Efficient and scalable anti-collusion multi-party privacy set intersection method and device

Abstract

The present application relates to an efficient and scalable method and apparatus for intersecting multi-party private sets that resist collusion. The method comprises: mapping the hash value of each element in the private set of a central participant to the corresponding position in a cuckoo graph to obtain the central participant's obfuscated cuckoo hash table; constructing a secret sharing share, a secret sharing obfuscated cuckoo hash table, and sending a copy of the secret sharing share to the other participants; constructing the obfuscated cuckoo hash tables of the other participants based on their private sets and secret sharing shares, and sequentially transferring and calculating the obfuscated cuckoo hash tables of the other participants based on a preset communication structure and a preset query calculation strategy, and outputting the intersection result through interaction between a preset target participant and the central participant. This method solves the problems of low efficiency, weak functional scalability, and poor anti-collusion capability in the existing technology for intersecting multi-party private sets in the field of secure multi-party computation.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an efficient and scalable method and device for calculating the intersection of multi-party privacy sets against collusion. Background Art

[0002] In recent years, with the rapid development and widespread application of the internet and big data technologies, an increasing amount of distributed data requires collaborative processing by multiple parties, such as in advertising revenue calculation and infectious disease risk prevention and control. However, unrestricted data sharing and the potential for data leakage that arises in this process pose a significant threat to personal privacy, corporate reputation, and even national security. To this end, industry and academia have proposed a large number of secure multi-party computation protocols to address the privacy protection issues inherent in multi-party collaborative computing.

[0003] The Private Set Intersection (PSI) protocol is a specific secure multi-party computation protocol. Existing multi-party PSI protocols primarily utilize public key encryption and oblivious transfer (OT). The following describes each of these two technologies:

[0004] (1) Multi-party PSI protocol based on public key

[0005] The public key-based multi-party PSI protocol mainly uses homomorphic encryption technology; the core idea of ​​this protocol is to use the additive homomorphic encryption system to implement oblivious polynomial evaluation (OPE), and further implement the multi-party PSI protocol on this basis. Furthermore, some researchers have optimized the above-mentioned public key-based multi-party PSI protocol using secret sharing technology. In the optimized protocol, each participant secretly shares the private key of the additive homomorphic encryption, encrypts their own data separately, and jointly decrypts the intersection ciphertext. The computational and communication complexity of the new protocol both reach O(n 2 m 2 ) level; related technologies can also use a public key homomorphic encryption technology with threshold decryption capability to further optimize the communication complexity of the protocol to the O(nm) level, where n is the number of participants and m is the size of the privacy set of each participant.

[0006] In addition, existing technologies can also propose a new multi-party PSI protocol based on zero-knowledge proof technology and optimization of polynomial operations. In this protocol, the communication complexity and computational complexity are quasi-linear with the size of the privacy set m. In addition, some researchers have proposed a general compilation framework that can enhance the security of most multi-party PSI protocols based on zero-knowledge proof, making their security more resistant to attacks from at most 50 million in a semi-honest model. The collusion attack launched by the three participants is elevated to the same level as that in the malicious model.

[0007] In the latest research on public key technology, a multi-party PSI protocol has been proposed based on threshold public key cryptography and Bloom filters (BF), where the full set can be set as a fixed-length string. The protocol's computational complexity is related to the size of the full set, but is insensitive to increases in the number of participants, offering advantages in scenarios with a small number of elements and a large number of participants. Existing technologies can also implement the "AND" operation on private set elements based on elliptic curves, and multi-party PSI protocols have been designed for small and large set scenarios. The small set protocol is two orders of magnitude more efficient than the BF-based protocol, while the large set protocol is considered to be the most theoretically efficient multi-party PSI protocol known under a semi-honest model. For small set scenarios, researchers have also designed a three-party PSI protocol based on the three-party Diffie-Hellman key agreement protocol, which achieves optimal communication efficiency in small set scenarios.

[0008] (2) Multi-party PSI protocol based on OT

[0009] Compared to public key encryption, OT-based technologies started relatively late. In 2017, researchers first used OT-Extension (OTE) technology to construct an oblivious programmable pseudorandom function (OPPRF). They presented three OPPRF instances and combined them with zero-sharing technology to construct a multi-party PSI protocol.

[0010] Subsequently, researchers also implemented a multi-party PSI protocol based on data structures such as Garbled Bloom Filters (GBF) and on-the-fly (OT) interactions between participants. The advantage of this protocol is that some of the overhead can be handled offline, before each participant provides their data set, while the online phase has relatively low overhead.

[0011] In recent years, existing technologies have utilized Multi Message Symmetric Private Information Retrieval (MM-SPIR) technology to design and implement a multi-party PSI protocol with information-theoretic security by cleverly setting three types of shared random numbers (local random numbers, associated random numbers, and global random numbers) between the replicated and non-colluded databases of each participant. This protocol has excellent download complexity, but its disadvantage is that it cannot resist conspiracy attacks.

[0012] Currently, researchers have combined OPPRF with a secure multiplication protocol with linear communication overhead to propose a new multi-party PSI protocol. The protocol has a communication complexity of O(nm log m) and can resist attacks by at most In addition, the existing technology can also construct a multi-party PSI protocol based on whether the adversaries collude or not. The non-collusion-resistant protocol is constructed using only symmetric cryptographic primitives, while the collusion-resistant protocol combines the OPPRF oblivious key-value store (OKVS) and the zero-XOR secret sharing technology extended from zero sharing. It is considered to be the multi-party PSI protocol with the best performance under the existing malicious model.

[0013] The existing multi-party PSI protocol has the following flaws:

[0014] (1) Low efficiency of the protocol: The computational or communication complexity of some existing technologies is greater than O(nm), and the time and space complexity of some solutions is related to the size of the entire set. In the real-world scenario where the number of participants in collaborative computing and the amount of data are exploding, it is difficult to put them into practical application. In addition, although some other existing technologies have computational and communication complexities of O(nm), they rely heavily on expensive public key cryptographic primitives or have large complexity constants, and their actual efficiency is low.

[0015] (2) The protocol has poor scalability: Some existing technologies only support three-party intersection, not any multiple parties, or rely on each participant to store data in multiple "replicated and non-collusive" databases; in addition, other technical solutions can only implement simple multi-party PSI functions, and it is difficult to expand and construct various threshold multi-party PSI solutions, which limits its application in complex real-world scenarios such as electronic elections and log audits. The new solution proposed in this invention can be well combined with various two-party PSI technologies to achieve functional extensions such as threshold multi-party PSI with limited intersection size.

[0016] (3) The protocol has poor anti-collusion capabilities: Some existing technologies cannot resist collusion attacks, or rely on the "honest majority" assumption and can only resist attacks by at most In addition, some other existing technologies also need to use public key cryptography to ensure anti-collusion, or require each participant to communicate with each other, which has high computing and communication costs.

[0017] In summary, the existing technologies for solving the problem of intersection of multi-party privacy sets in the field of secure multi-party computing are inefficient, have weak functional scalability and anti-collusion capabilities, and urgently need to be solved. Summary of the Invention

[0018] The present application provides an efficient and scalable method and device for calculating the intersection of multi-party private sets in the field of secure multi-party computing, so as to solve the problems of low efficiency, weak functional scalability and poor anti-collusion ability in the process of calculating the intersection of multi-party private sets in the field of secure multi-party computing in the existing technology.

[0019] The first aspect of the present application provides an efficient and scalable method for intersecting multi-party privacy sets that is resistant to collusion, including the following steps: mapping the hash value of each element in the privacy set of a central participant to the corresponding position of a preset cuckoo graph to obtain the obfuscated cuckoo hash table of the central participant; constructing at least one secret sharing share of the obfuscated cuckoo hash table, secretly sharing the obfuscated cuckoo hash table, and sending a secret sharing share to each other participant; constructing the obfuscated cuckoo hash table of the other participants based on the privacy sets of the other participants and the at least one secret sharing share, and based on a preset communication structure and a preset query calculation strategy, sequentially transferring and calculating the obfuscated cuckoo hash tables of the other participants, and comparing the hash value of each element in the privacy set of the central participant through interaction with a preset target participant and the central participant to obtain and output the intersection result of all participants.

[0020] Optionally, in one embodiment of the present application, after mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph, it also includes: sequentially removing the edges connected by the points of the preset degree in the cuckoo graph, and updating the degrees of the endpoints of the cuckoo graph after each edge is removed, until there are no points of the preset degree in the cuckoo graph, thereby obtaining the largest subgraph of the cuckoo graph; determining the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and a preset security parameter; adjusting the cuckoo graph according to the number of vertices that need to be added to the cuckoo graph to obtain a new cuckoo graph, and remapping each element to the new cuckoo graph to construct the obfuscated cuckoo hash table construction protocol.

[0021] Optionally, in one embodiment of the present application, constructing at least one secret sharing share of the obfuscated cuckoo hash table, secretly sharing the obfuscated cuckoo hash table, and sending a secret sharing share to each other participant includes: splitting each row of the obfuscated cuckoo hash table of the central participant based on the number of the other participants, constructing the at least one secret sharing share; sending the at least one secret sharing share to the other participants respectively, so that each of the other participants obtains the secret sharing share.

[0022] Optionally, in one embodiment of the present application, constructing the obfuscated cuckoo hash table of the other participants based on the privacy sets of the other participants and the at least one secret sharing share includes: using each element in the privacy sets of the other participants, performing query calculations in the at least one secret sharing share to obtain multiple first query results; and constructing the obfuscated cuckoo hash table of the other participants based on the multiple first query results.

[0023] Optionally, in one embodiment of the present application, based on the preset communication structure and the preset query calculation strategy, the confused cuckoo hash tables of the other participants are sequentially transmitted and calculated, and through the preset target participant and the central participant, the hash value of each element in the privacy set of the central participant is compared to obtain and output the intersection result of all participants, including: sending the secret sharing share to each of the other participants through the central participant; based on each of the other participants, sequentially transmitting and calculating the confused cuckoo hash tables of the other participants to obtain a merged confused cuckoo hash table; based on each element in the privacy set of the preset target participant, querying the merged confused cuckoo hash table to obtain multiple second query results; sending the multiple second query results to the central participant, comparing the multiple second query results with the hash value, and determining the intersection result of all participants.

[0024] The second aspect of the present application provides an efficient and scalable anti-collusion multi-party privacy set intersection device, including: a mapping module, used to map the hash value of each element in the privacy set of a central participant to the corresponding position of a preset cuckoo graph, to obtain the obfuscated cuckoo hash table of the central participant; a sharing module, used to construct at least one secret sharing share of the obfuscated cuckoo hash table, secretly share the obfuscated cuckoo hash table, and send a secret sharing share to each other participant; an intersection module, used to construct the obfuscated cuckoo hash table of the other participants based on the privacy sets of the other participants and the at least one secret sharing share, and based on a preset communication structure and a preset query calculation strategy, sequentially transfer and calculate the obfuscated cuckoo hash tables of the other participants, and compare the hash value of each element in the privacy set of the central participant through interaction with a preset target participant and the central participant to obtain and output the intersection result of all participants.

[0025] Optionally, in one embodiment of the present application, it further includes: an updating module, which is used to sequentially remove the edges connected by the points of preset degrees in the cuckoo graph after mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph, and update the degrees of the endpoints of the cuckoo graph after removing an edge each time, until there are no points of the preset degrees in the cuckoo graph, thereby obtaining the largest subgraph of the cuckoo graph; a determining module, which is used to determine the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and preset security parameters; and an adjusting module, which is used to adjust the cuckoo graph according to the number of vertices that need to be added to the cuckoo graph, to obtain a new cuckoo graph, and remap each element to the new cuckoo graph to construct the obfuscated cuckoo hash table construction protocol.

[0026] Optionally, in one embodiment of the present application, the sharing module includes: a splitting unit, used to split each row of the obfuscated cuckoo hash table of the central participant based on the number of the other participants, and construct the at least one secret sharing share; a first sending unit, used to send the at least one secret sharing share to the other participants respectively, so that each of the other participants obtains the secret sharing share.

[0027] Optionally, in one embodiment of the present application, the intersection module includes: a first query unit, used to use each element in the privacy set of the other participants to perform query calculations in the at least one secret sharing share to obtain multiple first query results; a table building unit, used to construct a confused cuckoo hash table of the other participants based on the multiple first query results.

[0028] Optionally, in one embodiment of the present application, the intersection module further includes: a second sending unit, used to send the secret sharing share to each other participant through the central participant; a calculation unit, used to sequentially transmit and calculate the obfuscated cuckoo hash table of the other participant based on each other participant, to obtain a merged obfuscated cuckoo hash table; a second query unit, used to query the merged obfuscated cuckoo hash table based on each element in the preset target participant privacy set, to obtain multiple second query results; a comparison unit, used to send the multiple second query results to the central participant, compare the multiple second query results with the hash value, and determine the intersection results of all participants.

[0029] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the efficient and scalable anti-collusion multi-party privacy set intersection method as described in the above embodiments.

[0030] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the program is executed by a processor, it implements the above-mentioned efficient and scalable anti-collusion multi-party privacy set intersection method.

[0031] Therefore, the embodiments of the present application have the following beneficial effects:

[0032] In an embodiment of the present application, an obfuscated cuckoo hash table of a central participant can be obtained by mapping the hash value of each element in the privacy set of a central participant to the corresponding position of a cuckoo graph; constructing at least one secret sharing share of the obfuscated cuckoo hash table, secretly sharing the obfuscated cuckoo hash table, and sending a secret sharing share to each other participant; constructing obfuscated cuckoo hash tables of other participants based on the privacy sets of other participants and at least one secret sharing share, and sequentially transferring and calculating the obfuscated cuckoo hash tables of other participants based on a preset communication structure and a preset query calculation strategy, and comparing the hash value of each element in the privacy set of the central participant through interaction with a preset target participant and the central participant to obtain and output the intersection result of all participants, thereby effectively improving the computational and communication efficiency, scalability, and anti-collusion capability of the multi-party PSI protocol, and greatly promoting its application in large database scenarios, scenarios requiring rich threshold extension functions, or critical scenarios where users have a high sense of crisis about other participants colluding to steal their private information. This solves the problems of low efficiency, weak functional scalability and anti-collusion ability in the process of multi-party privacy set intersection in the field of secure multi-party computing in the existing technology.

[0033] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0035] Figure 1 A flowchart of an efficient and scalable method for intersecting multi-party private sets against collusion provided in accordance with an embodiment of the present application;

[0036] Figure 2 A schematic diagram of a multi-party PSI protocol interaction process provided for one embodiment of the present application;

[0037] Figure 3 A schematic diagram of a loop-free obfuscated cuckoo diagram construction process provided by one embodiment of the present application;

[0038] Figure 4 A schematic diagram of a looped obfuscated cuckoo graph and hash table construction process provided in one embodiment of the present application;

[0039] Figure 5 A schematic diagram of loop elimination provided in accordance with an embodiment of the present application;

[0040] Figure 6 This is an example diagram of an efficient and scalable device for intersecting multi-party privacy sets against collusion according to an embodiment of the present application;

[0041] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0042] Among them, 10-efficient and scalable anti-collusion multi-party privacy set intersection device, 100-mapping module, 200-sharing module, 300-intersection module, 701-memory, 702-processor, 703-communication interface. DETAILED DESCRIPTION

[0043] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0044] The following describes an efficient and scalable anti-collusion multi-party privacy set intersection method and device according to an embodiment of the present application with reference to the accompanying drawings. To address the problems mentioned in the above background technology, the present application provides an efficient and scalable method for calculating the intersection of multi-party private sets that is resistant to collusion. In this method, the central participant's obfuscated cuckoo hash table is obtained by mapping the hash value of each element in the private set of the central participant to the corresponding position in the cuckoo graph. At least one secret sharing share of the obfuscated cuckoo hash table is constructed, the obfuscated cuckoo hash table is secret-shared, and a secret sharing share is sent to each other participant. Based on the privacy sets of the other participants and the at least one secret sharing share, the obfuscated cuckoo hash tables of the other participants are constructed. Based on a preset communication structure and a preset query calculation strategy, the obfuscated cuckoo hash tables of the other participants are sequentially transmitted and calculated. Through interaction between a preset target participant and the central participant, the hash value of each element in the private set of the central participant is compared to obtain and output the intersection result of all participants. This effectively improves the computational and communication efficiency, scalability, and collusion resistance of the multi-party PSI protocol, greatly promoting its application in large database scenarios, scenarios requiring rich threshold extension functions, or critical scenarios where users have a high sense of crisis about other participants colluding to steal their private information. This solves the problems of low efficiency, weak functional scalability and anti-collusion ability in the process of multi-party privacy set intersection in the field of secure multi-party computing in the existing technology.

[0045] To facilitate those skilled in the art to understand the efficient and scalable collusion-resistant multi-party private set intersection method of the present application, the purpose and properties of the multi-party PSI protocol involved in the efficient and scalable collusion-resistant multi-party private set intersection method of the present application are explained below.

[0046] 1. Purpose of the Multi-Party PSI Agreement:

[0047] In the multi-party PSI protocol, for n (n>2) participants P1,…,P n , each participant P i Hold your own private collection X i , set size|X i | = m, each participant P i They all hope to jointly calculate the intersection of all participants’ privacy sets S=∩ through the multi-party PSI protocol i∈[1,n] X i , and avoid leaking other element information in their respective privacy sets that is outside the multi-party intersection (i.e. X i The final output S of the protocol will be generated by at least one participant P n Get (here P n is the central participant or server, P1,…,P n-1For other participants or clients), its function expression is as follows:

[0048]

[0049] 2. Nature of the Multi-Party PSI Agreement:

[0050] Generally speaking, a secure and practical multi-party PSI protocol needs to satisfy the following properties:

[0051] 1. Correctness: If the element x∈∩ i∈[1,n] X i , then Pr[x∈S]→1; and if the element Then Pr[x∈S]→0;

[0052] 2. Security: For any participant P i and elements All have |Pr[x∈P j ]-Pr[y∈P j ]|→0, where j≠i;

[0053] 3. Efficiency: The protocol should have low computational and communication complexity.

[0054] 4. Scalability: This refers to the ability of the protocol to be expanded by adjusting its own parameters or combining with other technologies to cope with different practical scenarios;

[0055] 5. Anti-collusion attack: When the adversary controls multiple participants and conducts a collusion attack, the protocol can still ensure the security of the private sets and element information in the partial intersection of other honest participants.

[0056] Specifically, Figure 1 This is a flowchart of an efficient and scalable method for intersecting multi-party private sets that is resistant to collusion provided in an embodiment of the present application.

[0057] like Figure 1 As shown in FIG, the efficient and scalable anti-collusion multi-party privacy set intersection method includes the following steps:

[0058] In step S101, the hash value of each element in the privacy set of the central participant is mapped to the corresponding position of the preset cuckoo graph to obtain the obfuscated cuckoo hash table of the central participant.

[0059] It should be understood by those skilled in the art that the embodiments of the present application can be implemented by constructing a multi-party PSI protocol mp , to solve the problem of multi-party privacy set intersection in the field of secure multi-party computing. The communication structure and interaction process of this protocol are as follows Figure 2 As shown in Figure 2, it can be divided into three stages: pre-calculation stage, interaction stage, and intersection output stage.

[0060] In the embodiment of the present application, the pre-calculation stage belongs to the offline stage, and the central participant P n The private set elements can be hashed using the undisclosed hash function h Hash and use point set Construct an obfuscated cuckoo hash table. The specific construction process is as follows:

[0061] First, a cuckoo graph with h = 2.4m points and m edges is initialized, and the central participant P is hashed by a private hash function h. n Each privacy set element in the point set Hash to map the hash value of each element in the privacy set to the corresponding position in the cuckoo map, thereby using the point set Constructing a confusing cuckoo hash table for the central participants effectively ensures the realization of an efficient and scalable anti-collusion multi-party privacy set intersection function.

[0062] Optionally, in one embodiment of the present application, after mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph, it also includes: sequentially removing the edges connected by the points of the preset degree in the cuckoo graph, and updating the degree of the endpoints of the cuckoo graph after each edge is removed until there are no points of the preset degree in the cuckoo graph, thereby obtaining the largest subgraph of the cuckoo graph; determining the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and the preset security parameters; adjusting the cuckoo graph according to the number of vertices that need to be added to the cuckoo graph to obtain a new cuckoo graph, and remapping each element to the new cuckoo graph to construct an obfuscated cuckoo hash table construction protocol.

[0063] It should be noted that after mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph, the embodiment of the present application can remove the edges connected by points of a preset degree (such as a degree of 1) in sequence, and re-update the degrees of all points each time an edge is removed until there are no points of a preset degree (such as a degree of 1), at which time the retained cuckoo graph is the largest subgraph.

[0064] To solve the loop problem in the cuckoo graph, the embodiment of the present application can add (d+λ) points for the mapping of the new hash function, where d is the maximum number of edges in the largest subgraph, which is generally taken as And for each element value x in the privacy set of the central participant on all edges of the largest subgraph, use the new hash function to calculate, output the bit string, and store the x value in the corresponding position. The XOR value of all points connected by the edge x is y, so that the set of m key-value pairs {(x i ,y i )}i∈[m] Stored in the hash table, the obfuscated cuckoo hash table construction protocol π is constructed GCT .

[0065] The specific obfuscated cuckoo hash table construction protocol process is shown in Table 1, where [m] represents an integer between 1 and m. Represents a bitwise exclusive OR (XOR) operation.

[0066] Table 1

[0067]

[0068]

[0069] It should be noted that the obfuscated cuckoo hash table construction protocol π GCT In the construction process of , it is also necessary to eliminate the loop when constructing the cuckoo graph. The specific steps to eliminate the loop are as follows:

[0070] When the edge of the largest subgraph is smaller than a processable threshold d, embodiments of the present application may use a new hash function to further map all elements, thereby increasing the number of vertices in the cuckoo graph to effectively store data.

[0071] like Figure 3 As shown in the figure, x1, x2, and x3 represent three elements to be stored. The initial number of vertices in the cuckoo graph is 8. The element x1 is first mapped to positions 1 and 3 by two hash functions h1 and h2. Then, vertices 1 and 3 are connected in the cuckoo graph, and elements d1 and d3 are stored in positions 1 and 3 in the cuckoo hash table D, satisfying The same applies to elements x2 and x3. When no loop occurs when constructing the cuckoo hash table, the degree of all vertices is less than or equal to 2, and the data structure formed in the cuckoo graph is a tree.

[0072] However, in the process of constructing the cuckoo graph, a cycle may occur, which may cause the elements to be unable to be stored in the hash table. Figure 4 It shows that there are loops when constructing the cuckoo hash table, such as Figure 4 As shown, if at this time After elements x1 and x2 are inserted, positions d1, d3, and d8 are already occupied by elements y1 and y2. Therefore, y′3 cannot be inserted into the hash table, that is, element x′3 cannot be stored effectively.

[0073] During the actual implementation process, the embodiments of the present application can determine the number of vertices to be added to the cuckoo graph based on preset security parameters and the size of the privacy set of the central participant; furthermore, a third hash function can be selected to map each element to the corresponding position of the supplemented vertex. Figure 5 To eliminate the loop diagram, as shown in Figure 5 As shown in the figure, h1(x1) and h2(x1) are the results of the original hash function acting on the element x1, and the output is a decimal number less than or equal to 8, corresponding to one of the 8 positions respectively; r(x1) is the result of the new hash function acting on the element x1, and the output is a string of length d+λ. The position where the bit is 1 in the string is the vertex position of the new mapping of the element in the cuckoo graph.

[0074] Therefore, the embodiment of the present application constructs a confusing cuckoo hash table construction protocol π GCT , which can realize the oblivious key-value storage function with linear computation and communication overhead, is more efficient than traditional technologies such as random matrix, polynomial interpolation, and Bloom filter, and provides a sufficient basis for the implementation of efficient and scalable anti-collusion multi-party privacy set intersection.

[0075] In step S102, at least one secret sharing share of the obfuscated cuckoo hash table is constructed, the obfuscated cuckoo hash table is secret shared, and a secret sharing share is sent to each other participant.

[0076] After constructing the obfuscated cuckoo hash table of the central participant, the embodiments of the present application can further construct multiple secret sharing shares of the obfuscated cuckoo hash table and secretly share the obfuscated cuckoo hash table so that each other participant can receive a secret sharing share, thereby providing reliable data support for subsequent data transmission and calculation between the participants.

[0077] Optionally, in one embodiment of the present application, at least one secret sharing share of the obfuscated cuckoo hash table is constructed, the obfuscated cuckoo hash table is secret-shared, and a secret sharing share is sent to each other participant, including: based on the number of other participants, splitting each row of the obfuscated cuckoo hash table of the central participant, constructing at least one secret sharing share; sending at least one secret sharing share to each other participant, so that each other participant obtains a secret sharing share.

[0078] It should be noted that the embodiment of the present application is to construct a multi-party PSI protocol mp The process mainly includes two rounds of communication processes.

[0079] In the first round of communication, the central participant P n The secret sharing shares can be distributed to all other participants P1,…,P through the star structure n-1 , central participant P nThe obfuscated cuckoo hash table is divided into n-1 parts in a secret sharing manner; then, in the interactive stage, the embodiment of the present application can be used by the central participant P n The constructed n-1 secret sharing shares are sent to the participants P1,…,P n-1 , so that each other participant can obtain a share of the secret.

[0080] In step S103, based on the privacy sets of other participants and at least one secret sharing share, the obfuscated cuckoo hash tables of other participants are constructed, and based on the preset communication structure and the preset query calculation strategy, the obfuscated cuckoo hash tables of other participants are transmitted and calculated in sequence to obtain the intersection result of each participant, and the intersection result is output through the interaction of the preset target participant and the central participant.

[0081] After sending a secret sharing share to each other participant, further, the multi-party PSI protocol π in the embodiment of the present application mp The communication structure combining star and path is used, and in the second round of communication, other participants P1,…,P n-1 Sequentially process and transmit secret sharing shares, and through the preset path structure, by P n-1 and P n Interactively output the intersection results.

[0082] Among them, this communication structure enables the protocol to resist collusion attacks from any number of clients without the need for pairwise communication between the participating parties. At the same time, in the final output intersection stage, it can be combined with other two-party PSI technologies (such as T-PSI, PSI-CA, etc.) to achieve functional extensions such as threshold multi-party PSI that limits the intersection size, ensuring the scalability and anti-collusion capability of multi-party privacy set intersection.

[0083] Optionally, in one embodiment of the present application, a confused cuckoo hash table of other participants is constructed based on the privacy sets of other participants and at least one secret sharing share, including: using each element in the privacy sets of other participants, performing query calculations in at least one secret sharing share to obtain multiple first query results; and constructing the confused cuckoo hash table of other participants based on the multiple first query results.

[0084] It should be noted that after the other n-1 participants obtain the shared obfuscated cuckoo hash table shares, the embodiment of the present application can use each element in the privacy set of other participants to perform query calculations and use the query results as the new y value, thereby combining the private elements of other participants with the new y value. Collaboratively build an obfuscated cuckoo hash table of other parties.

[0085] Optionally, in one embodiment of the present application, based on a preset communication structure and a preset query calculation strategy, the obfuscated cuckoo hash tables of other participants are sequentially transmitted and calculated, and through interaction between a preset target participant and a central participant, the hash value of each element in the privacy set of the central participant is compared to obtain and output the intersection result of all participants, including: sending a secret sharing share to each other participant through the central participant; based on each other participant, sequentially transmitting and calculating the obfuscated cuckoo hash tables of other participants to obtain a merged obfuscated cuckoo hash table; based on each element in the privacy set of the preset target participant, querying the merged obfuscated cuckoo hash table to obtain multiple second query results; sending the multiple second query results to the central participant, comparing the multiple second query results with the hash value, and determining the intersection result of all participants.

[0086] Furthermore, the embodiment of the present application can sequentially transmit and calculate the obfuscated cuckoo hash tables of other participants based on the preset communication structure and query calculation strategy, and in the intersection output stage, the second to last participant P n-1 Send the results of the private collection query to participant P n , P n Combine it with Compare them one by one to get the intersection result.

[0087] It should be noted that the message transmission order of each participant can be determined based on the IP address of the participant.

[0088] Specifically, in the embodiment of the present application, the multi-party PSI protocol workflow is shown in Table 2.

[0089] Table 2

[0090]

[0091]

[0092] It can be understood that the embodiments of the present application can also store and distribute data based on the obfuscated cuckoo hash table and secret sharing technology while achieving the correctness and security of the multi-party PSI protocol; among them, the computational and communication complexity of the multi-party PSI protocol is linearly related to the number of participants n and the set size m of each participant, and it mainly uses efficient symmetric cryptographic primitives, with excellent time and space efficiency.

[0093] In addition, the embodiment of the present application constructs a communication structure combining star and path, so that the output intersection stage can be combined with various two-party PSI technologies to achieve functional extensions such as threshold multi-party PSI that limits the intersection size, and can resist any number of clients P1, ..., P in a semi-honest model. n-1Collusion attacks can be prevented, so that the multi-party PSI protocol can effectively solve the multi-party PSI problem while also being efficient, scalable and anti-collusion.

[0094] According to the efficient and scalable collusion-resistant multi-party privacy set intersection method proposed in the embodiments of the present application, the central participant's obfuscated cuckoo hash table is obtained by mapping the hash value of each element in the privacy set of the central participant to the corresponding position in the cuckoo graph; at least one secret sharing share of the obfuscated cuckoo hash table is constructed, the obfuscated cuckoo hash table is secret-shared, and a secret sharing share is sent to each other participant; based on the privacy sets of other participants and the at least one secret sharing share, the obfuscated cuckoo hash tables of other participants are constructed, and based on a preset communication structure and a preset query calculation strategy, the obfuscated cuckoo hash tables of other participants are sequentially transmitted and calculated. Through interaction between a preset target participant and the central participant, the hash value of each element in the privacy set of the central participant is compared to obtain and output the intersection result of all participants, thereby effectively improving the computational and communication efficiency, scalability, and collusion-resistant capability of the multi-party PSI protocol, and greatly promoting its application in large database scenarios, scenarios requiring rich threshold extension functions, or critical scenarios where users have a high sense of crisis about other participants colluding to steal their private information.

[0095] Secondly, an efficient and scalable anti-collusion multi-party privacy set intersection device proposed according to an embodiment of the present application is described with reference to the accompanying drawings.

[0096] Figure 6 It is a block diagram of an efficient and scalable anti-collusion multi-party privacy set intersection device according to an embodiment of the present application.

[0097] like Figure 6 As shown, the efficient and scalable anti-collusion multi-party privacy set intersection device 10 includes: a mapping module 100, a sharing module 200 and an intersection module 300.

[0098] Among them, the mapping module is used to map the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo map to obtain the obfuscated cuckoo hash table of the central participant.

[0099] The sharing module is used to construct at least one secret sharing share of the obfuscated cuckoo hash table, perform secret sharing on the obfuscated cuckoo hash table, and send a secret sharing share to each other participant.

[0100] The intersection module is used to construct the obfuscated cuckoo hash tables of other participants based on the privacy sets of other participants and at least one secret sharing share, and to sequentially transfer and calculate the obfuscated cuckoo hash tables of other participants based on the preset communication structure and the preset query calculation strategy. The module also compares the hash value of each element in the privacy set of the central participant through interaction with the preset target participant and the central participant to obtain and output the intersection results of all participants.

[0101] Optionally, in one embodiment of the present application, the efficient and scalable anti-collusion multi-party privacy set intersection device 10 of the embodiment of the present application further includes: an updating module, a determining module, and an adjusting module.

[0102] Among them, the update module is used to map the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph, and then remove the edges connected by the points of the preset degree in the cuckoo graph in sequence. After each edge is removed, the degree of the endpoints of the cuckoo graph is updated until there are no points of the preset degree in the cuckoo graph, thereby obtaining the largest subgraph of the cuckoo graph.

[0103] The determination module is used to determine the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and a preset security parameter.

[0104] The adjustment module is used to adjust the cuckoo graph according to the number of vertices that need to be added in the cuckoo graph to obtain a new cuckoo graph, and remap each element to the new cuckoo graph to construct an obfuscated cuckoo hash table construction protocol.

[0105] Optionally, in one embodiment of the present application, the sharing module 200 includes: a splitting unit and a first sending unit.

[0106] The splitting unit is used to split each row of the central participant's obfuscated cuckoo hash table based on the number of other participants to construct at least one secret sharing share.

[0107] The first sending unit is configured to send at least one secret sharing share to other participants respectively, so that each of the other participants obtains a secret sharing share.

[0108] Optionally, in one embodiment of the present application, the intersection module 300 includes: a first query unit and a table building unit.

[0109] The first query unit is configured to use each element in the privacy set of other participants to perform query calculation in at least one secret sharing share to obtain multiple first query results.

[0110] The table building unit is used to construct the obfuscated cuckoo hash tables of other participants based on the multiple first query results.

[0111] Optionally, in an embodiment of the present application, the intersection module 300 further includes: a second sending unit, a calculation unit, a second query unit, and a comparison unit.

[0112] The second sending unit is used to send the secret sharing share to each other participant through the central participant.

[0113] The calculation unit is used to sequentially transfer and calculate the obfuscated cuckoo hash tables of other participants based on each other participant to obtain a merged obfuscated cuckoo hash table.

[0114] The second query unit is used to query and merge the obfuscated cuckoo hash table based on each element in the preset target participant privacy set to obtain multiple second query results.

[0115] The comparison unit is used to send the multiple second query results to the central participant, compare the multiple second query results with the hash value, and determine the intersection results of all participants.

[0116] It should be noted that the above explanation of the embodiment of the efficient and scalable anti-collusion multi-party private set intersection method is also applicable to the efficient and scalable anti-collusion multi-party private set intersection device of this embodiment, and will not be repeated here.

[0117] The efficient and scalable anti-collusion multi-party privacy set intersection device proposed in the embodiment of the present application includes a mapping module for mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo graph to obtain the obfuscated cuckoo hash table of the central participant; a sharing module for constructing at least one secret sharing share of the obfuscated cuckoo hash table, secretly sharing the obfuscated cuckoo hash table, and sending a secret sharing share to each other participant; an intersection module for constructing the obfuscated cuckoo hash tables of other participants based on the privacy sets of other participants and at least one secret sharing share. Cuckoo hash table, and based on the preset communication structure and preset query calculation strategy, sequentially transmit and calculate the obfuscated cuckoo hash tables of other participants, and compare the hash value of each element in the privacy set of the central participant through the preset target participant and the central participant to obtain and output the intersection result of all participants, thereby effectively improving the computing and communication efficiency, scalability and anti-collusion ability of the multi-party PSI protocol, and greatly promoting its application in large database scenarios, scenarios that require rich threshold expansion functions, or key scenarios where users have a high sense of crisis about other participants conspiring to steal their private information.

[0118] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0119] Memory 701 , processor 702 , and computer programs stored in the memory 701 and executable on the processor 702 .

[0120] When the processor 702 executes the program, the efficient and scalable anti-collusion multi-party privacy set intersection method provided in the above embodiment is implemented.

[0121] Furthermore, the electronic device further includes:

[0122] The communication interface 703 is used for communication between the memory 701 and the processor 702 .

[0123] The memory 701 is used to store computer programs that can be run on the processor 702 .

[0124] The memory 701 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0125] If the memory 701, processor 702, and communication interface 703 are implemented independently, the communication interface 703, memory 701, and processor 702 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0126] Optionally, in a specific implementation, if the memory 701, the processor 702 and the communication interface 703 are integrated on a chip, the memory 701, the processor 702 and the communication interface 703 can communicate with each other through an internal interface.

[0127] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0128] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the above-mentioned efficient and scalable anti-collusion multi-party privacy set intersection method is implemented.

[0129] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0130] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0131] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing a custom logical function or process step, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed in a different order than shown or discussed, including performing functions in a substantially simultaneous manner or in a reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application pertain.

[0132] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0133] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0134] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0135] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0136] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. An efficient and scalable method for intersecting multi-party private sets against collusion, characterized by: The following steps are involved: Mapping the hash value of each element in the central participant's privacy set to the corresponding position in the preset cuckoo map to obtain the obfuscated cuckoo hash table of the central participant; Constructing at least one secret share of the obfuscated cuckoo hash table, performing secret sharing on the obfuscated cuckoo hash table, and sending a secret share to each other participant; Based on the privacy sets of other participants and the at least one secret sharing share, the obfuscated cuckoo hash tables of the other participants are constructed, and based on a preset communication structure and a preset query calculation strategy, the obfuscated cuckoo hash tables of the other participants are sequentially transmitted and calculated, and through interaction with a preset target participant and the central participant, the hash value of each element in the privacy set of the central participant is compared to obtain and output the intersection result of all participants.

2. The method according to claim 1, characterized in that After mapping the hash value of each element in the privacy set of the central participant to the corresponding position of the preset cuckoo chart, the method further includes: Sequentially removing edges connected to points of a preset degree from the cuckoo graph, and updating the degrees of endpoints of the cuckoo graph after each edge is removed, until no points of the preset degree remain in the cuckoo graph, thereby obtaining a maximum subgraph of the cuckoo graph; Determining the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and a preset security parameter; According to the number of vertices that need to be added to the cuckoo graph, the cuckoo graph is adjusted to obtain a new cuckoo graph, and each element is remapped to the new cuckoo graph to construct the obfuscated cuckoo hash table construction protocol.

3. The method according to claim 1, characterized in that The constructing at least one secret sharing share of the obfuscated cuckoo hash table, performing secret sharing on the obfuscated cuckoo hash table, and sending a secret sharing share to each other participant includes: Splitting each row of the central party's obfuscated cuckoo hash table based on the number of other parties to construct the at least one secret share; The at least one secret sharing share is sent to each of the other participants, so that each of the other participants obtains the secret sharing share.

4. The method according to claim 1, wherein The step of constructing the obfuscated cuckoo hash table of the other party based on the privacy set of the other party and the at least one secret sharing share includes: Using each element in the privacy set of the other party, performing query calculation on the at least one secret sharing share to obtain a plurality of first query results; Based on the multiple first query results, a confused cuckoo hash table of the other participants is constructed.

5. The method according to claim 1, wherein Based on the preset communication structure and the preset query calculation strategy, the obfuscated cuckoo hash tables of the other participants are sequentially transmitted and calculated, and the hash value of each element in the privacy set of the central participant is compared through the preset target participant and the central participant to obtain and output the intersection result of all participants, including: Sending the secret sharing share to each of the other participants through the central participant; Based on the sequential transmission and calculation of the obfuscated cuckoo hash tables of the other participants by each of the other participants, a merged obfuscated cuckoo hash table is obtained; Based on each element in the preset target participant privacy set, query the merged obfuscated cuckoo hash table to obtain multiple second query results; The multiple second query results are sent to the central participant, and the multiple second query results are compared with the hash value to determine the intersection results of all the participants.

6. An efficient and scalable anti-collusion multi-party privacy set intersection device, characterized by: include: A mapping module, configured to map the hash value of each element in the privacy set of the central participant to a corresponding position in a preset cuckoo map, thereby obtaining an obfuscated cuckoo hash table of the central participant; a sharing module configured to construct at least one secret share of the obfuscated cuckoo hash table, perform secret sharing on the obfuscated cuckoo hash table, and send a secret share to each other participant; The intersection module is used to construct the obfuscated cuckoo hash tables of the other participants based on the privacy sets of the other participants and the at least one secret sharing share, and to sequentially transmit and calculate the obfuscated cuckoo hash tables of the other participants based on a preset communication structure and a preset query calculation strategy, and to compare the hash value of each element in the privacy set of the central participant through interaction with a preset target participant and the central participant to obtain and output the intersection result of all participants.

7. The device according to claim 6, characterized in that Also includes: an updating module, configured to, after mapping the hash value of each element in the privacy set of the central participant to a corresponding position in the preset cuckoo graph, sequentially remove edges connected by points of a preset degree in the cuckoo graph, and update the degrees of the endpoints of the cuckoo graph each time an edge is removed, until no points of the preset degree are left in the cuckoo graph, thereby obtaining a maximum subgraph of the cuckoo graph; a determination module, configured to determine the number of vertices that need to be added to the cuckoo graph based on the size of the largest subgraph and a preset security parameter; An adjustment module is used to adjust the cuckoo graph according to the number of vertices that need to be added in the cuckoo graph to obtain a new cuckoo graph, and remap each element to the new cuckoo graph to construct the obfuscated cuckoo hash table construction protocol.

8. The device according to claim 6, characterized in that The sharing module includes: a splitting unit, configured to split each row of the obfuscated cuckoo hash table of the central party based on the number of the other parties, to construct the at least one secret sharing share; The first sending unit is configured to send the at least one secret sharing share to each of the other participants, so that each of the other participants obtains the secret sharing share.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the efficient and scalable anti-collusion multi-party privacy set intersection method as described in any one of claims 1 to 5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the efficient and scalable anti-collusion multi-party privacy set intersection method as described in any one of claims 1 to 5.

Images