Method and system for calculating the cardinality of three-party private set intersection based on bilinear mapping

Abstract

The application provides a three-party privacy set intersection cardinality calculation method and system based on a bilinear mapping. The communication round number and calculation amount of a multi-party protocol are reduced based on a bilinear mapping technology. In order to avoid information leakage, a secret sharing is introduced. Secret elements are distributed to each participant through the secret sharing. Each participant performs calculation based on the received secret share and the ciphertext of other participants. The calculation results of each participant are compared and calculated to obtain the cardinality of the three-party privacy set intersection, thereby solving the problem that the existing privacy set intersection cardinality calculation needs three rounds of communication and a large number of power operations in three parties.

Description

Technical Field

[0001] This invention belongs to the field of security technology, and in particular relates to a method and system for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of next-generation information technologies such as 5G and cloud computing, the world has entered the digital economy era. Data is the core of the digital economy, and fully leveraging its value is a crucial cornerstone for its healthy development. However, the widespread existence of "data silos," frequent big data breaches, and increasingly stringent data compliance laws and policies severely restrict data sharing and circulation, necessitating a reliable method for data flow. Technologies such as secure multi-party computation, federated learning, and differential privacy offer feasible solutions for the rational analysis and modeling of data while protecting privacy.

[0004] Privacy-preserving computation involves performing calculations on data while protecting its security, achieving the goal of making the data usable but not visible. Currently, a series of privacy-preserving computation methods have been proposed, such as Private Set Intersection (PSI), Private Set Union (PSU), and Private Set Intersection Cardinality (PSI-CA). Private Set Intersection Cardinality is a specific problem in secure multi-party computation that allows two or more parties to calculate the size of the intersection of their sets without revealing any data information other than the intersection size. This security greatly satisfies the needs of many new privacy-preserving scenarios. Currently, the application of Private Set Intersection Cardinality is widespread, such as calculating online advertising conversion rates, gene similarity detection, and privacy-preserving data mining.

[0005] In recent years, research on the PSI-CA protocol has mainly focused on two-party scenarios. A simple idea is based on the Diffie-Hellman key exchange concept. Participants P1 and P2 each hold their own privacy sets {x1, x2, ..., x...}. n} and {y1, y2, ..., y n P1 first applies a hash function H(·) to the elements of its set to map them to a certain multiplicative cyclic group G, and then encrypts them using its own key a to obtain the ciphertext set {H(x1)}. a H(x2) a H(x)n ) a} and send it to P2. Similarly, P2 first applies a hash function H(·) to its own set elements to map them to the group G, and then encrypts them with its own key b to obtain the ciphertext set {H(y1)}. b H(y2) b , ..., H(y n ) b} and send it to P1. At this point, P1 possesses the ciphertext set {H(y1)} obtained by P2 encrypting its set elements. b H(y2) b , ..., H(y n ) b Based on this, P1 further encrypts the ciphertext set using its key a, obtaining {(H(y1)}. b ) a , (H(y2) b ) a , ..., (H(y) n ) b ) a Similarly, P2 receives the ciphertext set {H(x1)} obtained by P1 encrypting its set elements. a H(x2) a H(x) n ) a After that, the ciphertext set is further encrypted using its key b, resulting in {(H(x1)}. a ) b , (H(x2) a ) b , ..., (H(x) n ) a ) b The elements are shuffled and then sent to P1. P1 then compares the two encrypted data sets {(H(y1)}. b ) a , (H(y2) b ) a , ..., (H(y) n ) b ) a} and {(H(x1)} a ) b , (H(x2) a ) b , ..., (H(x) n ) a ) b This allows us to obtain the cardinality of the ciphertext intersection of the privacy data sets P1 and P2. However, this method is not applicable for finding the cardinality of intersections between multiple privacy sets, such as three-party privacy set intersection schemes.Figure 1 As shown, a three-party PSI protocol is completed using the PSI protocol based on the Diffie-Hellman key exchange idea of ​​the two parties mentioned above. However, this operation can reveal the cardinality of the intersection of any two parties' sets, and it requires three rounds of communication and a large number of exponentiation operations. Summary of the Invention

[0006] To overcome the shortcomings of the prior art, this invention provides a method and system for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping. The method calculates the cardinality of the intersection of the privacy sets of the three parties based on bilinear mapping and secret sharing techniques, thereby reducing the number of communication rounds and computational load of multi-party protocols.

[0007] To achieve the above objectives, a first aspect of the present invention provides a method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, comprising:

[0008] The multiplication cyclic group agreed upon by the three participants is determined based on the bilinear mapping technique;

[0009] The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast.

[0010] Based on secret sharing, element 0 is shared into secret shares equal to the number of the multiple participants;

[0011] Each participating party calculates the received secret share and the ciphertext of other participating parties based on bilinear mapping technology;

[0012] The designated participant calculates the cardinality of the intersection of the privacy sets of the three parties by combining the results received from the other participants with its own calculation results.

[0013] A second aspect of the present invention provides a system for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, characterized in that,

[0014] Determining the module: Based on bilinear mapping technology, determining the multiplication cyclic group agreed upon by multiple participants;

[0015] Encryption module: The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast.

[0016] Secret sharing module: Based on secret sharing, element 0 is shared into secret shares equal to the number of participants;

[0017] First calculation module: Each participant calculates the received secret share and the ciphertext of other participants based on bilinear mapping technology;

[0018] The second calculation module: The designated participant calculates the cardinality of the intersection of the privacy sets of the multiple parties by combining the results of calculations received from other participants with its own calculation results.

[0019] A third aspect of the present invention provides a computer device, comprising: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, a method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping is performed.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs a method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping.

[0021] The above one or more technical solutions have the following beneficial effects:

[0022] In this invention, bilinear mapping technology is used to reduce the number of communication rounds and computational load in multi-party protocols. On this basis, to avoid information leakage, secret sharing is introduced. Secret elements are distributed to each participant through secret sharing. Each participant performs calculations based on the received secret share and the ciphertext of other participants. By comparing the calculation results of each participant, the cardinality of the intersection of the three-party privacy sets is obtained. This solves the problem that the calculation of the cardinality of the intersection of privacy sets in existing methods requires three rounds of communication and a large number of exponentiation operations in three parties.

[0023] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0024] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0025] Figure 1 For the existing third-party PSI-CA based on Diffie-Hellman key exchange;

[0026] Figure 2 This refers to the three-party key negotiation protocol in Embodiment 1 of the present invention.

[0027] Figure 3 This is a schematic diagram of the tri-party PSI-CA based on bilinear mapping in Embodiment 1 of the present invention. Detailed Implementation

[0028] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0029] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0030] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0031] Bilinear mappings: Bilinear pairings are widely used in cryptographic schemes. A bilinear mapping defines two q-order multiplicative cyclic groups G1 and G2, and defines a mapping e: G1×G1→G2 over these two multiplicative cyclic groups, where the bilinear mapping satisfies the following three properties:

[0032] Bilinear: For any g1, g2 ∈ G1, a, b ∈ Zq, then

[0033] Non-degeneracy: There exist g1, g2 ∈ G1 that satisfy in It is the identity element on group G2;

[0034] Computability: There exists an efficient algorithm for... e(g1, g2) can be calculated for both.

[0035] Secret sharing: Secret sharing refers to dividing a secret message into several shares in an appropriate form, and distributing these shares to different participants. Only when a certain number of participants jointly participate in decryption can the secret message be recovered, thereby achieving risk diversification and tolerance for intrusion. Based on the number of participants required for decryption, secret sharing can be divided into strict secret sharing and threshold secret sharing: Strict secret sharing requires the participation of everyone involved in decryption. Threshold secret sharing requires only a certain number of participants to complete the decryption.

[0036] Example 1

[0037] This embodiment discloses a method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, including:

[0038] The multiplication cyclic group agreed upon by the three participants is determined based on the bilinear mapping technique;

[0039] The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast.

[0040] Based on secret sharing, element 0 is shared into secret shares equal to the number of the multiple participants;

[0041] Each participating party calculates the received secret share and the ciphertext of other participating parties based on bilinear mapping technology;

[0042] The designated participant calculates the cardinality of the intersection of the privacy sets of the multiple participants by combining the results of calculations received from other participants with its own calculation results.

[0043] This embodiment aims to provide an efficient method for solving the three-party PSI-CA protocol, and to offer a solution for designing multi-party PSI-CA protocols.

[0044] To achieve the above objectives, this embodiment provides the following technical solution. The main idea of ​​the solution is a three-party one-round key negotiation based on bilinear pairings (BP), thereby reducing the number of communication rounds and computational load of the three-party protocol. The three-party one-round key negotiation based on bilinear pairings is as follows: Figure 2 As shown, participants P1, P2, and P3 wish to negotiate a key. It is assumed that these three participants have previously agreed upon two p-order multiplicative cyclic groups G1 and G2. T Given an element g on a group G1 and a bilinear mapping e: G1×G1→G T Due to the Bilinear Diffie-Hellman Problem (BDH) assumption on group G, the key negotiation process is as follows: Participants P1, P2, and P3 first randomly generate a positive integer a, b, c ∈ Z. p Then each broadcasts message g. a g b and g c Subsequently, P1 calculates e(g) locally. b g c ) a P2 local calculation e(g) a g c ) b P3 local calculation e(g) a g b ) c Due to the bilinearity, we have e(g) b g c ) a =e(g a g c ) b =e(g a g b ) c =e(g, g) abcSince the protocol is established, the three parties only need one round of communication to negotiate the key. We extend this idea to the three-party PSI-CA solution scenario, and thus design an efficient three-party PSI-CA protocol.

[0045] First, assume that participants P1, P2, and P3 each hold one set element x, y, and z. The privacy set intersection cardinality problem is then transformed into determining whether the elements x, y, and z of the three sets are equal. The three participants pre-agree on two multiplicative cyclic groups G1 and G2, both of order p. T A bilinear mapping e: G1×G1→G T and a hash function H: {0, 1} * →G1. Initially, P1, P2, and P3 each select their own keys a, b, and c ∈ Z. p Then P1 applies a hash function H(·) to its own set element x to map it onto the group G1, and then encrypts it with its own key a to obtain the ciphertext H(x). a P2 uses a hash function H(·) on its own set element y to map it to group G1, and then encrypts it with its own key b to obtain the ciphertext H(y). b P3 applies a hash function H(·) to its own set element z to map it onto the group G1, and then encrypts it with its own key c to obtain the ciphertext H(z). c Subsequently, each of the three participants broadcasts its calculated ciphertext message H(x). a H(y) b and H(z) c At this point, P1 receives message H(y). b and H(z) c Based on this, a two-line calculation is performed on this ciphertext using its key 'a' to obtain e(H(y)). b H(z) c ) a =e(H(y), H(z)) abc P2 received message H(x) a and H(z) c Based on this, bilinear pairing is performed on this ciphertext using its key b to obtain e(H(x)). a H(z) c ) b =e(H(x), H(z)) abc P3 received message H(x) a and H(y) b Similarly, using the key c, a bidirectional pairwise computation is performed on this ciphertext to obtain e(H(x)). a H(y) b ) c=e(H(x), H(y)) abc Finally, P1, P2, and P3 broadcast messages e(H(y), H(z)) respectively. abc e(H(x), H(z)) abc and e(H(x), H(y)) abc Note that, due to bilinearity, set elements x, y, and z are equal if and only if e(H(y), H(z)). abc =e(H(x), H(z)) abc =e(H(x), H(y)) abc If the latter is true, then the elements x, y, and z of the set are equal, and the cardinality of the intersection of the sets is 1.

[0046] While the above method can solve the problem of finding the cardinality of the intersection of three-party privacy sets, it also causes some information leakage: taking participant P3 as an example, if the set element x = y ≠ z, then by comparing the messages e(H(y), H(z)) abc e(H(x), H(z)) abc and e(H(x), H(y)) abc P3 will know that the elements of P1 and P2 are equal; in other words, P3 can obtain the cardinality of the intersection of the sets held by P1 and P2. To avoid this problem, we introduce a secret sharing technique. Assume P3 is designated to obtain the cardinality of the intersection of the three sets. First, let P1 use an additive secret sharing scheme, secretly sharing the element 0 as r1, r2, r3 ∈ Z. p The condition is met, where r1 + r2 + r3 = 0. Then P1 sends r2 and r3 to P2 and P3 respectively. During the above process, when the three participants broadcast H(x)... a H(y) b and H(z) c Then, P1 performs local calculations. And send it to P3, P2 calculates it locally. And send it to P3, P3 performs local calculation. If x = y = z, then since r1 + r2 + r3 = 0, then Therefore, P3 can be determined by whether the result is... To determine if elements x, y, and z of a set are equal, and thus to find the cardinality of the intersection of the three sets, but this cannot be done by comparison. and Determine the cardinality of the intersection of sets P1 and P2.

[0047] Below, we consider the general case where P1 holds a private data set {x1, x2, ..., x}. n P2 holds the privacy dataset and {y1, y2, ..., y}.n P3 holds a private data set {z1, z2, ..., z}. n Similarly, assume that the three parties agree in advance on two cyclic groups G1 and G2. T A bilinear mapping e: G1×G1→G T and a hash function H: {0, 1} * →G1. Similarly, assuming P3 is the party designated to obtain the cardinality of the intersection of the three sets, P1, P2, and P3 first each choose their own keys a, b, and c. Then, P1 selects its own set element x. i A hash function H(·) is used to map onto a group G1, where 1 ≤ i ≤ n, and then encrypted using its own key a to obtain the ciphertext H(x). i ) a Furthermore, P1 uses an additive secret sharing scheme to share element 0 into r1, r2, and r3, satisfying r1 + r2 + r3 = 0. P2 also shares its set element y... j A hash function H(·) is used to map the hash onto group G1, and then encrypted using the key b to obtain the ciphertext H(y). j ) b , 1≤j≤n; P3 has its own set element z k A hash function H(·) is used to map the hash onto group G1, and then encrypted using the key c to obtain the ciphertext H(z). k ) c , 1≤k≤n. Subsequently, the three participants each broadcast their calculated ciphertext message H(x). i ) a H(y) j ) b and H(z) k ) c 1≤i,j,k≤n, and at the same time, P1 sends r2 and r3 to P2 and P3 respectively. At this point, P1 receives message H(y). j ) b and H(z) k ) c Based on this, the following operations are performed on the received 2n ciphertext messages using their key a: P2 receives message H(x) i ) a and H(z) k ) c Based on this, the following operations are performed on the received 2n ciphertext messages using their key b: P3 receives message H(x) i ) a and H(y) j ) bBased on this, the following operations are performed on the received 2n ciphertext messages using their key c: Finally, P1 and P2 will send message u respectively. j，k and v i，k Send to P3, where 1 ≤ i, j, k ≤ n. Based on the above, if the intersection element is x... i y j and z k Since bilinearity and r1+r2+r3=0, there must be an equation. Therefore, by counting the number of such equations that are true locally, P3 can deduce the cardinality of the intersection of the three sets. Figure 3 This is a schematic diagram of the protocol.

[0048] Example 2

[0049] The purpose of this embodiment is to provide a system for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, including:

[0050] Determining the module: Based on the bilinear mapping technique, determine the multiplication cyclic group agreed upon by the three participants;

[0051] Encryption module: The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast.

[0052] Secret sharing module: Based on secret sharing, the secret element 0 is shared into secret shares equal to the number of the multiple participants;

[0053] First calculation module: Each participant calculates the received secret share and the ciphertext of other participants based on bilinear mapping technology;

[0054] The second calculation module: The designated participant calculates the cardinality of the intersection of the privacy sets of the three parties by combining the results of calculations received from other participants with its own calculation results.

[0055] Example 3

[0056] The purpose of this embodiment is to provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the above-described method.

[0057] Example 4

[0058] The purpose of this embodiment is to provide a computer-readable storage medium.

[0059] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the above-described method.

[0060] The steps and methods involved in the apparatuses of Embodiments 2, 3, and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0061] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0062] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, characterized in that, include: Based on the bilinear mapping technique, it is determined that the three participating parties pre-agreed that both orders are... Multiplication cyclic group and The three parties agreed in advance that both stages would be [unclear]. Multiplication cyclic group and The bilinear mapping is ; The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast. Specifically, each participant maps its own privacy set elements to the multiplication cyclic group using a hash function, and encrypts the result of the hash function using its own key to obtain the corresponding ciphertext. Each participant maps its own privacy set elements to the same first multiplication cyclic group using a hash function. Based on secret sharing, element 0 is shared into secret shares equal to the number of participants. This secret sharing is an additive secret sharing scheme, where element 0 is secretly shared as... , , ,satisfy ; Each participant calculates the received secret share and the ciphertext of other participants based on the bilinear mapping technique. Specifically, each participant uses its own key to calculate the received ciphertext and secret share of other participants based on the bilinear mapping technique. The designated participant obtains the cardinality of the intersection of the three-party privacy sets by multiplying the results of calculations received from other participants with its own calculation results.

2. The method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping as described in claim 1, characterized in that, For the intersection elements of the three-party privacy sets, based on the bilinear mapping and the fact that the multiplication of each secret share is 1, that is, the result of the designated participant multiplying the result calculated by the other participants with its own result is equal to the identity element on the second multiplication cyclic group.

3. A system for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping, characterized in that, The method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping as described in any one of claims 1-2 includes: Determining the module: Based on the bilinear mapping technique, determine the multiplication cyclic group agreed upon by the three participants; Encryption module: The three participants encrypt their respective privacy set elements and map them to the multiplication cyclic group to obtain the corresponding ciphertext, which is then broadcast. Secret sharing module: Based on secret sharing, secret elements are shared into secret shares equal to the number of participants; First calculation module: Each participant calculates the received secret share and the ciphertext of other participants based on bilinear mapping technology; The second calculation module: The designated participant calculates the cardinality of the intersection of the privacy sets of the three parties by combining the results of calculations received from other participants with its own calculation results.

4. The three-party privacy set intersection cardinality calculation system based on bilinear mapping as described in claim 3, characterized in that, The first calculation module specifically includes: each participant using its own key to calculate the ciphertext and secret share received from other participants based on bilinear mapping technology.

5. A computer device, characterized in that, include: The computer device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping as described in any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the method for calculating the cardinality of the intersection of three-party privacy sets based on bilinear mapping as described in any one of claims 1 to 2.

Images