A server-assisted multi-party privacy set merging method and system

Abstract

The present invention proposes a server-assisted multi-party private set merging method and system, which relates to the field of privacy protection technology and is used in scenarios with multiple participants who do not trust each other. Each participant holds a private set, and an auxiliary server without a private set is added. It is assumed that the auxiliary server does not collude with any participant, and a participant is pre-selected as the final result obtainer. The method includes five steps: generating a key and a private key, bucketing the elements in the private set and generating a bit string for each bucket, performing a bit string comparison test on each bucket to obtain the shared bits of each bucket, transmitting the encrypted set merging result, aggregating the encrypted set merging result, and decrypting the encrypted set merging result. In the server-assisted scenario, the present invention proposes an MPSU protocol with higher computational efficiency and higher communication efficiency, providing a feasible solution for realizing multi-party private set merging of large sets.

Description

Technical Field

[0001] The present invention belongs to the field of privacy protection technology, and in particular relates to a server-assisted multi-party privacy set merging method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Privacy set operations can complete specific set operations while ensuring the privacy of the input sets of all parties, and can provide a data circulation model where "data is available but invisible". It is a key cryptographic technology that currently takes into account both data circulation and privacy protection, and has become a powerful cryptographic tool to solve the current "data island" problem.

[0004] In the multi-party private set operations (MPSO) protocol, m (m>2) parties, each holding a private set, wish to perform secure computations on all sets without revealing any additional information to the other parties. The multi-party private set union (MPSU) protocol is a special case of MPSO, where the receiver (one of the participants) wishes to obtain the union of all sets.

[0005] MPSU is widely used in practice. For example, multiple internet companies can conduct network risk assessment and management by analyzing joint IP blacklists and joint vulnerability data. Or, if an institution needs to investigate residents' current housing purchase and rental needs, it can perform privacy set union operations on the data of different real estate agencies while ensuring the privacy of the real estate agencies' data.

[0006] Most existing MPSU protocols (e.g., KS05, Fri07, and VCE22) rely on superlinear public-key (PK) operations, such as additively homomorphic encryption (AHE), or (e.g., MA12) on generic secure multi-party computation, resulting in poor efficiency. Although two-party PSU protocols have made significant progress, achieving linear complexity, directly applying these techniques to MPSU constructions not only results in information leakage but also hinders scalability.

[0007] LG23 proposed the first scalable MPSU protocol that is applicable to large sets (i.e., privacy sets with large data volumes) based on symmetric-key (SK) operations and oblivious transfer (OT). Its efficiency is much higher than previous work, but its communication and computational efficiency are still unsatisfactory.

[0008] To address the issues of LG23, DCZB24 was proposed based on LG23. It includes two MPSU protocols, of which PK-MPSU is the MPSU protocol with the highest overall communication efficiency, and SK-MPSU is the MPSU protocol with the highest computational efficiency. DCZB24 improves on LG23 mainly by replacing the original multi-query secret-shared private membership test (mq-ssPMT) component with the more efficient batch secret sharing privacy membership test (batchssPMT). Although DCZB24 has good communication and computational efficiency, it assumes that the computing and communication resources of all participating parties are the same. In actual multi-device application scenarios (i.e., the types of participants are diverse, such as computers, mobile phones, and cloud servers), the resources between participants often vary greatly. Therefore, the party with the least resources will become the weak link in the operation of the entire protocol. Therefore, DCZB24 is not suitable for the privacy set merging scenario of multiple devices and large collections with unbalanced resources. Summary of the Invention

[0009] To overcome the shortcomings of the above-mentioned existing technologies, the present invention provides a server-assisted multi-party private set merging method and system. In the server-assisted scenario, an MPSU protocol with higher computational efficiency and higher communication efficiency than DCZB24's SK-MPSU is proposed, providing a feasible solution for realizing multi-party private set merging of multiple devices and large sets.

[0010] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0011] A first aspect of the present invention provides a server-assisted multi-party privacy set merging method.

[0012] A server-assisted multi-party privacy set merging method is used in scenarios with multiple participants who do not trust each other. Each participant holds a privacy set. An auxiliary server without a privacy set is added. It is assumed that the auxiliary server does not collude with any participant. A participant is pre-selected as the final result obtainer. The specific steps of the multi-party privacy set merging method are as follows:

[0013] Each participant generates its own key and sends it to the auxiliary server. The party that obtains the final result generates a private key and distributes it to other participants.

[0014] Each participant buckets the elements in the private set and generates a bit string for each bucket based on its own key. The bit string indicates whether the element in one participant's bucket is in the set of another participant.

[0015] The auxiliary server performs a bit string comparison test on each bucket with each participant to obtain the shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants;

[0016] Each participant encrypts the elements in the bucket with a private key and sends the encrypted set union result to the server using the oblivious transfer protocol based on the shared bits of each bucket.

[0017] The server aggregates and randomly sorts the encrypted set union results and sends them to the party obtaining the final result;

[0018] The party that obtains the final result uses the private key to decrypt the message of the result of the union of the sorted sets, and finally reconstructs the union of all sets.

[0019] Furthermore, the participants divide the elements in the privacy set into buckets, specifically:

[0020] The participants use hash functions h1, h2, and h3 to hash their own elements into the cuckoo hash table through cuckoo hashing, where the cuckoo hash table contains B buckets.

[0021] Furthermore, the bit string generated for each bucket based on its own key is specifically:

[0022] Calculate pseudo-random function values ​​for the elements in the bucket through batch oblivious pseudo-random functions;

[0023] Based on its own key, a random bit string is generated through a pseudo-random function, and an oblivious key value is generated for the XOR value of the pseudo-random function value and the bit string of the element, which is then encoded and sent to other participants;

[0024] Other participants perform an XOR operation on the pseudo-random function value of the elements in the bucket and the encoded oblivious key-value storage to generate a bit string.

[0025] Furthermore, the bit string comparison test is performed on each bucket to obtain the shared bits of each bucket, specifically:

[0026] Through the secret sharing privacy equivalence test, the adjacent shared bits are obtained by judging whether the elements in the bucket of the participant exist in the previous participant set;

[0027] Based on the adjacent shared bits, the multi-input AND gate protocol is called to check whether the elements in the bucket of the participant are in the set of all previous participants to obtain the final shared bits.

[0028] Furthermore, the encrypted set union result is sent to the server using the oblivious transfer protocol based on the shared bits of each bucket, specifically:

[0029] Between the server and the participants, based on the shared bits held by both parties, elements that are not in the sets of other participants are selected from the elements in the encrypted bucket, and the encrypted set union result is sent to the server.

[0030] Furthermore, the random sorting is to randomly sort the aggregated results by randomly selecting and replacing them.

[0031] Furthermore, the generation, encryption and decryption of the private key adopt a symmetric cryptographic scheme with indistinguishable multiple encryptions.

[0032] A second aspect of the present invention provides a server-assisted multi-party privacy set merging system.

[0033] A server-assisted multi-party private set merging system is used in scenarios with multiple participants who do not trust each other. Each participant holds a private set. An auxiliary server without a private set is added. It is assumed that the auxiliary server does not collude with any participant. A participant is pre-selected as the final result obtainer. The system includes the following modules:

[0034] The generation module is configured as follows: each participant generates its own key and sends it to the auxiliary server; the final result acquisition party generates a private key and distributes it to other participants;

[0035] The bucketing module is configured to: bucketize the elements in the private set by each participant and generate a bit string for each bucket based on its own key, wherein the bit string indicates whether the element in the bucket of one participant is in the set of another participant;

[0036] The comparison module is configured to: perform a bit string comparison test on each bucket with each participant separately by the auxiliary server to obtain a shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants;

[0037] The transmission module is configured to: each participant encrypts the elements in the bucket using a private key, and based on the shared bits of each bucket, sends the encrypted set union result to the server using the oblivious transfer protocol;

[0038] The aggregation module is configured to: the server aggregates and randomly sorts the encrypted set union results and sends them to the final result acquisition party;

[0039] The decryption module is configured to: the final result acquirer uses the private key to decrypt the message of the sorted set union result, and finally reconstruct the union of all sets.

[0040] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps in the server-assisted multi-party privacy set merging method as described in the first aspect of the present invention.

[0041] The fourth aspect of the present invention provides an electronic device, comprising a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of a server-assisted multi-party privacy set merging method as described in the first aspect of the present invention are implemented.

[0042] One or more of the above technical solutions have the following beneficial effects:

[0043] The present invention introduces a high-performance external server that has neither its own privacy set nor the ability to obtain output. It is assumed that it does not collude with other parties and undertakes the main computing and communication tasks, solving the shortcomings caused by the imbalance of multi-device resources in the scenario of merging multi-party privacy sets.

[0044] The present invention flexibly applies the efficient batch ssPMT component in DCZB24, replacing the randomly selected value in one step with a value generated by a pseudo-random function. Furthermore, the present invention replaces the superlinear multi-party random oblivious transfer (mss-ROT) in DCZB24's SK-MPSU through efficient SK operations (implemented by AES) combined with oblivious transfer (OT). This reduces the protocol's reliance on universal secure two-party computation (2PC) and significantly reduces computational and communication complexity.

[0045] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0047] Figure 1 This is a flow chart of the method of the first embodiment. DETAILED DESCRIPTION

[0048] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0049] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0050] The most efficient multi-party private set union (MPSU) protocol currently assumes that all participating parties have equal computing and communication resources. However, in real-world multi-device scenarios, the resources of the participating parties often vary greatly, so the party with the least resources becomes the bottleneck of the entire protocol. To better adapt to multi-device applications, this paper proposes an efficient server-aided MPSU protocol:

[0051] Specifically, a high-performance external server, with no input of its own and no output, assumes no collusion with other parties and performs the primary computation and communication tasks. The input here refers to the server having no private set of its own and relying solely on data from other parties for computation. By utilizing the batch secret-shared private membership test (batch ssPMT) protocol, a core component of the currently most efficient MPSU protocol, combined with efficient symmetric-key (SK) operations and oblivious transfer (OT), the MPSU protocol of the present invention significantly reduces its reliance on general secure two-party computation (2PC) and significantly improves computation and communication efficiency. Specifically, all parties (except the server) can achieve linear computation and communication complexity. Therefore, in scenarios assisted by an efficient outsourced server, the protocol of the present invention achieves current state-of-the-art operational efficiency and reduced communication overhead, providing a feasible approach for multi-party private set unions of large sets.

[0052] Example 1

[0053] In one embodiment of the present disclosure, a server-assisted multi-party privacy set merging method is provided for a scenario in which multiple participants do not trust each other. Each participant holds a privacy set, an auxiliary server without a privacy set is added, and it is assumed that the auxiliary server does not collude with any participant. A participant is pre-selected as the final result obtainer.

[0054] The above method proposes an MPSU protocol with higher computational efficiency and communication efficiency than DCZB24's SK-MPSU in a server-assisted scenario, providing a feasible solution for realizing multi-party privacy set union on multiple devices and large collections.

[0055] Specifically, the efficient batch ssPMT component in DCZB24 is flexibly applied, and the value that originally needed to be randomly selected in one step is replaced by a pseudo-random function. In addition, the efficient SK operation (implemented by AES) is combined with oblivious transfer (OT) to replace the superlinear multi-party random oblivious transfer (mss-ROT) in DCZB24's SK-MPSU, reducing the protocol's dependence on general secure two-party computation (2PC) and significantly reducing the complexity of computation and communication.

[0056] In addition, considering the actual application scenarios, there are differences in the computing power and network bandwidth of the participants. For example, some are equipped with dedicated cloud servers, some are equipped with personal computers, and some only have portable devices (such as mobile phones). Therefore, when the MPSU protocol, which assumes that all parties have the same computing and communication resources, is jointly executed between different devices, the weakest device will become the short board in the "barrel" theory. Therefore, this embodiment sets the entire protocol in a scenario where the computing power and communication resources of the participants are different, that is, the protocol has a high-performance server-aided party P1 (that is, P1 undertakes the main computing tasks and communication overhead, and P1 has neither input nor output). Under the assumption that any participant does not collude with P1, the protocol can be applied to a variety of devices with higher performance.

[0057] The following is a detailed description of the newly proposed MPSU protocol:

[0058] 1. Symbol definition.

[0059] For any positive integer n, the symbol [n] represents the set {1,…,n};

[0060] The symbol || means concatenating two strings into one string;

[0061] use to represent Cuckoo Hashing. Specifically, this expression means using hash functions h1, h2, h3: {0, 1} * → [B] Cuckoo hash the set X into B buckets where for each x ∈ X, there exists some i ∈ {1, 2, 3} such that If the i-th bucket is empty, then set

[0062] II. Parameters.

[0063] m parties P1,..., P m , specify P1 as the auxiliary server, with no input (so m > 3 here); the input set sizes n of the other parties, the bit lengths l of the elements in the set, P rcv is the final result acquirer (1 < rcv ≤ m).

[0064] Cuckoo hash functions h1, h2, h3 and the number B of buckets to hash into.

[0065] An oblivious key-value store (OKVS) scheme (Encode, Decode).

[0066] A symmetric cryptoscheme ε = (Gen, Enc, Dec) with indistinguishable multi - encryption.[[ID=2C]]

[0067] A pseudorandom function G: {0, 1} l × {0, 1} log m+log n → {0, 1} γ (implemented by AES), and γ is its output length.[[ID=C]]

[0068] III. Input.

[0069] For 2 ≤ i ≤ m, each party Pi has input

[0070] IV. Protocol execution process.

[0071] As Figure 1 shown, it includes six steps:

[0072] Step S1: Each party generates its own key and sends it to the auxiliary server, and the final result acquirer generates a private key and distributes it to the other parties;

[0073] Furthermore, the generation, encryption and decryption of the private key adopt a symmetric cryptoscheme with indistinguishable multi - encryption.

[0074] Specifically, for 2 ≤ i < m, each party P i randomly generates a key ki ' and send it to P1;

[0075] For 2≤i≤m, P rcv The Gen(1 λ ) to generate a private key sk and send it to Pi.

[0076] Step S2: Each participant divides the elements in the private set into buckets and generates a bit string for each bucket based on its own key. The bit string indicates whether the element in a bucket of one participant is in the set of another participant.

[0077] Furthermore, the participants divide the elements in the privacy set into buckets, specifically:

[0078] The participants use hash functions h1, h2, and h3 to hash their own elements into the cuckoo hash table through cuckoo hashing, where the cuckoo hash table contains B buckets.

[0079] Furthermore, the bit string generated for each bucket based on its own key is specifically:

[0080] Calculate pseudo-random function values ​​for the elements in the bucket through batch oblivious pseudo-random functions;

[0081] Based on its own key, a random bit string is generated through a pseudo-random function, and an oblivious key value is generated for the XOR value of the pseudo-random function value and the bit string of the element, which is then encoded and sent to other participants;

[0082] Other participants perform an XOR operation on the pseudo-random function value of the elements in the bucket and the encoded oblivious key-value storage to generate a bit string.

[0083] Specifically, PSTY1 9 is used to generate the bit string, for 2≤i<j≤m, 1≤y≤B:

[0084] (a)P j calculate

[0085] P i and P j Call the batch oblivious pseudorandom function (batch OPRF) protocol, where P i As the sender, P j As the receiver, enter C j ;P i take over P j take over For each element x∈X j , let x pass the hash function h zis hashed to the yth bucket, z∈{1, 2, 3}, then

[0086] (b) For each bucket y, P i According to the generated key k i ' to calculate the random bit string And calculate the set Then P i Calculating OKVS D i,j =Encode(A i，j ) and send D i，j Give P j .

[0087] (c)P j Calculating bit strings in

[0088] Step S3: The auxiliary server performs a bit string comparison test on each bucket with each participant to obtain the shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants;

[0089] Furthermore, the bit string comparison test is performed on each bucket to obtain the shared bits of each bucket, specifically:

[0090] (1) Through the secret sharing privacy equivalence test, the participant's element in the bucket is judged whether it exists in the previous participant set, and the adjacent shared bits are obtained;

[0091] Specifically, the secret-shared private equality test (ssPEQT) is used to calculate adjacent shared bits. For 2≤i <j≤m,1≤y≤B:

[0092] (a) P1 and P j Call ssPEQT, where P1 input take over P j enter take over

[0093] (b) If j = 3, P1 is set P3 Settings Otherwise P1 is set P j set up

[0094] (2) Based on the adjacent shared bits, the multi-input AND gate protocol is called to determine whether the element in the bucket of the participant is in the set of all previous participants, and obtain the final shared bits.

[0095] Specifically, a multi-fan-in AND gate circuit is used to calculate the final shared bits. <j≤m,1≤y≤B:

[0096] P1 and P j Call the (j-2)-bit multi-input AND gate protocol, where P1 input take over P j enter take over

[0097] Among them, the function of k-bit Multi-fan-in AND gates is: two participants P1 and P2 hold k-bit input a1,...,a m and b1, ..., b m , after the protocol ends, both parties obtain 1-bit random output a and b respectively, satisfying

[0098] Step S4: Each participant encrypts the elements in the bucket using a private key, and based on the shared bits of each bucket, uses the oblivious transfer protocol to send the encrypted set union result to the server;

[0099] Furthermore, the encrypted set union result is sent to the server using the oblivious transfer protocol based on the shared bits of each bucket, specifically:

[0100] Between the server and the participants, based on the shared bits held by both parties, elements that are not in the sets of other participants are selected from the elements in the encrypted bucket, and the encrypted set union result is sent to the server.

[0101] Specifically, the sending and inadvertent transmission of encrypted elements, Represents participant P j In the bucket Elements in , for 2≤j≤m, 1≤y≤B:

[0102] (a) For j = 2:

[0103] P2 calculation And send it to P1. P1 receives And set

[0104] (b) For 3≤j≤m:

[0105] P1 and P j Call the 0T protocol, where P1 is the receiver, and input P j As the sender, enter

[0106] P1 Receive

[0107] Step S5: The server aggregates and randomly sorts the encrypted set union results and sends them to the party obtaining the final result;

[0108] Furthermore, the random sorting is to randomly sort the aggregated results by randomly selecting and replacing them.

[0109] Specifically, for 2≤j≤m, 1≤y≤B:

[0110] P1 defines the vector and calculate

[0111] P1 randomly selects a permutation π: [(m-1)B] → [(m-1)B] and calculates the vector

[0112] P1 sends Give P rcv .

[0113] Step S6: The party obtaining the final result uses the private key to decrypt the message of the result of the sorted set union, and finally reconstructs the union of all sets.

[0114] Specifically, P rcv set up

[0115] For 1≤i≤(m-1)B, if Dec(sk,v i ′)≠⊥, it updates Y=Y∪{v i ′}.

[0116] P rcv Output Y.

[0117] 5. Complexity analysis.

[0118] The computational complexity of the online phase of P1 is O(γm 2 n), the communication complexity is O(γm 2 n+lmn); for 2≤j≤m and j≠recv, P j The computational complexity of the online phase is O(γmn), and the communication complexity is O(γmn+ln); P rcvThe computational complexity of the online phase is O(γmn), the communication complexity is O((r+l)mn), and the round complexity is O(logγ+logm).

[0119] It can be seen that party P1 undertakes the main computing and communication tasks, and other parties can achieve linear computing and communication complexity. Under the assumption that party P1 does not collude with others, there will be no additional information leakage.

[0120] Therefore, in the scenario with the assistance of efficient outsourced servers, our protocol can achieve the best specific operating efficiency and lower communication overhead, providing a feasible method for realizing multi-party privacy set union of large sets.

[0121] Example 2

[0122] In one embodiment of the present disclosure, a server-assisted multi-party privacy set merging system is provided. The system is used in scenarios where multiple participants do not trust each other. Each participant holds a privacy set. An auxiliary server without a privacy set is added. It is assumed that the auxiliary server does not collude with any participant. A participant is pre-selected as the final result obtainer. The system includes the following modules:

[0123] The generation module is configured as follows: each participant generates its own key and sends it to the auxiliary server; the final result acquisition party generates a private key and distributes it to other participants;

[0124] The bucketing module is configured to: bucketize the elements in the private set by each participant and generate a bit string for each bucket based on its own key, wherein the bit string indicates whether the element in the bucket of one participant is in the set of another participant;

[0125] The comparison module is configured to: perform a bit string comparison test on each bucket with each participant separately by the auxiliary server to obtain a shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants;

[0126] The transmission module is configured to: each participant encrypts the elements in the bucket using a private key, and based on the shared bits of each bucket, sends the encrypted set union result to the server using the oblivious transfer protocol;

[0127] The aggregation module is configured to: the server aggregates and randomly sorts the encrypted set union results and sends them to the final result acquisition party;

[0128] The decryption module is configured to: the final result acquirer uses the private key to decrypt the message of the sorted set union result, and finally reconstruct the union of all sets.

[0129] Example 3

[0130] The purpose of this embodiment is to provide a computer-readable storage medium.

[0131] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a server-assisted multi-party privacy set merging method as described in the first embodiment of the present disclosure.

[0132] Example 4

[0133] The purpose of this embodiment is to provide an electronic device.

[0134] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of a server-assisted multi-party privacy set merging method as described in the first embodiment of the present disclosure are implemented.

[0135] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A server-assisted multi-party privacy set merging method, characterized in that: This method is used for scenarios with multiple participants who do not trust each other. Each participant holds a privacy set. An auxiliary server without a privacy set is added. Assuming that the auxiliary server does not collude with any participant, a participant is pre-selected as the final result obtainer. The specific steps of the multi-party privacy set union method are as follows: Each participant generates its own key and sends it to the auxiliary server. The party that obtains the final result generates a private key and distributes it to other participants. Each participant buckets the elements in the private set and generates a bit string for each bucket based on its own key. The bit string indicates whether the element in one participant's bucket is in the set of another participant. The auxiliary server performs a bit string comparison test on each bucket with each participant to obtain the shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants; Each participant encrypts the elements in the bucket with a private key and sends the encrypted set union result to the server using the oblivious transfer protocol based on the shared bits of each bucket. The server aggregates and randomly sorts the encrypted set union results and sends them to the party obtaining the final result; The party that obtains the final result uses the private key to decrypt the message of the result of the union of the sorted sets, and finally reconstructs the union of all sets.

2. The server-assisted multi-party privacy set merging method according to claim 1, characterized in that: The participants divide the elements in the privacy set into buckets, specifically: The participants use hash functions h1, h2, and h3 to hash their own elements into the cuckoo hash table through cuckoo hashing, where the cuckoo hash table contains B buckets.

3. The server-assisted multi-party privacy set merging method according to claim 1, wherein: The bit string generated for each bucket based on its own key is specifically: Calculate pseudo-random function values ​​for the elements in the bucket through batch oblivious pseudo-random functions; Based on its own key, a random bit string is generated through a pseudo-random function, and an oblivious key value is generated for the XOR value of the pseudo-random function value and the bit string of the element, which is then encoded and sent to other participants; Other participants perform an XOR operation on the pseudo-random function value of the elements in the bucket and the encoded oblivious key-value storage to generate a bit string.

4. The server-assisted multi-party privacy set merging method according to claim 1, wherein: The bit string comparison test is performed on each bucket to obtain the shared bits of each bucket, specifically: Through the secret sharing privacy equivalence test, the adjacent shared bits are obtained by judging whether the elements in the bucket of the participant exist in the previous participant set; Based on the adjacent shared bits, the multi-input AND gate protocol is called to check whether the elements in the bucket of the participant are in the set of all previous participants to obtain the final shared bits.

5. The server-assisted multi-party privacy set merging method according to claim 1, wherein: The encrypted set union result is sent to the server using the oblivious transfer protocol based on the shared bits of each bucket, specifically: Between the server and the participants, based on the shared bits held by both parties, elements that are not in the sets of other participants are selected from the elements in the encrypted bucket, and the encrypted set union result is sent to the server.

6. The server-assisted multi-party privacy set merging method according to claim 1, wherein: The random sorting is to randomly sort the aggregated results by randomly selecting and replacing them.

7. The server-assisted multi-party privacy set merging method according to claim 1, wherein: The generation, encryption and decryption of the private key adopt a symmetric cryptographic scheme with indistinguishable multiple encryptions.

8. A server-assisted multi-party privacy set merging system, characterized in that: It is used in scenarios with multiple participants who do not trust each other. Each participant holds a privacy set. An auxiliary server without a privacy set is added. It is assumed that the auxiliary server does not collude with any participant. A participant is pre-selected as the final result obtainer. It includes the following modules: The generation module is configured as follows: each participant generates its own key and sends it to the auxiliary server; the final result acquisition party generates a private key and distributes it to other participants; The bucketing module is configured to: bucketize the elements in the private set by each participant and generate a bit string for each bucket based on its own key, wherein the bit string indicates whether the element in the bucket of one participant is in the set of another participant; The comparison module is configured to: perform a bit string comparison test on each bucket with each participant separately by the auxiliary server to obtain a shared bit of each bucket, which is used to indicate whether the element in the bucket of the participant is in the set of all previous participants; The transmission module is configured to: each participant encrypts the elements in the bucket using a private key, and based on the shared bits of each bucket, sends the encrypted set union result to the server using the oblivious transfer protocol; The aggregation module is configured to: the server aggregates and randomly sorts the encrypted set union results and sends them to the final result acquisition party; The decryption module is configured to: the final result acquirer uses the private key to decrypt the message of the sorted set union result, and finally reconstruct the union of all sets.

9. An electronic device, comprising: a memory for non-transitory storage of computer-readable instructions; a processor for executing the computer-readable instructions; When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is executed.

10. A storage medium, characterized in that: The method comprises non-transitory storage of computer-readable instructions, wherein when the computer-readable instructions are executed by a computer, the method according to any one of claims 1 to 7 is performed.

Images