APSI parameter selection method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to an APSI parameter selection method and device, electronic equipment and a storage medium. The method comprises: obtaining a sender set size of a data set of a data sender and a receiver set size of a data set of a data receiver; determining parameter values of other parameters in APSI parameters under each ring dimension value according to a plurality of ring dimension values preset for a ring dimension in the APSI parameters required by an APSI protocol, the sender set size and the receiver set size, wherein one ring dimension value and the parameter values of other parameters under the ring dimension value form a group of APSI parameter values; predicting the calculation overhead and / or communication overhead generated when each group of APSI parameter values implements the APSI protocol according to the plurality of groups of APSI parameter values; and selecting target APSI parameter values from the plurality of groups of APSI parameter values according to the calculation overhead and / or communication overhead generated by each group of APSI parameter values. According to the embodiments of the present disclosure, the parameter values of the APSI parameters can be effectively selected automatically, and the parameter selection efficiency, accuracy and flexibility are improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to an APSI parameter selection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Asymmetric Private Set Intersection (APSI) is a two-party privacy computation protocol proposed in the CCS 2021 paper, "Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication." In APSI, the communicating parties are a sender and a receiver, each possessing a dataset. The sender's dataset is significantly larger than the receiver's. The goal of APSI is for the receiver to obtain the intersection of the two datasets. The sender sends this intersection to the receiver, while the receiver has no access to any other elements in the sender's dataset, and vice versa. For example, in a common friend recommendation scenario, after a user registers for an application on their device, the application's server can perform a privacy set intersection between the user's contact information and its own registered user information to obtain the users' registered contacts, thus enabling friend recommendations. In this case, the server acts as the sender in the APSI protocol, and the user's device acts as the receiver.

[0003] The APSI protocol can be based on a fully homomorphic encryption scheme, such as an APSI protocol based on the BFV encryption scheme. The BFV encryption scheme is a fully homomorphic encryption scheme based on RLWE (Ring-Learning With Errors). Its operating efficiency and security are closely related to the selection of RLWE parameters. The APSI parameters required for the BFV-based APSI protocol include at least the ring dimension (i.e., the degree of the modular polynomial), the plaintext modulus, the ciphertext modulus and the constituent primes of the ciphertext modulus (i.e., decomposing the ciphertext modulus based on CRT (Chinese Remainder Theorem) into a product of a series of distinct primes, with each prime having a modulus of 2n and a remainder of 1), the plaintext modulus and the SIMD (Single Instruction Multiple Data) decomposition of the plaintext space. The SIMD decomposition means that the plaintext polynomial is isomorphic to a finite field vector. Performing homomorphic operations on a single plaintext polynomial can perform homomorphic operations on the entire vector, improving computational efficiency. In addition, the APSI protocol itself has general adjustable APSI parameters, such as hash table size, maximum number of elements in each bucket of the hash table, number of hash functions, Paterson-Stockmeyer parameters, etc.

[0004] The selection of the aforementioned APSI parameters is closely related to the correctness of the APSI protocol's operation, as well as its computational and communication efficiency. Although the developers of the APSI protocol have provided a library of preset parameters applicable to different sender and receiver set sizes, the parameter values ​​set in this library are too coarse, and the applicable set sizes for adjacent sets of parameters differ too much. This makes it difficult to obtain optimal computational and communication overhead in complex and ever-changing real-world applications, resulting in poor flexibility.

[0005] Meanwhile, the APSI parameters in the above-mentioned APSI protocol are highly coupled. A single parameter may simultaneously affect the security, correctness and operating efficiency of the APSI protocol implementation. Furthermore, the existing method of manually selecting APSI parameter values ​​is cumbersome and requires certain professional knowledge, resulting in problems such as difficulty in selecting APSI parameters, low efficiency, low accuracy and poor flexibility. Summary of the Invention

[0006] In view of this, this disclosure proposes an APSI parameter selection method, apparatus, electronic device and storage medium, which can realize the automatic selection of APSI parameter values, improve the efficiency, accuracy and flexibility of parameter selection, and meet the needs of computational and communication overhead in various application scenarios.

[0007] According to one aspect of this disclosure, an APSI parameter selection method is provided, characterized by comprising: obtaining the sender set size of the dataset of the data sender and the receiver set size of the dataset of the data receiver, wherein the data sender and the data receiver use an APSI protocol based on fully homomorphic encryption to perform privacy set intersection; determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value according to multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, wherein a ring dimension value and other parameters under that ring dimension value are... The parameter values ​​of the numbers constitute a set of APSI parameter values. The other parameters include parameters in the APSI parameters other than the ring dimension, where the ring dimension represents the degree of the modular polynomial used in identical encryption. Based on the multiple sets of APSI parameter values, the computational and / or communication overhead generated by each set of APSI parameter values ​​in implementing the APSI protocol is predicted. Based on the computational and / or communication overhead generated by each set of APSI parameter values ​​in implementing the APSI protocol, a target APSI parameter value is selected from the multiple sets of APSI parameter values. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0008] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, constituent prime numbers of the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, hash table size, the maximum number of elements in each bucket of the hash table, and pre-computed parameters.

[0009] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set includes: determining the plaintext modulus value and the ciphertext modulus value under each ring dimension value based on each ring dimension value; determining the number of finite field elements under each ring dimension value based on the plaintext modulus value; determining multiple component prime values ​​of the ciphertext modulus under each ring dimension value based on each ring dimension value and the ciphertext modulus value; and determining the hash table size under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension based on the preset number of hash functions (the size of the sender set, the size of the receiver set, the number of hash functions, and the number of finite field elements under each ring dimension).

[0010] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on the multiple ring dimension values ​​preset in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set further includes: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension based on each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension; and determining the pre-computation parameter values ​​of the pre-computation parameters based on the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension.

[0011] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the single computational overhead corresponding to each set of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each set of APSI parameter values; predicting the total number of computations corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the computational overhead corresponding to each set of APSI parameter values ​​based on the total number of computations and the single computational overhead.

[0012] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the communication overhead of a single ciphertext data corresponding to each set of APSI parameter values ​​based on the number of constituent element values ​​and the ring dimension value in each set of APSI parameter values, wherein the ciphertext data includes the ciphertext and public key transmitted by the data receiver to the data sender; predicting the total number of ciphertext data corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the communication overhead corresponding to each set of APSI parameter values ​​based on the total number of ciphertext data corresponding to each set of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0013] In one possible implementation, the plurality of ring dimension values ​​include 2 10 Up to 2 15 The pre-calculated parameters include the Paterson-Stockmeyer parameters.

[0014] According to another aspect of this disclosure, an APSI parameter selection device is provided, comprising: an acquisition module, configured to acquire the sender set size of a data sender's dataset and the receiver set size of a data receiver's dataset, wherein the data sender and the data receiver employ an APSI protocol based on fully homomorphic encryption to achieve privacy set intersection; and a parameter determination module, configured to determine the parameter values ​​of other parameters in the APSI parameters at various ring dimension values ​​based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the sender set size, and the receiver set size, wherein a ring dimension value and other parameters at that ring dimension value are considered to be... The parameter values ​​constitute a set of APSI parameter values. The other parameters include parameters in the APSI parameters other than the ring dimension, where the ring dimension represents the degree of the modular polynomial used in identical encryption. The overhead determination module is used to predict the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol, based on the multiple sets of APSI parameter values. The selection module is used to select a target APSI parameter value from the multiple sets of APSI parameter values ​​based on the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0015] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, constituent prime numbers of the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, hash table size, the maximum number of elements in each bucket of the hash table, and pre-computed parameters.

[0016] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set includes: determining the plaintext modulus value and the ciphertext modulus value under each ring dimension value based on each ring dimension value; determining the number of finite field elements under each ring dimension value based on the plaintext modulus value; determining multiple component prime values ​​of the ciphertext modulus under each ring dimension value based on each ring dimension value and the ciphertext modulus value; and determining the hash table size under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension based on the preset number of hash functions (the size of the sender set, the size of the receiver set, the number of hash functions, and the number of finite field elements under each ring dimension).

[0017] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on the multiple ring dimension values ​​preset in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set further includes: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension based on each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension; and determining the pre-computation parameter values ​​of the pre-computation parameters based on the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension.

[0018] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the single computational overhead corresponding to each set of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each set of APSI parameter values; predicting the total number of computations corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the computational overhead corresponding to each set of APSI parameter values ​​based on the total number of computations and the single computational overhead.

[0019] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the communication overhead of a single ciphertext data corresponding to each set of APSI parameter values ​​based on the number of constituent element values ​​and the ring dimension value in each set of APSI parameter values, wherein the ciphertext data includes the ciphertext and public key transmitted by the data receiver to the data sender; predicting the total number of ciphertext data corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the communication overhead corresponding to each set of APSI parameter values ​​based on the total number of ciphertext data corresponding to each set of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0020] In one possible implementation, the plurality of ring dimension values ​​include 2 10 Up to 2 15 The pre-calculated parameters include the Paterson-Stockmeyer parameters.

[0021] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-described method when executing instructions stored in the memory.

[0022] According to another aspect of this disclosure, a non-volatile computer-readable storage medium is provided that stores computer program instructions thereon, wherein the computer program instructions, when executed by a processor, implement the above-described method.

[0023] According to another aspect of this disclosure, a computer program product is provided, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the above-described method.

[0024] According to embodiments of this disclosure, multiple sets of APSI parameter values ​​are determined based on the size of the sender set and the size of the receiver set, and the computational and / or communication overhead generated by each set of APSI parameter values ​​is predicted. Then, based on the computational and / or communication overhead generated by each set of APSI parameter values, the optimal target APSI parameter values ​​suitable for the data receiver and data sender in the APSI protocol are automatically selected. Compared with manual selection of APSI parameter values, parameter value selection is more efficient, accurate, flexible, and does not require professional knowledge. It is more convenient and can also meet the preference requirements for computational and communication overhead in various application scenarios.

[0025] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0026] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0027] Figures 1(a) and 1(b) illustrate a schematic diagram of an application scenario according to an embodiment of the present disclosure.

[0028] Figures 2(a) and 2(b) illustrate another application scenario according to an embodiment of the present disclosure.

[0029] Figure 3 A flowchart illustrating an APSI parameter selection method according to an embodiment of the present disclosure is shown.

[0030] Figure 4 A block diagram of an APSI parameter selection device according to an embodiment of the present disclosure is shown.

[0031] Figure 5 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. Detailed Implementation

[0032] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0033] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0034] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0035] To better understand the solutions of the embodiments of this application, the relevant terms and concepts that may be involved in the embodiments of this application will be briefly introduced below.

[0036] 1) The ring dimension n, which is the degree of the modular polynomial, is a power of 2, and n is usually taken as 2. 10 Up to 2 15 (that is, 2) 10 211 2 12 2 13 2 14 2 15 The ring dimension can affect the security of ciphertext data after fully homomorphic encryption. If other parameters remain unchanged, the larger the ring dimension, the more secure the data. The modulo polynomial degree can be understood as the modulo operation of the polynomial degree in fully homomorphic encryption.

[0037] 2) The plaintext modulus p is a prime number that satisfies p modulo 2n remainder 1. p corresponds to the eigenvalue of each finite field element in the finite field vector after the plaintext polynomial isomorphism used in fully homomorphic encryption. Here, p modulo 2n remainder 1 is used to ensure that the expansion order of each finite field after isomorphism is 1, thereby maximizing the length of the finite field vector after isomorphism.

[0038] 3) The ciphertext modulus Q is a product of a series of distinct prime numbers, i.e., Q = Q1 * Q2 * ... * Qk, where Q1, Q2, ..., Qk are k distinct constituent prime numbers. The CRT (Chinese Remainder Theorem) can be used to decompose the operations modulo Q into operations modulo each constituent prime number. Simultaneously, to accelerate polynomial multiplication using Number Theoretic Transform (NTT), each prime number needs to have a remainder of 1 modulo 2^n. In APSI, Q consists of at least two prime numbers, typically 2 to 8 prime numbers (i.e., k ranges from 2 to 8), with each prime number reaching 60 bits in size. The noise budget is linearly related to the total number of bits for these prime numbers. The ciphertext modulus also affects encryption security: if other parameters remain constant, a larger ciphertext modulus with a larger total number of bits results in lower security.

[0039] 4) The number of finite field elements required for a single set element represents how many finite field elements are used to represent each set element. For example, suppose a ciphertext (equivalent to a set) can hold 100 finite field elements, and a piece of information in the ciphertext (equivalent to an element in a set) is represented by 4 finite field elements.

[0040] 5) Number of hash functions, that is, the number of hash functions used in the APSI protocol. Hash functions can be used to achieve compression mapping of plaintext data.

[0041] 6) Hash table size, also known as the size of the hash table used in the APSI protocol, can represent the number of buckets in the hash table. Plaintext data can be inserted into the hash table using a hash function.

[0042] 7) The maximum number of elements in each bucket of a hash table. A single hash table can contain multiple buckets, which is equivalent to "multiple tables". The maximum number of elements in each bucket is also the amount of data that can be put into each bucket of the hash table.

[0043] 8) The pre-computation parameter, also known as the Paterson-Stockmeyer parameter, determines the size of the pre-computation ciphertext group. The pre-computation ciphertext group consists of multiple ciphertexts and needs to be generated by the receiver (e.g., a client, or the holder of the homomorphic encryption private key) and sent to the sender (e.g., a server) before the APSI protocol begins. Its purpose is to reduce the sender's computational overhead and the maximum number of homomorphic multiplication layers required by the entire APSI protocol. The more ciphertexts in the pre-computation ciphertext group, the lower the sender's computational overhead and the lower the maximum number of multiplication layers of the protocol, but at the cost of higher communication throughput.

[0044] For example, Figures 1(a) and 1(b) illustrate an application scenario according to an embodiment of the present disclosure. As shown in Figure 1(a), the goods operator holds a set A of completed transaction user information, consisting of user information of users who have completed goods transactions, and the advertising delivery party holds a set B of viewed advertising user information, consisting of user information of users who have viewed advertisements. Generally, the set B of viewed advertising user information is larger than the set A of completed transaction user information. In this case, the advertising delivery party can be the sender in the APSI protocol, and the goods operator can be the receiver in the APSI protocol. In order to calculate which users who viewed the advertisement ultimately purchased the corresponding goods, that is, to calculate the true conversion rate of the advertisement, the goods operator and the advertising delivery party can use the APSI protocol to perform privacy set intersection on the set B of viewed advertising user information and the set A of completed transaction user information to obtain the intersection of the two sets. Specifically, the goods operator can send the homomorphic ciphertext data corresponding to the set A of completed transaction user information ( The encrypted data (including the ciphertext and public key) is sent to the advertising provider. The advertising provider can perform a privacy set intersection based on the ciphertext data of the user information set that has viewed the advertisement and its own set of user information set B that has completed transactions. The intersection of the two sets is then sent to the product operator, who can then calculate the actual conversion rate of the advertisement based on the intersection of the sets. In order to implement the APSI protocol between the product operator and the advertising provider, it is necessary to determine the parameter values ​​of the APSI parameters used in the APSI protocol. At this time, the size of the set of user information set B that has viewed the advertisement and the size of the set of user information set A that has completed transactions can be input into the APSI parameter selection system 100 in Figure 1(b). The APSI parameter selection system 100 can use the APSI parameter selection method of the present disclosure embodiment to automatically and efficiently determine the target APSI parameter value required to implement the APSI protocol. The product operator and the advertising provider can directly implement the APSI protocol based on the target APSI parameter value.

[0045] For example, Figures 2(a) and 2(b) illustrate another application scenario of this disclosure. As shown in Figure 2(a), the client of an application that has been installed and registered on a user's mobile phone, with authorized access to the address book, can obtain the user's contact information (such as mobile phone numbers) from the address book to form a contact information set C. The server of the application can hold a set of registered user information D consisting of all registered user information of the application. Generally speaking, the set of registered user information D is larger than the set of contact information C. In this case, the server is the sender in the APSI protocol, and the client is the receiver in the APSI protocol. In order to find the contact information of those who have registered with the application from the user's contact information, that is, to find the intersection of the two sets without revealing the current user's contact information and the server's registered user information, so as to realize the friend recommendation function in the application, the client and the server can use the APSI protocol to compare the contact information set C with the registered user information set C. The privacy set intersection of the registered user information set D is performed to obtain the intersection of the two sets. Specifically, the client can send the homomorphic encrypted data of the contact information set to the server. The server performs privacy set intersection based on the homomorphic encrypted data and its own set of registered user information to obtain the intersection of the two sets and returns it to the client. The client can implement the friend recommendation function based on the intersection of the sets. In order to implement the APSI protocol between the client and the server, it is necessary to determine the parameter values ​​of the APSI parameters used in the APSI protocol. At this time, the size of the contact information set C and the size of the registered user information set D can be input into the APSI parameter selection system 100 in Figure 2(b). The APSI parameter selection system 100 can use the APSI parameter selection method of the present disclosure embodiment to automatically and efficiently determine the target APSI parameter value required to implement the APSI protocol. The client and the server can implement the APSI protocol based on the target APSI parameter value.

[0046] It should be understood that the above-described applications of calculating the true conversion rate of advertisements and implementing the friend recommendation function are exemplary application scenarios provided by the embodiments of this disclosure. In fact, any application scenario that uses the APSI protocol based on fully homomorphic encryption to perform privacy set intersection can use the APSI parameter selection method of the embodiments of this disclosure to determine the parameter values ​​of the APSI parameters used in the APSI protocol. Through the APSI parameter selection method of the embodiments of this disclosure, the selection efficiency, accuracy and flexibility of APSI parameter values ​​can be improved, and APSI parameter values ​​with better computational and / or communication overhead can be selected to meet the needs of computational and / or communication overhead in various application scenarios.

[0047] The APSI parameter selection method of this disclosure can be deployed on various terminal devices through software or hardware modifications. The terminal devices involved in this application can refer to devices with wireless connectivity, meaning they can connect to other terminal devices via Wi-Fi, Bluetooth, or other wireless connection methods. The terminal devices in this application can also have wired communication capabilities. The terminal devices in this application can be touchscreen, non-touchscreen, or screenless. Touchscreen devices can be controlled by clicking or swiping on the display screen using fingers or styluses. Non-touchscreen devices can connect to input devices such as mice, keyboards, or touch panels to control the terminal device. Screenless devices can be, for example, screenless Bluetooth speakers. For instance, the terminal devices in this application can be smartphones, netbooks, tablets, laptops, wearable electronic devices (such as smart bracelets and smartwatches), TVs, virtual reality devices, speakers, e-ink devices, and so on.

[0048] The APSI parameter selection method of this disclosure can also be deployed on a server. This server can be located in the cloud or locally, and can be a physical device or a virtual device, such as a virtual machine or container. It has wireless communication capabilities, which can be configured in the server's chip (system) or other components. It can refer to a device with wireless connectivity, meaning it can connect to other servers or terminal devices via wireless connections such as Wi-Fi or Bluetooth. The server in this application can also have wired communication capabilities. For example, the server in this application can be located in the cloud, communicate with terminal devices, receive information such as the size of the sender set and the size of the receiver set sent by the terminal devices, and output the target APSI parameter value using the APSI parameter selection method deployed on the server, returning it to the terminal devices.

[0049] Based on the problems raised in the background art, this disclosure embodiment considers both the fully homomorphic encryption scheme in the APSI protocol and the parameter requirements of the APSI protocol itself, and provides an automated method for searching for optimal APSI parameter values, namely, an ASPI parameter selection method provided by this disclosure embodiment. Through the APSI parameter selection method provided by this disclosure embodiment, the optimal target APSI parameter value can be automatically selected based on the size of the receiver set, the size of the sender set, and the user's preference for computational and communication overhead. The following is a description of... Figure 3 The method for selecting APSI parameters provided in the embodiments of this application will be described in detail.

[0050] Figure 3A flowchart illustrating an APSI parameter selection method according to an embodiment of the present disclosure is provided. This method can be used in the aforementioned APSI parameter selection system 100, and can be executed by the aforementioned terminal device or server, such as... Figure 3 As shown, the method for selecting the APSI parameter includes:

[0051] Step S31: Obtain the size of the sender set of the data sender's dataset and the size of the receiver set of the data receiver's dataset. The data sender and data receiver use the APSI protocol based on fully homomorphic encryption to realize the intersection of privacy sets.

[0052] In this context, the data sender is the sender in the APSI protocol, such as the advertising delivery party or the server in the above exemplary application scenario, and the data receiver is the receiver in the APSI protocol, such as the product operator or the client in the above exemplary application scenario.

[0053] In this context, the sender set size refers to the size of the dataset sent by the data sender, and the receiver set size refers to the size of the dataset received by the data receiver. The set size can be understood as the amount of data in the dataset. It should be understood that the data content in the dataset can be different in different application scenarios, and the sender set size and receiver set size can also be different in different application scenarios. For example, the receiver set size can be 1K, 256K, 512K, 1024K, 2048K, 4096K, etc., and the sender set size can be 100K, 256K, 1M, 16M, 256M, etc. The sender set size is usually larger than the receiver set size, but this embodiment of the disclosure does not limit this.

[0054] As described above, the APSI protocol used between the data sender and the data receiver may include an APSI protocol based on fully homomorphic encryption. The fully homomorphic encryption may adopt BFV encryption scheme, BGV encryption scheme, etc., and this disclosure embodiment does not limit this.

[0055] Step S32: Based on the multiple preset ring dimension values, sender set size, and receiver set size of the ring dimension in the APSI parameters required by the APSI protocol, determine the parameter values ​​of other parameters in the APSI parameters under each ring dimension value. A ring dimension value and the parameter values ​​of other parameters under that ring dimension value constitute a set of APSI parameter values. Other parameters include parameters in the APSI parameters other than the ring dimension. The ring dimension represents the degree of the modulo polynomial used in identical encryption.

[0056] As mentioned above, the APSI parameters required by the APSI protocol can include at least: ring dimension, plaintext modulus, ciphertext modulus, the prime numbers that make up the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, hash table size, the maximum number of elements in each bucket of the hash table, and pre-computation parameters. Therefore, the APSI parameters other than the ring dimension can include at least one of the following: plaintext modulus, ciphertext modulus, the prime numbers that make up the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, hash table size, the maximum number of elements in each bucket of the hash table, and pre-computation parameters.

[0057] As mentioned above, the ring dimension n is usually 2. 10 Up to 2 15 (that is, 2) 10 2 11 2 12 2 13 2 14 2 15 Therefore, multiple ring dimension values ​​can include at least 2. 10 2 11 2 12 2 13 2 14 2 15 In practical applications, the parameter values ​​of other parameters under each ring dimension value can be calculated sequentially.

[0058] Based on this, in one possible implementation, step S32, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value according to the multiple preset ring dimension values, the sender set size, and the receiver set size in the ring dimension of the APSI parameters required by the APSI protocol, may include:

[0059] Step S321: Determine the plaintext modulus value and the ciphertext modulus value under each ring dimension value based on each ring dimension value.

[0060] Step S322: Determine the number of finite field elements for each ring dimension value based on the plaintext modulus value for each ring dimension value.

[0061] Step S323: Based on each ring dimension value and the ciphertext modulus value under each ring dimension value, determine the multiple constituent prime values ​​of the ciphertext modulus under each ring dimension value.

[0062] Step S324: Based on the size of the sender set, the size of the receiver set, the number of hash functions preset by the number of hash functions, and the number of finite field elements in each ring dimension, determine the hash table size in each ring dimension and the maximum number of elements in each bucket of the hash table in each ring dimension.

[0063] Step S325: Determine the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension, based on each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension.

[0064] Step S326: Determine the pre-computation parameter values ​​based on the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension.

[0065] In step S321, the plaintext modulus p can be determined based on the formula p mod 2n = 1 for each ring dimension value n. This is to ensure that the expansion dimension of each finite field is 1 after SIMD decomposition, thereby maximizing the utilization of the plaintext space. After obtaining the plaintext modulus values ​​for each ring dimension value, in step S322, the number of finite field elements felts_per_item can be determined based on the formula 80 <= felts_per_item * log2(p) <= 128. This formula can be understood as each set element needs to be represented by 80 to 128 bits. The more bits, the lower the probability of false positives caused by hash collisions.

[0066] In step S321, the lattice-estimator tool can be used to determine the ciphertext modulus value Q for each ring dimension value. Specifically, the maximum ciphertext modulus value Q corresponding to 128-bit security can be determined. The lattice-estimator tool is a known tool for determining ciphertext modulus values. Of course, those skilled in the art can also use other known techniques to determine the ciphertext modulus value Q for each ring dimension value; this embodiment of the disclosure does not limit this approach.

[0067] In step S323, CRT decomposition can be used to determine multiple constituent element values ​​Qi of the ciphertext modulus Q. The ciphertext modulus Q can be limited to not exceeding the upper bound determined in step S321, and each constituent element value satisfies Qi mod 2n = 1, log2(Qi) <= 60 (this is to accelerate the processor's computation using NTT (Number Theoretic Transform)). Optionally, if the multiplication depth in the homomorphic computation is >= 2, a special Qk can be selected as the special modulus for key conversion, satisfying Qk >= Qi (i = 1, 2, ..., k-1). Optionally, under the premise of satisfying the above conditions, the number of constituent element values ​​decomposed by CRT can be reduced, thereby accelerating the homomorphic computation in the BFV encryption scheme. It should be understood that the embodiments of this disclosure do not limit the number of constituent element values.

[0068] In step S324, by specifying constraints, the hash table size in each ring dimension and the maximum number of elements in each bucket of the hash table in each ring dimension can be determined based on the preset number of hash functions (the size of the sender set, the size of the receiver set, the number of hash functions, and the number of finite field elements in each ring dimension).

[0069] In practical applications, the number of hash functions used in the APSI protocol can be set in advance according to different application scenarios. For example, in the privacy intersection set, the number of hash functions can be set to 3, or a value can be randomly selected from 2 to 8 as the number of hash functions. For other scenarios such as privacy information retrieval, the number of hash functions can be set to 1. This disclosure does not limit this.

[0070] Specifically, the specified constraints mentioned above may include: the hash table size `table_size` must be greater than or equal to the receiver set size `n_recv`; the rounded-up value `ceil(n / felts_per_item)` of the ratio between each ring dimension value `n` and the finite field element value `felts_per_item` must be divisible by the hash table size `table_size`; and the product of the hash table size `table_size` and the maximum number of elements in each bucket of the hash table `max_items_per_bin` must be greater than or equal to the product of the receiver set size `n_send` and the hash function value `hash_func_count`. In other words, the above constraints can be expressed as:

[0071] table_size >= n_recv; ceil(n / felts_per_item)|table_size; table_size * max_items_per_bin >= n_send * hash_func_count; where ceil represents rounding up, and "|" represents integer division.

[0072] In step S325, any known technique in the art can be employed. For example, the research results on the homomorphic noise growth and supported multiplication layers of the BFV encryption scheme can be referenced from the paper "Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication." maintained by the IACR Cryptology ePrint Archive. This allows for the determination of the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol at each ring dimension, based on the plaintext modulus value at each ring dimension and the ciphertext modulus value at each ring dimension. This disclosure does not limit this approach. The number of multiplication layers can be referred to as the multiplication depth. Different encryption parameters (i.e., modulo polynomial degree, plaintext modulus, and ciphertext modulus) support different maximum multiplication layers, and the number of multiplication layers affects the computational overhead of homomorphic computation.

[0073] In step S326, a pre-calculated parameter value can be selected from the APSI protocol's preset parameter library based on the maximum number of multiplication layers supported by fully homomorphic encryption in each ring dimension and the maximum number of elements in each bucket of the hash table in each ring dimension. This preset parameter library contains multiple preset Paterson-Stockmeyer parameter values. Specifically, a preset Paterson-Stockmeyer parameter value can be found in the APSI protocol's preset parameter library. The maximum number of elements in each bucket and the maximum number of multiplication layers corresponding to the selected Paterson-Stockmeyer parameter value should not be less than the currently determined maximum number of elements in each bucket and the maximum number of multiplication layers, and the smaller the difference, the better. It is known that the Paterson-Stockmeyer parameter affects both computational and communication overhead; decreasing one will increase the other.

[0074] Step S33: Based on multiple sets of APSI parameter values, predict the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol.

[0075] In practical applications, a pre-established correspondence between different APSI parameter values ​​and computational and communication overhead can be established. After obtaining multiple sets of APSI parameter values ​​in step S32, the computational and / or communication overhead generated by each set of APSI parameter values ​​can be determined based on this correspondence. In practical applications, technicians can pre-determine the correspondence between different APSI parameter values ​​and computational and communication overhead through a combination of experiments and theoretical analysis. This disclosure does not limit the method for determining the aforementioned correspondence.

[0076] In one possible implementation, the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol is predicted based on multiple sets of APSI parameter values. This includes: predicting the single computational overhead of each set of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each set of APSI parameter values; predicting the total number of computations corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the computational overhead corresponding to each set of APSI parameter values ​​based on the total number of computations and the single computational overhead.

[0077] In practical applications, experiments combined with theoretical analysis can be used to establish a first correspondence between the number of prime values ​​(i.e., the number of primes that make up the ciphertext modulus) and ring dimension values, as well as the single computation cost, and a second correspondence between the pre-computed parameter values, the number of elements in the finite field, and the hash table values, and the total number of computations. Based on the first correspondence, the single computation cost can be predicted for different ring dimension values ​​and the number of prime values ​​in the ciphertext modulus. Based on the second correspondence, the total number of computations can be predicted for different pre-computed parameter values, the number of elements in the finite field, and the hash table values. Finally, the product of the total number of computations and the single computation cost corresponding to each set of APSI parameter values ​​can be used as the computation cost corresponding to each set of APSI parameter values.

[0078] It is known that homomorphic computation in fully homomorphic encryption includes homomorphic multiplication and homomorphic addition. Since the computational overhead generated by homomorphic multiplication accounts for the majority, the above-mentioned single computational overhead can be the overhead generated by a single homomorphic multiplication, and the above-mentioned total number of computations can be the number of homomorphic multiplications performed in fully homomorphic encryption. Based on this, the computational overhead corresponding to each of the above-mentioned APSI parameter values ​​can be the total computational overhead generated by homomorphic multiplication under each of the above-mentioned APSI parameter values.

[0079] In one possible implementation, the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol is predicted based on multiple sets of APSI parameter values. This includes: predicting the communication overhead of a single ciphertext data corresponding to each set of APSI parameter values ​​based on the number of constituent element values ​​and the ring dimension value in each set of APSI parameter values, where the ciphertext data includes the ciphertext and public key transmitted from the data receiver to the data sender; predicting the total number of ciphertext data corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the communication overhead corresponding to each set of APSI parameter values ​​based on the total number of ciphertext data corresponding to each set of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0080] It is known that the communication overhead generated in the APSI protocol mainly includes the overhead incurred by the receiver needing to transmit ciphertext data (ciphertext and public key) to the sender. In practical applications, through experiments combined with theoretical analysis, a third correspondence can be established between APSI parameter values ​​such as the number of prime values ​​in the ciphertext modulus and the ring dimension value and the communication overhead of a single ciphertext data point. A fourth correspondence can also be established between APSI parameter values ​​such as the pre-calculated parameter values, the number of elements in the finite field, and the hash table value and the total number of ciphertext data points. Based on this third correspondence, the communication overhead of a single ciphertext data point under different ring dimension values ​​and the number of prime values ​​in the ciphertext modulus can be predicted. Similarly, based on this fourth correspondence, the total number of ciphertext data points under different pre-calculated parameter values, the number of elements in the finite field, and the hash table value can be predicted. Finally, the product of the total number of ciphertext data points corresponding to each set of APSI parameter values ​​and the communication overhead of a single ciphertext data point can be used as the communication overhead for each set of APSI parameter values.

[0081] Step S34: Based on the computational and / or communication overhead incurred by each group of APSI parameter values ​​when implementing the APSI protocol, select a target APSI parameter value from multiple groups of APSI parameter values. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0082] In practical applications, users can pre-set parameter selection preferences, specifically whether to select target APSI parameter values ​​based on minimizing computational or communication overhead. Based on these preferences, multiple sets of APSI parameter values ​​can be sorted according to their respective computational and / or communication overhead. The target APSI parameter value can then be selected from these sorted sets. This method enables the automatic selection of the optimal target APSI parameter value based on the user's preferences for computational and communication overhead.

[0083] For example, if only computational overhead is used for sorting, the set of APSI parameter values ​​with the smallest computational overhead can be selected as the target APSI parameter values; if only communication overhead is used for sorting, the set of APSI parameter values ​​with the smallest communication overhead can be selected as the target APSI parameter values; if both computational overhead and communication overhead are used for sorting, a weight w can be set for communication overhead S and computational overhead T, and sorting can be performed using the weighted result of communication overhead and computational overhead (i.e., w*T+(1-w)*S), and then the set of APSI parameter values ​​with the smallest weighted result can be selected as the target APSI parameter values.

[0084] Alternatively, in practical applications, the sorting results sorted by computational and / or communication overhead can be directly displayed to the user, and the user can select the target APSI parameter value based on the sorting results according to their own needs.

[0085] According to the ASPI parameter selection method of this disclosure, multiple sets of APSI parameter values ​​are determined based on the size of the sender set and the size of the receiver set, and the computational and / or communication overhead generated by each set of APSI parameter values ​​is predicted. Then, based on the computational and / or communication overhead generated by each set of APSI parameter values, the optimal target APSI parameter values ​​suitable for the data receiver and data sender in the APSI protocol are automatically selected. Compared with manual selection of APSI parameter values, the parameter value selection is more efficient, accurate, and flexible, and does not require professional knowledge. It is more convenient and can also meet the preference requirements for computational and communication overhead in various application scenarios.

[0086] Figure 4 A block diagram of an APSI parameter selection apparatus according to an embodiment of the present disclosure is shown, such as Figure 4 As shown, the APSI parameter selection device includes:

[0087] The acquisition module 401 is used to acquire the size of the sender set of the dataset of the data sender and the size of the receiver set of the dataset of the data receiver. The data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to realize the intersection of privacy sets.

[0088] The parameter determination module 402 is used to determine the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set. A ring dimension value and the parameter values ​​of other parameters under that ring dimension value constitute a set of APSI parameter values. The other parameters include parameters in the APSI parameters other than the ring dimension. The ring dimension represents the degree of the modulo polynomial used in identical encryption.

[0089] The overhead determination module 403 is used to predict the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol, based on multiple sets of APSI parameter values.

[0090] The parameter selection module 404 is used to select a target APSI parameter value from the multiple sets of APSI parameter values ​​based on the computational and / or communication overhead incurred by each set of APSI parameter values ​​when implementing the APSI protocol. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

[0091] In one possible implementation, the other parameters include at least one of the following: plaintext modulus, ciphertext modulus, constituent prime numbers of the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, hash table size, the maximum number of elements in each bucket of the hash table, and pre-computed parameters.

[0092] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set includes: determining the plaintext modulus value and the ciphertext modulus value under each ring dimension value based on each ring dimension value; determining the number of finite field elements under each ring dimension value based on the plaintext modulus value; determining multiple component prime values ​​of the ciphertext modulus under each ring dimension value based on each ring dimension value and the ciphertext modulus value; and determining the hash table size under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension based on the preset number of hash functions (the size of the sender set, the size of the receiver set, the number of hash functions, and the number of finite field elements under each ring dimension).

[0093] In one possible implementation, determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on the multiple ring dimension values ​​preset in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set further includes: determining the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension based on each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension; and determining the pre-computation parameter values ​​of the pre-computation parameters based on the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension.

[0094] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the single computational overhead corresponding to each set of APSI parameter values ​​based on the number of constituent prime values ​​and the ring dimension value in each set of APSI parameter values; predicting the total number of computations corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the computational overhead corresponding to each set of APSI parameter values ​​based on the total number of computations and the single computational overhead.

[0095] In one possible implementation, predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: predicting the communication overhead of a single ciphertext data corresponding to each set of APSI parameter values ​​based on the number of constituent element values ​​and the ring dimension value in each set of APSI parameter values, wherein the ciphertext data includes the ciphertext and public key transmitted by the data receiver to the data sender; predicting the total number of ciphertext data corresponding to each set of APSI parameter values ​​based on the pre-computed parameter values, the number of finite field elements, and the hash table values ​​in each set of APSI parameter values; and determining the communication overhead corresponding to each set of APSI parameter values ​​based on the total number of ciphertext data corresponding to each set of APSI parameter values ​​and the communication overhead of a single ciphertext data.

[0096] In one possible implementation, the plurality of ring dimension values ​​include 2 10 Up to 2 15 The pre-calculated parameters include the Paterson-Stockmeyer parameters.

[0097] According to embodiments of this disclosure, multiple sets of APSI parameter values ​​are determined based on the size of the sender set and the size of the receiver set, and the computational and / or communication overhead generated by each set of APSI parameter values ​​is predicted. Then, based on the computational and / or communication overhead generated by each set of APSI parameter values, the optimal target APSI parameter values ​​suitable for the data receiver and data sender in the APSI protocol are automatically selected. Compared with manual selection of APSI parameter values, parameter value selection is more efficient, accurate, flexible, and does not require professional knowledge. It is more convenient and can also meet the preference requirements for computational and communication overhead in various application scenarios.

[0098] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0099] This disclosure also proposes a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the above-described method. The computer-readable storage medium can be volatile or non-volatile.

[0100] This disclosure also proposes an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0101] This disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the above-described method.

[0102] Figure 5 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. For example, the electronic device 1900 may be provided as a server or a terminal device. (Refer to...) Figure 5 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0103] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). Electronic device 1900 can operate on an operating system, such as Windows Server, stored in memory 1932. TM Mac OS X TM Unix TM Linux TM FreeBSD TM Or similar.

[0104] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.

[0105] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0106] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0107] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0108] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0109] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0110] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0111] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0112] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0113] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for selecting APSI parameters in asymmetric privacy intersection, characterized in that, include: Obtain the size of the sender set of the data sender's dataset and the size of the receiver set of the data receiver's dataset. The data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to achieve intersection of privacy sets. Based on the multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set, the parameter values ​​of other parameters in the APSI parameters under each ring dimension value are determined. A ring dimension value and the parameter values ​​of other parameters under that ring dimension value constitute a set of APSI parameter values. The other parameters include parameters in the APSI parameters other than the ring dimension. The ring dimension represents the degree of the modulo polynomial used in identical encryption. The other parameters include at least one of the following: plaintext modulus, ciphertext modulus, the constituent prime numbers of the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, the hash table size, the maximum number of elements in each bucket of the hash table, and pre-computed parameters. Based on multiple sets of APSI parameter values, predict the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol. Based on the computational and / or communication overhead incurred by each set of APSI parameter values ​​when implementing the APSI protocol, a target APSI parameter value is selected from the multiple sets of APSI parameter values. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

2. The method according to claim 1, characterized in that, The step of determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set includes: Based on each ring dimension value, determine the plaintext modulus value and the ciphertext modulus value under each ring dimension value; The number of finite field elements is determined based on the plaintext modulus value under each ring dimension value. Based on each ring dimension value and the ciphertext modulus value under each ring dimension value, determine the multiple constituent prime values ​​of the ciphertext modulus under each ring dimension value. Based on the size of the sender set, the size of the receiver set, the preset number of hash functions, and the number of finite field elements in each ring dimension, determine the hash table size in each ring dimension and the maximum number of elements in each bucket of the hash table in each ring dimension.

3. The method according to claim 2, characterized in that, The step of determining the parameter values ​​of other parameters in the APSI parameters under each ring dimension value based on multiple preset ring dimension values ​​in the ring dimension of the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set further includes: Based on each ring dimension, the plaintext modulus value under each ring dimension, and the ciphertext modulus value under each ring dimension, determine the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension. The pre-computation parameter values ​​are determined based on the maximum number of multiplication layers supported by fully homomorphic encryption in the APSI protocol under each ring dimension and the maximum number of elements in each bucket of the hash table under each ring dimension.

4. The method according to claim 3, characterized in that, The step of predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: Based on the number of constituent prime values ​​and the ring dimension value in each group of APSI parameter values, predict the single calculation cost corresponding to each group of APSI parameter values. Based on the pre-calculated parameter values, the number of finite field elements, and the hash table values ​​in each group of APSI parameter values, predict the total number of calculations corresponding to each group of APSI parameter values. Based on the total number of calculations and the cost per calculation for each group of APSI parameter values, the computational cost for each group of APSI parameter values ​​is determined.

5. The method according to claim 3, characterized in that, The step of predicting the computational and / or communication overhead of each set of APSI parameter values ​​in implementing the APSI protocol, based on multiple sets of APSI parameter values, includes: Based on the number of constituent element values ​​and the ring dimension value in each group of APSI parameter values, the communication overhead of a single ciphertext data corresponding to each group of APSI parameter values ​​is predicted. The ciphertext data includes the ciphertext and public key transmitted by the data receiver to the data sender. Based on the pre-calculated parameter values, the number of finite field elements and the hash table values ​​in each group of APSI parameter values, predict the total number of ciphertext data corresponding to each group of APSI parameter values. Based on the total number of ciphertext data corresponding to each group of APSI parameter values ​​and the communication overhead of a single ciphertext data, determine the communication overhead corresponding to each group of APSI parameter values.

6. The method according to any one of claims 1 to 5, characterized in that, The plurality of ring dimension values ​​include 2 10 Up to 2 15 ; The pre-calculated parameters include the Paterson-Stockmeyer parameters.

7. An asymmetric privacy intersection (APSI) parameter selection device, characterized in that, include: The acquisition module is used to acquire the size of the sender set of the dataset of the data sender and the size of the receiver set of the dataset of the data receiver. The data sender and the data receiver use the APSI protocol based on fully homomorphic encryption to realize the intersection of privacy sets. The parameter determination module is used to determine the parameter values ​​of other parameters in the APSI parameters under various ring dimension values ​​based on multiple preset ring dimension values ​​of the ring dimension in the APSI parameters required by the APSI protocol, the size of the sender set, and the size of the receiver set. A ring dimension value and the parameter values ​​of other parameters under that ring dimension value constitute a set of APSI parameter values. The other parameters include parameters in the APSI parameters other than the ring dimension. The ring dimension represents the degree of the modulo polynomial used in identical encryption. The other parameters include at least one of the following: plaintext modulus, ciphertext modulus, the constituent prime numbers of the ciphertext modulus, the number of finite field elements required for a single set element in the dataset, the number of hash functions, the hash table size, the maximum number of elements in each bucket of the hash table, and pre-computed parameters. The overhead determination module is used to predict the computational and / or communication overhead generated by each set of APSI parameter values ​​when implementing the APSI protocol, based on multiple sets of APSI parameter values. The parameter selection module is used to select a target APSI parameter value from the multiple sets of APSI parameter values ​​based on the computational and / or communication overhead incurred by each set of APSI parameter values ​​when implementing the APSI protocol. The target APSI parameter value is used to implement the APSI protocol between the data sender and the data receiver.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to implement the method of any one of claims 1 to 6 when executing instructions stored in the memory.

9. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images