APSI parameter selection method and device, electronic equipment and storage medium

Abstract

The invention relates to an APSI parameter selection method and apparatus, an electronic device and a storage medium. The method comprises the steps of obtaining a sender set size of a data set of a data sender and a receiver set size of a data set of a data receiver; according to a plurality of preset ring dimension values of ring dimensions in the APSI parameters required by the APSI protocol, the size of a sender set and the size of a receiver set, parameter values of other parameters in the APSI parameters under each ring dimension value are determined, and one ring dimension value and the parameter values of other parameters under the ring dimension value form a group of APSI parameter values; according to the multiple groups of APSI parameter values, predicting calculation overhead and / or communication overhead generated by each group of APSI parameter values when the APSI protocol is realized; and selecting a target APSI parameter value from the multiple groups of APSI parameter values according to calculation overhead and / or communication overhead generated by each group of APSI parameter values. According to the embodiment of the invention, the parameter values of the APSI parameters can be effectively and automatically selected, and the parameter selection efficiency, precision and flexibility are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an APSI parameter selection method, device, electronic device and storage medium. Background Art

[0002] The asymmetric private set intersection (APSI) protocol is a two-party privacy computing protocol proposed in the "Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication" of CCS2021. The two communicating parties in the APSI protocol are divided into a sender and a receiver. Each party has a data set, and the sender's set size is much larger than the receiver's set size. The goal of the APSI protocol is to allow the receiver to obtain the intersection of the two sets. The sender sends the set intersection to the receiver, and the receiver cannot obtain any information about other elements in the sender's set. The sender cannot obtain any information about the receiver's set. For example, in a common friend recommendation scenario, when a user registers an application on the terminal, the server of the application can perform a private set intersection based on the contact information in the user's terminal address book and the registered user information held by the server itself, so as to obtain the contacts of the registered application in the user's terminal address book, and then complete the friend recommendation function. In this case, the server acts as the sender in the APSI protocol, and the user terminal acts as the receiver in the APSI protocol.

[0003] Among them, the APSI protocol can be an APSI protocol based on a fully homomorphic encryption scheme, for example, it can be an APSI protocol based on a BFV encryption scheme. The BFV encryption scheme is a fully homomorphic encryption scheme based on RLWE (Ring-Learning With Errors). Its operating efficiency and security are closely related to the parameter selection of RLWE. The APSI parameters required for the APSI protocol based on the BFV scheme include at least the ring dimension (that is, the degree of the modular polynomial), the plaintext modulus, the ciphertext modulus and the constituent prime numbers of the ciphertext modulus (that is, the ciphertext modulus is decomposed into a series of different prime numbers based on CRT (Chinese Remainder Theorem), and the modulus of each prime number is 2n and the remainder is 1), the plaintext modulus and the SIMD (Single Instruction Multiple Data) decomposition of the plaintext space, wherein SIMD decomposition means that the plaintext polynomial is isomorphic to a finite field vector, and homomorphic operations on a single plaintext polynomial can perform homomorphic operations on the entire vector, thereby improving computational efficiency. In addition, the APSI protocol itself also has general APSI parameters that can be adjusted, such as the hash table size, the maximum number of elements in each bucket of the hash table, the number of hash functions, and the Paterson-Stockmeyer parameters.

[0004] The selection of the above APSI parameters is closely related to the correctness of the operation of the APSI protocol and the computational efficiency and communication efficiency. Although the developers of the current APSI protocol have provided a preset parameter library suitable for different sender set sizes and receiver set sizes, the parameter values ​​set in the preset parameter library are too rough, and the difference in the set sizes applicable to two adjacent sets of parameters is too large, making it difficult to obtain the optimal computational cost and communication cost in complex and changeable practical applications, and the flexibility is poor.

[0005] At the same time, the APSI parameters in the above-mentioned APSI protocol are highly coupled, and a single parameter may affect the security, correctness and operating efficiency of the APSI protocol implementation at the same time. In addition, the existing method of manually selecting the parameter values ​​of APSI parameters is relatively cumbersome and requires certain professional knowledge, which makes the selection of APSI parameters difficult, inefficient, low in precision, and poor in flexibility. Summary of the invention

[0006] In view of this, the present disclosure proposes an APSI parameter selection method, device, electronic device and storage medium, which can realize automatic selection of parameter values ​​of APSI parameters, improve the efficiency, accuracy and flexibility of parameter selection, and meet the requirements of computing overhead and communication overhead in various application scenarios.

[0007] According to one aspect of the present disclosure, an APSI parameter selection method is provided, characterized in that it includes: obtaining a sender set size of a data set of a data sender and a receiver set size of a data set of a data receiver, wherein the data sender and the data receiver use an APSI protocol based on fully homomorphic encryption to implement privacy set intersection; according to a plurality of ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, determining parameter values ​​of other parameters in the APSI parameters under each ring dimension value, wherein a ring dimension value is correlated with other parameters under the ring dimension value. The parameter values ​​of the number constitute a group of APSI parameter values, the other parameters include parameters of the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in the identical encryption; according to the multiple groups of APSI parameter values, predict the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol; according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, select a target APSI parameter value from the multiple groups of APSI parameter values, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0008] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, prime numbers constituting the ciphertext modulus, the number of finite field elements required for a single set element in a data set, the number of hash functions, the size of the hash table, the maximum number of elements in each bucket in the hash table, and pre-calculation parameters.

[0009] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, including: determining the plaintext modulus value of the plaintext modulus at each ring dimension value and the ciphertext modulus value of the ciphertext modulus at each ring dimension value according to each ring dimension value; determining the finite field element value of the number of finite field elements at each ring dimension value according to the plaintext modulus value at each ring dimension value; determining the multiple prime values ​​of the constituent prime numbers of the ciphertext modulus at each ring dimension value according to each ring dimension value and the ciphertext modulus value at each ring dimension value; determining the hash table value of the hash table size at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension according to the sender set size, the receiver set size, the hash function value preset by the hash function number, and the finite field element value at each ring dimension.

[0010] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, and also include: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension according to each ring dimension, the plaintext modulus value at each ring dimension, and the ciphertext modulus value at each ring dimension; determining the pre-calculated parameter values ​​of the pre-calculated parameters according to the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension.

[0011] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the single computational overhead corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values; predicting the total number of computations corresponding to each group of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; and determining the computational overhead corresponding to each group of APSI parameter values ​​based on the total number of computations and the single computational overhead corresponding to each group of APSI parameter values.

[0012] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values, the ciphertext data including the ciphertext and public key transmitted from the data receiving direction to the data sending direction; predicting the total number of ciphertext data corresponding to each group of APSI parameter values ​​based on the pre-calculated parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; determining the communication overhead corresponding to each group of APSI parameter values ​​based on the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0013] In a possible implementation, the multiple ring dimension values ​​include 2 10 to 2 15 ; The pre-calculated parameters include Paterson-Stockmeyer parameters.

[0014] According to another aspect of the present disclosure, an APSI parameter selection device is provided, comprising: an acquisition module, used to acquire the sender set size of the data set of the data sender and the receiver set size of the data set of the data receiver, wherein the data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to implement privacy set intersection; a parameter determination module, used to determine the parameter values ​​of other parameters in the APSI parameters under each ring dimension value according to a plurality of ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, wherein a ring dimension value is related to the values ​​of other parameters under the ring dimension value. The parameter values ​​constitute a group of APSI parameter values, and the other parameters include parameters in the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in the identical encryption; an overhead determination module is used to predict the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol according to the multiple groups of APSI parameter values; a selection module is used to select a target APSI parameter value from the multiple groups of APSI parameter values ​​according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0015] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, prime numbers constituting the ciphertext modulus, the number of finite field elements required for a single set element in a data set, the number of hash functions, the size of the hash table, the maximum number of elements in each bucket in the hash table, and pre-calculation parameters.

[0016] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, including: determining the plaintext modulus value of the plaintext modulus at each ring dimension value and the ciphertext modulus value of the ciphertext modulus at each ring dimension value according to each ring dimension value; determining the finite field element value of the number of finite field elements at each ring dimension value according to the plaintext modulus value at each ring dimension value; determining the multiple prime values ​​of the constituent prime numbers of the ciphertext modulus at each ring dimension value according to each ring dimension value and the ciphertext modulus value at each ring dimension value; determining the hash table value of the hash table size at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension according to the sender set size, the receiver set size, the hash function value preset by the hash function number, and the finite field element value at each ring dimension.

[0017] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, and also include: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension according to each ring dimension, the plaintext modulus value at each ring dimension, and the ciphertext modulus value at each ring dimension; determining the pre-calculated parameter values ​​of the pre-calculated parameters according to the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension.

[0018] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the single computational overhead corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values; predicting the total number of computations corresponding to each group of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; and determining the computational overhead corresponding to each group of APSI parameter values ​​based on the total number of computations and the single computational overhead corresponding to each group of APSI parameter values.

[0019] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values, the ciphertext data including the ciphertext and public key transmitted from the data receiving direction to the data sending direction; predicting the total number of ciphertext data corresponding to each group of APSI parameter values ​​based on the pre-calculated parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; determining the communication overhead corresponding to each group of APSI parameter values ​​based on the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0020] In a possible implementation, the multiple ring dimension values ​​include 2 10 to 2 15 ; The pre-calculated parameters include Paterson-Stockmeyer parameters.

[0021] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0022] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0023] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0024] According to the embodiments of the present disclosure, multiple groups of APSI parameter values ​​are determined based on the sender set size and the receiver set size, and the computing overhead and / or communication overhead generated by each group of APSI parameter values ​​are predicted. Then, based on the computing overhead and / or communication overhead generated by each group of APSI parameter values, automatic selection of preferred target APSI parameter values ​​suitable for data receivers and data senders in the APSI protocol is achieved. Compared with manual selection of APSI parameter values, parameter value selection has high efficiency, high accuracy, high flexibility, does not require reliance on professional knowledge, is more convenient, and can also meet the preference requirements for computing overhead and communication overhead in various application scenarios.

[0025] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0027] FIG. 1( a ) and FIG. 1( b ) are schematic diagrams showing an application scenario according to an embodiment of the present disclosure.

[0028] FIG. 2( a ) and FIG. 2( b ) are schematic diagrams showing another application scenario according to an embodiment of the present disclosure.

[0029] Figure 3 A flow chart of an APSI parameter selection method according to an embodiment of the present disclosure is shown.

[0030] Figure 4 A block diagram of an APSI parameter selection device according to an embodiment of the present disclosure is shown.

[0031] Figure 5 A block diagram of an electronic device 1900 according to an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0033] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0034] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0035] In order to better understand the solutions of the embodiments of the present application, the following is a brief introduction to the relevant terms and concepts that may be involved in the embodiments of the present application.

[0036] 1) The ring dimension n, that is, the degree of the modular polynomial, is a power of 2, usually n is 2 10 to 2 15 (i.e., 2 10 , 211 , 2 12 , 2 13 , 2 14 , 2 15 ), the ring dimension can affect the security of the ciphertext data after fully homomorphic encryption. If other parameters remain unchanged, the larger the ring dimension, the more secure the data. Among them, the modulus polynomial degree can be understood as the modulus of the polynomial degree in fully homomorphic encryption.

[0037] 2) The plaintext modulus p is a prime number and satisfies p modulo 2n remainder 1. p corresponds to the eigenvalue of each finite field element in the finite field vector after the plaintext polynomial isomorphic to the fully homomorphic encryption. Among them, p modulo 2n remainder 1 is used to make the expansion times of each finite field after isomorphism to 1, so as to make the length of the finite field vector after isomorphism the longest.

[0038] 3) The ciphertext modulus Q is the product of a series of different prime numbers, that is, Q = Q1*Q2*…*Qk, where Q1, Q2, …, Qk are k different prime numbers. The operation modulo Q can be decomposed into operations modulo each prime number using CRT (Chinese Remainder Theorem). At the same time, in order to use the Number Theoretic Transform (NTT) to accelerate polynomial multiplication, the remainder of each prime number modulo 2n is required to be 1. In APSI, Q consists of at least two prime numbers, usually 2 to 8 prime numbers (that is, k is 2 to 8), and the size of a single prime number can reach 60 bits. The noise budget is linearly related to the total bits of these prime numbers. The ciphertext modulus also affects the security of encryption: if other parameters remain unchanged, the larger the total bits of the ciphertext modulus, the lower the security.

[0039] 4) The number of finite field elements required for a single set element, which represents how many finite field elements are used to represent each set element. For example, assuming that a ciphertext (equivalent to a set) can accommodate 100 finite field elements, a piece of information in the ciphertext (equivalent to an element in a set) is represented by 4 finite field elements.

[0040] 5) The number of hash functions, that is, the number of hash functions used in the APSI protocol. Hash functions can be used to achieve compression mapping of plaintext data.

[0041] 6) Hash table size, that is, the size of the hash table used in the APSI protocol, can represent the number of buckets in the hash table. The hash function can be used to insert plaintext data into the hash table.

[0042] 7) The maximum number of elements in each bucket in the hash table. A single hash table can include multiple buckets, which is equivalent to "multiple tables". The maximum number of elements in each bucket is the amount of data that can be placed in each bucket in the hash table.

[0043] 8) Pre-calculation parameters, also known as Paterson-Stockmeyer parameters, are used to determine the size of the pre-calculated ciphertext group. The pre-calculated ciphertext group consists of multiple ciphertexts, which need to be generated by the receiver (such as the client, the holder of the private key of homomorphic encryption) and sent to the sender (such as the server) before the start of the APSI protocol. The function is to reduce the computational overhead of the sender and the maximum number of homomorphic multiplication layers required for the entire APSI protocol. The more ciphertexts in the pre-calculated ciphertext group, the smaller the computational overhead of the sender and the maximum number of multiplication layers of the protocol, but at the cost of higher communication volume.

[0044] Exemplarily, FIG. 1(a) and FIG. 1(b) show schematic diagrams of an application scenario according to an embodiment of the present disclosure. As shown in FIG. 1(a), the commodity operator holds a completed transaction user information set A consisting of user information of completed commodity transactions, and the advertisement delivery party holds a viewed advertisement user information set B consisting of user information of users who have viewed advertisements. Generally speaking, the viewed advertisement user information set B is larger than the set size of the completed transaction user information set A. At this time, the advertisement delivery party may be the sender in the APSI protocol, and the commodity operator may be the receiver in the APSI protocol. In order to calculate which users who viewed the advertisements ultimately purchased the corresponding commodities, that is, to calculate the real conversion rate of the advertisements; the commodity operator and the advertisement delivery party may use the APSI protocol to perform a privacy set intersection on the viewed advertisement user information set B and the completed transaction user information set A to obtain the intersection of the two sets. Specifically, the commodity operator may store the homomorphic ciphertext data ( The advertisement sender can perform a privacy set intersection based on the ciphertext data of the viewed advertisement user information set and the completed transaction user information set B held by itself to obtain the intersection of the two sets and send the set intersection to the commodity operator, and then the commodity operator can calculate the real conversion rate of the advertisement based on the set intersection; and in order to implement the APSI protocol between the commodity operator and the advertisement sender, it is necessary to determine the parameter values ​​of the APSI parameters used in the APSI protocol. At this time, the set size of the above-mentioned viewed advertisement user information set B and the set size of the completed transaction user information set A can be input into the APSI parameter selection system 100 of Figure 1 (b). The APSI parameter selection system 100 can adopt the APSI parameter selection method of the embodiment of the present disclosure to realize automatic and efficient determination of the target APSI parameter value required to implement the APSI protocol. The commodity operator and the advertisement sender can directly implement the APSI protocol based on the target APSI parameter value.

[0045] Exemplarily, Figures 2(a) and 2(b) show schematic diagrams of another application scenario of an embodiment of the present disclosure. As shown in Figure 2(a), a client of an application that has been installed and registered in a user's mobile phone can obtain the user's contact information (such as mobile phone number) from the address book to form a contact information set C if the address book viewing permission has been authorized. The server of the application can hold a registered user information set D consisting of all registered user information of the application. Generally speaking, the registered user information set D is larger than the contact information set C. At this time, the server is the sender in the APSI protocol, and the client is the receiver in the APSI protocol. In order to find the contact information registered for the application from the user's contact information, that is, without revealing the current user's contact information and the registered user information of the server, find the intersection of the two sets to implement the friend recommendation function in the application, the client and the server can use the APSI protocol to compare the contact information set C with the registered user information. The registered user information set D performs privacy set intersection to obtain the intersection of the two sets. Specifically, the client can send the homomorphic ciphertext data of the contact information set to the server. The server performs privacy set intersection based on the homomorphic ciphertext data and the registered user information set it holds to obtain the intersection of the two sets and return it to the client. The client can implement the friend recommendation function based on the set intersection. In order to implement the APSI protocol between the client and the server, it is necessary to determine the parameter values ​​of the APSI parameters used in the APSI protocol. At this time, the set size of the above-mentioned contact information set C and the set size of the registered user information set D can be input into the APSI parameter selection system 100 of Figure 2 (b). The APSI parameter selection system 100 can adopt the APSI parameter selection method of the embodiment of the present disclosure to realize automatic and efficient determination of the target APSI parameter value required to implement the APSI protocol, wherein the client and the server can implement the APSI protocol based on the target APSI parameter value.

[0046] It should be understood that the above calculation of the real conversion rate of advertisements and the realization of the friend recommendation function are exemplary application scenarios provided by the embodiments of the present disclosure. In fact, as long as the application scenario uses the APSI protocol based on fully homomorphic encryption to perform privacy set intersection, the APSI parameter selection method of the embodiments of the present disclosure can be used to determine the parameter values ​​of the APSI parameters used in the APSI protocol. Through the APSI parameter selection method of the embodiments of the present disclosure, the selection efficiency, accuracy and flexibility of the APSI parameter values ​​can be improved, and APSI parameter values ​​with better computing overhead and / or communication overhead can be selected to meet the requirements for computing overhead and / or communication overhead in various application scenarios.

[0047] The APSI parameter selection method of the disclosed embodiment can be deployed on various terminal devices through software or hardware modification. The terminal device involved in this application can refer to a device with a wireless connection function. The wireless connection function refers to the ability to connect to other terminal devices through wireless connection methods such as wifi and Bluetooth. The terminal device of this application can also have the function of communicating through a wired connection. The terminal device of this application can be a touch screen, a non-touch screen, or a screenless device. The touch screen can control the terminal device by clicking and sliding on the display screen with a finger or a stylus. The non-touch screen device can be connected to an input device such as a mouse, keyboard, touch panel, etc., and the terminal device can be controlled by the input device. The device without a screen can be, for example, a Bluetooth speaker without a screen. For example, the terminal device of this application can be a smart phone, a netbook, a tablet computer, a laptop computer, a wearable electronic device (such as a smart bracelet, a smart watch, etc.), a TV, a virtual reality device, a stereo, an electronic ink, and the like.

[0048] The APSI parameter selection method of the disclosed embodiment can also be deployed on a server, which can be located in the cloud or locally, and can be a physical device or a virtual device, such as a virtual machine, a container, etc., and has a wireless communication function, wherein the wireless communication function can be set in the chip (system) or other parts or components of the server. It can refer to a device with a wireless connection function, and the wireless connection function refers to the ability to connect to other servers or terminal devices through wireless connection methods such as Wi-Fi and Bluetooth. The server of the present application can also have the function of communicating through a wired connection. For example, the server of the present application can be located in the cloud, communicate with the terminal device, receive information such as the sender set size and the receiver set size sent by the terminal device, and use the APSI parameter selection method deployed on the server to output the target APSI parameter value, and return it to the terminal device.

[0049] Based on the problems raised in the background technology, the embodiments of the present disclosure take into account the fully homomorphic encryption scheme in the APSI protocol and the parameter requirements of the APSI protocol itself, and provide an automated method for searching for optimal APSI parameter values, that is, an ASPI parameter selection method provided by the embodiments of the present disclosure. The APSI parameter selection method provided by the embodiments of the present disclosure can automatically select the optimal target APSI parameter value based on the size of the receiver set, the size of the sender set, and the user's preference for computing overhead and communication overhead. The following is Figure 3 The APSI parameter selection method provided in the embodiment of the present application is introduced in detail.

[0050] Figure 3FIG. 1 is a flow chart showing a method for selecting an APSI parameter according to an embodiment of the present disclosure. The method can be used in the above-mentioned APSI parameter selection system 100, and the method can be executed by the above-mentioned terminal device or server, such as Figure 3 As shown, the APSI parameter selection method includes:

[0051] Step S31, obtaining the sender set size of the data set of the data sender and the receiver set size of the data set of the data receiver, and implementing the private set intersection between the data sender and the data receiver using the APSI protocol based on fully homomorphic encryption.

[0052] Among them, the data sender is also the sender in the APSI protocol, such as the advertising delivery party, server, etc. in the above exemplary application scenario, and the data receiver is also the receiver in the APSI protocol, such as the commodity operator, client, etc. in the above exemplary application scenario.

[0053] Among them, the sender set size is the set size of the data set of the data sender, and the receiver set size is the set size of the data set of the data receiver; the set size can be understood as the data volume of the data in the data set. It should be understood that the data content in the data set in different application scenarios may be different, and the sender set size and the receiver set size in different application scenarios may also be different. For example, the receiver set size can be 1K, 256K, 512K, 1024K, 2048K, 4096K, etc., and the sender set size can be 100K, 256K, 1M, 16M, 256M, etc. The sender set size is usually larger than the receiver set size, and the embodiments of the present disclosure are not limited to this.

[0054] As described above, the APSI protocol used between the data sender and the data receiver may include an APSI protocol based on fully homomorphic encryption, wherein the fully homomorphic encryption may use a BFV encryption scheme, a BGV encryption scheme, etc., which is not limited in the embodiments of the present disclosure.

[0055] Step S32, according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size and the receiver set size, determine the parameter values ​​of other parameters in the APSI parameters under each ring dimension value, wherein a ring dimension value and the parameter values ​​of other parameters under the one ring dimension value constitute a set of APSI parameter values, and the other parameters include the parameters in the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in the identical encryption.

[0056] As described above, the APSI parameters required by the APSI protocol may include at least: ring dimension, plaintext modulus, ciphertext modulus, prime numbers of ciphertext modulus, number of finite field elements required for a single set element in a data set, number of hash functions, hash table size, maximum number of elements in each bucket in the hash table, and pre-calculation parameters. Then, other parameters in the APSI parameters except the ring dimension may include at least one of the following: plaintext modulus, ciphertext modulus, prime numbers of ciphertext modulus, number of finite field elements required for a single set element in a data set, number of hash functions, hash table size, maximum number of elements in each bucket in the hash table, and pre-calculation parameters.

[0057] As mentioned above, the ring dimension n is usually 2. 10 to 2 15 (i.e., 2 10 , 2 11 , 2 12 , 2 13 , 2 14 , 2 15 ), therefore, the multiple ring dimension values ​​of the ring dimension may include at least 2 10 , 2 11 , 2 12 , 2 13 , 2 14 , 2 15 In practical applications, the parameter values ​​of other parameters under each ring dimension value may be calculated in turn for the ring dimension value.

[0058] Based on this, in a possible implementation, step S32, according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, determines the parameter values ​​of other parameters in the APSI parameters under each ring dimension value, which may include:

[0059] Step S321, determining the plaintext modulus value of the plaintext modulus at each ring dimension value and the ciphertext modulus value of the ciphertext modulus at each ring dimension value according to each ring dimension value;

[0060] Step S322, determining the number of finite field elements at each ring dimension value according to the plaintext modulus value at each ring dimension value;

[0061] Step S323, determining multiple constituent prime values ​​of constituent prime numbers of the ciphertext modulus at each ring dimension value according to each ring dimension value and the ciphertext modulus value at each ring dimension value;

[0062] Step S324, determining the hash table value of the hash table size at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension according to the sender set size, the receiver set size, the hash function value preset by the number of hash functions, and the finite field element value at each ring dimension;

[0063] Step S325, determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension according to each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension;

[0064] Step S326, determine the pre-calculated parameter value of the pre-calculated parameter according to the maximum number of multiplication layers supported by the fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket in the hash table under each ring dimension.

[0065] In step S321, the plaintext modulus value of the plaintext modulus p at each ring dimension value n can be determined based on the formula p mod 2n=1. This is to ensure that after SIMD decomposition, the expansion dimension of each finite field is 1, thereby maximizing the use of the plaintext space. After obtaining the plaintext modulus value at each ring dimension value, in step S322, the number of finite field elements felts_per_item at each ring dimension value can be determined based on the formula 80<=felts_per_item*log2(p)<=128. This formula can be understood as each set element needs to be represented by 80 to 128 bits. The more bits there are, the lower the probability of false positives caused by hash collisions.

[0066] In step S321, the lattice-estimator tool can be used to determine the ciphertext modulus value Q at each ring dimension value based on each ring dimension value. Specifically, the value of the maximum ciphertext modulus value Q corresponding to 128-bit security can be determined. Among them, the lattice-estimator tool is a tool known in the art for determining the ciphertext modulus value. Of course, those skilled in the art can also use other known technical means in the art to determine the ciphertext modulus value Q at each ring dimension value, and this embodiment of the present disclosure is not limited to this.

[0067] In step S323, the CRT decomposition method can be used to determine multiple prime values ​​Qi of the ciphertext modulus value Q, wherein the ciphertext modulus value Q can be limited to not exceed the upper bound determined in step S321, and each prime value satisfies Qi mod2n=1, log2(Qi)<=60 (this is to use NTT (Number Theoretic Transform) to accelerate the processor for calculation operations). Optionally, if the multiplication depth in the homomorphic calculation is greater than or equal to 2, a special Qk can be selected as the special modulus for key conversion, satisfying Qk>=Qi(i=1,2…,k-1). Optionally, under the premise of meeting the above conditions, the number of prime values ​​decomposed by CRT can be reduced, thereby accelerating the homomorphic calculation in the BFV encryption scheme. It should be understood that the embodiments of the present disclosure do not limit the number of prime values.

[0068] In step S324, by specifying constraints, it is possible to determine the hash table value of the hash table size under each ring dimension and the maximum number of elements in each bucket in the hash table under each ring dimension according to the sender set size, the receiver set size, the number of hash functions preset by the number of hash functions, and the number of finite field elements under each ring dimension.

[0069] In actual applications, the number of hash functions used in the APSI protocol can be set in advance according to different application scenarios. For example, the number of hash functions in the privacy intersection set can be set to 3, or a value can be randomly selected from 2 to 8 as the number of hash functions. For other scenarios such as privacy information retrieval, the number of hash functions can be set to 1, and this is not limited to the embodiments of the present disclosure.

[0070] Specifically, the above specified constraints may include: constraining the hash table size table_size to be greater than or equal to the receiver set size n_recv, the upward rounded value ceil(n / felts_per_item) of the ratio between each ring dimension value n and the finite field element number value felts_per_item to divide the hash table size table_size, and the product of the hash table size table_size and the maximum number of elements max_items_per_bin in each bucket in the hash table to be greater than or equal to the product of the receiver set size n_send and the hash function number value hash_func_count. That is, the above constraints can be expressed as:

[0071] table_size>=n_recv; ceil(n / felts_per_item)|table_size; table_size*max_items_per_bin>=n_send*hash_func_count; where ceil represents rounding up and “|” represents integer division.

[0072] In step S325, any known technical means in the art may be used, for example, the research results on homomorphic noise growth and supported multiplication layers of the BFV encryption scheme in the paper "Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication." from the Cryptography ePrint Archive maintained by IACR may be referred to, and the maximum number of multiplication layers supported by the fully homomorphic encryption in the APSI protocol under each ring dimension may be determined according to each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension, and the disclosed embodiment is not limited to this. Among them, the number of multiplication layers may be referred to as the multiplication depth, and different encryption parameters (i.e., the degree of the modulus polynomial, the plaintext modulus, and the ciphertext modulus) may support different maximum number of multiplication layers, and the number of multiplication layers may affect the computational overhead generated by homomorphic computing.

[0073] In step S326, the pre-calculated parameter value of the pre-calculated parameter can be selected from the preset parameter library of the APSI protocol according to the maximum number of multiplication layers supported by the fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket in the hash table under each ring dimension, wherein the preset parameter library contains multiple preset Paterson-Stockmeyer parameter values. Specifically, the preset Paterson-Stockmeyer parameter value can be found in the preset parameter library of the APSI protocol, and the maximum number of elements in each bucket in the hash table and the maximum number of multiplication layers corresponding to the selected Paterson-Stockmeyer parameter value should not be less than the maximum number of elements in each bucket in the hash table and the maximum number of multiplication layers, and the smaller the gap, the better. It can be seen that the Paterson-Stockmeyer parameter affects both the computational overhead and the communication overhead, and if one is reduced, the other will increase.

[0074] Step S33: predicting the computational overhead and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol based on the multiple sets of APSI parameter values.

[0075] In practical applications, the corresponding relationships between different APSI parameter values ​​and the computing overhead and the communication overhead can be established in advance, so that after obtaining multiple groups of APSI parameter values ​​in step S32, the computing overhead and / or communication overhead generated by each group of APSI parameter values ​​can be determined based on the corresponding relationship. In practical applications, technicians can obtain the corresponding relationships between different APSI parameter values ​​and the computing overhead and the communication overhead in advance through experiments combined with theoretical analysis, and the embodiment of the present disclosure does not limit the method for determining the above-mentioned corresponding relationship.

[0076] In one possible implementation, based on multiple groups of APSI parameter values, the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol is predicted, including: predicting the single computational overhead corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values; predicting the total number of computations corresponding to each group of APSI parameter values ​​based on the pre-computed parameter values, finite field element values, and hash table values ​​in each group of APSI parameter values; determining the computational overhead corresponding to each group of APSI parameter values ​​based on the total number of computations and the single computational overhead corresponding to each group of APSI parameter values.

[0077] In practical applications, through experiments combined with theoretical analysis, a first correspondence between APS parameter values ​​such as the number of prime values ​​in the ciphertext modulus (that is, the number of prime numbers that constitute the ciphertext modulus) and the ring dimension value and the single calculation overhead can be pre-established, and a second correspondence between APSI parameter values ​​such as pre-calculated parameter values, finite field element values, and hash table values ​​and the total number of calculations can be pre-established. Then, based on the first correspondence, the single calculation overhead under different ring dimension values ​​and the number of prime values ​​in the ciphertext modulus can be predicted, and based on the second correspondence, the total number of calculations under different pre-calculated parameter values, finite field element values, and hash table values ​​can be predicted. Then, the product of the total number of calculations corresponding to each group of APSI parameter values ​​and the single calculation overhead can be used as the calculation overhead corresponding to each group of APSI parameter values.

[0078] It can be known that homomorphic computing in fully homomorphic encryption includes homomorphic multiplication computing and homomorphic addition computing. Since the computational overhead generated by homomorphic multiplication computing accounts for the main part, the above-mentioned single computational overhead can be the overhead generated by a single homomorphic multiplication computing, and the above-mentioned total number of computations can be the number of homomorphic multiplication computings performed in fully homomorphic encryption. Based on this, the computational overhead corresponding to each of the above-mentioned groups of APSI parameter values ​​can be the total computational overhead generated by the homomorphic multiplication computing under each group of APSI parameter values.

[0079] In one possible implementation, based on multiple groups of APSI parameter values, the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol is predicted, including: predicting the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values, the ciphertext data including the ciphertext and public key transmitted from the data receiver to the data sender; predicting the total number of ciphertext data corresponding to each group of APSI parameter values ​​based on the pre-calculated parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; determining the communication overhead corresponding to each group of APSI parameter values ​​based on the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0080] It is known that the communication overhead generated in the APSI protocol mainly includes: the overhead generated by the ciphertext data (ciphertext and public key) that the receiver needs to transmit to the sender. In practical applications, the third correspondence between the number of prime values ​​in the ciphertext modulus and the APSI parameter values ​​such as the ring dimension value and the communication overhead of a single ciphertext data can be established in advance through experiments combined with theoretical analysis, and the fourth correspondence between the APSI parameter values ​​such as the pre-calculated parameter value, the number of finite field elements and the hash table value and the total number of ciphertext data can be established. Then, based on the third correspondence, the communication overhead of a single ciphertext data under different ring dimension values ​​and the number of prime values ​​in the ciphertext modulus can be predicted, and based on the fourth correspondence, the total number of ciphertext data under different pre-calculated parameter values, the number of finite field elements and the hash table value can be predicted. Then, the product between the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data can be used as the communication overhead corresponding to each group of APSI parameter values.

[0081] Step S34, selecting a target APSI parameter value from the multiple groups of APSI parameter values ​​according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0082] In actual applications, the user can pre-set the parameter selection preference, that is, the user can pre-set whether to select the target APSI parameter value according to the preference of generating a smaller computing cost or generating a smaller communication cost, and then based on the selection preference set by the user, multiple groups of APSI parameter values ​​can be sorted according to the computing cost and / or communication cost corresponding to each group of APSI parameter values, and then the target APSI parameter value can be selected from the multiple groups of APSI parameter values ​​based on the sorting result. In this way, it is possible to automatically select the optimal target APSI parameter value based on the user's preference for computing cost and communication cost.

[0083] For example, if sorting is performed only by computational cost, a set of APSI parameter values ​​with the smallest computational cost can be selected as the target APSI parameter values; if sorting is performed only by communication cost, a set of APSI parameter values ​​with the smallest communication cost can be selected as the target APSI parameter values; if sorting is performed by computational cost and communication cost, a weight w can be set for the communication cost S and the computational cost T, and sorting can be performed based on the weighted result of the communication cost and the computational cost (i.e., w*T+(1-w)*S), and then the set of APSI parameter values ​​with the smallest weighted result can be selected as the target APSI parameter values.

[0084] Optionally, in actual applications, the sorting results sorted by computing cost and / or communication cost may be directly displayed to the user, and the user may select a target APSI parameter value based on the sorting results according to his / her own needs.

[0085] According to the ASPI parameter selection method of the embodiment of the present invention, multiple groups of APSI parameter values ​​are determined based on the sender set size and the receiver set size, and the computing overhead and / or communication overhead generated by each group of APSI parameter values ​​are predicted. Then, based on the computing overhead and / or communication overhead generated by each group of APSI parameter values, the optimal target APSI parameter values ​​suitable for the data receiver and the data sender in the APSI protocol are automatically selected. Compared with manual selection of APSI parameter values, the parameter value selection has high efficiency, high accuracy, high flexibility, does not need to rely on professional knowledge, is more convenient, and can also meet the preference requirements for computing overhead and communication overhead in various application scenarios.

[0086] Figure 4 A block diagram of an APSI parameter selection device according to an embodiment of the present disclosure is shown as follows: Figure 4 As shown, the APSI parameter selection device includes:

[0087] An acquisition module 401 is used to acquire a sender set size of a data set of a data sender and a receiver set size of a data set of a data receiver, wherein the data sender and the data receiver use an APSI protocol based on fully homomorphic encryption to implement privacy set intersection;

[0088] A parameter determination module 402 is used to determine parameter values ​​of other parameters in the APSI parameters under each ring dimension value according to a plurality of ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, wherein a ring dimension value and parameter values ​​of other parameters under the ring dimension value constitute a group of APSI parameter values, and the other parameters include parameters in the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in the identical encryption;

[0089] The cost determination module 403 is used to predict the calculation cost and / or communication cost generated by each set of APSI parameter values ​​when implementing the APSI protocol according to the multiple sets of APSI parameter values;

[0090] The parameter selection module 404 is used to select a target APSI parameter value from the multiple groups of APSI parameter values ​​according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0091] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, prime numbers constituting the ciphertext modulus, the number of finite field elements required for a single set element in a data set, the number of hash functions, the size of the hash table, the maximum number of elements in each bucket in the hash table, and pre-calculation parameters.

[0092] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, including: determining the plaintext modulus value of the plaintext modulus at each ring dimension value and the ciphertext modulus value of the ciphertext modulus at each ring dimension value according to each ring dimension value; determining the finite field element value of the number of finite field elements at each ring dimension value according to the plaintext modulus value at each ring dimension value; determining the multiple prime values ​​of the constituent prime numbers of the ciphertext modulus at each ring dimension value according to each ring dimension value and the ciphertext modulus value at each ring dimension value; determining the hash table value of the hash table size at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension according to the sender set size, the receiver set size, the hash function value preset by the hash function number, and the finite field element value at each ring dimension.

[0093] In a possible implementation, the parameter values ​​of other parameters in the APSI parameters at each ring dimension value are determined according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, and also include: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension according to each ring dimension, the plaintext modulus value at each ring dimension, and the ciphertext modulus value at each ring dimension; determining the pre-calculated parameter values ​​of the pre-calculated parameters according to the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension and the maximum number of elements in each bucket in the hash table at each ring dimension.

[0094] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the single computational overhead corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values; predicting the total number of computations corresponding to each group of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; and determining the computational overhead corresponding to each group of APSI parameter values ​​based on the total number of computations and the single computational overhead corresponding to each group of APSI parameter values.

[0095] In a possible implementation, the method predicts the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol based on multiple groups of APSI parameter values, including: predicting the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values, the ciphertext data including the ciphertext and public key transmitted from the data receiving direction to the data sending direction; predicting the total number of ciphertext data corresponding to each group of APSI parameter values ​​based on the pre-calculated parameter values, the number of finite field element values, and the hash table values ​​in each group of APSI parameter values; determining the communication overhead corresponding to each group of APSI parameter values ​​based on the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0096] In a possible implementation, the multiple ring dimension values ​​include 2 10 to 2 15 ; The pre-calculated parameters include Paterson-Stockmeyer parameters.

[0097] According to the embodiments of the present disclosure, multiple groups of APSI parameter values ​​are determined based on the sender set size and the receiver set size, and the computing overhead and / or communication overhead generated by each group of APSI parameter values ​​are predicted. Then, based on the computing overhead and / or communication overhead generated by each group of APSI parameter values, automatic selection of preferred target APSI parameter values ​​suitable for data receivers and data senders in the APSI protocol is achieved. Compared with manual selection of APSI parameter values, parameter value selection has high efficiency, high accuracy, high flexibility, does not require reliance on professional knowledge, is more convenient, and can also meet the preference requirements for computing overhead and communication overhead in various application scenarios.

[0098] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0099] The embodiment of the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium can be a volatile or non-volatile computer-readable storage medium.

[0100] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0101] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0102] Figure 5 1 is a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 may be provided as a server or a terminal device. Figure 5 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0103] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0104] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0105] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0106] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0107] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0108] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0109] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0110] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0111] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0112] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0113] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for selecting asymmetric privacy intersection APSI parameters, characterized in that: include: Obtaining the sender set size of the data set of the data sender and the receiver set size of the data set of the data receiver, wherein the data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to implement privacy set intersection; According to a plurality of ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, determine parameter values ​​of other parameters in the APSI parameters under each ring dimension value, wherein a ring dimension value and parameter values ​​of other parameters under the ring dimension value constitute a group of APSI parameter values, and the other parameters include parameters in the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in the identical encryption; According to the multiple groups of APSI parameter values, predicting the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol; According to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, a target APSI parameter value is selected from the multiple groups of APSI parameter values, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

2. The method according to claim 1, characterized in that The other parameters include at least one of the following: plaintext modulus, ciphertext modulus, prime numbers constituting the ciphertext modulus, the number of finite field elements required for a single set element in a data set, the number of hash functions, the size of the hash table, the maximum number of elements in each bucket in the hash table, and pre-calculation parameters.

3. The method according to claim 2, characterized in that The determining parameter values ​​of other parameters in the APSI parameters at each ring dimension value according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, includes: Determine, according to each ring dimension value, a plaintext modulus value of the plaintext modulus at each ring dimension value and a ciphertext modulus value of the ciphertext modulus at each ring dimension value; Determine the number of finite field element values ​​of the number of finite field elements at each ring dimension value according to the plaintext modulus value at each ring dimension value; Determine, according to each ring dimension value and the ciphertext modulus value at each ring dimension value, a plurality of component prime values ​​of the component prime numbers of the ciphertext modulus at each ring dimension value; Determine the hash table value of the hash table size under each ring dimension and the maximum number of elements in each bucket in the hash table under each ring dimension according to the sender set size, the receiver set size, the hash function number value preset by the hash function number, and the finite field element number value under each ring dimension.

4. The method according to claim 3, characterized in that The determining, according to the multiple ring dimension values ​​preset by the ring dimension in the APSI parameter required by the APSI protocol, the sender set size, and the receiver set size, parameter values ​​of other parameters in the APSI parameter at each ring dimension value, further includes: According to each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension, the maximum number of multiplication layers supported by the fully homomorphic encryption in the APSI protocol under each ring dimension is determined; The pre-calculated parameter values ​​of the pre-calculated parameters are determined according to the maximum number of multiplication layers supported by the fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket in the hash table under each ring dimension.

5. The method according to claim 4, characterized in that The step of predicting, based on the multiple groups of APSI parameter values, the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol includes: According to the number of prime values ​​in each group of APSI parameter values ​​and the ring dimension value, the single calculation cost corresponding to each group of APSI parameter values ​​is predicted; Predict the total number of calculations corresponding to each group of APSI parameter values ​​according to the pre-calculated parameter values, the number of finite field elements, and the hash table values ​​in each group of APSI parameter values; The calculation costs corresponding to each group of APSI parameter values ​​are determined according to the total number of calculations corresponding to each group of APSI parameter values ​​and the single calculation costs.

6. The method according to claim 4, characterized in that The step of predicting, based on the multiple groups of APSI parameter values, the computational overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol includes: Predicting the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​according to the number of constituent prime values ​​in each group of APSI parameter values ​​and the ring dimension value, wherein the ciphertext data includes the ciphertext and the public key transmitted by the data receiving direction to the data sending direction; Predict the total amount of ciphertext data corresponding to each group of APSI parameter values ​​according to the pre-calculated parameter values, the number of finite field elements and the hash table values ​​in each group of APSI parameter values; The communication overhead corresponding to each group of APSI parameter values ​​is determined according to the total amount of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data.

7. The method according to any one of claims 2 to 6, characterized in that: The multiple ring dimension values ​​include 2 10 to 2 15 ; The pre-calculated parameters include Paterson-Stockmeyer parameters.

8. An asymmetric privacy intersection APSI parameter selection device, characterized in that: include: An acquisition module, used to acquire the sender set size of the data set of the data sender and the receiver set size of the data set of the data receiver, wherein the data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to implement privacy set intersection; A parameter determination module, configured to determine parameter values ​​of other parameters in the APSI parameters at each ring dimension value according to a plurality of ring dimension values ​​preset by the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, wherein a ring dimension value and parameter values ​​of other parameters at the ring dimension value constitute a group of APSI parameter values, the other parameters include parameters in the APSI parameters except the ring dimension, and the ring dimension represents the degree of the modular polynomial used in identical encryption; The cost determination module is used to predict the calculation cost and / or communication cost generated by each set of APSI parameter values ​​when implementing the APSI protocol according to the multiple sets of APSI parameter values; A parameter selection module is used to select a target APSI parameter value from the multiple groups of APSI parameter values ​​according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values ​​when implementing the APSI protocol, and the target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method described in any one of claims 1 to 7 when executing the instructions stored in the memory.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images