A multi-party threshold privacy set intersection calculation method and system based on a secure comparison protocol

Abstract

The application discloses a kind of multi-party threshold privacy set intersection method and system based on security judgment, belong to computer science and technology field, solve the problem that multiple participants need to jointly decrypt ciphertext in the multi-party threshold privacy set intersection calculation method in prior art, thereby leading to the problems of calculation and communication overhead.The application generates SEQ request according to the multi-party threshold privacy set intersection calculation service request, and the server initializes parameters;Client first generates the corresponding confusion bloom filter of its own privacy data set and sends it to leader to generate SEQ request;The server generates SEQ response according to SEQ request;Leader generates SBT request after receiving SEQ response;The server generates SBT response after receiving SBT request;Leader obtains the result after recovery according to SBT response, and judges whether the privacy data belongs to threshold intersection or not.The application is used for the multi-party threshold privacy set intersection calculation.

Description

Technical Field

[0001] A method and system for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol are disclosed, which belong to the field of computer science and technology. Background Technology

[0002] With the rapid development of information technology, various applications have played a vital role in many aspects of people's lives, generating massive amounts of data. While these applications have greatly facilitated people's lives, they have also led to the continuous mining of vast amounts of personal privacy, customer information, and corporate data, posing a significant threat to people's privacy. With increasing privacy awareness and the introduction of stringent regulations (such as the GDPR in Europe, the CCPA in the United States, and the Personal Information Protection Law of the People's Republic of China in China), the protection of personal data privacy has become crucial. This has spurred the demand for new privacy-preserving technologies that enable multiple parties to share information without disclosing sensitive data. In traditional dataset intersection calculations, all datasets are typically gathered together before the intersection is calculated. However, this method has serious privacy issues because it requires the calculator to have access to all datasets, posing a significant threat to the privacy of data owners. Furthermore, many real-world scenarios require calculating the threshold intersection of multiple datasets, meaning that at least τ (τ < t) datasets contain data from t datasets. Therefore, how to calculate the threshold intersection of multiple privacy-preserving datasets in a privacy-preserving manner has become an urgent problem to solve.

[0003] In recent years, scholars both domestically and internationally have proposed a series of methods for calculating the intersection of privacy sets, such as methods based on public-key cryptography, methods based on obfuscated circuits, and methods based on unintended transmission. However, research on multi-party threshold privacy set intersection calculation is still relatively limited. Some researchers have calculated the threshold intersection of datasets by randomly selecting τ datasets from t datasets and performing multi-party privacy set intersection calculation on these τ datasets. However, this method requires traversing all possible combinations, which incurs significant overhead when the number of datasets is large. Furthermore, although there are cryptographic methods that can securely count datasets containing certain data using the homomorphic properties of ciphertext, thus avoiding the need to traverse multiple datasets to calculate the threshold intersection, these methods require multiple parties to jointly decrypt the ciphertext, leading to unnecessary computational and communication overhead.

[0004] In summary, the existing technology has the following technical problems:

[0005] Multiple parties are required to jointly decrypt the ciphertext, which leads to computational and communication overhead. Summary of the Invention

[0006] To address the problems mentioned above, the present invention aims to provide a method and system for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol. This solves the problem that existing methods for calculating the intersection of multi-party threshold privacy sets require multiple parties to jointly decrypt the ciphertext, resulting in computational and communication overhead.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol includes the following steps:

[0009] Step 1: Based on the multi-party threshold privacy set intersection computation service request, the server initializes the parameters, including the public and private key pairs of the Paillier cryptosystem, the hash function, and the length of the obfuscated Bloom filter;

[0010] Step 2: Based on the initialization parameters, the client first sends its own privacy dataset D i Generate the corresponding obfuscated Bloom filter and send it to the leader, where the leader represents a client whose execution operation is different from that of other clients;

[0011] Step 3: After receiving the obfuscated Bloom filter, the leader will store its own privacy dataset D. t Substitute it into the obfuscated Bloom filter and generate a SEQ request based on the SEQ request algorithm in the SEQ protocol;

[0012] Step 4: After receiving the SEQ request, the server calculates the SEQ response according to the SEQ response algorithm in the SEQ protocol and generates the SEQ response;

[0013] Step 5: After receiving the SEQ response, the Leader calculates according to the SEQ result recovery algorithm in the SEQ protocol and generates an SBT request;

[0014] Step 6: After receiving the SBT request, the server calculates the SBT response according to the SBT response algorithm in the SBT protocol and generates the SBT response.

[0015] Step 7: After receiving the SBT response, the Leader calculates the SBT recovery result according to the SBT result recovery algorithm in the SBT protocol, and determines whether the privacy data belongs to the threshold intersection.

[0016] Furthermore, the specific steps of step 1 are as follows:

[0017] Step 1.1: Server S generates a public-private key pair (pk, sk) for the Paillier cryptosystem.

[0018] Step 1.2: Select k independent and uniformly distributed hash functions H = {h1, h2, …, h k};

[0019] Step 1.3: Determine the length m of the obfuscated Bloom filter based on the size of the privacy dataset and the number of hash functions.

[0020] Furthermore, the specific steps of step 2 are as follows:

[0021] Step 2.1: Client P i (1 ≤ i ≤ t-1) Based on privacy dataset Privacy data in Use the public key pk of the Paillier cryptosystem to generate a ciphertext of 0. ;

[0022] Step 2.2: Client P i Select k random strings r of the same length as the Paillier ciphertext i1 , r i2 , …, r ik And k strings satisfy r i1 ⊕r i2 ⊕…⊕r ik = , ⊕ represents the XOR operation on a string;

[0023] Step 2.3: Client P i Use the hash function H = {h1, h2, …, h k} Calculate the data By filling the k positions in the obfuscated Bloom filter with the corresponding k strings, you generate your own local obfuscated Bloom filter GBF. i And send it to leader P t .

[0024] Furthermore, the SEQ protocol includes a SEQ request algorithm, a SEQ response algorithm, and a SEQ result recovery algorithm;

[0025] SEQ request algorithm:

[0026] Given two ciphertexts Enc(m1) and Enc(m2), participant P1 flips a coin to choose s. i Let ∈ {−1, 1}, i = {1,2} and select four random numbers r1, r2, r3, r4∈{0, 1}. kWhere r1 and r2 satisfy r1 > r2 > 0, and r3 and r4 satisfy r3 > r4 > 0, where Enc is a homomorphic encryption algorithm;

[0027] Subsequently, participant P1 calculates: Enc( ) = ((Enc(m1)·(Enc(m2) -1 )) r1 ·(Enc(r2) -1 )) s1 =(Enc(r1·(m1– m2))·Enc(- r2)) s1 = Enc(s1(r1(m1– m2) - r2)), Enc( ) = ((Enc(m2)·(Enc(m1) -1 )) r3 ·(Enc(r4) -1 )) s2 = (Enc(r3·(m2– m1))·Enc(- r4)) s2 = Enc(s2(r3(m2– m1) - r4)), and set Enc( ) and Enc( Send to participant P2;

[0028] SEQ response algorithm:

[0029] When the ciphertext Enc( is received) ) and Enc( When participant P2 decrypts Enc using sk, ) and Enc( If θ i > 0 (i = {1, 2}), participant P2 sets µ i = −1 and encrypt it Enc(µ) i ) = Enc(−1), otherwise, participant P2 generates Enc(μ) i ) = Enc(1), and then participant P2 returns Enc(μ1) and Enc(μ2) to participant P1;

[0030] SEQ result recovery algorithm:

[0031] Participant P1 received Enc(μ) i After that, if s i = 1, then participant P1 sets Enc(δ) i = Enc(μ) i If s i=−1, participant P1 calculates Enc(δ) i ) = (Enc(μ i ) −1 ) = Enc(−μ i Finally, participant P1 generates the output of the SEQ protocol as ν = Enc(δ1) + H Enc(δ2);

[0032] Here, P1 corresponds to Leader, and P2 corresponds to Service.

[0033] The specific steps of step 3 are as follows:

[0034] Step 3.1: Leader P t Based on its own privacy dataset Each of the Using k hash functions, its performance in the GBF (Blurred Bloom Filter) is calculated. i The corresponding k positions: ;

[0035] Step 3.2: Leader P t Will In the confusion of Bloom filter GBF i XOR the strings at the corresponding k positions in the string: ;

[0036] Step 3.3: Leader P t Will and As input, the SEQ request algorithm in the SEQ protocol is executed to generate a SEQ request. The final SEQ request set is as follows Ultimately, leader P t Privacy datasets SEQ requests for all private data Send to server S.

[0037] Furthermore, the specific steps of step 4 are as follows:

[0038] Step 4.1: Server S receives the SEQ request. Afterwards, for each Then, use the private key sk to... and Decrypt;

[0039] Step 4.2: If Server S settings And encrypt it, at this time there is Otherwise, server S generates ;

[0040] Step 4.3: Server S Construction , Ultimately, server S will respond with SEQ. Return to leader P t .

[0041] Furthermore, the specific steps of step 5 are as follows:

[0042] Step 5.1: Leader P t Received SEQ response Afterwards, for each If generated When choosing leader P t set up Otherwise, leader P t for ;

[0043] Step 5.2: Server S calculates ,as well as ,in, Homomorphic addition operation representing ciphertext;

[0044] Step 5.3: For the threshold value Server S uses the Paillier ciphertext generation algorithm to generate ciphertext. That is, for each piece of privacy data Server S will and As input, the SBT request algorithm is executed to generate SBT requests. Ultimately, server S will send the SBT request. Send to server S.

[0045] Furthermore, the specific steps of step 6 are as follows:

[0046] Step 6.1: Server S receives the SBT request. Afterwards, for each Using the private key sk Decrypt;

[0047] Step 6.2: If Server S settings Otherwise, server S settings ;

[0048] Step 6.3: Server S Construction Ultimately, server S will respond with SBT. Return to leader Pt .

[0049] Furthermore, the specific steps of step 7 are as follows:

[0050] Step 7.1: Leader P t Received SBT response Afterwards, for each If generated When choosing leader P t set up Otherwise, leader P t set up , The value can be 0 or 1. It is a process variable in the SEQ protocol;

[0051] Step 7.2: If Then privacy data It belongs to the threshold intersection, otherwise It does not belong to the threshold intersection.

[0052] A multi-party threshold privacy set intersection computation system based on a security equality protocol includes:

[0053] Server: Based on the multi-party threshold privacy set intersection computation service request, initialize the parameters, including the public and private key pairs of the Paillier cryptosystem, the hash function, and the length of the obfuscated Bloom filter;

[0054] Upon receiving a SEQ request, a SEQ response is generated by calculating the response according to the SEQ response algorithm in the SEQ protocol.

[0055] Upon receiving an SBT request, an SBT response is generated based on the SBT response algorithm in the SBT protocol.

[0056] Client: Based on the initialization parameters, first, it stores its own privacy dataset D. i Generate the corresponding obfuscated Bloom filter and send it to the leader, where the leader represents a client whose execution operation is different from that of other clients;

[0057] leader: After receiving the obfuscated Bloom filter, it will send its own privacy dataset D t Substitute it into the obfuscated Bloom filter and generate a SEQ request based on the SEQ request algorithm in the SEQ protocol;

[0058] Upon receiving the SEQ response, the SBT request is generated based on the SEQ result recovery algorithm in the SEQ protocol.

[0059] After receiving the SBT response, the SBT result is calculated using the SBT result recovery algorithm in the SBT protocol, and it is determined whether the privacy data belongs to the threshold intersection.

[0060] Compared with the prior art, the beneficial effects of this invention are as follows:

[0061] This invention achieves secure computation of multi-threshold intersections through the additive homomorphic property of the Paillier cryptosystem, the secure equality protocol (SEQ protocol), and the secure comparison protocol (SBT protocol). Its advantages include the following:

[0062] 1) A secure equality determination protocol was designed specifically for additive homomorphic cryptosystems. This protocol can determine whether the plaintexts corresponding to two ciphertexts are equal in a privacy-preserving manner.

[0063] 2) Unlike existing methods for calculating the intersection of multi-party threshold privacy sets, this invention proposes an efficient algorithm based on a confusion Bloom filter, a security equality protocol, and a security comparison protocol, which greatly improves the computational efficiency of threshold intersection.

[0064] 3) Analysis shows that the multi-party threshold privacy set intersection calculation method proposed in this invention is secure under the semi-honest model, and no party can obtain or infer any privacy information of the other parties during the entire calculation process;

[0065] 4) Experiments and analysis show that, compared with existing methods for calculating the intersection of multi-party threshold privacy sets, the method proposed in this invention greatly improves communication and computation efficiency. This invention has computational complexity that is linear with the number of participants and the amount of data. Specifically, when the number of clients is 50 and the dataset size of each client is 32, the computation time of this invention is only 2.97% and 1.3% of that of related methods, respectively. Moreover, the larger the dataset size n of the leader and each client, the greater the advantage of this invention. Attached Figure Description

[0066] Figure 1 This is a system architecture diagram of the present invention;

[0067] Figure 2 This is a schematic diagram of the process of the present invention;

[0068] Figure 3The graph shows a comparison of communication overhead for different schemes. (a) represents the communication overhead comparison between the present invention and other related schemes when the number of clients is 30 and the amount of data per client ranges from 4 to 32. (b) represents the communication overhead comparison between the present invention and other related schemes when the amount of data per client is 32 and the amount of data per client ranges from 5 to 50. n represents the size of the privacy dataset held by each client, that is, how many pieces of privacy data each client holds, and t represents the number of clients.

[0069] Figure 4 A comparison chart showing the overhead of different schemes, representing the cost received by the leader from other clients when each client has 32 data points and the client data volume ranges from 5 to 50. The time required to calculate the threshold intersection is then compared with other relevant schemes. Detailed Implementation

[0070] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0071] An efficient multi-party threshold privacy set intersection calculation method based on a secure equality protocol is proposed. This method utilizes the homomorphic ciphertext property of homomorphic cryptosystems to calculate the threshold intersection of multiple datasets. First, each client encodes its dataset using a confusion Bloom filter and sends the result to the leader. Upon receiving the confusion Bloom filter, the leader substitutes its own data into the filter, then uses the result and a specified ciphertext as input to perform a secure equality protocol with the cloud server. For each dataset, the leader homomorphically adds all the security equality results and uses the result and the ciphertext of the threshold value as input to perform a secure comparison protocol with the cloud server to determine if the number of clients possessing the data exceeds a preset threshold. Finally, the leader obtains the threshold intersection of multiple datasets.

[0072] An efficient method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol includes the following definitions:

[0073] Definition 1: The Paillier cryptosystem is a homomorphic encryption system. It consists of three algorithms: key generation, encryption, and decryption.

[0074] Key generation: Given a security parameter κ, randomly select two large prime numbers p and q of length κ. Then calculate λ = lcm(p – 1, q – 1) and N = p·q, where λ is the least common multiple of p – 1 and q – 1. Next, define the function L(x) = Where x is the independent variable in the function, N is the public key in the Paillier cryptosystem, and g satisfies gcd(L(g λ(N)mod N 2 ), N) = 1. Then calculate μ = ( L ( g λ mod N 2 ) ) -1 mod N, μ is the private key in the Paillier cryptosystem, and g is a parameter in the Paillier cryptosystem, which is the public key. This parameter has requirements for its selection; it must satisfy: gcd(L(g λ(N) mod N 2 ), N) = 1, where gcd is the greatest common divisor of two numbers. Finally, the public and private keys of this cryptosystem are pk = (N, g) and sk = (λ(N), μ), respectively.

[0075] Encryption: Given a message m (m∈[0, N)), select a random number r∈ Encrypt m using the public key pk:

[0076] C = Enc(pk, m) = g m ·r N mod N 2 .

[0077] Decryption: For ciphertext C, the corresponding plaintext m can be recovered using sk:

[0078] m = Dec(sk, c) = L(c λ mod N 2 )·μ mod N.

[0079] The Paillier cryptosystem supports two types of homomorphic operations: additive homomorphism and scalar multiplication. That is, given the ciphertexts Enc(pk, m1) and Enc(pk, m2) of m1 and m2, we have:

[0080] Dec(sk, (Enc(pk, m1)·Enc(pk, m2))) = m1 + m2,

[0081] Dec(sk, Enc(pk, m1) m2 ) = m1·m2

[0082] Definition 2: A garbled Bloom filter (GBF) is a variant of the Bloom filter. Unlike the Bloom filter, which uses a bit array, the GBF uses an ε-bit string array. The GBF can retrieve elements with a lower false positive rate than the Bloom filter. A GBF with parameters (m, n, k, H, ε) can encode a set X containing at most n elements, where ε, m, and H = {h1, h2, ..., h...} k Let} represent the security parameters, the length of GBF, and a set of k independent unified hash functions, respectively. Initially, all positions of GBF are set to NULL. To add element x, it is divided into k ε-bit secret shares using XOR-based secret sharing. Then, element x is mapped to k positions using the k hash functions, and the z-th secret share of x is stored at position h. z In (x), that is, GBF[h1(x)]⊕GBF[h2(x)]⊕ · · · ⊕GBF[h k (x)] = x, where GBF[h z [x] represents the value stored at location h. z The string (x) is given, and z ∈ [1, z]. After adding all elements of set X to GBF, to complete the construction of GBF, the positions marked as NULL in GBF are filled with ε-bit random strings. To check whether element y is in set X, h1(y), h2(y), ..., h are first calculated using k hash functions. k (y), and check GBF[h1(y)]⊕GBF[h2(y)]⊕···⊕GBF[h k If x is equal to y, then set X contains element y. Otherwise, y is not in set X.

[0083] Definition 3: Given two ciphertexts Enc(m1) and Enc(m2), the Secure Bigger Than (SBT) protocol can determine whether m1 ≥ m2 without revealing any information about m1 and m2 to participants P1 and P2, where Enc is a homomorphic encryption algorithm. If m1 ≥ m2, the protocol outputs Enc(1); otherwise, it outputs Enc(0). It is important to note that the private key sk of the homomorphic encryption algorithm is held by P2. The SBT protocol is described as follows:

[0084] The SBT protocol includes the SBT request algorithm, the SBT response algorithm, and the SBT result recovery algorithm.

[0085] SBT request algorithm:

[0086] Participant P1 flips a coin to select s∈{−1, 1} and chooses two random numbers r1, r2∈{0, 1}. k Where r1 > r2 > 0, then participant P1 calculates Enc(η) = ((Enc(m2)·(Enc(m1))). −1 )) r1 ·(Enc(r2) −1 )) s = Enc(r1·(m2−m1))·Enc(−r2)) s = Enc(s·(r1·(m2– m1)- r2)), and send Enc(η) to participant P2;

[0087] SBT response algorithm:

[0088] After receiving Enc(η), participant P2 decrypts Enc(η) using sk. If η > 0, participant P2 sets ξ = 0 and encrypts Enc(ξ) = Enc(0). Otherwise, participant P2 generates Enc(ξ) = Enc(1) and then returns Enc(ξ) to participant P1.

[0089] SBT result recovery algorithm:

[0090] When Enc(ξ) is received, if s = 1, participant P1 sets Enc(ω) = Enc(ξ); otherwise, s = −1, and participant P1 calculates Enc(ω) = Enc(1)·(Enc(ξ)). −1 ) = Enc(1 − ξ), and finally, the output of the SBT protocol is Enc(ω).

[0091] This invention first designs a basic protocol: the secure equal (SEQ) protocol. Then, based on this protocol, it proposes an efficient method for calculating the intersection of multi-party threshold privacy sets. The invention will first introduce the secure equal protocol:

[0092] Given two ciphertexts Enc(m1) and Enc(m2), the secure equal (SEQ) protocol can determine whether m1 = m2 without revealing any information about m1 and m2 to participants P1 and P2, where Enc is a homomorphic encryption algorithm. If m1 = m2, the protocol outputs Enc(2); otherwise, it outputs Enc(0). It is important to note that the private key sk of the homomorphic encryption algorithm is held by P2. The SEQ protocol is described below:

[0093] The SEQ protocol includes a SEQ request algorithm, a SEQ response algorithm, and a SEQ result recovery algorithm;

[0094] SEQ request algorithm:

[0095] Given two ciphertexts Enc(m1) and Enc(m2), participant P1 flips a coin to choose s. i Let ∈ {−1, 1}, i = {1,2} and select four random numbers r1, r2, r3, r4∈{0, 1}. k Where r1 and r2 satisfy r1 > r2 > 0, and r3 and r4 satisfy r3 > r4 > 0, where Enc is a homomorphic encryption algorithm;

[0096] Subsequently, participant P1 calculates: Enc( ) = ((Enc(m1)·(Enc(m2) -1 )) r1 ·(Enc(r2) -1 )) s1 =(Enc(r1·(m1– m2))·Enc(- r2)) s1 = Enc(s1(r1(m1– m2) - r2)), Enc( ) = ((Enc(m2)·(Enc(m1) -1 )) r3 ·(Enc(r4) -1 )) s2 = (Enc(r3·(m2– m1))·Enc(- r4)) s2 = Enc(s2(r3(m2– m1) - r4)), and set Enc( ) and Enc( Send to participant P2;

[0097] SEQ response algorithm:

[0098] When the ciphertext Enc( is received) ) and Enc( When participant P2 decrypts Enc using sk, ) and Enc( If θ i > 0 (i = {1, 2}), participant P2 sets µ i = −1 and encrypt it Enc(µ) i ) = Enc(−1), otherwise, participant P2 generates Enc(μ) i) = Enc(1), and then participant P2 returns Enc(μ1) and Enc(μ2) to participant P1;

[0099] SEQ result recovery algorithm:

[0100] Participant P1 received Enc(μ) i After that, if s i = 1, then participant P1 sets Enc(δ) i = Enc(μ) i If s i =−1, participant P1 calculates Enc(δ) i ) = (Enc(μ i ) −1 ) = Enc(−μ i Finally, participant P1 generates the output of the SEQ protocol as ν = Enc(δ1) + H Enc(δ2).

[0101] To prove the correctness of this protocol, a simple correctness analysis is performed below: When the plaintexts corresponding to Enc(m1) and Enc(m2) are equal, if s1 and s2 are both 1, then 1 and Both 2 are less than 0, therefore, the server-side calculated Enc( 1) and Enc( 2) The ciphertext Enc(1) consists of all 1s. Since s1 = s2 = 1, therefore Enc( 1) = Enc( 1) = Enc(1), Enc( 2) = Enc( 2) = Enc(1), α = Enc( 1)·Enc( 2) = Enc(2). The same logic applies when s1 and s2 are other cases.

[0102] When the plaintexts corresponding to Enc(m1) and Enc(m2) are not equal, assuming m1 > m2, if s1 = 1 and s2 = -1, then 1>0, 2 > 0, therefore the server-side calculated Enc( 1) and Enc( 2) The ciphertext Enc(-1) consists of all elements -1. Since s1 = 1, therefore Enc( 1) = Enc( 1) = Enc(-1); s2 = -1, so Enc( 2) = Enc(- 2) = Enc(1), α = Enc( 1)·Enc( 2) = Enc(0). The same logic applies when s1 and s2 are other cases. The same logic applies when m2 > m1. Table 1 lists all the possibilities involved in the security equality calculation protocol.

[0103]

[0104] Table 1 SEQ Protocol Correctness Analysis Table

[0105] Based on the above definition, an efficient method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol is proposed. This method involves clients (P1, P2, …, P…). t-1 ), leaderP t Execute with server S.

[0106] In this example, client P i (1 ≤ i ≤ t-1) Performs multi-party threshold privacy set intersection calculation together with server S. The system architecture diagram of the efficient multi-party threshold privacy set intersection calculation method based on a security equality protocol in this invention is shown below. Figure 1 As shown, the main processes include system initialization, local GBF generation, generation of SEQ request, SEQ response, generation of SBT request, SBT response, and set intersection calculation, as detailed below:

[0107] Step 1: System Initialization. When the system receives a request for multi-party threshold privacy set intersection computation service, server S needs to select some parameters to initialize the system before performing the computation. Server S first generates a public-private key pair (pk, sk) for the Pailier cryptosystem, selects k independent and uniformly distributed hash functions, and determines the length m of the obfuscated Bloom filter. Finally, S publishes these parameters to client P. i (1 ≤ i ≤ t-1).

[0108] The specific steps are as follows:

[0109] Step A1: Server S first generates a public-private key pair (pk, sk) for the Paillier cryptosystem, and selects k independent and uniformly distributed hash functions H = {h1, h2, …, h k The length m of the obfuscated Bloom filter is determined based on the size of the privacy dataset and the number of hash functions.

[0110] Step A2: Server S publishes {H, k, m, pk} to client P. i(1 ≤ i ≤ t-1).

[0111] Step 2: Local GBF generation. Each client P i (1 ≤ i ≤ t-1) Based on your own privacy dataset Constructing a Bloom filter GBF i Unlike Definition 2 above, instead of dividing the data x into k secret shares and inserting them into the obfuscation Bloom filter, we divide the ciphertext Enc(0) into k secret shares and insert them into the obfuscation Bloom filter. The specific steps are as follows:

[0112] Step B1: Regarding privacy data Client P i Generate a ciphertext of 0 using the public key pk of the Paillier cryptosystem. .

[0113] Step B2: Client P i Select k random strings r of the same length as the Paillier ciphertext i1 , r i2 , …, r ik And these k strings satisfy r i1 ⊕r i2 ⊕…⊕r ik = .

[0114] Step B3: Client P i Use the hash function H = {h1, h2, …, h k} Calculate the data In the obfuscated Bloom filter, fill the corresponding positions with the k strings generated in step B2.

[0115] Step B4: When client P i Privacy datasets After all privacy elements have been processed according to the above steps, the client P i Generate your own local obfuscation Bloom filter GBF i Send it to leader P t .

[0116] Step 3: Generate a SEQ request. (leader P) t Received from other client P i GBF sent (1 ≤ i ≤ t-1) i After (1 ≤ i ≤ t-1), for each GBF i and privacy datasets With each data point in the table, leader P t First, use k hash functions to calculate the k positions to which the data maps in the obfuscated Bloom filter, then use GBF. i XOR the strings at these k positions. Finally, leader P... t The XOR result and the ciphertext Enc(0) containing 0 are used to generate a SEQ request using the SEQ request algorithm in the SEQ protocol, thus determining D in a privacy-preserving manner. t Does the privacy data in GBF also include it? i The process involves sending a SEQ request to server S. The specific steps are as follows:

[0117] Step C1: Regarding privacy data leader P t Use k hash functions to calculate the k positions corresponding to this data in the obfuscated Bloom filter: .

[0118] Step C2: Leader P t Will In GBF i XOR the strings at the corresponding k positions in the string: .

[0119] Step C3: Leader P t Will Using Enc(0) as input, execute the SEQ request generation algorithm in the SEQ protocol to generate a SEQ request. where i∈[1, t-1], j∈[1, n] t Regarding a specific piece of privacy data. P t generate Ultimately, leader P t Will SEQ requests for all private data Send to server S.

[0120] Step 4: SEQ Response. Server S receives a response from leader P. t After receiving the SEQ request, the response is calculated according to the SEQ response algorithm in the SEQ protocol, and the response result is returned to leader P. t The specific steps are as follows:

[0121] Step D1: Received from leader P t Send SEQ request Afterwards, for each Server S uses private key sk to... and Decryption is performed.

[0122] Step D2: If Server S settings And encrypt it, at this time there is Otherwise, server S generates... .

[0123] Step D3: Server S Construction , Finally, server S will respond with SEQ. Return to leader P t .

[0124] Step 5: Generate SBT request. (leader P) t Upon receiving the SEQ response from server S, calculations are performed according to the SEQ result recovery algorithm in the SEQ protocol. For each piece of privacy data, leader P... t t-1 GBF i The corresponding SEQ results are homomorphically summed. Finally, leader P t The result of the homomorphic addition is combined with the ciphertext Enc(2τ) of 2τ, and the SBT request generation algorithm in Definition 3 is executed. The SBT request is then sent to the server S. The specific steps are as follows:

[0125] Step E1: Receive the SEQ response from the server. Afterwards, for each If generated When choosing leader P t set up Otherwise, leader P t set up .

[0126] Step E2: For Server S calculation ,in This represents a homomorphic addition operation on the ciphertext. Then server S calculates... .

[0127] Step E3: For the threshold value Server S generates ciphertext For each piece of privacy data Server S will and As input, the SBT request generation algorithm of the security comparison protocol in Definition 3 is executed to generate an SBT request. Ultimately, server S will send an SBT request. Send to server S.

[0128] Step 6: SBT Response. Server S receives a response from leader P. t After receiving the SBT request, the SBT response algorithm in Definition 3 is used for calculation, but there is no need to encrypt the SBT response result at this time. Finally, the response result is returned to the leader P. t The specific steps are as follows:

[0129] Step F1: Received from leader P t Send SBT request Afterwards, for each Server S uses private key sk to... Decryption is performed.

[0130] Step F2: If S settings Otherwise, S setting .

[0131] Step F3: S Construction Ultimately, server S will respond with SBT. Return to leader P t .

[0132] Step 7: Calculate the intersection of sets. (leader P) t Upon receiving the SBT response from server S, calculations are performed according to the SBT result recovery algorithm in Definition 3. Since server S did not encrypt the SBT response result in step 6, therefore, leader P... t When recovering the SBT results, you can directly manipulate the plaintext. (leader P) t Based on the results of SBT recovery, determine whether the privacy data belongs to the threshold intersection; the same operation applies to other privacy data. The specific steps are as follows:

[0133] Step G1: Receive the SBT response from the server. Afterwards, for each If generated When choosing P t set up Otherwise P t set up .

[0134] Step G2: If Then privacy data It belongs to the threshold intersection. Otherwise It does not belong to the threshold intersection.

[0135] We assume the protocol operates under a semi-honest security model, where all parties are honest and curious. Specifically, they honestly execute the protocol but hope to deduce the private information of other participants. For example, P i (i∈[1,t-1]) are interested in the datasets of other clients, while server S not only wants to know the datasets of the clients, but also wants to obtain the result of the intersection computation of the multi-party threshold privacy sets. Furthermore, we also assume that server S and leader P... t There is no collusion between them due to potential conflicts of interest. Specifically, this invention can achieve the following security objectives:

[0136] 1) Client P i Privacy dataset D (i∈[1, t-1]) i Privacy is protected. During the local GBF generation phase, the client P i Constructing a perturbation Bloom filter (GBF) based on my own private dataset i Send it to leader P t If leader P t Possessing P i If the elements are the same, then substitute the data element into GBF. i The string obtained will be the ciphertext Enc(0) with 0 as its value; otherwise, it will be a random string of the same length as the ciphertext. However, due to leader P... t Without the private key for the Paillier cryptosystem, P t It is also impossible to know whether the string is Enc(0) or a random string. Although in subsequent steps, leader P... t The server S executes a security agreement, but S returns the result to P in encrypted form. t Therefore, leader P t The information about the string is still unknown. Therefore, client P i Privacy dataset D i Their privacy can be protected.

[0137] 2) Leader P t Privacy dataset D t Privacy is protected. (leader P) t Received from client P i (1 ≤ i ≤ t-1) sent by a bloom filter GBF i Then, a string is calculated based on the user's private data. Then, a security equality protocol and a security comparison protocol are executed with server S. Because in the security equality protocol and the security comparison protocol, leader P...t Both protocols use random numbers r and s to obfuscate the plaintext relationship between the two ciphertexts, thus S cannot obtain any useful information from either protocol. Therefore, leader P t Privacy dataset D t Their privacy can be protected.

[0138] 3) The privacy of the threshold intersection calculation results is protected. Server S only participates in the security equality protocol and the security comparison protocol in the protocol. Because in the security equality protocol and the security comparison protocol, leader P... t Both protocols use random numbers r and s to obfuscate the plaintext relationship between the two ciphertexts. Therefore, server S cannot obtain any valid information from either protocol, nor can it obtain any information about the threshold intersection. Thus, the privacy of the threshold intersection calculation result is protected.

[0139] From the above analysis, it can be seen that client P i Privacy dataset D (i∈[1, t-1]) i Since the privacy of the calculation results is protected, the method described in this invention can effectively achieve privacy protection.

[0140] This invention effectively solves the problem of calculating the intersection of multiple threshold privacy sets, and its usability has been verified through experiments. We evaluated this implementation scheme using Python 3.10 on a Windows 10 computer equipped with an AMD Ryzen 5 5600G CPU (3.90GHz) and 16GB RAM. In the evaluation, we set the length of Paillier's public key to 1024 bits and the number of hash functions k = 10.

[0141] 1) Communication overhead

[0142] To evaluate the communication overhead of the system when users use our method to compute the multi-threshold intersection, we evaluate the communication overhead generated by the multi-threshold privacy set intersection computation proposed in this invention. We tested the communication overhead when the number of clients t is 30 and the privacy dataset size n of each client varies linearly from 4 to 32, and the communication overhead when the privacy dataset size n of each client is 32 and the number of clients t varies linearly from 5 to 50, and compared it with the relevant literature POT-MPSI[1] and PT-MPSI[2]. The results of the communication overhead are as follows: Figure 3As shown in the figure, it is clear from the figure that the communication overhead of the present invention is lower than that of POT-MPSI[1] and much lower than that of PT-MPSI[2]. In addition, as the number of clients t and the privacy data and size n of each client increase, the increase in the communication overhead of the present invention is also significantly lower than that of POT-MPSI[1] and PT-MPSI[2].

[0143] 2) Calculate the cost

[0144] To evaluate the computational overhead of the system when users use our method to compute multi-party threshold intersection, we evaluate the computational overhead generated by the multi-party threshold privacy set intersection computation proposed in this invention. We tested the computational overhead when the privacy dataset size n for each client is 32 and the number of clients t varies linearly from 5 to 50, and compared it with the relevant literature POT-MPSI[1] and PT-MPSI[2]. The communication overhead results are as follows: Figure 4 As shown in the figure, it is clear from the figure that the communication overhead of the present invention is significantly lower than that of POT-MPSI[1] (referring to Mahdavi RA, Humphries T, Kacsmar B, et al. Practical over-threshold multi-party private set intersection[C] / / Annual Computer Security Applications Conference. 2020: 772-783.) and PT-MPSI[2] (referring to Bay A, Erkin Z, Hoepman JH, et al. Practical multi-party private set intersection protocols[J]. IEEE Transactions on Information Forensics and Security, 2021, 17: 1-15.). Moreover, as the number of clients t increases linearly, the time overhead of the present invention also increases slowly linearly, while the time overhead of POT-MPSI[1] and PT-MPSI[2] increases exponentially. Therefore, the present invention has excellent computational efficiency compared with the prior art.

[0145] The above are merely representative embodiments among the many specific applications of this invention, and do not constitute any limitation on the scope of protection of this invention. All technical solutions formed by transformation or equivalent substitution fall within the scope of protection of this invention.

Claims

1. A method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol, characterized in that, The steps include the following: Step 1: Based on the multi-party threshold privacy set intersection computation service request, the server initializes the parameters, including the public and private key pairs of the Paillier cryptosystem, the hash function, and the length of the obfuscated Bloom filter; Step 2: Based on the initialization parameters, the client first sends its own privacy dataset D i Generate the corresponding obfuscated Bloom filter and send it to the leader, where the leader represents a client whose execution operation is different from that of other clients; Step 3: After receiving the obfuscated Bloom filter, the leader will store its own privacy dataset D. t Substitute it into the obfuscated Bloom filter and generate a SEQ request based on the SEQ request algorithm in the SEQ protocol; Step 4: After receiving the SEQ request, the server calculates the SEQ response according to the SEQ response algorithm in the SEQ protocol and generates the SEQ response; Step 5: After receiving the SEQ response, the Leader calculates according to the SEQ result recovery algorithm in the SEQ protocol and generates an SBT request; Step 6: After receiving the SBT request, the server calculates the SBT response according to the SBT response algorithm in the SBT protocol and generates the SBT response; Step 7: After receiving the SBT response, the Leader calculates the SBT recovery result according to the SBT result recovery algorithm in the SBT protocol, and determines whether the privacy data belongs to the threshold intersection. The SEQ protocol includes a SEQ request algorithm, a SEQ response algorithm, and a SEQ result recovery algorithm; SEQ request algorithm: Given two ciphertexts Enc(m1) and Enc(m2), participant P1 flips a coin to choose s. i Let r1, r2, r3, r4 ∈ {−1, 1}, i = {1, 2}, and select four random numbers r1, r2, r3, r4 ∈ {0, 1}. k Where r1 and r2 satisfy r1 > r2 > 0, and r3 and r4 satisfy r3 > r4 > 0, where Enc is a homomorphic encryption algorithm; Subsequently, participant P1 calculates: Enc( ) = ((Enc(m1)·(Enc(m2) -1 )) r1 ·(Enc(r2) -1 )) s1 = (Enc(r1·(m1– m2))·Enc(- r2)) s1 = Enc(s1(r1(m1– m2) - r2)), Enc( ) = ((Enc(m2)·(Enc(m1) -1 )) r3 ·(Enc(r4) -1 )) s2 = (Enc(r3·(m2– m1))·Enc(- r4)) s2 = Enc(s2(r3(m2–m1) - r4)), and set Enc( ) and Enc( Send to participant P2; SEQ response algorithm: When the ciphertext Enc( is received) ) and Enc( When participant P2 decrypts Enc using sk, ) and Enc( If θ i > 0 (i = {1, 2}), participant P2 sets µ i = −1 and encrypt it Enc(µ) i ) = Enc(−1), otherwise, participant P2 generates Enc(μ) i ) = Enc(1), and then participant P2 returns Enc(μ1) and Enc(μ2) to participant P1; SEQ result recovery algorithm: Participant P1 received Enc(μ) i After that, if s i = 1, then participant P1 sets Enc(δ) i = Enc(μ) i If s i = −1, participant P1 calculates Enc(δ) i ) = (Enc(μ i ) −1 ) = Enc(−μ i Finally, participant P1 generates the output of the SEQ protocol as ν = Enc(δ1) + H Enc(δ2); Here, P1 corresponds to Leader, and P2 corresponds to Service.

2. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 1, characterized in that, The specific steps of step 1 are as follows: Step 1.1: Server S generates a public-private key pair (pk, sk) for the Paillier cryptosystem. Step 1.2: Select k independent and uniformly distributed hash functions H = {h1, h2, …, h k }; Step 1.3: Determine the length m of the obfuscated Bloom filter based on the size of the privacy dataset and the number of hash functions.

3. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 2, characterized in that, The specific steps of step 2 are as follows: Step 2.1: Client P i (1 ≤ i ≤ t-1) Based on privacy dataset Privacy data in Use the public key pk of the Paillier cryptosystem to generate a ciphertext of 0. ; Step 2.2: Client P i Select k random strings r of the same length as the Paillier ciphertext i1 , r i2 , …, r ik And k strings satisfy r i1 ⊕r i2 ⊕…⊕r ik = , ⊕ represents the XOR operation on a string; Step 2.3: Client P i Use the hash function H = {h1, h2, …, h k } Calculate the data By filling the k positions in the obfuscated Bloom filter with the corresponding k strings, you generate your own local obfuscated Bloom filter GBF. i And send it to leader P t .

4. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 1, characterized in that, The specific steps of step 3 are as follows: Step 3.1: Leader P t Based on its own privacy dataset Each of the Using k hash functions, its performance in the GBF (Blurred Bloom Filter) is calculated. i The corresponding k positions: ; Step 3.2: Leader P t Will In the confusion of Bloom filter GBF i XOR the strings at the corresponding k positions in the string: ; Step 3.3: Leader P t Will and As input, the SEQ request algorithm in the SEQ protocol is executed to generate a SEQ request. The final SEQ request set is as follows Ultimately, leader P t Privacy datasets SEQ requests for all private data Send to server S.

5. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 4, characterized in that, The specific steps of step 4 are as follows: Step 4.1: Server S receives the SEQ request. Afterwards, for each Then, use the private key sk to... and Decrypt; Step 4.2: If Server S settings And encrypt it, at this time there is Otherwise, server S generates ; Step 4.3: Server S Construction , Ultimately, server S will respond with SEQ. Return to leader P t .

6. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 5, characterized in that, The specific steps of step 5 are as follows: Step 5.1: Leader P t Received SEQ response Afterwards, for each If generated When choosing leader P t set up Otherwise, leader P t for ; Step 5.2: Server S calculates ,as well as ,in, Homomorphic addition operation representing ciphertext; Step 5.3: For the threshold value Server S uses the Paillier ciphertext generation algorithm to generate ciphertext. That is, for each piece of privacy data Server S will and As input, the SBT request algorithm is executed to generate SBT requests. Ultimately, server S will send the SBT request. Send to server S.

7. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 6, characterized in that, The specific steps of step 6 are as follows: Step 6.1: Server S receives the SBT request. Afterwards, for each Use private key sk Decrypt; Step 6.2: If Server S settings Otherwise, server S settings ; Step 6.3: Server S Construction Ultimately, server S will respond with SBT. Return to leader P t .

8. The method for calculating the intersection of multi-party threshold privacy sets based on a security equality protocol according to claim 7, characterized in that, The specific steps of step 7 are as follows: Step 7.1: Leader P t Received SBT response Afterwards, for each If generated When choosing leader P t set up Otherwise, leader P t set up , The value can be 0 or 1. It is a process variable in the SEQ protocol; Step 7.2: If Then privacy data It belongs to the threshold intersection, otherwise It does not belong to the threshold intersection.

9. A multi-party threshold privacy set intersection calculation system based on a security equality protocol, characterized in that, include: Server: Based on the multi-party threshold privacy set intersection computation service request, initialize the parameters, including the public and private key pairs of the Paillier cryptosystem, the hash function, and the length of the obfuscated Bloom filter; Upon receiving a SEQ request, a SEQ response is generated by calculating the response according to the SEQ response algorithm in the SEQ protocol. Upon receiving an SBT request, an SBT response is generated based on the SBT response algorithm in the SBT protocol. Client: Based on the initialization parameters, first, it stores its own privacy dataset D. i Generate the corresponding obfuscated Bloom filter and send it to the leader, where the leader represents a client whose execution operation is different from that of other clients; leader: After receiving the obfuscated Bloom filter, it will send its own privacy dataset D t Substitute it into the obfuscated Bloom filter and generate a SEQ request based on the SEQ request algorithm in the SEQ protocol; Upon receiving the SEQ response, the SBT request is generated based on the SEQ result recovery algorithm in the SEQ protocol. After the SBT response, the SBT result is calculated according to the SBT result recovery algorithm in the SBT protocol, and it is determined whether the privacy data belongs to the threshold intersection. The SEQ protocol includes a SEQ request algorithm, a SEQ response algorithm, and a SEQ result recovery algorithm; SEQ request algorithm: Given two ciphertexts Enc(m1) and Enc(m2), participant P1 flips a coin to choose s. i Let r1, r2, r3, r4 ∈ {−1, 1}, i = {1, 2}, and select four random numbers r1, r2, r3, r4 ∈ {0, 1}. k Where r1 and r2 satisfy r1 > r2 > 0, and r3 and r4 satisfy r3 > r4 > 0, where Enc is a homomorphic encryption algorithm; Subsequently, participant P1 calculates: Enc( ) = ((Enc(m1)·(Enc(m2) -1 )) r1 ·(Enc(r2) -1 )) s1 = (Enc(r1·(m1– m2))·Enc(- r2)) s1 = Enc(s1(r1(m1– m2) - r2)), Enc( ) = ((Enc(m2)·(Enc(m1) -1 )) r3 ·(Enc(r4) -1 )) s2 = (Enc(r3·(m2– m1))·Enc(- r4)) s2 = Enc(s2(r3(m2–m1) - r4)), and set Enc( ) and Enc( Send to participant P2; SEQ response algorithm: When the ciphertext Enc( is received) ) and Enc( When participant P2 decrypts Enc using sk, ) and Enc( If θ i > 0 (i = {1, 2}), participant P2 sets µ i = −1 and encrypt it Enc(µ) i ) = Enc(−1), otherwise, participant P2 generates Enc(μ) i ) = Enc(1), and then participant P2 returns Enc(μ1) and Enc(μ2) to participant P1; SEQ result recovery algorithm: Participant P1 received Enc(μ) i After that, if s i = 1, then participant P1 sets Enc(δ) i = Enc(μ) i If s i = −1, participant P1 calculates Enc(δ) i ) = (Enc(μ i ) −1 ) = Enc(−μ i Finally, participant P1 generates the output of the SEQ protocol as ν = Enc(δ1) + H Enc(δ2); Here, P1 corresponds to Leader, and P2 corresponds to Service.

Images