically: ​

[0132] CS1 performs calculation:

[0133]

[0134]

[0135] CS2 performs calculation:

[0136]

[0137]

[0138] CS3 performs calculation:

[0139]

[0140]

[0141] And the combination of the number of plaintext calculation results C(d i ,k) = <C(d i ,k) (1) >1 + <C(d i ,k) (1) >2 = <C(d i ,k) (2) >1 + <C(d i ,k) (2) >2 = <C(d i ,k) (3) >1 + <C(d i ,k) (3) >2.

[0142] Finally, CS {1,2,3} Local aggregation of all the user node terminal corresponding to the above calculation results, get the complete k-star sub-graph count number of secret sharing shares. Specifically:

[0143] CS1 calculation:

[0144] CS2 calculation:

[0145] CS3 calculation:

[0146] That is, three encryption terminals will return three kinds of secret sharing shares of k-star sub-graph count results, and the final encrypted k-star sub-graph number is:

[0147]

[0148] After that, CS {1,2,3} The computing result is returned to the demand terminal, and the demand terminal judges whether CS {1,2,3} The computing protocol in the foregoing is performed honestly and correctly, that is, the demand terminal judges whether the plaintext data corresponding to the three secret sharing shares of the k-star subgraph counting result are consistent. If formula (11) is established, the demand terminal can determine the plaintext data of the k-star subgraph counting result.

[0149] For triangle subgraph counting, the demand terminal obtains the plaintext data of the subgraph counting result according to the received secret sharing share of the subgraph counting result, and the plaintext data of the subgraph counting result comprises:

[0150] The first, second and third encryption terminals respectively receive the secret sharing share of the verification key sent by the demand terminal, and respectively obtain the secret sharing share of the verification value based on the secret sharing share of the triangle subgraph counting result of the global social graph held locally and based on replicated secret sharing, and send the secret sharing share of the verification value to the demand terminal, wherein the verification value is the product of the verification key and the triangle subgraph counting result of the global social graph.

[0151] The demand terminal verifies whether the product of the plaintext data of the triangle subgraph counting result of the global social graph and the verification key is equal to the verification value, and when the product is equal to the verification value, the verification is passed, and the plaintext data of the triangle subgraph counting result of the global social graph is determined.

[0152] The triangle subgraph counting process against malicious adversaries for an undirected graph is as shown in Figure 11 The triangle subgraph counting process against malicious adversaries for a directed graph is similar to this. The method provided by the application uses an information-theoretic MACs mechanism to allow the demand terminal to check whether malicious behavior occurs when the triangle subgraph counting result returned by the encryption terminal is received. Specifically, a MACs mechanism called is used. Given that the server holds a secret sharing share of a private value x in a ring , a MAC key unknown to the encryption terminal (held by the demand terminal) is used. The encryption terminal also holds a secret sharing share of corresponding to x. The MACs on the private value have the property of homomorphic addition: α·x1+α·x2=α·(x1+x2). If the final output y of the calculation and its corresponding MAC χ' do not satisfy α·y=χ', the demand terminal can infer that the server has not correctly performed the calculation.

[0153] Specifically, first, the demand terminal randomly samples a MAC key The key is then encrypted using the RSS technique and the secret share of the key is sent to the CS {1,2,3} Upon receiving the encrypted MAC key Then, similar to the semi-trusted protocol, the CS {1,2,3} Enumerate all possible triangles. Unlike the semi-trusted protocol, the CS {1,2,3} Additionally, compute MACs: (corresponding to ). Then, the CS {1,2,3} Aggregate all the intermediate results to get the number of encrypted triangles and aggregate all the MACs to get Finally, the CS {1,2,3} returns n △ and its corresponding MAC χ to the demand terminal. The demand terminal determines whether the CS △ correctly performed the computation by checking whether χ = α·n {1,2,3} holds.

[0154] Based on the subgraph counting results, the demand terminal performs data analysis on the global social graph, for example, the demand terminal determines social roles in the social network based on the subgraph counting results, or generates characterization data of the social network based on the subgraph counting results, the characterization data is used to describe the social network. Specifically, the demand terminal determines the probability that two friends of the same user in the social network are still friends based on the number of k-star subgraphs and triangle subgraphs.

[0155] To sum up, the distributed social graph data subgraph secure counting method provided by the application does not expose the information of the number of edges in the local social graph data to other terminals, and the first encryption terminal, the second encryption terminal and the third encryption terminal can only obtain the secret share of the private data to be protected throughout the process, and cannot obtain the plaintext data, thereby realizing the secure counting of the social graph data subgraph with privacy protection, and protecting the privacy and security of the data in the social graph data subgraph counting process.

[0156] The distributed social graph data subgraph secure counting system provided by the application is described below, and the distributed social graph data subgraph secure counting system described below can be correspondingly referred to the distributed social graph data subgraph secure counting method described above.

[0157] As Figure 12 As shown, the distributed social graph data subgraph security counting system provided by the present application comprises a first encryption terminal, a second encryption terminal, a third encryption terminal and a plurality of user node terminals; the first encryption terminal, the second encryption terminal and the third encryption terminal are respectively in communication connection with the plurality of user node terminals to cooperatively complete the distributed social graph data subgraph security counting method as described above.

[0158] Through the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and necessary universal hardware platforms, and of course, can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product in essence or in the form of a part shared by the prior art. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method described in each embodiment or some part of the embodiment.

[0159] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.< / z> < / z> < / y> < / x> < / y> < / x> < / y> < / x> < / z> < / x> < / x> < / y> < / x> < / x> < / y> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A method for secure counting of subgraphs in a distributed social graph, characterized in that, The method includes: User node terminals generate an initial subset based on locally held local social graph data. This initial subset includes multiple sets of original triples. Each set of original triples includes a first node ID, a second node ID, and a relational parameter for the connection edge from the first node ID to the second node ID. The first node ID is the node ID corresponding to the user node terminal in the global social graph. A connection edge exists in the local social graph from the first node ID to the second node ID, and its relational parameter is 1. The user node terminal adds multiple obfuscated triples to the initial subset to obtain an obfuscated subset. Each obfuscated triple includes the first node ID, an obfuscated node ID, and a relational parameter for the connection edge from the first node ID to the obfuscated node ID. No connection edge exists in the local social graph from the first node ID to the obfuscated node ID, and its relational parameter is 0. Nodes in the social graph data correspond to entities in the social network, and edges in the social graph data correspond to relationships between entities in the social network. The user node terminal encrypts the relationship parameters in the obfuscated subset according to the replication secret sharing protocol to obtain a first secret sharing share combination, a second secret sharing share combination, and a third secret sharing share combination of the obfuscated subset. The first secret sharing share combination is sent to a first encryption terminal, the second secret sharing share combination is sent to a second encryption terminal, and the third secret sharing share combination is sent to a third encryption terminal. The first secret sharing share combination includes the first secret sharing share and the second secret sharing share of the relationship parameters in the obfuscated subset. The second secret sharing share combination includes the second secret sharing share and the third secret sharing share of the relationship parameters in the obfuscated subset. The third secret sharing share includes the third secret sharing share and the first secret sharing share of the relationship parameters in the obfuscated subset. The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each determine the secret sharing share of the subgraph counting result in the global social graph based on the secret sharing share combination of the obfuscated subset sent by each user node terminal held locally, and send the secret sharing share of the subgraph counting result held locally to the requesting terminal. The requesting terminal obtains the plaintext data of the subgraph counting result based on the secret sharing share of the received subgraph counting result.

2. The distributed social graph data subgraph secure counting method according to claim 1, characterized in that, The user node terminal adds multiple obfuscated triples to the initial subset, including: The user node terminal samples in a Laplace distribution to obtain noise data, and adds multiple confusion triples to the initial subset based on the noise data; Specifically, when the noise data is greater than 0, the number of confused triples is equal to the noise data; when the noise data is less than or equal to 0, the number of confused triples is 0.

3. The distributed social graph data subgraph secure counting method according to claim 1, characterized in that, The subgraph counting result is the number of k-star subgraphs in the global social graph, where k is a positive integer; the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each determine the secret sharing share of the subgraph counting result based on the secret sharing share combination of the obfuscation subset held locally, according to the replication secret sharing protocol, including: The first encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the first secret sharing share and the second secret sharing share of the total obfuscation set. The second encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the second secret sharing share and the third secret sharing share of the total obfuscation set. The third encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the third secret sharing share and the first secret sharing share of the total obfuscation set. The first encryption terminal sums the first and second secret share shares of each relation parameter related to the user node terminal in the local obfuscation set to obtain the first and second secret share shares of the degree of the user node terminal. The second encryption terminal sums the second and third secret share shares of each relation parameter related to the user node terminal in the local obfuscation set to obtain the second and third secret share shares of the degree of the user node terminal. The third encryption terminal sums the third and first secret share shares of each relation parameter related to the user node terminal in the local obfuscation set to obtain the third and first secret share shares of the degree of the user node terminal. The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each obtain a secret share of the comparison result between the degree of the user node terminal and all feasible degrees based on the secret share of the degree of the user node terminal held locally. When the degree of the user node terminal is equal to the target feasible degree, the comparison result is 1; otherwise, it is 0. The first encryption terminal, the second encryption terminal, and the third encryption terminal each obtain the product of the secret share of the comparison result corresponding to each feasibility level held locally and the number of combinations corresponding to the feasibility level, resulting in multiple first product results, where the number of combinations corresponding to the feasibility level is... Where d is the feasibility degree; The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum all the first product results held locally locally to obtain the secret shared share of the k-star graph counting results of the global social graph.

4. The distributed social graph data subgraph secure counting method according to claim 3, characterized in that, When the global social graph is an undirected graph, the relationship parameters related to the user node terminal are the relationship parameters from the node ID corresponding to the user node terminal to other node IDs; When the global social graph is a directed graph, the relationship parameters related to the user node terminal include the relationship parameters from the node ID corresponding to the user node terminal to other node IDs and the relationship parameters from other node IDs to the node ID corresponding to the user node terminal.

5. The distributed social graph data subgraph secure counting method according to claim 3, characterized in that, The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each obtain a secret share of the comparison result between the degree of the user node terminal and all feasible degrees based on the secret share of the degree of the user node terminal held locally, according to the secret share of the degree held locally, including: The third encryption terminal generates a first random number, and generates an offset function for the initial function based on the first random number. The offset function satisfies the following condition: γ is the first random number, f 0,1 (x) is the output of the initial function when the input is x. The initial function is the output of the offset function when the input is x+γ; the initial function satisfies the condition that the output is 1 when the input is equal to 0, and 0 when the input is not equal to 0. The third encryption terminal generates a key pair for the offset function based on function secret sharing, divides the first random number into two secret sharing shares, sends the first key in the key pair and one secret sharing share of the first random number to the first encryption terminal, and sends the second key in the key pair and the other secret sharing share of the first random number to the second encryption terminal. The first encrypted terminal sums the first secret share of the degree of the user node terminal held locally with the secret share of the first random number to obtain a first summation result and sends it to the second encrypted terminal. The second encrypted terminal sums the third secret share of the degree of the user node terminal held locally with the secret share of the first random number to obtain a second summation result and sends it to the first encrypted terminal, so that both the first encrypted terminal and the second encrypted terminal hold a third summation result, which is the sum of the degree of the user node terminal and the first random number. The first encryption terminal obtains an additive secret sharing share of the function output result based on the difference between the third summation result and the feasibility, and the first key, according to the function secret sharing protocol. The second encryption terminal obtains another additive secret sharing share of the function output result based on the difference between the third summation result and the feasibility, and the second key, according to the function secret sharing protocol. The function output result is the result output by the offset function when the input is the difference between the third summation result and the feasibility. The first encryption terminal, the second encryption terminal, and the third encryption terminal each obtain the copy secret share of the comparison result based on the additive secret share of the function output result.

6. The distributed social graph data subgraph secure counting method according to claim 1, characterized in that, The subgraph counting result is the number of triangular subgraphs in the global social graph; the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each determine the secret sharing share of the subgraph counting result based on the secret sharing share combination of the obfuscation subset held locally, according to the replication secret sharing protocol, including: The first encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the first secret sharing share and the second secret sharing share of the total obfuscation set. The second encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the second secret sharing share and the third secret sharing share of the total obfuscation set. The third encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the third secret sharing share and the first secret sharing share of the total obfuscation set. When the global social graph is an undirected graph, the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal perform the following operations: The first encryption terminal, the second encryption terminal, and the third encryption terminal determine a first target node, and determine a second target node and a third target node based on the first target node. The second target node is a node in the total obfuscation set that has a relationship parameter with the first target node, and the third target node is a node in the total obfuscation set that has a relationship parameter with both the first target node and the second target node. The first encryption terminal, the second encryption terminal, and the third encryption terminal obtain the secret sharing share of the product of the first relationship parameter, the second relationship parameter, and the third relationship parameter based on the replication secret sharing protocol, which is used as the secret sharing share of the triangular subgraph counting step value corresponding to the first target node. The first relationship parameter is the relationship parameter from the first target node to the second target node, the second relationship parameter is the relationship parameter from the first target node to the third target node, and the third relationship parameter is the relationship parameter from the third target node to the first target node. The first encryption terminal, the second encryption terminal, and the third encryption terminal re-determine the first target node until they obtain the secret shared share of the triangular subgraph count step value corresponding to each node in the total obfuscation set; The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum the secret sharing shares with the same sequence number of the counting step value of each of the triangular subgraphs they hold locally to obtain the secret sharing share of the triangular subgraph counting result of the global social graph.

7. The distributed social graph data subgraph secure counting method according to claim 1, characterized in that, The subgraph counting result is the number of triangular subgraphs in the global social graph; the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each determine the secret sharing share of the subgraph counting result based on the secret sharing share combination of the obfuscation subset held locally, according to the replication secret sharing protocol, including: The first encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the first secret sharing share and the second secret sharing share of the total obfuscation set. The second encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the second secret sharing share and the third secret sharing share of the total obfuscation set. The third encrypted terminal combines the secret sharing shares with the same sequence number of the obfuscation subsets of each user node terminal held locally to obtain the third secret sharing share and the first secret sharing share of the total obfuscation set. When the global social graph is a directed graph, the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal perform the following operations: The first encryption terminal, the second encryption terminal, and the third encryption terminal determine a first target node, and determine a second target node and a third target node based on the first target node. The second target node is a node in the total obfuscation set that has a relationship parameter with the first target node, and the third target node is a node in the total obfuscation set that has a relationship parameter with both the first target node and the second target node. The first encryption terminal, the second encryption terminal, and the third encryption terminal obtain the secret sharing share of the sum of the first intermediate value, the second intermediate value, and the third intermediate value based on the replication secret sharing protocol, which is used as the secret sharing share of the triangular subgraph counting step value corresponding to the first target node. The first intermediate value is the difference between the sum of the relationship parameters from the first target node to the second target node and the relationship parameters from the second target node to the first target node, minus the product of the relationship parameters from the first target node to the second target node and the relationship parameters from the second target node to the first target node. The second intermediate value is the difference between the sum of the relationship parameters from the first target node to the third target node and the relationship parameters from the third target node to the first target node, minus the product of the relationship parameters from the first target node to the third target node and the relationship parameters from the third target node to the first target node. The third intermediate value is the difference between the sum of the relationship parameters from the second target node to the third target node and the relationship parameters from the third target node to the second target node, minus the product of the relationship parameters from the second target node to the third target node and the relationship parameters from the third target node to the second target node. The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum the secret sharing shares with the same sequence number of the counting step value of each of the triangular subgraphs they hold locally to obtain the secret sharing share of the triangular subgraph counting result of the global social graph.

8. The distributed social graph data subgraph secure counting method according to claim 3, characterized in that, The requesting terminal obtains the plaintext data of the subgraph counting result based on the secret sharing share of the received subgraph counting result, including: The first encryption terminal generates a second random number so that the second encryption terminal and the third encryption terminal each obtain multiple second product results; the second encryption terminal generates a third random number so that the first encryption terminal and the third encryption terminal each obtain multiple third product results. The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum up all the second product results they hold locally to obtain the second secret sharing share of the k-star graph counting result of the global social graph; The first encrypted terminal, the second encrypted terminal, and the third encrypted terminal each sum up all the third product results they hold locally to obtain the third secret sharing share of the k-star graph counting result of the global social graph; The demand terminal sums the three secret sharing shares of the k-star subgraph counting result of the global social graph to obtain three plaintext data of the k-star subgraph counting result of the global social graph. If the three plaintext data are the same, the verification is passed and the plaintext data of the k-star subgraph counting result of the global social graph is determined.

9. The distributed social graph data subgraph secure counting method according to claim 6 or 7, characterized in that, The requesting terminal obtains the plaintext data of the subgraph counting result based on the secret sharing share of the received subgraph counting result, including: The first encryption terminal, the second encryption terminal, and the third encryption terminal respectively receive the secret share of the verification key sent by the requesting terminal, and according to the secret share of the triangular subgraph count result of the global social graph held locally, respectively obtain the secret share of the verification value based on the copy secret share and send it to the requesting terminal, wherein the verification value is the product of the verification key and the triangular subgraph count result of the global social graph; The terminal verifies whether the product of the plaintext data of the triangular subgraph counting result of the global social graph and the verification key is equal to the verification value. If they are equal, the verification is successful, and the plaintext data of the triangular subgraph counting result of the global social graph is determined.

10. A distributed social graph data subgraph secure counting system, characterized in that, The system includes a first encrypted terminal, a second encrypted terminal, a third encrypted terminal, and multiple user node terminals; the first encrypted terminal, the second encrypted terminal, and the third encrypted terminal are respectively connected to the multiple user node terminals to collaboratively complete the distributed social graph data subgraph secure counting method as described in any one of claims 1-9.

Images