A decentralized storage method for calculating the intersection of private sets

Abstract

The present invention discloses a method for calculating the intersection of private sets in decentralized storage, and relates to the field of decentralized storage technology. The data owner sends a query request for requesting data sharing records to a smart contract and several storage servers of a blockchain platform, the smart contract is used to store a summary of data sharing records, and the storage server is used to store data sharing; the storage server receives an intermediate result based on the query request and the summary of data sharing records fed back by the smart contract; the intermediate result is verified according to the data sharing and the summary of data sharing records, and the intermediate result that passes the verification is determined to be the final query result. The present invention enables multiple data owners to retrieve private data sets from each other through untrusted storage server verification in a secret sharing manner, which ensures the quality and data security of data sharing services, and is conducive to improving the robustness of data sharing services in decentralized storage.

Description

Technical Field

[0001] The present invention relates to the technical field of decentralized storage, and in particular to a method for calculating the intersection of private sets in decentralized storage. Background Art

[0002] Decentralized storage is considered a promising blockchain application for building trustworthy data sharing services. Decentralized storage enables distributed data owners to collaboratively store and share their resources, and brings well-known benefits, including trust elimination, tamper-proofing, and strong fault tolerance. It provides a transparent and auditable platform for storing and retrieving data from different owners, and each operation is recorded in a distributed ledger (i.e., blockchain) accessible to all nodes in the network.

[0003] However, due to the inherent transparent access service model in decentralized storage, it also brings privacy issues of private information disclosure, so privacy-preserving decentralized storage has attracted great attention in the research community. That is, multiple users can search for encrypted data from multiple owners through untrusted storage servers.

[0004] In the prior art, privacy-preserving decentralized storage has been proposed to address the privacy issue in blockchain-based systems. In order to ensure data privacy without losing availability, secure decentralized storage based on cryptographic schemes has been recognized as a widely adopted solution. However, existing secure decentralized storage based on cryptographic schemes either focuses on traditional single-user settings or only supports simple keyword search functions, which is not suitable for the practical requirements of rich multi-owner queries in decentralized storage. In particular, a more general use case of decentralized storage is to perform set operations (i.e., intersection) on public data records between different owners, rather than just simple keyword matching. Therefore, as the demand for data collaboration increases, the lack of effective privacy-preserving solutions is becoming a limitation of decentralized storage. The Private Set Intersection (PSI) solution is considered to be an ideal cryptographic scheme in this case because it allows multiple parties to collaborate to perform private set computations without revealing additional information.

[0005] However, in the process of implementing the technical solution of the invention in the embodiment of the present application, the inventors of the present application found that the above technical solution has at least the following technical problems:

[0006] Existing PSI solutions lack the necessary verification of PSI results, which is an indispensable security requirement in decentralized storage, resulting in low robustness of decentralized storage based on PSI solutions. Summary of the invention

[0007] The present invention aims to solve the technical problem of lack of effective verification of data sharing services in existing decentralized storage, so as to ensure data sharing security and sharing service quality.

[0008] The above invention objectives are mainly achieved through the following technical solutions:

[0009] In a first aspect, a method for calculating the intersection of private sets in decentralized storage includes:

[0010] Send a query request for requesting data sharing records to a smart contract and several storage servers of a blockchain platform, wherein the smart contract is used to store a summary of data sharing records, and the storage server is used to store data sharing; receive an intermediate result fed back by the storage server based on the query request and the summary of data sharing records fed back by the smart contract; verify the intermediate result according to the data sharing and the summary of data sharing records, and determine that the verified intermediate result is the final query result.

[0011] Preferably, if the intermediate result is verified, a notification message of the verification is sent to the smart contract, and the notification message is used to instruct the smart contract to settle the resource service fee with the storage server for the query request.

[0012] Preferably, if the intermediate result verification fails, an arbitration request is sent to the smart contract, and the arbitration request is used to instruct the smart contract to arbitrate with respect to the intermediate result.

[0013] In the second aspect, a method for calculating the intersection of private sets in decentralized storage includes:

[0014] Receive a query request for requesting data sharing records sent by a data owner; based on the query request, feed back a summary of the data sharing records to several storage servers, so that the storage servers generate intermediate results based on the query request and the summary of the data sharing records, and the storage servers are used to store data sharing.

[0015] Preferably, a notification message sent by the data owner in response to the passing of the intermediate result verification is received; and a resource service fee is settled with the storage server for the query request based on the notification message.

[0016] Preferably, an arbitration request sent by the data owner due to failure of verification of the intermediate result is received; and based on the arbitration request, the intermediate result is arbitrated.

[0017] Preferably, based on the arbitration request, a random challenge is sent to the server; a proof fed back by the server based on the random challenge is received, wherein the proof is generated by the storage server according to its private key, the intermediate result and the random challenge; the intermediate result is arbitrated and verified according to the proof; if the arbitration verification passes, the storage server is determined to be an honest storage server, and if the data owner is determined to be a dishonest data owner, a resource service fee is settled with the honest storage server, and a time for paying the resource service fee is locked for the dishonest data owner; otherwise, the storage server is determined to be a dishonest storage server, and the dishonest storage server is punished.

[0018] In a third aspect, a method for calculating the intersection of private sets in decentralized storage includes:

[0019] Receive a query request sent by a data owner for requesting a data sharing record, and a data sharing record summary fed back by a smart contract of a blockchain platform based on the query request; generate an intermediate result based on the query request and the data sharing record summary; and send the intermediate result to the data owner so that the data owner can verify the intermediate result based on the stored data sharing and the data sharing record summary.

[0020] Preferably, a resource service fee paid by the smart contract for passing the verification of the intermediate result is received.

[0021] Preferably, a random challenge sent by the smart contract due to failure of verification of the intermediate result is received; a certificate is generated according to the intermediate result, the random challenge and the private key; the certificate is sent to the smart contract so that the smart contract performs arbitration verification on the intermediate result based on the certificate; a resource service fee paid by the smart contract for passing the arbitration verification of the intermediate result is received; or, a penalty imposed by the smart contract for failing the arbitration verification of the intermediate result is accepted.

[0022] Compared with the existing technology, the beneficial effects are:

[0023] The technical solution disclosed in the present invention enables multiple data owners to retrieve private data sets from each other through untrusted storage server verification in a secret sharing manner, and uses the verified intermediate results as the query results of the data sharing records requested by the data owner, ensuring the quality of data sharing services and data security, which is conducive to improving the robustness of data sharing services in decentralized storage. If the data owner fails to verify the intermediate results, an arbitration request is sent to the smart contract of the blockchain platform to request public arbitration for the intermediate results in a privacy-protecting manner; since the PSI results are jointly evaluated by multiple parties, malicious behavior or unexpected failures of the storage server will affect the correctness of the final results, thereby seriously affecting the quality of data sharing services; and the existing PSI scheme cannot provide public auditability and fairness of arbitration. Therefore, in a decentralized storage system, security threats come from users and storage servers; entrusting key audit functions to any party violates the principle of service fairness. Therefore, when the data owner fails to verify the intermediate result, the present invention provides a public arbitration method to review potential service quality disputes between the parties in a fair and secure manner; through arbitration verification, it is determined whether it is an honest storage server or an honest data owner, and corresponding punishment measures are imposed on dishonest storage servers and dishonest data owners; the potential malicious behavior of dishonest data owners or dishonest storage servers is resolved, and at the same time, the damaged results from dishonest storage servers can be effectively detected and recovered, which is conducive to further ensuring the quality of data sharing services. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] FIG1(a) is an example diagram of the initialization process of a method for calculating the intersection of private sets in a decentralized storage in an embodiment of the present application, FIG1(b) is an example diagram of the private set intersection calculation process of a method for calculating the intersection of private sets in a decentralized storage in an embodiment of the present application, and FIG1(c) is an example diagram of the arbitration process of a method for calculating the intersection of private sets in a decentralized storage in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of the intersection calculation of decentralized private sets in an embodiment of the present application;

[0026] FIG. 3( a ) is a data partition diagram of the data outsourcing stage of the embodiment of the present application, and FIG. 3( b ) is a summary generation diagram of the data outsourcing stage of the embodiment of the present application;

[0027] Figure 4(a) is a diagram showing the evaluation of server-side computing performance in off-chain private set intersection calculations in an embodiment of the present application, Figure 4(b) is a diagram showing the evaluation of server communication cost in off-chain private set intersection calculations in an embodiment of the present application, Figure 4(c) is a diagram showing the evaluation of query delay in off-chain private set intersection calculations in an embodiment of the present application, and Figure 4(d) is a diagram showing the evaluation of user-side computing performance in off-chain private set intersection calculations in an embodiment of the present application;

[0028] Figure 5(a) is a gas consumption evaluation diagram in the on-chain arbitration of the embodiment of the present application, Figure 5(b) is a time cost evaluation diagram for generating proof in the on-chain arbitration of the embodiment of the present application, Figure 5(c) is an arbitration delay evaluation diagram in the on-chain arbitration of the embodiment of the present application, and Figure 5(d) is an arbitration cost evaluation diagram in the on-chain arbitration of the embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] The present invention discloses a method for calculating the intersection of private sets in decentralized storage. As shown in FIG1 , the application scenario includes three subjects: a number of data owners (which may also be query users when querying data sharing records), a number of storage servers, and a blockchain platform (including smart contracts); wherein the blockchain platform and the storage server form a hybrid storage architecture, and a lightweight summary of data sharing records is recorded on the blockchain platform, while the original data sharing is outsourced to a storage server outside the chain. The data owner is a user end seeking to share its data records. The storage server is a service node that rents out its computing resources (e.g., storage and computing) for monetary rewards. The connection between the data owner and the storage server is established by using a smart contract within the blockchain platform. The tamper-proof feature of the smart contract can provide strong security protection for malicious users and storage servers, ensuring the correctness of data record calculations for multiple data owners.

[0031] It should be noted that blockchain can be defined as a decentralized public ledger jointly maintained by distributed nodes by running consensus protocols. Once a transaction is recorded on the blockchain, it cannot be changed and can be seen by every participant on the network. The core characteristics of a blockchain network include transparency, consistency, and verifiability. Transparency means that any participant on the network can access recorded transactions. All network participants reach a consensus through the protocol to ensure that only valid transactions can be recorded on the blockchain. Verifiability ensures that all transactions are auditable and tamper-proof. Smart contracts can be represented as user-defined trusted code, executed and programmed on the blockchain. It can be triggered by sending a transaction to the unique address of the smart contract. Once deployed to the blockchain network, smart contracts can reliably execute predefined programs without relying on a central authority. Programs and data stored on smart contracts can trigger user-defined actions, and the outputs are recorded on the blockchain.

[0032] The above method comprises the following steps:

[0033] Step 1: Private data outsourcing. The data owner stores their own data in the storage server through a secret sharing algorithm and uploads the data sharing record summary to the smart contract.

[0034] As shown in (a) of Figure 1, the system initialization process, in which the participating data owners first use Shamir's secret sharing algorithm to divide their respective data records into multiple data shares. The generated data shares are assigned to independent storage servers. At the same time, the relevant data share record summary is transmitted to the smart contract as a proof of storage service. After receiving the outsourced share, each contracted server also generates a commitment based on its private key and submits it to the smart contract for possible subsequent arbitration services. The security of Shamir's secret sharing algorithm ensures that the storage server only holds data shares instead of the original data.

[0035] For the convenience of description, let the data owner j∈{1,m}, the storage server s∈{1,n}, and the c-th column attribute A c , Table T and Server s's private key r s , hash function H. For each data owner j∈{1,m}, execute b=|Dom(A c )|; Initialize t j ={t1,t2,...,t b}, t b Indicates the bth column T in the table j , Represents column b in the table For each i∈{1,b}, execute if a i ∈A c , then t i =H(a i );T j [t i ]=1, Others are filled with random values. Execute the permutation function F on each storage server s∈{1,n} using its private key r s Generate a promise s Among them, A c Indicates the column attributes of column c in the table, Dom(A c ) is A c Domain. c )| represents the number of different column attribute domains. In the embodiment of the present invention, T and is defined as two hash tables generated based on different values ​​of the column attributes. T[i] is the i-th element of T. For each secret share stored on server s, let and Indicates data owner j and table The polynomial of the Shamir secret share generated by the i-th element of . Let P(x) denote the function after performing Lagrange interpolation.

[0036] It should be noted that the private set outsourcing phase is performed by the data owner and the contracted storage server. To facilitate the use of private set computation and blockchain-assisted verification services, each newly joined owner and storage server needs to first upload the metadata (i.e., summary and commitment) of the outsourced data record to the smart contract. The corresponding secret share of the outsourced data record should also be stored in the contracted storage server. Each data owner has a shared column attribute A c Local data records, but each owner in the column attribute A c To implement private queries on these data records, the data owner uses the hash function H to hash the shared column attributes A c Specifically, each data owner j first creates two tables containing b elements: T j and Build table The purpose is to allow users to perform local verification. c Each value a under i (i.e. a i ∈A c ), each data owner uses a hash function H to i Mapped to table T j t in i element, the value item is 1, indicating In element, value 0, table T j t in i elements. The remaining elements are filled with random values. Here, this application uses a hash function to build a separate chained hash table to avoid hash collisions. Once the data owner builds table T j And After the permutation, the Shamir secret sharing algorithm is applied to generate a secret share s for each storage server. From Table T j and Each element t in i and Get the secret values ​​of the Shamir secret sharing algorithm. These values ​​are used together with the storage server s as input to the initialization algorithm to generate secret sharing for server s respectively. and The resulting data shares are then stored on their respective storage servers, ensuring that no single server has all the information needed to reconstruct the original data.

[0037] To ensure the integrity of the share, the data owner generates a summary for each share and sends it to the smart contract for subsequent verification. Specifically, data owner j generates a two-dimensional array d j , d j ={d j [1][s],...,d j [b][s]}; where the row represents the element t i , columns represent server s. This process can further improve the reliability of decentralized storage services.

[0038] Regarding the server-side setup, each storage server s should be configured with its private key r s Generates a promise, i.e. The commitment is recorded in the corresponding smart contract for subsequent arbitration verification.

[0039] Step 2: Private set intersection calculation.

[0040] After the system initialization is completed, the technical solution of the present application follows that shown in (b) of Figure 1. The data owner sends a query request for requesting data sharing records to the smart contract and several storage servers of the blockchain platform, the smart contract is used to store the data sharing record summary, and the storage server is used to store data sharing; the storage server generates an intermediate result based on the query request and the data sharing record summary fed back by the smart contract; the data owner verifies the intermediate result according to the data sharing and the data sharing record summary, and determines that the verified intermediate result is the final query result. Specifically, the data user submits a query request to the storage server and the smart contract, and the smart contract uses the request history as service evidence. After that, the storage server collaborates to execute the incoming request, generating the intermediate result and the corresponding proof in an inadvertent manner. Finally, the storage server returns the intermediate result to the user together with the proof. After the user side verification is passed, the smart contract automatically issues a time-locked payment for the query service.

[0041] During the PSI calculation process, each storage server must calculate T j and The shares of each index item in the storage server are summed and the intermediate result is returned to the user. Due to the homomorphism and fault tolerance of the Shamir secret sharing algorithm, users can use the Lagrange interpolation algorithm to obtain reliable PSI results. When the storage server receives the query request sent by the data owner, it executes for the server s∈{1,n}:

[0042]

[0043] O s = {O s [1],O s [2],…,O s [b]};

[0044] V s = {V s [1],V s [2],…,V s [b]};

[0045] The server calculates the sum of the i-th data from all data owners and returns the intermediate result to the data user, that is, V s and O s Sent to the data owner, the data owner selects t random storage servers; in V s Execute the permutation function F on it; then perform Lagrange interpolation: obtain the tables of all data owners respectively and T j The sum of the i-th value items in (denoted as P v (0) and P o (0)). To perform Lagrange interpolation, use the points (1,V1[i]), (2,V2[i]), ..., (t,V t [i]) The function obtained is recorded as P v (x). By setting x = 0, we can get the corresponding table The sum of the i-th value items in v (0). Similarly, using the points (1,O1[i]), (2,O2[i]), ..., (n,O n [i]) Perform Lagrange interpolation and the obtained function is recorded as P o (0). By setting x=0, the present application can obtain the corresponding table T j The sum of the i-th value items in o (0). During the lock time, users can o (0) / m and P v (0) Perform verifiable set calculation. If P o (0) / m=1 and P o (0) / m=0, it means there is an intersection from the owner, and the user should add it to the result set R of the requested query and add the intersection index item i to the intersection result set R. Otherwise P o (0) / m is a random value, the user will return no intersection, triggering a time-locked payment; in addition, the user can check P v (0) to verify the correctness of the query result. v(0) is a random value, it means that at least one storage server has maliciously calculated the result. The user should initiate an arbitration request to the smart contract. Otherwise, the result verification will be confirmed and the smart contract will trigger a preset time-limited payment. It should be noted that the Lagrange interpolation method only requires a certain number of known point values ​​to reconstruct the corresponding function. Once the required number of known points is obtained, the final ciphertext value can be obtained by setting x to zero, and the resulting number is the required ciphertext. This feature of the Lagrange interpolation method makes it very suitable for decentralized storage platforms, because it only needs to reconstruct the query results from a subset of honest storage servers in the platform. This application uses this feature of the Lagrange interpolation method to enhance the robustness of the private set calculation process.

[0046] For example, Figure 2 As shown in Figure 1, there are two contracted storage servers (s1 and s2) and three data owners (j1, j2, j3), each of which maintains its own data records under the same column attribute structure. Each owner maintains two tables T j and The index item (i=1, i=2, i=3) is used to index the original record, and the value item indicates whether the owner holds the data record. Given a column attribute record, the encrypted hash function should be used to randomly map it to T j and In Table T j (and ), the index items with the value of "1" (and "0") indicate that the owner holds the corresponding data record, and the other index items are filled with random values. Then, the Shamir secret sharing algorithm is used to convert T j and Each value in is divided into ( and ) and are randomly arranged and outsourced to two storage servers. The intermediate results from the storage servers are (1,O1[1]),...,(1,O1[3]) and (1,V1[1]),...,(1,V1[3]). Users can then use these intermediate results in the Lagrange interpolation algorithm to calculate the final results of each index item. and Here, can be used to determine the intersection result, and It is used to assist users in verifying the results. For example, the evaluation result of index item i=1 is and This means that all storage servers have faithfully calculated the PSI, and the record of the first index item is the intersection result. The evaluation result of the third index item is This indicates that there is a dishonest server returning incorrect results and the user should further execute the arbitration agreement.

[0047] The key point that the existing PSI scheme cannot provide resilience and fault tolerance is that all data shares extracted from PSI should always remain valid. Otherwise, even if only one piece of data is invalid, the user end cannot reconstruct the PSI query result. In view of this, this application proposes to combine the Shamir secret sharing algorithm with a verified index structure to establish a reliable PSI fault-tolerant scheme. A common practice for secure data sharing is to perform exact matching between multi-owner encrypted data records. Intuitively, the encryption technology of PSI can provide a promising solution to promote the practical application of this security paradigm in decentralized storage. That is, data owners outsource their respective encrypted data records to decentralized storage servers, and then use the PSI scheme to efficiently perform private set calculations. Unfortunately, since the storage server is an untrusted peer in the blockchain network, the correctness and integrity of the PSI query results cannot be guaranteed, so verification is required. The openness of decentralized storage requires the establishment of an effective fault-tolerant mechanism to ensure the robustness of data sharing services. This is because the PSI results are jointly evaluated by multiple parties. Malicious behavior or unexpected failures of the storage server will affect the correctness of the final result, which will seriously affect the quality of the data sharing service.

[0048] In a preferred embodiment, if the intermediate result is verified, a verification-passed notification message is sent to the smart contract, and the notification message is used to instruct the smart contract to settle the resource service fee with the storage server for the query request.

[0049] In a preferred embodiment, if the intermediate result verification fails, an arbitration request is sent to the smart contract, and the arbitration request is used to instruct the smart contract to arbitrate with respect to the intermediate result.

[0050] Step 3: Fair Arbitration.

[0051] When the smart contract receives a notification message from the data owner that the intermediate result has passed the verification, that is, the storage server has faithfully provided the correct query service, it will issue the above service payment to it. If the smart contract receives an arbitration request from the data owner that the intermediate result has failed the verification, the intermediate result will be arbitrated based on the arbitration request.

[0052] Existing PSI schemes cannot provide public auditability and fairness of arbitration. In decentralized storage systems, security threats come from users and storage servers. Entrusting key audit functions to any party violates the principle of service fairness. Therefore, the present invention discloses a public arbitration protocol to audit potential service quality disputes between parties in a fair and secure manner; to ensure fairness while ensuring privacy. In addition, it can help users accurately identify dishonest servers hidden in the group and effectively recover damaged results.

[0053] The embodiment of the present invention takes the lightweight Sigma protocol as the starting point and carefully designs the PSI arbitration protocol. Intuitively speaking, the present application can directly delegate the Sigma protocol to the smart contract, thereby fairly performing PSI service arbitration. Although this direct approach will lead to privacy leakage, that is, all blockchain nodes can access the private parameters of the original Sigma protocol. In order to solve this problem, the design of the present application adopts the strategy of the commitment-reveal scheme, requiring each owner to generate an on-chain commitment for its private parameters with a random mask. In this way, the smart contract can use its committed parameters in the arbitration protocol to fairly verify the PSI results without leaking additional information in advance. More precisely, the on-chain summary of the i-th index item is generated by the j-th owner using his secret share. as follows: When a user detects an incorrect result, the service arbitration process described in (c) of Figure 1 is initiated, requesting the smart contract to make a fair judgment. More precisely, the smart contract can fairly determine which storage servers have returned incorrect calculations based on the evidence previously anchored on the blockchain and the commitments made by the storage servers. If the smart contract determines that there is a malicious server that provides inaccurate results, the corresponding storage server will be punished by charging a fine from its deposit; when the initiator of the arbitration (i.e., the data user) is determined to be dishonest, the service payment will be completed after the lock time.

[0054] In the security model, the embodiment of the present invention considers three types of security threats from dishonest data owners, storage servers, and semi-honest blockchain nodes. Dishonest data users: that is, they may try to access data records other than calculation results. Use the query process to obtain additional information, including data content and data records of other owners. In addition, dishonest users may maliciously accuse honest storage servers to refuse service payments. Dishonest storage servers: that is, they may try to learn from the owner's private data records, or even return wrong query results for fraud. In addition, malicious servers may intentionally modify their data sharing to undermine the robustness of the storage system. Based on the existing security assumptions of the PSI scheme, this application assumes that storage servers cannot collude with each other. Semi-honest blockchain nodes: This application assumes that semi-honest blockchain nodes honestly execute consensus protocols to provide smart contract services, but by observing on-chain summaries and commitments, they may be curious about the owner's private information. The correctness of smart contract execution and the availability of on-chain data are guaranteed.

[0055] It should be noted that the Sigma protocol enables the prover to effectively convince the verifier that it knows the witness of a statement without revealing the witness. Let q be p -1 The prime divisor of , and g is The protocol consists of three rounds of communication between the prover and the verifier. In the initialization phase, the verifier starts from the integer set q modulo (Use Z q represents) randomly selects an element r and sets the resulting value o=g r modp is sent to the verifier. To verify, the verifier randomly selects a challenge e from the set of reversible elements of an integer modulo p (using The prover calculates z = r + e·w mod q and returns it to the verifier for verification, where w is the value to be proved. Finally, the verifier can check g z =o×h e modp. If the condition is met and the parameters p, q, g and h (i.e. h = g w ) satisfies the required conditions, the verifier can accept the proof.

[0056] The embodiment of the present invention introduces a blockchain-assisted arbitration protocol, which protects the confidentiality of on-chain authentication and the auditability of PSI calculation, thereby ensuring the fairness of the arbitration process. It can effectively help accurately identify dishonest servers and help users recover damaged results.

[0057] In a preferred embodiment, based on the arbitration request, the smart contract sends a random challenge to the server; receives the proof fed back by the server based on the random challenge, the proof is generated by the storage server according to its private key, the intermediate result and the random challenge; performs arbitration verification on the intermediate result according to the proof; if the arbitration verification passes, the storage server is determined to be an honest storage server, and if the data owner is determined to be a dishonest data owner, the resource service fee is settled to the honest storage server, and the time for paying the resource service fee is locked to the dishonest data owner; otherwise, the storage server is determined to be a dishonest storage server, and the dishonest storage server is punished. The storage server receives the random challenge sent by the smart contract for the failure of the intermediate result verification; generates a proof according to the intermediate result, the random challenge and the private key; sends the proof to the smart contract so that the smart contract performs arbitration verification on the intermediate result based on the proof; receives the resource service fee paid by the smart contract for the success of the arbitration verification of the intermediate result; or accepts the punishment imposed by the smart contract for the failure of the arbitration verification of the intermediate result.

[0058] The specific implementation method is as follows: the user independently verifies the query results locally. If the local verification fails, it means that there is at least one malicious storage server. Therefore, the user initiates a fair arbitration request to the smart contract. When the smart contract receives the arbitration request, it will Generate a random challenge e for each storage server s s , and sends it to the corresponding server. The storage server receives the random challenge e issued by the smart contract for service arbitration. s After that, the server under trial calculates the value o s [i], generate a proof for each index item i: z s [i]=(r s +e s ×o s [i])modq; where r s Indicates the private key of the storage server s, o s [i] indicates the intermediate result of the i-th index item. s ={z s [1],z s [2],…,z s [b]}, the storage server returns z to the smart contract s The smart contract receives proof z from storage server s s , and verify whether the i-th index item has passed arbitration verification by calculation:

[0059] If the calculation formula is established, the arbitration verification is passed, otherwise it fails. Among them, h[i][s] is generated by the summaries of multiple data owners, and the calculation formula is as follows:

[0060] h[i][s]=d1[i][s]×L×d j [i][s]modp. Ability to identify malicious storage servers that submit erroneous data.

[0061] If the arbitration verification passes, it means that the storage server s has honestly calculated the i-th index item. Otherwise, this means malicious operation or storage server failure, and the payment will stop. Finally, the smart contract feeds back the arbitration results to the user, who can delete the erroneous interpolation results returned by the dishonest server and restore the final PSI results to ensure the quality of service. If the smart contract detects that the storage server has submitted incorrect data, the payment of service fees should be suspended. When the data user is detected to be dishonest, the smart contract should finally complete the payment after the lock time. To ensure the robustness of the system, any malicious storage server detected by the smart contract will be sent to the data user. The user can then delete the values ​​within the threshold range provided by the malicious server and select values ​​from the honest server for Lagrangian interpolation to restore the final query result.

[0062] The following is an example evaluation of a method for calculating the intersection of private sets of decentralized storage disclosed in an embodiment of the present invention. Specifically, a decentralized storage platform was built on Fabric using Python, and the storage server was deployed to the cloud platform to evaluate its performance in a real network environment. The data owner, storage server, and smart contract communicate through the HTTP protocol. All experiments were run under the following configuration: the data owner is a 16GB, 8-core machine, 4 cloud servers are deployed to simulate the contract storage server, the memory is 4GB, and the CPU is a 2.67GHz, 16-core Intel Xeon processor. In this experiment, the Python pycryptodome library is used to implement the Shamir secret sharing algorithm module. And the cryptographic hash function SHA-256 in the Python cryptography library is used to generate two tables; regarding on-chain arbitration, the encryption primitives provided by Java are used to implement the arbitration protocol.

[0063] The data outsourcing process includes system setup, data sharding, and generating lightweight summaries. In the data sharding stage, the computational cost mainly depends on the number of data records and storage servers used for outsourcing. After a new data owner joins the system, the data records should be divided into multiple shares and outsourced to the corresponding contracted storage servers. As shown in Figure 3(a), the time cost of data sharding increases linearly with the increase in the number of data records and servers. Specifically, it takes about 1.9ms to initialize 0.1K data records and about 34.2ms to initialize 1.6K data records. In Figure 3(b), the application measures the gas consumption when uploading summaries to the blockchain with different numbers of servers, and finds that the gas consumption also shows a linear growth pattern with the increase in the number of data records and servers. It is worth noting that in the ordinary Ethereum blockchain, the cost is evaluated in gas, which is a measure of the storage and computational costs incurred by the Ethereum state machine. The gas consumption per byte remains unchanged, and each byte requires 16 gas. When this application is implemented on a blockchain platform (using Java-based smart contracts), the size of bytes consumed is calculated by considering the storage and execution costs of the JVM virtual machine, and then converted into gas consumption. The evaluation results show that there is a significant difference in gas consumption between different numbers of servers when processing more data records. This is because the data owner needs to generate a separate summary for each data share on each server. The results confirm that the gas cost is within the acceptable range for practical decentralized storage.

[0064] The technical solution of this application requires users and storage servers to collaboratively calculate PSI query results, where the server calculates the intermediate result set and the user uses the Lagrange interpolation method to calculate the final result and verify its correctness. Figure 4 shows the performance evaluation of the PSI query process between the user and the server. Since the query process is performed off-chain, it can greatly reduce unnecessary computing overhead on the blockchain while improving query efficiency. In order to evaluate the scalability of the solution proposed in this application, this application randomly selected five data sets with record sizes ranging from 0.1K to 1.6K.

[0065] As shown in Figure 4(a), this application first measures the time cost of server-side calculation. The evaluation results show that the time cost increases linearly as the number of data records increases from 0.1K to 1.6K. Although the time cost also increases slightly with the number of data owners, the impact on performance is minimal. When the number of data owners increases from 2 to 4, the time cost of calculating 1.6K records only increases from 1.9ms to 3.6ms. Figure 4(b) also shows that the communication cost of the server increases linearly with the number of data records. It is independent of the number of data owners because the complexity of intermediate result communication in server calculation is O(1).

[0066] Figure 4(c) evaluates the PSI query latency, including network latency and server-side computation. We found that for smaller data records, the number of servers may have little impact on query latency, while the number of servers becomes increasingly critical as the number of data records increases. This is because the user needs to wait for all intermediate results from the contracted server before performing local computation. To further optimize the computation process, the proposed design introduces a threshold mechanism. Figure 4(d) further comprehensively evaluates the user-side time cost associated with Lagrange interpolation and result verification. Experimental results show that when the number of servers is fixed, the time cost increases linearly with the increase of the threshold. These results highlight the importance of threshold configuration in reducing time cost while ensuring system accuracy.

[0067] In the fair arbitration phase, users need to submit arbitration requests to the smart contract on the blockchain. In order to evaluate the practicality of the design of this application, Figure 5 shows the gas cost and time cost associated with the implementation of this application. Specifically, Figure 5(a) shows the gas consumption during the arbitration process, including the user's request, the storage server's commitment and proof. The results confirm the efficiency of the design of this application, because the gas consumption of requests and commitments is not affected by the growth of data records. The gas consumption of generating proofs increases linearly with the increase in the number of data records. This is because the server generates a proof for each data record, but the overall gas consumption is small. In particular, the gas consumption of generating proofs for 1.6K data records is about 2×105. In Figure 5(b), this application further evaluates the corresponding time cost of generating proofs. It only takes 0.17 seconds for the server to generate proofs for 1.6K data records. This shows that the additional proof cost does not impose a performance burden on the server.

[0068] In Figure 5(c), the application also measures the on-chain arbitration delay, that is, the time consumed from sending the arbitration request to receiving the arbitration result of the smart contract. The time cost is proportional to the number of data records and servers, while the number of servers has a relatively small impact on the time. When the data record size reaches 1.6K, the time difference between 2 servers and 3 servers is less than 0.01 seconds. This finding shows that the maximum time delay is due to the need to verify the computational correctness of each data record. In addition, the application also evaluates the gas consumption during the arbitration process, as shown in Figure 5(d). The gas consumption increases with the increase in the number of data records and servers. However, the impact of the number of servers is relatively small, which further supports the analysis results of the application. Through the above analysis and evaluation, the application has a comprehensive understanding of the performance of the arbitration process. These evaluation results provide important guidance for the design and optimization of the system.

[0069] The embodiments of the present invention are described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for calculating the intersection of private sets in decentralized storage, characterized in that: include: Sending a query request for requesting data sharing records to a smart contract and several storage servers of a blockchain platform, wherein the smart contract is used to store a summary of data sharing records, and the storage server is used to store data sharing; Receiving an intermediate result fed back by the storage server based on the query request and the data sharing record summary fed back by the smart contract; Verifying the intermediate result according to the data sharing and the data sharing record summary, and determining the intermediate result that passes the verification as the final query result; When sharing data and verifying intermediate results, this includes: Set data owner , Storage Server , No. Column properties ,surface and , the private key of server s , hash function H; for each data owner implement ;initialization , ; Indicates the first List , Indicates the first List ; For each implement ,but ; ;Other fill random values; In the table Execute the permutation function on ; For each storage server Use its private key Generate Commitment ;in, Indicates the the column properties of the column, yes domain; Indicates the number of different column attribute domains; T and Defined as two hash tables generated based on different values ​​of column attributes; ; For storage on the server For each secret shared by and Indicates the data owner With table No. The polynomial of the Shamir secret share generated by the elements; Each data owner First create two files containing Table of elements: and ; Build table The purpose is to allow users to perform local verification; for column attributes Each value below (Right now ), each data owner uses the hash function H to Mapping to table In element, the value item is 1, indicating In element, the value item is 0, indicating The remaining elements are filled with random values; Use the hash function to build a separate chained hash table to avoid hash collisions; when the data owner builds the table And When performing the permutation, the Shamir secret sharing algorithm is applied to generate a secret share s for each storage server; and Each element in and Get the secret values ​​of Shamir's secret sharing algorithm; these values ​​are used together with the storage server s as input to the initialization algorithm to generate secret sharing for server s respectively and ; When the storage server receives a query request from the data owner, implement: The server calculates the first The sum of the data is returned to the data user. and Sent to the data owner, the data owner selects t random storage servers; Execute the permutation function F on it; then perform Lagrange interpolation: obtain the tables of all data owners respectively and Middle The sum of the value items (expressed as and ); To perform Lagrange interpolation, use the point (1, ),(2, ),...,(t, ) The function obtained is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; Similarly, using the point (1, ),(2, ),...,(n, ) performs Lagrange interpolation, and the obtained function is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; During the lockout period, the user and Perform verifiable set computation.

2. The method for calculating the intersection of private sets in decentralized storage according to claim 1, characterized in that: Also includes: If the intermediate result is verified, a verification-pass notification message is sent to the smart contract, and the notification message is used to instruct the smart contract to settle the resource service fee with the storage server for the query request.

3. The method for calculating the intersection of private sets in decentralized storage according to claim 1 or 2, characterized in that: Also includes: If the intermediate result verification fails, an arbitration request is sent to the smart contract, where the arbitration request is used to instruct the smart contract to arbitrate the intermediate result.

4. A method for calculating the intersection of private sets in decentralized storage, characterized in that: include: Receiving a query request sent by a data owner for requesting data sharing records; Based on the query request, the data sharing record summary is fed back to a plurality of storage servers, so that the storage servers generate intermediate results based on the query request and the data sharing record summary, and the storage servers are used to store the data sharing; the intermediate results are then sent to the data owner, so that the data owner verifies the intermediate results according to the stored data sharing and the data sharing record summary; When sharing data and verifying intermediate results, this includes: Set data owner , Storage Server , No. Column properties ,surface and , server s's private key , hash function H; for each data owner implement ;initialization , ; Indicates the first List , Indicates the first List ; For each implement ,but ; ;Other fill random values; In the table Execute the permutation function on ; For each storage server Use its private key Generate Commitment ;in, Indicates the the column properties of the column, yes domain; Indicates the number of different column attribute domains; T and Defined as two hash tables generated based on different values ​​of column attributes; ; For storage on the server For each secret shared by and Indicates the data owner With table No. The polynomial of the Shamir secret share generated by the elements; Each data owner First create two files containing Table of elements: and ; Build table The purpose is to allow users to perform local verification; for column attributes Each value below (Right now ), each data owner uses the hash function H to Mapping to table In element, the value item is 1, indicating In element, the value item is 0, indicating The remaining elements are filled with random values; Use the hash function to build a separate chained hash table to avoid hash collisions; when the data owner builds the table And When performing the permutation, the Shamir secret sharing algorithm is applied to generate a secret share s for each storage server; and Each element in and Get the secret values ​​of Shamir's secret sharing algorithm; these values ​​are used together with the storage server s as input to the initialization algorithm to generate secret sharing for server s respectively and ; When the storage server receives a query request from the data owner, implement: The server calculates the first The sum of the data is returned to the data user. and Sent to the data owner, the data owner selects t random storage servers; Execute the permutation function F on it; then perform Lagrange interpolation: obtain the tables of all data owners respectively and Middle The sum of the value items (expressed as and ); To perform Lagrange interpolation, use the point (1, ),(2, ),...,(t, ) The function obtained is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; Similarly, using the point (1, ),(2, ),...,(n, ) performs Lagrange interpolation, and the obtained function is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; During the lockout period, the user and Perform verifiable set computation.

5. The method for calculating the intersection of private sets in decentralized storage according to claim 4, characterized in that: Also includes: Receiving a notification message sent by the data owner that the intermediate result has passed verification; A resource service fee is settled with the storage server for the query request based on the notification message.

6. The method for calculating the intersection of private sets in decentralized storage according to claim 4 or 5, characterized in that: Also includes: receiving an arbitration request sent by the data owner due to failure of verification of the intermediate result; The intermediate results are arbitrated based on the arbitration request.

7. The method for calculating the intersection of private sets in decentralized storage according to claim 6, characterized in that: Arbitrating the intermediate results includes: Based on the arbitration request, sending a random challenge to the server; receiving a proof fed back by the server based on the random challenge, where the proof is generated by the storage server according to its private key, the intermediate result and the random challenge; The intermediate result is subjected to arbitration verification according to the proof; if the arbitration verification passes, the storage server is determined to be an honest storage server, and if the data owner is determined to be a dishonest data owner, the resource service fee is settled to the honest storage server, and the time for paying the resource service fee to the dishonest data owner is locked; otherwise, the storage server is determined to be a dishonest storage server, and the dishonest storage server is punished.

8. A method for calculating the intersection of private sets in decentralized storage, characterized in that: include: Receive a query request for requesting data sharing records sent by a data owner, and a summary of the data sharing records fed back by the smart contract of the blockchain platform based on the query request; Generate an intermediate result based on the query request and the data sharing record summary; Sending the intermediate result to the data owner so that the data owner can verify the intermediate result based on the stored data sharing and the data sharing record summary; When sharing data and verifying intermediate results, this includes: Set data owner , Storage Server , No. Column properties ,surface and , server s's private key , hash function H; for each data owner implement ;initialization , ; Indicates the first List , Indicates the first List ; For each implement ,but ; ;Other fill random values; In the table Execute the permutation function on ; For each storage server Use its private key Generate Commitment ;in, Indicates the the column properties of the column, yes domain; Indicates the number of different column attribute domains; T and Defined as two hash tables generated based on different values ​​of column attributes; ; For storage on the server For each secret shared by and Indicates the data owner With table No. The polynomial of the Shamir secret share generated by the elements; Each data owner First create two files containing Table of elements: and ; Build table The purpose is to allow users to perform local verification; for column attributes Each value below (Right now ), each data owner uses the hash function H to Mapping to table In element, the value item is 1, indicating In element, the value item is 0, indicating The remaining elements are filled with random values; Use the hash function to build a separate chained hash table to avoid hash collisions; when the data owner builds the table And When performing the permutation, the Shamir secret sharing algorithm is applied to generate a secret share s for each storage server; and Each element in and Get the secret values ​​of Shamir's secret sharing algorithm; these values ​​are used together with the storage server s as input to the initialization algorithm to generate secret sharing for server s respectively and ; When the storage server receives a query request from the data owner, implement: The server calculates the first The sum of the data is returned to the data user. and Sent to the data owner, the data owner selects t random storage servers; Execute the permutation function F on it; then perform Lagrange interpolation: obtain the tables of all data owners respectively and Middle The sum of the value items (expressed as and ); To perform Lagrange interpolation, use the point (1, ),(2, ),...,(t, ) The function obtained is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; Similarly, using the point (1, ),(2, ),...,(n, ) performs Lagrange interpolation, and the obtained function is recorded as ; By setting x=0, we get the corresponding table Middle The sum of the value items ; During the lockout period, the user and Perform verifiable set computation.

9. The method for calculating the intersection of private sets in decentralized storage according to claim 8, characterized in that: Receive the resource service fee paid by the smart contract for passing the verification of the intermediate result.

10. The method for calculating the intersection of private sets in decentralized storage according to claim 8 or 9, characterized in that: Receiving a random challenge sent by the smart contract due to failure of verification of the intermediate result; Generate a certificate according to the intermediate result, the random challenge and the private key; Sending the proof to the smart contract so that the smart contract performs arbitration verification on the intermediate result based on the proof; Receiving a resource service fee paid by the smart contract for passing arbitration verification of the intermediate result; Alternatively, accept the penalty imposed by the smart contract for failing the arbitration verification of the intermediate result.

Images