A multi-party threshold private set intersection method

Abstract

This invention provides a method for finding the intersection of multi-party threshold privacy sets, belonging to the field of information interaction technology. The invention selects one party as the judge and another as the initiator. The initiator randomly generates a secret and obtains a number of shares and indices equal to the set size. The set elements, secret shares, and indices are encoded to obtain OKVS. The other parties encode their respective set elements and element hash values ​​to obtain corresponding OKVS. Each party divides its OKVS into N-1 parts and sends them to the other parties. These obtained OKVS shares are then used to calculate a new OKVS. Finally, the judge, initiator, and each protocol party execute the OPPRF protocol. The judge determines whether the number of elements in the intersection of all parties reaches a threshold value and calculates the intersection based on the obtained value. Through the above process, this invention implements a multi-party TPSI protocol without requiring threshold fully homomorphic encryption, with low computational cost and complexity, effectively implementing a multi-party TPSI protocol.

Description

Technical Field

[0001] This invention provides a method for finding the intersection of multiple threshold privacy sets, belonging to the field of information interaction technology. Background Technology

[0002] Private Set Intersection (PSI) allows participants to obtain the intersection information of their own set and others' sets without disclosing their own private set information. It has important research significance and application value, and has been widely used in many fields, such as social contact discovery and measuring advertising conversion rates.

[0003] The standard PSI protocol is unsuitable for certain scenarios, such as privacy-preserving data mining and machine learning, where data is vertically partitioned across multiple parties. These parties may desire the intersection of other datasets and will only begin cooperating if the intersection is large enough; if the intersection is too small, they lack strong incentive to cooperate. Similarly, in ride-sharing applications that prioritize user privacy, multiple users will only want to carpool if most of their routes intersect on the map.

[0004] To address this, Freedman et al. proposed the concept of Threshold Private Set Intersection (TPSI). The TPSI protocol allows N participants with private sets of size n to obtain the intersection of their sets only if the number of elements in their intersection is greater than or equal to a threshold value t, without revealing any other information about their inputs.

[0005] However, most existing TPSI protocols are designed for two-party scenarios. Research on TPSI protocols for multi-party scenarios still faces many challenges. Furthermore, existing TPSI protocols use public-key algorithms, such as fully homomorphic encryption, which are costly. Summary of the Invention

[0006] The purpose of this invention is to provide a method for finding the intersection of multi-party threshold privacy sets, which addresses the high cost of using the TPSI protocol in multi-party scenarios.

[0007] This invention provides a method for finding the intersection of multiple threshold privacy sets, the method comprising the following steps:

[0008] 1) Configure a set for each of the N participants in the interaction, and configure an encoding / decoding scheme and two hash functions for all participants to share. N is greater than or equal to 3. Select one participant as the judge, one participant as the initiator, and the remaining participants as the protocol parties.

[0009] 2) Let the initiator randomly generate a secret s and n indices, and use them to obtain n shares and the corresponding secret polynomials. Then, use the indices, shares and elements in the initiator set to encode the initiator's OKVS, and send the hash value H(s) of secret s to the judge.

[0010] 3) Instruct each protocol party to encode the corresponding OKVS based on the elements in its own set and the hash value of the elements;

[0011] 4) The initiator and each party to the agreement shall divide their respective OKVS into N-1 parts and send them to the other participating parties except the judge. The initiator and each party to the agreement shall reconstruct OKVS according to the OKVS share received.

[0012] 5) The judge, the initiator, and each party to the agreement execute the OPPRF protocol respectively. The judge calculates the results obtained from the execution of the OPPRF protocol by each party, thereby obtaining the reconstructed secret share and index.

[0013] 6) The judge performs a polynomial reconstruction based on the reconstructed secret share and index. Based on the reconstructed polynomial and the hash value H(s) of the secret s, it determines whether the number of intersections with each party has reached the threshold value, and calculates the intersection based on the obtained value.

[0014] This invention selects one party as the judge and another as the initiator from among the participating parties. The initiator randomly generates a secret and obtains a number of shares and indices equal to the size of the set. It then encodes the set elements, secret shares, and indices to obtain OKVS. The other parties encode their respective set elements and element hash values ​​to obtain corresponding OKVS. Each party divides its OKVS into N-1 parts and sends them to the other parties. These obtained OKVS shares are then used to calculate a new OKVS. Finally, the judge, initiator, and each protocol party execute the OPPRF protocol. The judge determines whether the number of elements in the intersection of the parties reaches a threshold value and calculates the intersection based on the obtained value. Through the above process, this invention implements a multi-party TPSI protocol without requiring threshold fully homomorphic encryption, with low computational cost and complexity, effectively implementing a multi-party TPSI protocol.

[0015] Furthermore, in step 2), the initiator's OKVS is:

[0016]

[0017] Where Encode is the encoding scheme. s is the l-th element in the set to which the initiator belongs. l For the l-th secret share, ind l Let n be the l-th index, and n be the number of elements in the set, which is also the number of indices.

[0018] Furthermore, the OKVS obtained by the protocol party in step 3) is:

[0019]

[0020] Where Encode is the encoding scheme. It is the l-th element in the set to which the parties to the agreement belong. is the hash value of the l-th element in the set to which the protocol belongs, and n is the number of elements in the set.

[0021] Furthermore, the process of determining the party's calculation and the execution of the OPPRF protocol by all parties in step 5) is as follows:

[0022] The initiator and each protocol party act as senders, constructing a set of points based on the elements in their respective sets and the newly constructed OKVS. These constructed point sets are then used as input to the OPPRF protocol. S j ' represents the OKVS reconstructed by the initiator or the protocol provider, and Decode represents the decoding scheme;

[0023] Let the judge act as the receiver and assign its set to the receiver. As input;

[0024] After the judge, the initiator, and each other party to the agreement have executed the OPPRF protocol, the result is as follows: If an element in the set to which the judge belongs is an element in the sets to which both the initiator and the protocol party belong, that is... Then let Otherwise It is a random value;

[0025] The sum of the results calculated by the judge and the results obtained by all parties after executing the OPPRF protocol. This yields the reconstructed secret share and index.

[0026] Furthermore, the secret share and index reconstructed in step 5) are:

[0027]

[0028] Where || denotes the concatenation of two strings, the result calculated on the right-hand side of the equation is a 2λ-bit string, and the first λ bits are defined as s. l ′, the last λ bits are defined as ind l ′; To determine the hash value of the l-th element in the set to which the party belongs, s l ′ represents the reconstructed l-th secret share; ind l ′ represents the reconstructed l-th index.

[0029] Furthermore, the judgment process in step 6) is as follows:

[0030] The judgment party inputs the reconstructed secret share and index, executes the reconstruction algorithm to obtain the polynomial f′(·), and judges whether H(f′(0)) is equal to H(s). If H(f′(0)) is equal to H(s), it means that the number of elements in the intersection has reached the threshold value t.

[0031] Further, step 2) uses the RSS share generation algorithm to obtain each share and the corresponding key polynomial; step 6) uses the RSS reconstruction algorithm to obtain the polynomial.

[0032] Furthermore, in step 2), the hash value H(s) of the secret s is calculated using the first hash function; in step 3), the hash value of the element is calculated using the second hash function. Attached Figure Description

[0033] Figure 1 This is a flowchart of the multi-party threshold privacy set intersection method in an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0035] Implementation examples of the multi-threshold privacy set intersection method:

[0036] The multi-party threshold privacy set intersection method of this invention achieves multi-party secret intersection for the first time. This intersection method is mainly based on three cryptographic primitives: Robust Secret Sharing (RSS), Oblivious Key-Value Stores (OKVS), and Oblivious Programmable PRF (OPPRF).

[0037] Robust Secret Sharing (RSS) is an enhancement to standard secret sharing, allowing the recovery of a shared secret even when some shares are incorrect. In other words, secret s can be correctly recovered when the number of correct shares is not less than a threshold t. This invention instantiates the RSS function using the Reed-Solomon decoding algorithm. RSS includes a share generation algorithm and a secret reconstruction algorithm. The share generation algorithm is as follows: Input secret s, randomly select n distinct indices {ind1, ..., ind...} nChoose a secret polynomial f(·) of degree t-1 that satisfies f(0) = s; calculate the secret shares: s1 = f(ind1), ..., s n =f(ind n The set of secret shares S = {s1, ..., s2} is output. n The secret reconstruction algorithm is as follows: Input a share set S′={s1′,…,s…} n (where S′ may be different from S). A polynomial f′(·) satisfying f′(ind) is calculated using the Reed-Solomon decoding algorithm. i ) = s i If the number of correct shares in S′ (i.e., shares in S) is greater than or equal to t, then f′(0) = f(0) = s.

[0038] A key-value store (KVS) consists of a set of keys K, a set of values ​​V, an encoding algorithm, and a decoding algorithm. The encoding algorithm (Encode) retrieves a set of (k+1) keys from a finite key-value pair field K×V. i ,v i The input consists of key-value pairs (k) and the output data structure S. The decoding algorithm (Decode) takes the input data structure S and the key k as input and outputs the value v. A KVS structure is correct if for any... have:

[0039] The probability of Pr[Encode(M)=⊥] is negligible; if Encode(M)=S≠⊥ and (k,v)∈M, then Decode(S,k)=v.

[0040] experiment

[0041] For i∈[m], randomly select v i ←V; Return

[0042] Consider the experiment If for any set of keys K1, K2 of size m and a probabilistic polynomial-time adversary... satisfy:

[0043]

[0044] The KVS structure is then called an oblivious key-value pair storage structure (OKVS). The decoding algorithm for binary OKVS has the following homomorphic properties:

[0045]

[0046] S and S′ are unintentional key-value pair storage structures (OKVS) and they have the same dimension.

[0047] The Oblivious Programmable PRF (OPPRF) is an improvement upon the Oblivious Random Function (OPRF). The OPRF is a two-party protocol that allows the sender to learn the key k of the pseudo-random function, and the receiver to learn F(k, q1),...,F(k, q1). t ), where F is a pseudo-random function, and (q1, ..., q t ) is the input selected by the receiver. Furthermore, the receiver's input information will not be disclosed to the sender, nor will the key k be disclosed to the receiver.

[0048] A programmable pseudo-random function (PPRF) consists of the following algorithms:

[0049] 1) KeyGen(λ,P)→(k,hint): Given a security parameter λ and a set of keys with different values ​​a i The point P with value P = {(a1,b1),...,(a... u ,b u Then generate a pseudo-random function key k and (public) auxiliary information hint.

[0050] 2) F(k,hint,a)→b: Calculate the pseudo-random function on input a and give the output b.

[0051] The following is the formal definition of the Unintentional Programmable Pseudo-Random Function (OPPRF) function. The Unintentional Programmable Pseudo-Random Function function is similar to the Unintentional Pseudo-Random Function function, but the difference lies in:

[0052] It allows the sender to initially provide a set of P points, program the P points into a pseudo-random function, and also provide a cue value to the receiver.

[0053] Ideal function of inadvertently programmable pseudo-random function (OPPRF)

[0054] Parameters: A programmable pseudo-random function F, an upper limit u for the number of points to be programmed, and an upper limit v for the number of queries.

[0055] Process: Wait for input from sender S: P = {(a1, b1), ..., (a u ,b u The inputs (q1, ..., q) to receiver R are: vFinally, run (k,hint)←KeyGen(λ,P), and send (k,hint) to S, and set (hint,F(k,hint,q1),···,F(k,hint,q) to S. v Send to R.

[0056] Based on the above technology, this invention provides a method for finding the intersection of multiple threshold privacy sets. This invention selects one participant as the judge, one participant as the initiator, and the remaining participants as the protocol parties. The method involves the initiator P2 randomly generating a secret s, performing an RSS share generation phase to obtain a number of shares equal to the set size, and encoding the set elements and secret shares to obtain OKVS; the protocol parties P3, ..., P... N Encode the set elements and hash values ​​to obtain OKVS; then, divide each party's OKVS into N-1 parts and send them to the other parties; then use these obtained OKVS shares to calculate the new OKVS; finally, judge parties P1 and P2, ..., P N The OPPRF protocol is executed; the judge P1 determines whether the number of elements in the intersection of the parties reaches a threshold value, and calculates the intersection based on the obtained value. The implementation flow of this method is as follows: Figure 1 As shown, the specific implementation steps are as follows.

[0057] In this embodiment, there are N participants P1, ..., P2. N Each participant P i Have a set An OKVS scheme (Encode, Decode) with two hash functions H:{0,1} * →{0,1} λ and h:{0,1} * →{0,1} 2λ t is the threshold value of the protocol, which can take any value between 0 and n, where 0 < t ≤ n. P1 is the decision-making party, P2 is the initiating party, P3, ..., P... N As a party to the agreement.

[0058] 1. A secret s is randomly generated by P2. The RSS share generation algorithm is used to obtain the same number of shares as the set size. The set elements and secret shares are encoded to obtain OKVS. The hash value H(s) of secret s is given to P1.

[0059] In this embodiment, P2 randomly generates a secret s and n indices {ind1, ..., ind}. n Then, the RSS share generation algorithm is used to obtain n shares {s1, ..., s2}. n} and the secret polynomial f(·), for all l∈[n], f(ind l ) = s l Each share and index is a λ-bit string, and P2 is based on its set. The elements, shares, and indices in the data are encoded to obtain OKVS S2.

[0060]

[0061] At the same time, P2 performs a hash operation on the secret s according to the first hash function to obtain the corresponding hash value H(s), and sends it to participant P1.

[0062] 2. Other participants encode the set elements and hash values ​​to obtain OKVS.

[0063] For the other participants P besides the first participant P1 and the second participant P2 i (i∈[3,N]) respectively according to their own sets And the hash function h:{0,1} * →{0,1} 2λ Once the hash value corresponding to each element in the set is determined, other participants encode the elements in their own sets and their corresponding hash values ​​to obtain the OKVS corresponding to that participant, i.e.:

[0064]

[0065] in Let represent the l-th element in the set of the i-th participant. Therefore, through this step, all other participants can obtain the corresponding OKVS.

[0066] 3.P i (i∈[2,N]) will each have their own OKVSS i The OKVS is divided into N-1 parts and sent to all parties except the first party. The other parties then reconstruct a new OKVS based on the received OKVS share.

[0067] Apart from the first participant P1, all other parties P i (i∈[2,N]) will correspond to S i Divide into N-1 parts and distribute to the other parties, that is For example, if participant N equals 5, then participant P2 will divide its S2 into 4 parts, giving them to P2, P3, P4, and P5 respectively. At the same time, P2 will also receive the shares sent by P3, P4, and P5 respectively. i (i∈[2,N]) Reconstruct each party's OKVS based on the obtained N-1 shares. For example, participant P2 will reconstruct their OKVS based on their share. And the shares received from P3, P4 and P5 respectively. and Building a new OKVS for user P j For (j∈[2,N]), the new OKVS constructed is:

[0068]

[0069] 4. Each participating party executes the OPPRF protocol, and P1 calculates the result obtained by each party after executing the OPPRF protocol.

[0070] Participant P j (j∈[2,N]) as the sender, based on the elements in its set and the constructed S j Construct a set of points and use it as input to construct a set of points.

[0071] Participant P1, as the receiver, will transfer the set to which it belongs. As input.

[0072] P1 and P j (j∈[2,N]) After each party executes the OPPRF protocol, they will receive the corresponding... If some element of the set to which P1 belongs is P j The elements in the set to which (j∈[2,N]) belong, i.e. Then let Otherwise It is a random value, where Indicates participant P j The l′-th element in the set, for a set element of participant P1 It may be related to participant P. j If some elements in the set are equal, but this element corresponds to a different value in set P. j Since the index in a set is not necessarily l, we use the subscript l′ to indicate that this element may appear in P. j The position within the set.

[0073] Through this process, P1 and P j (j∈[2,N]) After executing the OPPRF protocol, we will get For example, after P1 and P2 complete the OPPRF protocol, they will get...

[0074] Participant P1 calculates the sum of the results obtained by all parties after executing the OPPRF agreement. For all elements l∈[n] in the set, if N is odd, P1 is calculated. (|| denotes the concatenation of two strings. The result on the right-hand side of the equation is a 2λ-bit string. The first λ bits are defined as s.) l ′, the last λ bits are defined as ind l Otherwise, user P1 calculates...

[0075] 5. P1 determines whether the number of elements in the intersection of the parties reaches the threshold value, and calculates the intersection based on the obtained value.

[0076] P1 input {s l ′} l∈[n] and {ind l ′} l∈[n] The RSS reconstruction phase yields the polynomial f′(·), and it checks whether H(f′(0)) is equal to H(s). If H(f′(0)) is equal to H(s), it means that the number of elements in the intersection has reached the threshold value t, because if H(f′(0)) is equal to H(s), it means that {s} l ′} l∈[n] If the number of correct shares reaches the threshold value t (only when the number of correct shares reaches the threshold value can the correct secret polynomial be reconstructed, and f′(0)=s), then it means that the number of intersections has reached the threshold value t, and an intersection element can obtain a correct share; otherwise, the protocol ends.

[0077] To better illustrate the interaction method of this invention, a specific example of its application is presented below. Assume the participants in this example are three companies, P1, P2, and P3. These three companies want to jointly train a machine learning model using their respective datasets, expecting to collaborate only when the size of the shared dataset reaches a certain threshold. For ease of explanation, assume P1's dataset is X1 = {1,3,4,6,8}, P2's dataset is X2 = {1,2,3,4,9}, and P3's dataset is X3 = {1,3,4,5,8}. Now, a threshold value t = 3 is set, meaning that an intersection will only be obtained when the number of intersections among the three parties reaches 3. The specific interaction process is as follows:

[0078] 1) P2 randomly selects a secret s and an index {ind1,ind2,ind3,ind4,ind5} that is the same number of elements in the set. The RSS share generation algorithm is executed to obtain a secret polynomial f(·) and shares {s1,s2,s3,s4,s5}, where f(ind1) = s1,…,f(ind5) = s5.

[0079] 2) P2 constructs a point set {(1,s1||ind1),(2,s2||ind2),(3,s3||ind3),(4,s4||ind4),(9,s5||ind5)} by mapping the elements of the set to their corresponding shares; P2 takes the point set as input and uses the OKVS Encode algorithm to obtain S2: S2←Encode({(1,s1||ind1),(2,s2||ind2),(3,s3||ind3),(4,s4||ind4),(9,s5||ind5)}); then P2 divides S2 into two parts such that: And instruct P2 to send P2 sends the hash value H(s) of s to P3.

[0080] 3) P3 constructs a point set {(1,h(1)),(3,h(3)),(4,h(4)),(5,h(5)),(8,h(8))}. P3 takes the point set as input and uses the OKVS Encode algorithm to obtain S3: S3←Encode({(1,h(1)),(3,h(3)),(4,h(4)),(5,h(5)),(8,h(8))}), and then divides S3 into two parts such that: Command P3 to send Given P2, calculate P2 P3 calculation

[0081] 4) P1 executes the OPPRF protocol with P2 and P3 respectively. P1 acts as the receiver, with the input set X1 = {1, 3, 4, 6, 8}. P2 and P3 act as the senders, each constructing a set of points:

[0082] D2={(1,Decode(S2′,1)),(2,Decode(S2′,2)),(3,Decode(S2′,3)),(4,Decode(S2′,4)),(9,Decode(S2′,9))}

[0083] D3={(1,Decode(S3′,1)),(3,Decode(S3′,3)),(4,Decode(S3′,4)),(5,Decode(S3′,5)),(8,Decode(S3′,8))}

[0084] P2 and P3 take the constructed point set as input, and P1 and P2 will obtain the result after executing the OPPRF protocol. (obtained by entering 1) Get by entering 3 …, obtained by entering 8 If the input of P1 is in the x-coordinate value of the input point set D2 of P2, then the corresponding y-coordinate value is obtained; otherwise, a random value is obtained. For example, if the input 1 of P1 is actually in the input point set of P2, then the value obtained by inputting 1 is... The input 6 to P1 is not in the input point set of P2, so the result obtained by inputting 6 is... It is a random value that P1 and P3 will get after executing the OPPRF protocol. The analysis is the same as above.

[0085] 5) Calculation of P1 P1 takes {s1′,s2′,s3′,s4′,s5′} and {ind1′,ind2′,ind3′,ind4′,ind5′} as input and executes the secret reconstruction algorithm of RSS to obtain the polynomial f′(·). It then checks whether H(f′(0)) is equal to H(s). If they are equal, it means the number of correct shares has reached the threshold, and consequently, the number of intersections has reached the threshold, because one intersection element can obtain a correct share. If they are not equal, the protocol is terminated.

[0086] 6) If the two are equal as determined in the previous step, continue executing the protocol, and P1 makes a judgment. Check if they are equal; if they are equal, then change the corresponding element. Add it to the intersection I. For example, s1′=f′(ind1′) means that element 1 is an element of the intersection. Put 1 into the intersection I, and finally P1 outputs the intersection I={1,3,4} to P2 and P3.

Claims

1. A method for finding the intersection of multi-party threshold privacy sets, characterized in that, The method includes the following steps: 1) Configure a set for each of the N participants in the interaction, and configure an encoding / decoding scheme and two hash functions for all participants to share. N is greater than or equal to 3. Select one participant as the judge, one participant as the initiator, and the remaining participants as the protocol parties. 2) The initiator randomly generates a secret *s* and *n* indices, and uses these to obtain *n* shares and their corresponding secret polynomials. The indices, shares, and elements from the initiator's set are then used to encode the initiator's OKVS, and the secret is then... hash value Send to the judgment party; 3) Instruct each protocol party to encode the corresponding OKVS based on the elements in its own set and the hash values ​​of those elements; 4) The initiator and each party to the agreement shall divide their respective OKVS into... The OKVS share is sent to all participating parties except the judgment party, and the initiator and each party to the agreement reconstruct OKVS according to the received OKVS share; 5) Let the initiator and each protocol party act as senders, construct a set of points based on the elements in their respective sets and the newly constructed OKVS, and use the constructed set of points as the input of the OPPRF protocol. Let the judge act as the receiver, and use its own set as the input. After the decision-making party, the initiating party, and each protocol party have executed the OPPRF protocol, if an element in the decision-making party's set is an element in the initiating party's or protocol party's set, that is... ( ), then let Otherwise It is a random value; The sum of the results calculated by the judge and the results obtained by all parties after executing the OPPRF protocol. This allows us to obtain the secret share and index for reconstruction: in This represents the concatenation of two strings; the result calculated on the right-hand side of the equation is a single string. A string of bits, with the first... Bit is defined as ,back Bit is defined as ; To determine the set to which the first party belongs The hash value of each element. For the reconstructed first A secret share; For the reconstructed first One index; 6) The judgment party performs a polynomial reconstruction based on the reconstructed secret share and index, and then determines the outcome based on the reconstructed polynomial and secret. hash value Determine whether the number of intersections with each party reaches a threshold value, and calculate the intersection based on the obtained value.

2. The method for finding the intersection of multi-party threshold privacy sets according to claim 1, characterized in that, In step 2), the initiator's OKVS is: in For the encoding scheme, The first in the set to which the initiator belongs One element, For the first A secret share, For the first One index, This represents the number of elements in the set, and also the number of indices.

3. The method for finding the intersection of multiple threshold privacy sets according to claim 1, characterized in that, In step 3), the OKVS obtained by the protocol party is: in For the encoding scheme, The first in the set of parties to the agreement One element, The first in the set of parties to the agreement The hash value of each element. The number of elements in the set.

4. The method for finding the intersection of multiple threshold privacy sets according to claim 1, characterized in that, The judgment process in step 6) is as follows: The judgment side inputs the reconstructed secret share and index, performs a reconstruction algorithm to obtain a polynomial. ,judge Is it equal to ,if equal This means that the number of elements in the intersection has reached the threshold value. .

5. The multi-party threshold privacy set intersection method according to claim 4, characterized in that, Step 2) uses the RSS share generation algorithm to obtain each share and the corresponding key polynomial; Step 6) uses the RSS reconstruction algorithm to obtain the polynomial.

6. The multi-party threshold privacy set intersection method according to claim 4, characterized in that, In step 2), the secret hash value The hash value of the element in step 3) is calculated using the first hash function; the hash value of the element in step 3) is calculated using the second hash function.

Images