A privacy set intersection method based on error learning problem

Abstract

The application discloses a privacy set intersection method based on an error learning problem, which comprises the following steps: a receiver performs hash calculation on a private set Y of the receiver, and uses a secret key s of the receiver and an error learning problem to calculate an encrypted set and send the encrypted set to a sender; B The sender performs hash calculation on a private set X of the sender, and uses a secret key s of the sender and an error learning problem to obtain an encrypted set and send the encrypted set to the receiver; A The sender performs hash calculation on a private set X of the sender, and uses a secret key s of the sender and an error learning problem to obtain an encrypted set and send the encrypted set to the receiver; A The sender performs hash calculation on a private set X of the sender, and uses a secret key s of the sender and an error learning problem to obtain an encrypted set and send the encrypted set to the receiver; A The receiver obtains the intersection of the sets X and Y based on the encrypted set C A , the secret key s B , and an error learning problem. The application can resist quantum computing attacks and has high protocol execution efficiency.

Description

Technical Field

[0001] This invention relates to the field of privacy computing technology, and in particular to a method for finding the intersection of privacy sets based on the error learning problem. Background Technology

[0002] Private Set Intersection (PSI) allows a group of distrustful participants to jointly compute the intersection of their private sets without revealing any additional information beyond the intersection. After the protocol is completed, some or all participants will obtain the correct intersection. The private set intersection protocol is an important cryptographic primitive and a key component of privacy computing. It has significant application value for data privacy protection and can be applied to scenarios such as contact discovery, behavior matching, remote diagnostics, calculating the actual effectiveness of online advertising, and gene sequence matching detection.

[0003] In 1986, Meadows et al. proposed the first secure privacy set intersection protocol. Later, in 1999, Huberman et al. provided a detailed description of the protocol, constructing a secure privacy set intersection protocol based on Diffie-Hellman key exchange. These protocols have the advantage of low communication overhead, but their computational cost is high due to the need to perform numerous modular exponentiation operations. In 2004, Freedman et al. proposed a privacy set intersection protocol based on inadvertent polynomial computation using partially homomorphic encryption algorithms. Currently, most efficient privacy set intersection protocols are generally constructed using Diffie-Hellman exchange, RSA public-key encryption, and inadvertent transmission; however, the communication complexity of these schemes is linearly related to the size of the largest set among the participants.

[0004] Based on the number and scale of participants, privacy set intersection protocols can be categorized into two-party privacy set intersection and multi-party privacy set intersection. In terms of security, based on the corruption of participants, they can be classified as semi-honest security and malicious model security. Based on whether the participant sets are of equal size, two-party privacy set intersection protocols can be classified as balanced PSI and unbalanced PSI. Pinkas et al. categorized privacy set intersection protocols based on different technical approaches into public-key based PSI, circuit-based PSI, accidental transmission-based PSI, and third-party based PSI.

[0005] Public-key privacy set intersection protocols are generally constructed based on Diffie-Hellman key exchange and homomorphic encryption, resulting in relatively low communication overhead. For example, the PSI protocol, based on fully homomorphic encryption, can solve problems involving two sets of different sizes. On the 11041, executing a privacy set intersection protocol incurs a communication overhead of 37.4 MB and a execution time of 18.9 seconds. This type of protocol is well-suited for environments with high computing power but limited communication. Circuit-based privacy set intersection protocols represent intersection computation as a Boolean or arithmetic circuit, employing obfuscated circuits and secure multi-party computation to perform secret-state computation of this circuit. While overall efficiency is low, they offer greater flexibility and can support data analysis on the intersection. Password-based privacy set intersection protocols utilize password and its extensions, achieving efficient computation through most symmetric cryptographic operations. These protocols have higher communication overhead. Third-party-based privacy set intersection protocols require the assistance of a trusted third-party server. They are extremely efficient, completing the intersection of millions of datasets within 1.7 seconds, but their security is weaker.

[0006] The rapid development of quantum computing poses a potential threat to current cryptographic algorithms and protocols. Once quantum computers become practical, they could successfully break cryptography constructed using mathematical tools such as large integer factorization, discrete logarithms, and elliptic curves. Privacy set intersection protocols, a key technology in privacy computing, heavily utilize the Diffie-Hellman key exchange method. These protocols are vulnerable to quantum computing attacks and incur significant computational overhead due to the large number of modular exponentiation operations required. Currently, privacy set intersection protocols face the following technical problems:

[0007] (1) Quantum-resistant privacy set intersection protocols. Currently, privacy set intersection protocols based on Diffie-Hellman key exchange are widely used. However, the security of these protocols is based on the discrete logarithm difficulty problem and does not have quantum-resistant capabilities. With the rapid development of quantum computing, the security of these protocols has been greatly threatened.

[0008] (2) Efficient design of privacy set intersection protocol. The privacy set intersection protocol based on Diffie-Hellman key exchange has low communication overhead, but the computational overhead is high due to the large number of modular exponentiation operations involved. Summary of the Invention

[0009] In view of this, the present invention provides a privacy set intersection method based on the error learning problem to solve the above-mentioned technical problems.

[0010] This invention discloses a privacy set intersection method based on the error learning problem, which includes:

[0011] Step 1: The receiver performs a hash calculation on the private set Y it holds and uses its key. And the RLWE error learning problem, to calculate the encrypted set and the encrypted set Send to the sender;

[0012] Step 2: The sender performs a hash calculation on the private set X it holds, and uses its private key. And the RLWE error learning problem, to obtain a cryptographic set and encrypted sets Send to the recipient;

[0013] Step 3: The sender encrypts the received set. Using its private key And the RLWE error learning problem, to calculate the privacy set for re-encryption. And send it to the recipient;

[0014] Step 4: The recipient uses the encrypted set , Key The intersection of set X and set Y is calculated.

[0015] Further, step 4 includes:

[0016] Step 41: The receiver uses its key For encrypted sets Each element in the dataset is processed to obtain the privacy set. ;

[0017] Step 42: Targeting privacy sets Each element in the privacy set We search for elements that meet the requirements, ultimately forming the intersection of set X and set Y.

[0018] Further, step 41 includes:

[0019] The receiver receives the set Then, for each element ,calculate: , Ultimately, a privacy set is obtained. ;in, Let X be the total number of elements in set X.

[0020] Further, step 42 includes:

[0021] The receiver initializes the intersection as an empty set, i.e. ; Traverse the privacy set Each element in , If privacy collection There exist elements that satisfy the following constraints. Then Corresponding elements Add to collection :

[0022] There exists a certain , making =0;

[0023] After traversing the privacy set Each element in Then, output the set. .

[0024] Furthermore, prior to step 1, the procedure also includes:

[0025] The sender distributes the private key. Randomly select an element as its private key. It is not disclosed to the public.

[0026] Furthermore, prior to step 1, the procedure also includes:

[0027] The recipient distributes the private key. Randomly select an element as its key. It is not disclosed to the public.

[0028] Further, step 1 includes:

[0029] The receiver on the set Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the sender; It is a positive integer.

[0030] Further, step 2 includes:

[0031] Sender in noise distribution Randomly select an element For sets Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the recipient.

[0032] Further, step 3 includes:

[0033] The sender receives the set Then, for each element In noise distribution Randomly select a noise ,calculate , ; and the resulting privacy set Send to the recipient ;in, Let Y be the total number of elements in set Y. To and Positive integers that are coprime.

[0034] Because of the adoption of the above technical solution, the present invention has the following advantages:

[0035] 1. Resistance to quantum computing attacks. The RLWE mathematically difficult problem used in this invention has the characteristic of resisting quantum computing attacks. The security of this method can be reduced to solving the RLWE problem, therefore this method has quantum-resistant security.

[0036] 2. High protocol execution efficiency. This invention adopts a lattice mathematics structure, mainly focusing on vector matrix and polynomial calculations. The underlying calculation operations do not involve complex modular exponentiation operations, and can be accelerated by NTT, resulting in higher computational efficiency. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0038] Figure 1 This is a schematic diagram of a privacy set intersection method based on the error learning problem according to an embodiment of the present invention. Detailed Implementation

[0039] The present invention will be further described in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0040] This invention utilizes the coordination mechanism of lattice-based key exchange protocols and proposes a two-party privacy set intersection protocol based on the Ring Learning with Errors (RLWE) problem. The basic idea of ​​this invention is: to allow participating parties... The private key is Its elements are Participants The private key is Its elements are Set elements , The hash value is hidden in the RLWE problem instance, that is... , Then they exchanged them. and .if ,but and They are approximately equal. Based on this characteristic, this invention achieves secure privacy set intersection.

[0041] make It is an integer ring. It is a positive integer, let Indicates the commercial ring Define a polynomial ring. It is a power of 2. An element on can be represented as 1 polynomial of degree ,make The parameter is The central binomial distribution has a standard deviation of . . Sampling To generate, among which , yes A uniform random distribution on.

[0042] set up , yes The two elements above, then , In this plan This method is used by default for addition and multiplication operations.

[0043] Let the secret distribution be represented as Generally The distribution can be either uniform or discrete Gaussian; this scheme chooses to use the central binomial distribution. Let the noise distribution be represented as... Generally, the distribution is a discrete Gaussian distribution; this scheme selects a central binomial distribution, which is similar to it. .

[0044] RLWE sampling: random sampling in a distribution (Standard deviation is) Select an element As secret information. Uniformly random in Choose a polynomial Noise distribution (Standard deviation is) Select an error .calculate Then we get sampling .

[0045] (1) Search-based RLWE problem: According to indivual sampling Unraveling the Secret .

[0046] (2) Decision-type RLWE problem: distinguish Distribution and uniform distribution

[0047] These two problems are mathematically difficult and have quantum-resistant properties, making them suitable for constructing cryptographic schemes.

[0048] This protocol is a two-party privacy set intersection protocol. Let the two parties be: the sender and the sender. Recipient Sender Having a collection The number of its elements is The bit length of each element is Recipient Having a collection The number of its elements is The bit length of each element is Hash function : The hash function will give a Data of bit length, transformed into indivual Number of bits. This can be achieved by... The function takes the key of the stream cipher as input, sets IV=0, generates a stream of sequences, and extracts them in segments. indivual Number of bits ,form elements on .parameter t It is a with The modulus of coprime.

[0049] See Figure 1 This invention provides an embodiment of a privacy set intersection method based on the error learning problem, which includes:

[0050] S1: The receiver performs a hash calculation on the private set Y it holds and uses its key. And the RLWE error learning problem, to calculate the encrypted set and the encrypted set Send to the sender;

[0051] S2: The sender performs a hash calculation on the private set X it holds and uses its private key. And the RLWE error learning problem, to obtain a cryptographic set and encrypted sets Send to the recipient;

[0052] S3: The encrypted set received by the sender. Using its private key And the RLWE error learning problem, to calculate the privacy set for re-encryption. And send it to the recipient.

[0053] S4: The receiver is based on the encrypted set. , Key Then we can obtain the intersection of set X and set Y.

[0054] In this embodiment, S4 includes:

[0055] S41: The receiver, based on its key For encrypted sets Each element in the dataset is processed to obtain the privacy set. ;

[0056] S42: For privacy collections Each element in the privacy set We search for elements that meet the requirements, ultimately forming the intersection of set X and set Y.

[0057] In this embodiment, S41 includes:

[0058] The receiver receives the set Then, for each element ,calculate: , Ultimately, a privacy set is obtained. ;in, Let X be the total number of elements in set X.

[0059] In this embodiment, S42 includes:

[0060] The receiver initializes the intersection as an empty set, i.e. ; Traverse the privacy set Each element in , If privacy collection There exist elements that satisfy the following constraints. Then Corresponding elements Add to collection :

[0061] There exists a certain , making =0;

[0062] After traversing the privacy set Each element in Then, output the set. .

[0063] In this embodiment, before S1, the following is also included:

[0064] The sender distributes the private key. Randomly select an element as its private key. It is not disclosed to the public.

[0065] In this embodiment, before S1, the following is also included:

[0066] The recipient distributes the private key. Randomly select an element as its key. It is not disclosed to the public.

[0067] In this embodiment, S1 includes:

[0068] The receiver on the set Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the sender; It is a positive integer.

[0069] In this embodiment, S2 includes:

[0070] Sender in noise distribution Randomly select an element For sets Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the recipient.

[0071] In this embodiment, S3 includes:

[0072] The sender receives the set Then, for each element In noise distribution Randomly select a noise ,calculate , ; and the resulting privacy set Send to the recipient ;in, Let Y be the total number of elements in set Y. It is a positive integer.

[0073] This method is constructed based on the RLWE difficult problem, possessing quantum-resistant security, and can be obtained by... The specific parameters are selected to obtain the required quantum security strength. For example... , ， It can achieve a quantum security strength of 128 bits.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A privacy set intersection method based on the error learning problem, characterized in that, include: Step 1: The receiver performs a hash calculation on the private set Y it holds and uses its key. And the RLWE error learning problem, to calculate the encrypted set and the encrypted set Send to the sender; Step 2: The sender performs a hash calculation on the private set X it holds, and uses its private key. And the RLWE error learning problem, to obtain a cryptographic set and encrypted sets Send to the recipient; Step 3: The sender encrypts the received set. Using its private key And the RLWE error learning problem, to calculate the privacy set for re-encryption. And send it to the recipient; Step 4: The recipient uses the encrypted set , Key Calculate the intersection of set X and set Y; Step 1 includes: The receiver on the set Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the sender; Hash function; Step 2 includes: Sender in noise distribution Randomly select an element For sets Each element In noise distribution Randomly select a noise ,calculate , ; Encrypt the set Send to the recipient; where, Let X be the total number of elements in set X; Step 3 includes: The sender receives the set Then, for each element In noise distribution Randomly select a noise ,calculate , ; and the resulting privacy set Send to the recipient ;in, Let Y be the total number of elements in set Y. To and Positive integers that are coprime. It is a positive integer. Indicates the commercial ring , It is an integer ring.

2. The method according to claim 1, characterized in that, Step 4 includes: Step 41: The receiver uses its key For encrypted sets Each element in the dataset is processed to obtain the privacy set. ; Step 42: Targeting privacy sets Each element in the privacy set We search for elements that meet the requirements, ultimately forming the intersection of set X and set Y.

3. The method according to claim 2, characterized in that, Step 41 includes: The receiver receives the set Then, for each element ,calculate: , Ultimately, a privacy set is obtained. .

4. The method according to claim 2, characterized in that, Step 42 includes: The receiver initializes the intersection as an empty set, i.e. ; Traverse the privacy set Each element in , If privacy collection There exist elements that satisfy the following constraints. Then Corresponding elements Add to collection : There exists a certain , making =0; After traversing the privacy set Each element in Then, output the set. .

5. The method according to claim 1, characterized in that, Before step 1, the following are also included: The sender distributes the private key. Randomly select an element as its private key. It is not disclosed to the public.

6. The method according to claim 1, characterized in that, Before step 1, the following are also included: The recipient distributes the private key. Randomly select an element as its key. It is not disclosed to the public.

Images