A privacy set intersection computation method based on a symmetric key pseudo-random function

Abstract

The present application relates to a communication processing method characterized by a protocol, and particularly relates to a privacy set intersection calculation method based on a symmetric key pseudo-random function, which is used to solve the problem that the existing PSI protocol usually has high communication and calculation costs, and especially the calculation cost based on a public key encryption (PKE) scheme and a circuit is high, although some schemes based on oblivious transfer (OT) attempt to balance the communication and calculation costs, but they usually need additional communication rounds, which leads to the defect of increasing the communication and transmission costs. The privacy set intersection calculation method based on the symmetric key pseudo-random function comprises the following steps: an organizer P1 outputs parameters according to a security parameter kappa to establish a privacy set intersection system; the organizer P1 and all users perform oblivious key value encryption; a server performs oblivious key value decryption; the server performs user privacy intersection calculation; and the organizer P1 performs verification.

Description

Technical Field

[0001] This invention relates to a communication processing method characterized by a protocol, specifically to a method for calculating the intersection of privacy sets based on a symmetric key pseudo-random function. Background Technology

[0002] Privacy-preserving set intersection (PSI) is a research problem in the field of secure multi-party computation (MPC), aiming to enable parties holding a set of inputs to determine their common elements without revealing any additional information beyond the intersection itself. PSI has various potential privacy-preserving applications, such as patient medical record sharing and online interest exchange. Recently, interdisciplinary efforts have developed a privacy-preserving contact tracing system. In this case, the privacy-preserving solution relies heavily on PSI.

[0003] Over the past decade, some important research has focused on developing structurally simple privacy set intersection algorithms. These structures are typically designed based on circuit-based protocols that handle the logic or computational arithmetic circuits of the parties involved. Using circuit-based protocols improves computational efficiency and allows for adaptation to various variants of the PSI algorithm.

[0004] However, existing PSI protocols typically have high communication and computation costs, especially those based on public-key encryption (PKE) schemes and circuits.

[0005] In their recent research (M; Chase and P; Miao, “Private setintersection in the internet setting from lightweight oblivious prf,” in Advances in Cryptology-CRYPTO 2020; Springer International Publishing, 2020, pp; 34-63;), they focused on exploring the trade-off between communication and computational costs to achieve optimal efficiency. They proposed a simplified multi-point OPRF protocol for achieving an efficient, semi-honest, and secure two-party PSI protocol. This protocol is based on a random oracle model and can be further enhanced to achieve unilateral malicious security. By employing a multi-point OPRF construction instead of the traditional single-point version, the communication complexity of the protocol is reduced by a constant factor because the evaluation of each set element only needs to be performed once.

[0006] However, Chase and Miao's scheme relies on public-key encryption and requires complex circuitry for privacy interactions, leading to increased computational complexity and reduced efficiency. Furthermore, Chase and Miao's scheme requires additional communication rounds, resulting in higher communication costs and additional financial burdens (this is not an isolated case). Therefore, it must be handled with caution in real-world scenarios. Summary of the Invention

[0007] The purpose of this invention is to address the high communication and computation costs inherent in existing PSI protocols, particularly the high computation costs of public-key encryption (PKE) schemes and circuits. While some unintentional transmission (OT) schemes attempt to balance communication and computation costs, they typically require additional communication rounds, leading to increased communication and transmission costs. Therefore, this invention provides a privacy set intersection calculation method based on a symmetric key pseudo-random function.

[0008] To address the shortcomings of the existing technology, the present invention provides the following technical solution:

[0009] A method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions is characterized by the following steps:

[0010] Step 1: Organizer P1 outputs parameter params based on safety parameter κ:

[0011] params=(k i Φ i +Φ i+1 ,r,k',F,F * , P, f);

[0012] In the formula, k i This indicates that it was sent to user P. i The key, i∈{2,...,n-2}, where n represents the total number of participants, Φ i This indicates that it was sent to user P. i The virtual set, Φ i+1 This indicates that it was sent to user P. i+1 The virtual set, r represents the set sent to user P. n-1 and user P n The random number, k', represents the number sent to user P. n-1 and user P n The key, F represents the pseudo-random function, F * Let f denote a pseudo-random function that approximates a key homomorphism, where P represents a pseudo-random permutation and f represents an encoding function.

[0013] Step 2: Accidental key-value encryption;

[0014] First, organizer P1 uses the function value f(d) of its own set elements. 1j ) as the key, using user P i key k i As the seed for the pseudo-random function F, the value is obtained through an XOR operation. And use unintentional key-value store encoding to generate an unintentional key-value store function A1 and send it to server CS1; 1j This represents the j-th element in the set P1 of the organizers. This indicates that the key is k. i pseudo-random function, This represents the XOR operation from i=2 to i=n-2;

[0015] Secondly, user P i The function value f(d) of the elements of its own set. ij ) as the key, calculate As a value, and using unintentional key-value storage encoding to generate an unintentional key-value storage function A. i Send to server CS2; d ij User P i The j-th element in the set;

[0016] Finally, user P n-1 The encrypted set S n-1 Pseudo-random function value F r * (k n-1 Send the data to servers CS1 and CS2 respectively; User P n The encrypted set S n Pseudo-random function value F r * (k n ) are sent to servers CS1 and CS2 respectively; F r * () denotes a pseudo-random function that approximates a key homomorphism for a key of random number r, k n-1 User P n-1 The seed of the pseudo-random function, k n User P n Seed for the pseudo-random function;

[0017] Step 3: Unintentional key-value decryption;

[0018] Servers CS1 and CS2 use a pseudo-random function F that is approximately homomorphic to the key. * Using the homomorphic property of the key, re-encrypt the received encrypted set S. n-1 and encrypted set S n And generate set S′ n-1 S' AThen server CS1 uses the unintentional key-value storage function A1 to decode set S′. n-1 and generate a set Server CS2 uses the unintentional key-value storage function A i To decode set S′ n and generate a set Send to server CS1;

[0019] Step 4: Server CS1 calculates the multi-way intersection I * And based on the intersection of multiple parties I * The re-encrypted intersection I' is calculated and returned to the organizer P1;

[0020] Step 5: Organizer P1 verifies the re-encrypted intersection I'. If the verification is successful, output the privacy intersection I = {d}. ij :d ij ∈(I k′ -Φ n+1 ) -λ} to user P i Otherwise, verification fails and a termination symbol is output. Let represent the inverse permutation of the pseudo-random permutation with key k'. λ represents the binary XOR operation, where λ indicates that the organizer P1 copies its own set elements λ times, and λ≥1.

[0021] Further, step 1 specifically includes:

[0022] Step 1.1: Organizer P1 generates key k based on security parameter κ. i ∈{0,1} κ and virtual set Φ i +Φ i+1 And sent to user P i The organizer P1 generates a random number r and a key k' based on the security parameter κ, and sends them to the user P. n-1 and user P n ;

[0023] Step 1.2: Organizer P1 selects a pseudo-random function F and a pseudo-random function Fapproximately key homomorphic. * : K×X→Y, and select a pseudo-random permutation P: {0, 1} κ ×D→{0,1} ≥κ K represents the key, X represents the input space, Y represents the output space, and D represents the plaintext form of the user set;

[0024] Step 1.3: Organizer P1 copies its own set elements λ times, defining set D. λ= {d||1, ..., d||λ: d∈D}, and have (D λ ) -λ =D;

[0025] Organizer P1 uses a pseudo-random function F based on approximate key homomorphism. * Construct an encoding function f using a pseudo-random permutation P, satisfying the following conditions: in The encoding function f is returned to user P. i P k′ This represents a pseudo-random permutation with key k'. User P i Sets and set D λ The intersection of.

[0026] Furthermore, in step 1.2, the pseudo-random function F is constructed as follows:

[0027] Step 1a: Construct a pseudo-random synthesizer G(x), where x is the input parameter;

[0028] Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m1×n1 matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n1, whose elements form a ring of integers modulo q. Let represent a vector of length m1, whose elements are a ring of integers modulo q, and let χ1 represent the random error distribution in the fault-tolerant learning problem;

[0029] Define s0 = s, and construct a pseudo-random synthesizer G(s) = σ1, ..., σ p(|s|) Among them, Zha is The first bit of data, in yes The data is of length |s| bits, counted from the end to the beginning. i1∈[1, p(|s|)], i1 represents the i1th iteration, l(n1)≤p(n1); l(n1) represents the seed length extension function of the pseudo-random synthesizer G'(s), p(n1) represents the seed length extension function of the pseudo-random synthesizer G(s), n1 represents the seed length of the pseudo-random synthesizer G(s); |s|=n1, p(|s|)=p(n1);

[0030] Step 1b: Construct a pseudo-random synthesizer F s (x), where x is the input parameter;

[0031] Extend the length s of the pseudo-random synthesizer G(s) constructed in step 1a to a length of 2n1, i.e., the pseudo-random synthesizer Let the function G0(s) be the data of the first n1 bits of G(s), and G1(s) be the data of the last n1 bits of G(s), that is, G(s) = G0(s)G1(s);

[0032] For any Define function

[0033] For each function f s key Perform the following calculations:

[0034]

[0035] Step 1c: Define the pseudo-random function in make ∈ R This means randomly selecting elements from the set, where N represents the set of positive integers, thus obtaining the random function F.

[0036] Furthermore, in step 1.2, the pseudo-random function F of the approximate key homomorphism * The construction method is as follows:

[0037] Step 2a: Construct a pseudo-random synthesizer G(x), where x is the input parameter;

[0038] Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m²×n² matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n², whose elements form a ring of integers modulo q. Let represent a vector of length m2, whose elements are a ring of integers modulo q, and let χ2 represent the random error distribution in the fault-tolerant learning problem;

[0039] Define s0 = s, and construct a pseudo-random synthesizer. in σ j It is G'(s) j-1 The first bit of data, σ j =pref1(G1(s j-1 )), s j It is G'(s) j-1 The data of length |s| bits is counted from the end to the beginning. j=suff |s| (G1(s j-1 n2 represents the seed length of the pseudo-random synthesizer G(s);

[0040] Step 2b, construct the following constructor:

[0041]

[0042] Where p represents a positive integer less than q, and Λ represents a variable... The matrix formed;

[0043] Define a pseudo-random function make That is, to obtain a pseudo-random function F that approximates the key homomorphism. * .

[0044] Furthermore, in step 2, the encrypted set S n-1 Encrypted set S n They are as follows:

[0045]

[0046]

[0047] Among them, P k′ Φ represents a pseudo-random permutation with key k'. n-1 Φ n This indicates that it was sent to user P. n-1 P n virtual collection, User P n-1 Sets and set D λ The intersection, User P n Sets and set D λ The intersection, Φ n+1 User P i User P n-1 and user P n The intersection of virtual sets;

[0048] In step 3, the set S′ n-1 S' n They are as follows:

[0049]

[0050]

[0051] The set gather They are as follows:

[0052]

[0053]

[0054] Where d′ n-1j ∈S′ n-1 ,d′ n-1j Describe the set S′ n-1 The j-th element in; d′ nj ∈S′ n ,d′ nj Describe the set S′ n The j-th element in the array; m represents the total number of user attributes.

[0055] Furthermore, in step 4, the multi-party intersection... Re-encrypted intersection x' represents the re-encrypted ciphertext form of user attributes, x * This represents the decrypted ciphertext form of user attributes.

[0056] Furthermore, step 5 specifically includes:

[0057] After receiving the re-encrypted intersection I', organizer P1 calculates... And check I k′ Do the elements in the array satisfy the following conditions:

[0058] ① and Represents the empty set;

[0059] ② α∈[λ], d||α∈I k′ This means that for every element d and a positive integer α less than or equal to λ in the privacy intersection I, d||α appears in I. k′ In this context, || represents a connection.

[0060] If any one condition is not met, the verification fails and a termination symbol is output; if both conditions are met, the verification succeeds and the privacy intersection I = {d} is output. ij :d ij ∈(I k′ -Φ n+1 ) -λ} to user P i .

[0061] Compared with the prior art, the beneficial effects of the present invention are:

[0062] (1) The present invention provides a method for calculating the intersection of privacy sets based on a symmetric key pseudo-random function, which includes the organizer P1 outputting parameters according to the security parameter κ to establish a privacy set intersection system, the organizer P1 and all users performing unintentional key-value encryption, the server performing unintentional key-value decryption, the server performing user privacy intersection calculation, and the organizer P1 performing verification. The present invention not only allows multiple participants to compare their respective sets, but also ensures that the specific elements in the set are not disclosed. It can handle large-scale data and a large number of participants, and achieve secure and efficient set intersection operation in multi-party private scenarios.

[0063] (2) The present invention provides a method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions, which not only ensures user privacy protection, but also verifies the calculation results and achieves low computational cost. This innovation has made an important breakthrough in solving the limitations of the existing PSI protocol and provides a promising solution for achieving a better balance between communication, computation and data transmission costs.

[0064] (3) The present invention provides a method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions. It employs two pseudo-random functions constructed based on the LWE (Learning With Errors) problem and its variants, one of which is an approximate key pseudo-random function. These techniques are selected based on widely accepted security principles in the current cryptographic field to ensure the privacy protection and security of the protocol. The pseudo-random function constructed using the LWE problem and its variants reflects the innovation and foresight of the present invention in cryptographic security.

[0065] (2) The present invention provides a privacy set intersection calculation method based on symmetric key pseudo-random function. Compared with existing classic schemes, it has obvious advantages in computational efficiency, especially in the intersection calculation stage. Due to the symmetric encryption used in the present invention, the CPU running time is almost negligible. Attached Figure Description

[0066] Figure 1 This is a schematic diagram of the structure of the privacy set intersection system in an embodiment of the privacy set intersection calculation method based on symmetric key pseudo-random function of the present invention;

[0067] Figure 2 This is a flowchart of an embodiment of the present invention;

[0068] Figure 3 This is a schematic diagram of the CPU runtime for the unintentional key-value encryption in step 2, corresponding to the total number n of different participants in this embodiment of the invention.

[0069] Figure 4 This is a schematic diagram of the CPU running time for steps 3 to 5 corresponding to the total number n of different participants in this embodiment of the invention.

[0070] Figure 5 The simulation results show the CPU runtime of the encryption phase for the different participants in the embodiments of the present invention and the prior art 1 and prior art 2.

[0071] Figure 6 The simulation results show the CPU running time of the decryption and verification stages for the total number n of different participants in the embodiments of the present invention and the prior art 1 and prior art 2.

[0072] Figure 7 This is a simulation result of the CPU running time during the intersection calculation stage of the embodiments of the present invention and the total number n of different participants in prior art 1 and prior art 2. Detailed Implementation

[0073] The present invention will be further described below with reference to the accompanying drawings and exemplary embodiments.

[0074] Reference Figures 1 to 4 A method for calculating the intersection of privacy sets based on symmetric-key pseudo-random functions is proposed. This method is based on a privacy set intersection system, which includes participants P1, P2, ..., P... n Servers CS1 and CS2, where P1 is the organizer, P2, ..., P... n For users;

[0075] The method for calculating the intersection of privacy sets includes the following steps:

[0076] Step 1: Organizer P1 outputs parameters based on safety parameter κ:

[0077] params=(k i Φ i +Φ i+1 ,r,k',F,F * , P, f);

[0078] In the formula, k i This indicates that it was sent to user P. i The key, Φ i +Φ i+1 This indicates that it was sent to user P. i Let r be a virtual set of i ∈ {2, ..., n-2}, and let r represent the value sent to user P. n-1 and user P n The random number, k', represents the number sent to user P. n-1 and user P n The key, Φ i This indicates that it was sent to user P. i The virtual set, Φ i+1 This indicates that it was sent to user P. i+1A virtual set, where F represents a pseudo-random function, F * Let f denote a pseudo-random function that approximates a key homomorphism, P denote a pseudo-random permutation, f denote a function of the elements λ of the organizer P1's own set, and n denote the total number of participants.

[0079] Step 1.1: Organizer P1 generates key k based on security parameter κ. i ∈{0,1} κ and virtual set Φ i +Φ i+1 And sent to user P i The organizer P1 generates a random number r and a key k' based on the security parameter κ, and sends them to the user P. n-1 and user P n ;

[0080] Step 1.2: Organizer P1 selects a pseudo-random function F and a pseudo-random function Fapproximately key homomorphic. * K×X→Y; and select a pseudo-random permutation P: (0, 1) κ ×D→{0,1} ≥κ K represents the key, X represents the input space, Y represents the output space, and D represents the plaintext form of the user set.

[0081] The pseudo-random function F is constructed as follows:

[0082] Step 1a: Construct a pseudo-random synthesizer G(x), where x is the input parameter;

[0083] Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m1×n1 matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n1, whose elements form a ring of integers modulo q1. Let represent a vector of length m1, whose elements are a ring of integers modulo q, and let χ1 represent the random error distribution in the fault-tolerant learning problem;

[0084] Define s0 = s, and construct a pseudo-random synthesizer G(s) = σ1, ..., σ p(|s|) , where σ1 is The first bit of data, in yes The data is of length |s| bits, counted from the end to the beginning. i1∈[1, p(|s|)], i1 represents the i1th iteration, l(n1)≤p(n1); l(n1) represents the seed length extension function of the pseudo-random synthesizer G'(s), p(n1) represents the seed length extension function of the pseudo-random synthesizer G(s), n1 represents the seed length of the pseudo-random synthesizer G(s); |s|=n1, p(|s|)=p(n1);

[0085] Step 1b: Construct a pseudo-random synthesizer F s (x), where x is the input parameter;

[0086] Extend the length s of the pseudo-random synthesizer G(s) constructed in step 1a to a length of 2n1, i.e., the pseudo-random synthesizer Let the function G0(s) be the data of the first n1 bits of G(s), and G1(s) be the data of the last n1 bits of G(s), that is, G(s) = G0(s)G1(s);

[0087] For any Define function

[0088] For each function f s key Perform the following calculations:

[0089]

[0090] Step 1c: Define the pseudo-random function in make ∈ R This means randomly selecting elements from a set, where N represents the set of positive integers, thus obtaining a random function F;

[0091] Step 2a: Construct a pseudo-random synthesizer G(x), where x is the input parameter;

[0092] Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m²×n² matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n², whose elements form a ring of integers modulo q. Let represent a vector of length m2, whose elements are a ring of integers modulo q, and let χ2 represent the random error distribution in the fault-tolerant learning problem;

[0093] Define s0 = s, and construct a pseudo-random synthesizer. in σ j It is G'(s) j-1 The first bit of data, σ j =pref1(G1(s j-1 )), s j It is G'(s) j-1 The data of length |s| bits is counted from the end to the beginning. j =suff |s| (G1(s j-1 ));

[0094] Step 2b, construct the following constructor:

[0095]

[0096] Where p represents a positive integer less than q, and Λ represents a variable... The matrix formed;

[0097] Define a pseudo-random function make That is, to obtain a pseudo-random function F that approximates the key homomorphism. * ;

[0098] Step 1.3: Organizer P1 copies its own set elements λ times, where λ ≥ 1, and defines set D. λ = {d||1, ..., d||λ: d∈D}, and have (D λ ) -λ =D;

[0099] Organizer P1 uses a pseudo-random function F based on approximate key homomorphism. * Construct an encoding function f using a pseudo-random permutation P, satisfying the following conditions: in The encoding function f is returned to user P. i ;d ij User P i The j-th element in the set, F r * () denotes a pseudo-random function that approximates a key homomorphism for a key of random number r, k n-1 User P n-1 The seed of the pseudo-random function, k n User P n The pseudo-random function seed, This represents the binary XOR operation. User P i Sets and set D λ The intersection;

[0100] Step 2: Accidental key-value encryption;

[0101] Step 2.1: Organizer P1 uses the function value f(d) of its own set elements. 1j ) as the key, using user P i The key is used as the seed of the pseudo-random function F. The n-3 seeds of the pseudo-random function F are XORed to obtain the value. This represents the XOR operation from i=2 to i=n-2, and uses unintentional key-value storage encoding to generate the unintentional key-value storage function A1, which is then sent to the server CS1.

[0102]

[0103] In the formula, d 1j This represents the j-th element in the set P1 of the organizers;

[0104] Step 2.2, User P i The function value f(d) of the elements of its own set. ij ) as the key, calculate As a value, and using unintentional key-value storage encoding to generate an unintentional key-value storage function A. i And send it to server CS2;

[0105]

[0106] Step 2.3, User P n-1 The encrypted set S n-1 Pseudo-random function value F r * (k n-1 Send them to servers CS1 and CS2 respectively;

[0107]

[0108] In the formula, P k′ This represents a pseudo-random permutation with key k'. User P n-1 Sets and set D λ The intersection;

[0109] User P n The encrypted set S n Pseudo-random function value F r * (k n ) are sent to servers CS1 and CS2 respectively;

[0110]

[0111] In the formula, User P n Sets and set Dλ The intersection;

[0112] Step 3: Unintentional key-value decryption;

[0113] Step 3.1: Servers CS1 and CS2 use the pseudo-random function F * Using the homomorphic property of the key, re-encrypt the received encrypted set S. n-1 and encrypted set S n And generate a new set S′ n-1 S' n ;

[0114]

[0115]

[0116] Where, Φ n+1 User P i User P n-1 and user P n The intersection of virtual sets;

[0117] Step 3.2: Server CS1 uses the received unintentional key-value storage function A1 to decode set S′. n-1 and generate a new set. Where d′ n-1j ∈S′ n-1 ,d′ n-1j Describe the set S′ n-1 The j-th element in; server CS2 uses the received unintentional key-value storage function A i To decode set S′ n and generate a new set. Where d′ nj ∈S′ n ,d′ nj Describe the set S′ n The j-th element in;

[0118] Step 3.3: Server CS2 will collect S n * Send to server CS1;

[0119]

[0120]

[0121] Where m represents the total number of user attributes;

[0122] Step 4: Calculate the intersection of user privacy data;

[0123] Server CS1 calculates the multi-intersection I* ={x′||x * :x′||x * ∈S n-1 * ∩S n *}, and based on the intersection of multiple parties I * Calculate the intersection of the re-encrypted sets I' = {x': x'||x}. * ∈S n-1 * ∩S n *}, x'∈S n-1 * ∩S n * Finally, server CS1 returns the re-encrypted intersection I' to organizer P1; x' represents the re-encrypted ciphertext form of user attributes, x * The decrypted ciphertext form representing user attributes;

[0124] Step 5: Verification;

[0125] After receiving the re-encrypted intersection v', organizer P1 calculates... Represent the inverse permutation of the pseudo-random permutation with key k', and check I. k′ Do the elements in the array satisfy the following conditions:

[0126] ① and Represents the empty set;

[0127] ② α∈[λ], d||α∈I k′ This means that for every element d and a positive integer α less than or equal to λ in the privacy intersection I, d||α appears in I. k′ In this context, || represents a connection.

[0128] If any one condition is not met, the verification fails and a termination symbol is output; if both conditions are met, the verification succeeds and the privacy intersection I = {d} is output. ij :d ij ∈(I k′ -Φ n+1 ) -λ} to user P i .

[0129] The tools used in this invention are Python 3.8 and Mathlab 2021b. All programs are executed on a Vostro Dell desktop computer configured with an 11th Gen Intel Core i5-11400 processor with frequencies of 2.60 GHz and 2.59 GHz, and 8.00 GB of memory.

[0130] A comparison of the embodiments of the present invention with prior art 1 and prior art 2 yields the following results: Figures 5 to 7 .

[0131] Existing technology one is A.Abadi, S.Terzis, and C.Dong, "Vd-psi: Verifiable delegatedprivate set intersection on outsourced private datasets," in FinancialCryptography, 2016. [Online].Available: https: / / api.semanticscholar.org / CorpusID: 13164375

[0132] The second existing technology is Q. Wang, F. Zhou, J. Xu, and S. Peng, “Tag-based verifiable delegated set intersection over outsourced private datasets,” IEEE Transactions on Cloud Computing, vol. 10, no. 2, pp. 1201-1214, 2022.

[0133] Figure 5 Simulation results of CPU runtime during the encryption phase are presented, showing that all three schemes exhibit instability and are generally positively correlated with the total number of participants, n. When the total number of participants, n < 9, the CPU runtime of the embodiments of the present invention is relatively small. However, for the portion where the total number of participants, n, is greater than or equal to 10, the CPU runtime of the embodiments of the present invention is roughly the same as that of prior art 1 and prior art 2.

[0134] Figure 6 The simulation results represent the CPU runtime during the decryption and verification phases. In this embodiment of the invention, when n ≤ 26, the CPU runtime is almost zero; however, when n > 26, the CPU runtime gradually increases. On the other hand, both prior art 1 and prior art 2 exhibit highly unstable CPU runtimes, and when n ≥ 26, the CPU runtime in this embodiment of the invention increases rapidly.

[0135] Figure 7 Simulation results of CPU runtime during the intersection calculation phase are described. Due to the symmetric encryption used in this embodiment, the CPU runtime is negligible. However, both prior art 1 and prior art 2 exhibit significant CPU runtime and instability. Prior art 1 and prior art 2 have almost identical CPU runtimes.

Claims

1. A method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions, characterized in that, Includes the following steps: Step 1: Organizer P1 outputs parameter params based on safety parameter κ: params = (k i , Φ i + Φ i+1 , r, k', F, F * , P, f); In the formula, k i This indicates that it was sent to user P. i The key, i∈{2,...,n-2}, where n represents the total number of participants, Φ i This indicates that it was sent to user P. i The virtual set, Φ i+1 This indicates that it was sent to user P. i+1 The virtual set, r represents the set sent to user P. n-1 and user P n The random number, k', represents the number sent to user P. n-1 and user P n The key, F represents the pseudo-random function, F * Let f denote a pseudo-random function that approximates a key homomorphism, where P represents a pseudo-random permutation and f represents an encoding function. Step 2: Accidental key-value encryption; First, organizer P1 uses the function value f(d) of its own set elements. 1j ) as the key, using user P i key k i As the seed for the pseudo-random function F, the value is obtained through an XOR operation. And use unintentional key-value store encoding to generate an unintentional key-value store function A1 and send it to server CS1; 1j This represents the j-th element in the set P1 of the organizers. This indicates that the key is k. i pseudo-random function, This represents the XOR operation from i=2 to i=n-2; Secondly, user P i The function value f(d) of the elements of its own set. ij ) as the key, calculate As a value, and using unintentional key-value storage encoding to generate an unintentional key-value storage function A. i Send to server CS2; d ij User P i The j-th element in the set; Finally, user P n-1 The encrypted set S n-1 Pseudo-random function value F r * (k n-1 Send the data to servers CS1 and CS2 respectively; User P n The encrypted set S n Pseudo-random function value F r * (k n ) are sent to servers CS1 and CS2 respectively; F r * () denotes a pseudo-random function that approximates a key homomorphism for a key of random number r, k n-1 User P n-1 The seed of the pseudo-random function, k n User P n Seed for the pseudo-random function; Step 3: Unintentional key-value decryption; Servers CS1 and CS2 use a pseudo-random function F that is approximately homomorphic to the key. * Using the homomorphic property of the key, re-encrypt the received encrypted set S. n-1 and encrypted set S n And generate set S′ n-1 S' n Then server CS1 uses the unintentional key-value storage function A1 to decode set S′. n-1 and generate a set Server CS2 uses the unintentional key-value storage function A i To decode set S′ n and generate a set Send to server CS1; Step 4: Server CS1 calculates the multi-way intersection I * And based on the intersection of multiple parties I * The re-encrypted intersection I' is calculated and returned to the organizer P1; Step 5: Organizer P1 verifies the re-encrypted intersection I'. If the verification is successful, output the privacy intersection I = {d}. ij :d ij ∈(I k′ -Φ n+1 ) -λ } to user P i Otherwise, verification fails and a termination symbol is output. Let represent the inverse permutation of the pseudo-random permutation with key k'. λ represents the binary XOR operation, where λ indicates that the organizer P1 copies its own set elements λ times, and λ≥1.

2. The method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions according to claim 1, characterized in that, Step 1 specifically involves: Step 1.1: Organizer P1 generates key k based on security parameter κ. i ∈{0,1} κ and virtual set Φ i +Φ i+1 And sent to user P i The organizer P1 generates a random number r and a key k' based on the security parameter κ, and sends them to the user P. n-1 and user P n ; Step 1.2: Organizer P1 selects a pseudo-random function F and a pseudo-random function Fapproximately key homomorphic. * : K×X→Y, and select a pseudo-random permutation P: (0, 1) κ ×D→{0,1} ≥κ K represents the key, X represents the input space, Y represents the output space, and D represents the plaintext form of the user set; Step 1.3: Organizer P1 copies its own set elements λ times, defining set D. λ = {d||1, ..., d||λ: d∈D}, and have (D λ ) -λ =D; Organizer P1 uses a pseudo-random function F based on approximate key homomorphism. * Construct an encoding function f using a pseudo-random permutation P, satisfying the following conditions: in The encoding function f is returned to user P. i P k′ This represents a pseudo-random permutation with key k'. User P i Sets and set D λ The intersection of.

3. The method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions according to claim 2, characterized in that, In step 1.2, the pseudo-random function F is constructed as follows: Step 1a: Construct a pseudo-random synthesizer G(x), where x is the input parameter; Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m1×n1 matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n1, whose elements form a ring of integers modulo q. Let represent a vector of length m1, whose elements are a ring of integers modulo q, and let χ1 represent the random error distribution in the fault-tolerant learning problem; Define s0 = s, and construct a pseudo-random synthesizer G(s) = σ1, ..., σ p(|s|) , where σ1 is The first bit of data, in yes The data is of length |s| bits, counted from the end to the beginning. i1 represents the i1th iteration, l(n1)≤p(n1); l(n1) represents the seed length extension function of the pseudo-random synthesizer G'(s), p(n1) represents the seed length extension function of the pseudo-random synthesizer G(s), n1 represents the seed length of the pseudo-random synthesizer G(s); |s|=n1, p(|s|)=p(n1); Step 1b: Construct a pseudo-random synthesizer F s (x), where x is the input parameter; Extend the length s of the pseudo-random synthesizer G(s) constructed in step 1a to a length of 2n1, i.e., the pseudo-random synthesizer Let the function G0(s) be the data of the first n1 bits of G(s), and G1(s) be the data of the last n1 bits of G(s), that is, G(s) = G0(s)G1(s); For any Define function f s : For each function f s key Perform the following calculations: Step 1c: Define the pseudo-random function in make ∈ R This means randomly selecting elements from the set, where N represents the set of positive integers, thus obtaining the random function F.

4. The method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions according to claim 2, characterized in that, In step 1.2, the pseudo-random function F of the approximate key homomorphism * The construction method is as follows: Step 2a: Construct a pseudo-random synthesizer G(x), where x is the input parameter; Define a matrix vector Sum of error terms Construct a pseudo-random synthesizer G'(s) = b = A·s + e; Let represent the set of all m²×n² matrices, where the elements form a ring of integers modulo q. Let n represent a vector of length n², whose elements form a ring of integers modulo q. Let represent a vector of length m2, whose elements are a ring of integers modulo q, and let χ2 represent the random error distribution in the fault-tolerant learning problem; Define s0 = s, and construct a pseudo-random synthesizer. in σ j It is G'(s) j-1 The first bit of data, σ j =pref1(G1(s j-1 )), s j It is G'(s) j-1 The data of length |s| bits is counted from the end to the beginning. j =suff |s| (G1(s j-1 n2 represents the seed length of the pseudo-random synthesizer G(s); Step 2b, construct the following constructor: Where p represents a positive integer less than q, and Λ represents a variable... The matrix formed; Define a pseudo-random function make That is, to obtain a pseudo-random function F that approximates the key homomorphism. * .

5. A method for calculating the intersection of privacy sets based on a symmetric key pseudo-random function according to any one of claims 1 to 4, characterized in that: In step 2, the encryption set S n-1 Encrypted set S n They are as follows: Among them, P k′ Φ represents a pseudo-random permutation with key k'. n-1 Φ n This indicates that it was sent to user P. n-1 P n virtual collection, User P n-1 Sets and set D λ The intersection, User P n Sets and set D λ The intersection, Φ n+1 User P i User P n-1 and user P n The intersection of virtual sets; In step 3, the set S′ n-1 S' n They are as follows: The set gather They are as follows: Where d′ n-1j ∈S′ n-1 ,d′ n-1j Describe the set S′ n-1 The j-th element in; d′ nj ∈S′ n ,d′ nj Describe the set S′ n The j-th element in the array; m represents the total number of user attributes.

6. The method for calculating the intersection of privacy sets based on symmetric key pseudo-random functions according to claim 5, characterized in that: In step 4, the multi-party intersection Re-encrypted intersection x' represents the re-encrypted ciphertext form of user attributes, x * This represents the decrypted ciphertext form of user attributes.

7. The method for calculating the intersection of privacy sets based on a symmetric key pseudo-random function according to claim 6, characterized in that, Step 5 specifically involves: After receiving the re-encrypted intersection I', organizer P1 calculates... And check I k′ Do the elements in the array satisfy the following conditions: ① and Indicates the empty set; ② α∈[λ], d||α∈I k′ This means that for every element d and a positive integer α less than or equal to λ in the privacy intersection I, d||α appears in I. k′ In this context, || represents a connection. If any one condition is not met, the verification fails and a termination symbol is output; if both conditions are met, the verification succeeds and the privacy intersection v = {d} is output. ij :d ij ∈(I k′ -Φ n+1 ) -λ } to user P i .

Images