Prediction Method, System, Device and Medium for Two-Party Private Set Intersection Based on Batch Grouping Parallel Intersection

Abstract

Prediction method, system, device and medium for two-party private set intersection based on batch grouping parallel intersection. The method is as follows: First, use the hash function agreed upon by both participating parties, namely the sender and the receiver, to group the two-party private sets; Secondly, perform parallel intersection on the grouping results of both participating parties; Then, merge the intersection results; The system, device and medium perform the calculation of the two-party private set intersection based on the prediction method of the two-party private set intersection based on batch grouping parallel intersection; The present invention improves the prediction speed and flexibility through the fact that the hash function with the same input will generate the same output value and the correctness of the adopted private set intersection protocol.

Description

Technical Field

[0001] The present invention belongs to the technical field of basic components and underlying technologies of secure multi-party computing, and particularly relates to a prediction method, system, device and medium for two-party private set intersection based on batch grouping parallel intersection. Background Technique

[0002] Private Set Intersection (PSI) allows parties who do not trust each other and hold private data to obtain the intersection of private data with each other without revealing other information through cross-regional and cross-institutional data security fusion. It is a type of cryptographic technology means that effectively realizes privacy protection. In the calculation of two-party private set intersection, the two participating parties each hold private sets X and Y respectively. After the calculation is completed, both parties can obtain the intersection X ∩ Y of the private data and cannot obtain any information outside the non-intersection [Benny Pinkas, Thomas Schneider, and Michael Zohner. Faster private set intersection based on ot extension. In Proceedings of the 23rd USENIX Conference on Security Symposium, SEC’14, pages 797–812, Berkeley, CA, USA, 2014. USENIX Association.], [Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, and Ni Trieu. Efficient batched oblivious PRF with applications to private set intersection. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016, pages 818–829. ACM, 2016.], [Benny Pinkas, Mike Rosulek, Ni Trieu, and Avishay Yanai. SpOT-light: Lightweight private set intersection from sparse OT extension. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part III, volume 11694 of LNCS, pages 401–431. Springer, Heidelberg, August 2019.], [Pinkas B, Rosulek M, Trieu N, et al.PSI from PaXoS: fast, malicious private set intersection[C] / / Annual International Conference on the Theory and Applications of Cryptographic Techniques. Cham: Springer International Publishing, 2020: 739-767.]、[Rosulek M, Trieu N. Compact and malicious private set intersection for small sets. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021: 1166-1181.]、[Raghuraman S, Rindal P. Blazing fast PSI from improved OKVS and subfield VOLE[C] / / Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2022: 2505-2517.].

[0003] The current two-party private set intersection protocol has the following bottlenecks when dealing with the calculation of sets with hundreds of millions of elements.

[0004] First, some efficient protocols are unavailable. Currently, protocols that support efficient calculations for tens of millions of elements (e.g., the PSZ protocol [Pinkas B, Schneider T, Zohner M. Scalable private set intersection based on OT extension[J]. ACM Transactions on Privacy and Security (TOPS), 2018, 21(2): 1-35.]) lack the selection of key parameters when facing calculations of hundreds of millions of elements, resulting in the inability to guarantee the correctness of the protocol. Protocols that support calculations at the level of hundreds of millions of elements (e.g., the CM protocol [CM20]) are highly dependent on the hardware performance specifications on which the protocol is deployed. When the hardware performance is insufficient, the protocol will stop running midway, resulting in execution failure.

[0005] Second, the calculation speed of available protocols is low. When calculating data on the scale of hundreds of millions (for example, the spot-fast protocol [Benny Pinkas, Mike Rosulek, Ni Trieu, and Avishay Yanai. SpOT-light: Lightweight private set intersection from sparse OT extension. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part III, volume 11694 of LNCS, pages 401–431. Springer, Heidelberg, August 2019.], CM protocol, etc.), due to frequent involvement of IO operations such as CPU and memory, as well as communication waiting between the two parties, the calculation time of the protocol increases significantly.

[0006] Third, the flexibility of protocol use is low. When performing private set intersection calculation once, the two participating parties can only bind the elements of their respective sets to the same protocol and each bind to their respective single server. This makes it impossible for both parties to comprehensively use multiple protocols with different advantages at the same time, impossible to use multiple servers for private set intersection calculation, and impossible to select the most suitable protocol for deployment according to the different network conditions of the multiple servers. Summary of the Invention

[0007] In order to overcome the defects of the above-mentioned prior art, the object of the present invention is to provide a prediction method, system, device and medium for two-party private set intersection based on batch grouping parallel intersection. The elements in the respective private sets of the sender and the receiver are mapped to different numbered groups with the same total number of groups through a hash function shared by the sender and the receiver. The two participating parties perform the intersection calculation process of the groups with the same number in parallel, so that the receiver can quickly obtain the private set intersection; the present invention improves the operation speed and flexibility through the fact that the hash function with the same input will generate the same output value and the correctness of the private set intersection protocol adopted.

[0008] In order to achieve the above object, the present invention adopts the following specific solutions:

[0009] A two-party private set intersection calculation method based on batch grouping parallel intersection is divided into three stages, namely hash grouping, parallel intersection, and intersection merging; the specific method is as follows:

[0010] Step 1: Group the private sets of both parties using the hash function agreed upon by both participating parties, namely the sender and the receiver;

[0011] Step 2: parallelize the intersection of the grouping results of the two parties in step 1;

[0012] Step 3: Intersect and merge the intersection results of step 2.

[0013] The specific method of step 1 is:

[0014] Step 1.1: Let G s represents a grouped set of sender set elements, Represents the jth group, j∈[0,m-1]; initialize m groups Empty, used to store the elements in the sender's private set X in the future;

[0015] The sender uses the hash function h to calculate the element x in the sender's private set i ∈X corresponding binary bit fingerprint string h(x i ), i∈[n1];

[0016] The sender intercepts the sender collection element x i The corresponding binary bit fingerprint string h(x i ) is grouped into the first k bits, and the binary bit fingerprint string h(x i ) is converted to decimal to obtain the group number j;

[0017] The sender sends the element x of the sender collection i Place in group middle;

[0018] When the grouping is completed, the sender's m pairs of groupings are

[0019] Step 1.2: Let G c represents a grouped set of elements of the receiver collection, represents the jth group, j∈[0,m-1]; the receiver initializes m groups G c , Empty, used to store the elements in the receiver's private set Y in the future;

[0020] The receiver uses the hash function h to solve the element y in the receiver's privacy set i ∈Y corresponding binary bit fingerprint string h(y i ), i∈[n2];

[0021] The receiver intercepts the receiver set element y i The corresponding binary bit fingerprint string h(y i ) is grouped into the first k bits, and the fingerprint string h(y i)Restore to decimal to obtain the grouping number j;

[0022] The receiver places the receiver set element y i into the grouping ;

[0023] When the grouping is over, the m pairs of groupings of the receiver are

[0024] The specific method of step 2 is as follows:

[0025] According to the m pairs of grouping results of both parties obtained in step 1, the sender and the receiver start the groupings with the same number through parallelization and and and of the private set intersection calculation to complete the parallel intersection finding:

[0026] For the jth grouping, j ∈ [0, m - 1], the sender and the receiver call the ideal private set intersection protocol to solve;

[0027] The sender and the receiver respectively take the jth grouping of the sender set elements and the jth grouping of the receiver set elements as the input of the ideal private set intersection protocol When the ideal private set intersection protocol executes and ends, the receiver will obtain the output of the ideal private set intersection protocol i.e., the private set intersection of the jth grouping

[0028] The specific method of step 3 is as follows:

[0029] The receiver combines the private set intersection solution results of the m pairs of groupings of both parties in step 2, that is

[0030] A prediction method for two-party private set intersection based on batch grouping parallel intersection finding, where the two participating parties meet the following conditions: The private set of the sender is The private set of the receiver is When the two participating parties complete the private set intersection calculation, the receiver obtains the private set intersection I = X ∩ Y; In addition, the two parties agree on a hash function h: {0, 1} * → {0, 1} l The two parties agree on the number of groupings of the private set as m, and let m = 2 k The private set intersection protocol is These m protocols are the same or different; denote 1 ≤ i ≤ n as i ∈ [n]; denote 1 < a ≤ j ≤ b as j ∈ [a, b].

[0031] A prediction system for two-party private set intersection based on batch grouping parallel intersection, comprising:

[0032] A hash grouping module, configured to group the hash functions agreed upon by both parties, i.e., the sender and the receiver, in step 1.

[0033] A parallel intersection module, configured to, in step 2, according to the grouping results of both parties in step 1, the sender and the receiver initiate the solution of the private set intersection of the groups with the same number in parallel to complete the parallel intersection.

[0034] An intersection merging module, configured to, in step 3, the receiver merge the solution results of the private set intersections of the m pairs of groups of both parties.

[0035] A prediction device for two-party private set intersection based on batch grouping parallel intersection, comprising:

[0036] A memory, configured to store a computer program;

[0037] A processor, configured to implement the prediction method for two-party private set intersection based on batch grouping parallel intersection described in steps 1 to 3 when executing the computer program.

[0038] A computer-readable storage medium, the computer-readable storage medium is used to store a computer program, and when the computer program is executed by a processor, it can perform two-party private set intersection prediction on the prediction method for two-party private set intersection based on batch grouping parallel intersection described in steps 1 to 3.

[0039] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0040] 1. The present invention can enhance the usability of the private set intersection protocol. It is known that protocols such as PSZ and KKRT only support private set intersection calculations with a data scale of tens of millions on ordinary personal PCs and servers. When the data scale reaches hundreds of millions, they cannot be successfully executed. Moreover, there are no parameter selections for these protocols at the scale of hundreds of millions, making the correctness of the protocols unable to be guaranteed. By using the present invention to divide a single private set intersection calculation of hundreds of millions into several intersection calculations of tens of millions and millions, such problems can be effectively avoided, thereby improving the usability of the protocol in private set intersection calculations with a data scale of hundreds of millions.

[0041] 2. The solution of the present invention for performing parallel intersection on the grouping results of both participating parties can improve the solving speed of the private set intersection protocol. Splitting the private set intersection calculation of two parties with a large data scale of hundreds of millions into several parallel calculations of private set intersections with relatively small data scales of tens of millions or millions for two parties will effectively reduce the calculation time of both parties. Theoretically, the calculation time can be reduced to (where m is the number of groups).

[0042] 3. By performing parallel intersection on the grouping results of both participating parties, the present invention can improve the flexibility of protocol use. The ideal private set intersection protocol in the solution can be instantiated with the same private set intersection protocol (for example, ), or different private set intersection protocols can be used for instantiation (for example, ). That is to say, private set intersection protocols with different advantages can be flexibly integrated into the solution of the present invention, and various protocols with high computational efficiency priority, high communication efficiency priority, low memory overhead priority, and balanced priority can be used for implementation during the solution process.

[0043] 4. The present invention uses the hash function agreed upon by both participating parties, namely the sender and the receiver, to group the private sets of both parties, which can reduce the number of element comparisons. Suppose the scales of elements in the private sets of both parties are n1 and n2 respectively. If no grouping is performed on both parties, the number of element comparisons between the two parties is n1n2. If both parties evenly distribute their respective elements into m groups, the number of element comparisons between the two parties is still n1n2. If both parties adopt the solution of the present invention, the number of element comparisons between the two parties is will be

[0044] In summary, the present invention maps the elements in the respective private sets of both parties to different numbered groups with the same total number of groups through the hash function shared by the sender and the receiver. The participating parties perform the intersection calculation process of the same numbered groups in parallel to enable the receiver to quickly obtain the private set intersection; the present invention improves the operation speed and flexibility through the fact that the hash function with the same input will generate the same output value and the correctness of the adopted private set intersection protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a two-party private set intersection calculation solution based on batch grouping parallel intersection.

[0046] Figure 2 is an embodiment of the present invention based on a server cluster.

[0047] Figure 3 is an embodiment of the present invention based on a single server. Detailed implementation manners

[0048] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the accompanying drawings.

[0049] The two-party private set intersection calculation scheme BGP-PSI based on batch grouping parallel intersection can be instantiated by the following two types of embodiments: the BGP-PSI scheme embodiment based on a server cluster and the BGP-PSI scheme embodiment based on a single server. By using different levels of computing power (such as multiple servers, CPU physical cores, multi-threading, etc.), the parallelization ability of the BGP-PSI scheme is improved, thereby improving the computing efficiency of the private set intersection protocol. It should be noted that the instantiation of BGP-PSI is not limited to the two types of embodiments proposed here.

[0050] See Figure 1 , a prediction method for two-party private set intersection based on batch grouping parallel intersection. The two participating parties satisfy the following conditions: the private set of the sender is The private set of the receiver is When the two participating parties complete the calculation of the private set intersection, the receiver obtains the private set intersection I = X ∩ Y; in addition, the two parties agree on a hash function h: {0,1} * →{0,1} l , the two parties agree on the number of groups of the private set as m, and let m = 2 k , and the private set intersection protocol is These m protocols are the same or different; denote 1 ≤ i ≤ n as i ∈ [n]; denote 1 < a ≤ j ≤ b as j ∈ [a, b].

[0051] A two-party private set intersection calculation method based on batch grouping parallel intersection is divided into three stages, namely hash grouping, parallel intersection, and intersection merging; the specific method is as follows:

[0052] Step 1: Use the hash function agreed upon by the two participating parties, namely the sender and the receiver, to group the private sets of both parties;

[0053] Step 1.1; Let G s represent the set of groups of the elements of the sender's set, represent the jth group, j ∈ [0, m - 1]; initialize m groups to be empty, for storing the elements in the sender's private set X subsequently;

[0054] The sender uses the hash function h to calculate the binary bit fingerprint string h(x i ∈ X corresponding to the element x i ), i ∈ [n1];

[0055] The sender intercepts the element x of the sender set i and the corresponding binary bit fingerprint string h(x i ) is grouped by taking the first k bits, and the grouping number j is obtained by restoring the binary bit fingerprint string h(x i ) to decimal;

[0056] The sender places the element x of the sender set i into the grouping ;

[0057] When the grouping is completed, the m pairs of grouping situations of the sender are

[0058] Step 1.2; Let G c represent the grouping set of the receiver set elements, represent the j-th grouping, j ∈ [0, m - 1]; The receiver initializes m groupings G c , which are empty and used to store the elements in the receiver's private set Y in the subsequent process;

[0059] The receiver uses the hash function h to calculate the binary bit fingerprint string h(y i ) corresponding to the element y i ∈ Y, i ∈ [n2];

[0060] The receiver groups by taking the first k bits of the fingerprint string of the binary bits corresponding to the receiver set element y i and obtains the grouping number j by restoring the fingerprint string of the binary bits h(y i ) to decimal; i The receiver places the receiver set element y

[0061] i into the grouping ;

[0062] When the grouping is completed, the m pairs of grouping situations of the receiver are

[0063] Step 2. Parallel intersection is performed on the grouping results of both parties in Step 1;

[0064] According to the m pairs of grouping results of both parties obtained in Step 1, the sender and the receiver start the privacy set intersection calculation of the groupings with the same number in parallel and and and to complete the parallel intersection:

[0065] For the j-th group, where j ∈ [0, m - 1], the sender and the receiver call the ideal private set intersection protocol to perform the calculation;

[0066] The sender and the receiver respectively take the j-th group of the sender's set elements and the j-th group of the receiver's set elements as the input of the ideal private set intersection protocol When the ideal private set intersection protocol finishes execution, the receiver will obtain the output of the ideal private set intersection protocol which is the private set intersection of the j-th group

[0067] Step 3: Merge the intersection results obtained in Step 2;

[0068] The receiver merges the private set intersection calculation results of the m pairs of groups from both sides, that is

[0069] Example 1: Based on a server cluster

[0070] As Figure 2 shown, this example assumes that the private set of the sender is and the private set of the receiver is When the two participating parties complete the private set intersection calculation, the receiver obtains the private set intersection I = X ∩ Y. In addition, the two parties agree on a hash function h: {0, 1} * → {0, 1} l , the number of groups m, let's assume m = 2 k , the ideal private set intersection protocol These m protocols can be the same or different. This example assumes that the sender has several servers and the receiver also has several servers

[0071] This example includes three stages, namely hash grouping, parallel intersection, and intersection merging; specifically as follows:

[0072] The first stage - hash grouping.

[0073] The sender initializes α + 1 servers Among them is the main server.

[0074] The main server of the sender initializes m groups to be empty.

[0075] The main server of the sender Traverse x i ∈ X, i ∈ [n1], use the hash function h to calculate x i corresponding binary bit fingerprint string h(x i ), intercept the first k bits of the fingerprint string h(x i ), and restore them to the corresponding decimal to obtain the group number j, 0 ≤ j ≤ m - 1, and place x i in the group .

[0076] The main server of the sender randomly and evenly distributes the m groups to α servers . Without loss of generality, assume that the group will be assigned to the server 0 ≤ j ≤ m - 1, 0 ≤ p ≤ α - 1.

[0077] The receiver initializes β + 1 servers where is the main server.

[0078] The main server of the receiver initializes the m groups to be empty.

[0079] The main server of the receiver traverses y i ∈ Y, i ∈ [n2], use the hash function h to calculate y i corresponding binary bit fingerprint string h(y i ), intercept the first k bits of the fingerprint string h(y i ), and restore them to the corresponding decimal to obtain the group number j, 0 ≤ j ≤ m - 1, and place y i in the group .

[0080] The main server of the receiver randomly and evenly distributes the m groups to β servers . Without loss of generality, assume that the group will be assigned to the server 0 ≤ j ≤ m - 1, 0 ≤ q ≤ β - 1.

[0081] The second stage - parallel intersection calculation.

[0082] The sender parallelizes the privacy set intersection calculation process of the m groups assigned in the α servers.

[0083] The server of the sender uses the j-th group it stores as The input, where 0 ≤ j ≤ m - 1 and 0 ≤ p ≤ m - 1.

[0084] The receiver parallelizes the private set intersection calculation process of the m packets allocated in β servers.

[0085] The receiver's server uses the j-th packet it stores as the input, where 0 ≤ j ≤ m - 1 and 0 ≤ q ≤ m - 1.

[0086] The receiver's server obtains the private set intersection of the j-th packet in the output where 0 ≤ j ≤ m - 1.

[0087] The receiver's server sends the calculated private set intersection to the main server

[0088] The third stage - intersection merging.

[0089] The receiver's main server merges the calculation results of the private set intersection of the m pairs of packets returned by the server, that is

[0090] This Embodiment 1 can enhance the usability of the private set intersection protocol. It is known that protocols such as PSZ and KKRT only support the private set intersection calculation of data scales in the tens of millions on ordinary personal computers and servers. When the data scale reaches the hundreds of millions, they cannot be successfully executed. Moreover, there are no parameter selections for these protocols at the scale of hundreds of millions, so the correctness of the protocols cannot be guaranteed. By using the present invention to divide a single private set intersection calculation of hundreds of millions into several intersection calculations of tens of millions and millions, such problems can be effectively avoided, thereby improving the usability of the protocol in the private set intersection calculation of data scales in the hundreds of millions.

[0091] The solution of parallel intersection of the packet results of the two participating parties in this Embodiment 1 can improve the solution speed of the private set intersection protocol. Splitting a single two-party private set intersection calculation of large data scales in the hundreds of millions into several groups of two-party parallel private set intersection calculations of relatively small data scales such as tens of millions and millions will effectively reduce the calculation time of both parties. Theoretically, the calculation time can be reduced to (m is the number of packets).

[0092] This Embodiment 1 can improve the flexibility of protocol use by parallelizing the intersection of the packet results of the two participating parties. The ideal private set intersection protocol in the solution The same private set intersection protocol can be selected for instantiation (for example, ), or different private set intersection protocols can be used for instantiation (for example, ). That is to say, private set intersection protocols with different advantages can be flexibly integrated into the solution of the present invention, and various protocols with high computational efficiency priority, high communication efficiency priority, low memory overhead priority, and balanced priority can be used in the solution process.

[0093] In Embodiment 1, the hash function agreed upon by the two participating parties, namely the sender and the receiver, is used to group the private sets of both parties, which can reduce the number of element comparisons. Assume that the scales of the elements in the private sets of both parties are n1 and n2 respectively. If the two parties do not perform grouping, the number of element comparisons between the two parties is n1n2. If the two parties evenly distribute their respective elements into m groups respectively, the number of element comparisons between the two parties is still n1n2. If the two parties adopt the solution of the present invention, the number of element comparisons between the two parties is will be

[0094] In summary, in Embodiment 1, the elements in their respective private sets are mapped by the hash function shared by the sender and the receiver to different numbered groups with the same total number of groups, and the two participating parties perform the intersection calculation process of the groups with the same number in parallel, so that the receiver can quickly obtain the private set intersection; this embodiment improves the operation speed and flexibility through the fact that the hash function with the same input will generate the same output value and the correctness of the private set intersection protocol adopted.

[0095] Embodiment 2: Based on a single server

[0096] As Figure 3 shown, in this embodiment, it is assumed that the private set of the sender is and the private set of the receiver is When the two participating parties complete the private set intersection calculation, the receiver obtains the private set intersection I = X ∩ Y. In addition, the two parties agree on a hash function h: {0, 1}* → {0, 1}l and the number of groups m. Without loss of generality, let m = 2 k , and the ideal private set intersection protocol These m protocols can be the same or different. In this embodiment, it is assumed that the sender has a number of processes and the receiver also has a number of processes

[0097] This embodiment includes three stages, namely hash grouping, parallel intersection, and intersection merging. Specifically as follows:

[0098] The first stage - hash grouping.

[0099] The sender initializes α + 1 processes Among them is the main process

[0100] The main process of the sender initializes m packets as empty

[0101] The main process of the sender traverses x i ∈ X, i ∈ [n1], and uses the hash function h to calculate the binary bit fingerprint string h(x i ) corresponding to x, intercepts the first k bits of the fingerprint string h(x i ) and restores them to the corresponding decimal to obtain the packet number j, 0 ≤ j ≤ m - 1, and places x i in the packet i

[0102] The main process of the sender randomly and evenly distributes the m packets to α processes Suppose the packet will be assigned to the process where 0 ≤ j ≤ m - 1, 0 ≤ p ≤ α - 1

[0103] The main process of the sender decides whether to bind the α processes to the CPU cores according to the user settings

[0104] The receiver initializes β + 1 processes Among them is the main process

[0105] The main process of the receiver initializes m packets as empty

[0106] The main process of the receiver traverses y i ∈ Y, i ∈ [n2], and uses the hash function h to calculate the binary bit fingerprint string h(y i ) corresponding to y, intercepts the first k bits of the fingerprint string h(y i ) and restores them to the corresponding decimal to obtain the packet number j, 0 ≤ j ≤ m - 1, and places y i in the packet i

[0107] The main process of the receiver randomly and evenly distributes the m packets ​​​​Randomly and evenly distributed to β processes Among them, without loss of generality, assume the grouping Will be assigned to the process 0 ≤ j ≤ m - 1, 0 ≤ q ≤ β - 1.

[0108] The main process of the receiver According to the user settings, decide whether to bind the β processes To the CPU cores.

[0109] The second stage - parallel intersection calculation.

[0110] The sender parallelizes the privacy set intersection calculation process of the m grouped packets allocated in the α processes.

[0111] The process of the sender Takes the j - th packet it stores As The input, 0 ≤ j ≤ m - 1, 0 ≤ p ≤ m - 1.

[0112] The receiver parallelizes the privacy set intersection calculation process of the m grouped packets allocated in the β processes.

[0113] The process of the receiver Takes the j - th packet it stores As The input, 0 ≤ j ≤ m - 1, 0 ≤ q ≤ m - 1.

[0114] The process of the receiver Obtains The privacy set intersection of the j - th packet output 0 ≤ j ≤ m - 1.

[0115] The process of the receiver Sends the calculated privacy set intersection to the main process

[0116] The third stage - intersection merging.

[0117] The main process of the receiver Merges the privacy set intersection calculation results of the m pairs of packets returned by the processes That is

[0118] The following is an explanation of the embodiment of the BGP - PSI scheme based on a single server:

[0119] The sender can choose to use the process for executing the privacy set intersection protocol corresponding to the j - th packet The corresponding privacy set intersection protocol The process Bind to the CPU core to further reduce the execution time.

[0120] The receiver can choose to execute the jth group corresponding private set intersection protocol process Bind to the CPU core to further reduce the execution time.

[0121] Embodiment 2 can enhance the usability of the private set intersection protocol. It is known that protocols such as PSZ and KKRT only support private set intersection calculations with a data scale of tens of millions on ordinary personal PCs and servers. When the data scale reaches hundreds of millions, they cannot be successfully executed. Moreover, there are no parameter selections for these protocols at the scale of hundreds of millions, so the correctness of the protocols cannot be guaranteed. By using the present invention to divide a single private set intersection calculation of hundreds of millions into several intersection calculations of tens of millions and millions, such problems can be effectively avoided, thereby improving the usability of the protocol in private set intersection calculations with a data scale of hundreds of millions.

[0122] The solution of parallel intersection of the grouped results of both participating parties in Embodiment 2 can improve the solution speed of the private set intersection protocol. Splitting a single two-party private set intersection calculation with a large data scale of hundreds of millions into several parallelized two-party private set intersection calculations with relatively small data scales such as tens of millions and millions will effectively reduce the calculation time of both parties. Theoretically, the calculation time can be reduced to (m is the number of groups).

[0123] By parallelizing the intersection of the grouped results of both participating parties in Embodiment 2, the flexibility of protocol usage can be improved. The ideal private set intersection protocol in the solution can choose the same private set intersection protocol for instantiation (for example, ), or different private set intersection protocols can be used for instantiation (for example, ). That is to say, private set intersection protocols with different advantages can be flexibly integrated into the solution of the present invention, and various protocols with high computational efficiency priority, high communication efficiency priority, low memory overhead priority, and balanced priority can be used in the solution process.

[0124] Embodiment 2 uses the hash function agreed upon by both participating parties, i.e., the sender and the receiver, to group the private sets of both parties, which can reduce the number of element comparisons. Suppose the scales of elements in the private sets of both parties are n1 and n2 respectively. If the two parties do not group, the number of element comparisons between the two parties is n1n2. If the two parties evenly distribute their respective elements into m groups respectively, the number of element comparisons between the two parties is still n1n2. If the two parties adopt the solution of the present invention, the number of element comparisons between the two parties is will be the original number of comparison times

[0125] In summary, in this Embodiment 2, the elements in the respective private sets are mapped to different numbered groups with the same total number of groups through a hash function shared by the sender and the receiver. The two participating parties perform the intersection calculation process for the groups with the same number in parallel, so that the receiver can quickly obtain the intersection of the private sets. Through the fact that the hash function with the same input generates the same output value and the correctness of the private set intersection protocol adopted, this embodiment improves the operation speed and flexibility.

Claims

1. A prediction method for two-party private set intersection based on batch grouping parallel intersection, characterized in that, The specific steps are as follows: Step 1: Group the privacy sets of the two participating parties, namely the sender and the receiver, using the hash function agreed upon by the two parties; Step 1.1; Let G s represent a set of groups of elements in the sender set, represent the j-th group, where j ∈ [0, m - 1]; Initialize m groups to be empty, which is used to store elements in the sender's private set X subsequently; The sender uses the hash function h to calculate the binary bit fingerprint string h(x i ∈X) corresponding to the element x in the sender's private set, where i ∈ [n1]; i ) The sender intercepts the element x of the sender set i and groups the first k bits of the corresponding binary bit fingerprint string h(x i ). The grouping number j is obtained by restoring the binary bit fingerprint string h(x i ) to decimal. The sender places the sender set element x i in the packet ; After the grouping ends, the m pairs of packets of the sender are as follows Step 1.2; Let G c denote a set of groups of elements of the recipient set, denote the j-th group, where j ∈ [0, m - 1]; The recipient initializes m groups G c , which is empty and is used to store elements in the recipient's private set Y subsequently; The recipient uses the hash function h to solve for the binary bit fingerprint string h(y i corresponding to the element y i ) in the recipient's private set, where i ∈ [n2]; The receiver intercepts the element y of the receiver set i and groups the first k bits of the fingerprint string h(y i ) corresponding to it. The grouping number j is obtained by restoring the fingerprint string h(y i ) of binary bits to decimal. The recipient places the recipient set element y i into the group ; After the grouping ends, the m pairs of packets at the receiver are as follows Step 2: Perform parallel intersection on the grouping results of the two parties in Step 1; Step 3: Merge the intersection results of Step 2.

2. The prediction method for the two-party private set intersection based on batch grouping parallel intersection according to claim 1, wherein, The specific method of Step 2 is as follows: Based on the m pairs of grouping results of both parties obtained in step 1, the sender and the receiver start the groups with the same number through parallelization and and and for the private set intersection calculation to complete the parallel intersection finding: For the j-th group, where j ∈ [0, m-1], the sender and the receiver call an ideal private set intersection protocol to solve it; The sender and the receiver respectively take the j-th packet of the sender set elements and the j-th packet of the receiver set elements as the input of the ideal private set intersection protocol When the ideal private set intersection protocol finishes execution, the receiver will obtain the output of the ideal private set intersection protocol which is the private set intersection of the j-th packet 3. A prediction method for two-party private set intersection based on batch grouping parallel intersection according to claim 1, characterized in that, The specific method of Step 3 is as follows: The receiving party combines the privacy set intersection solution results of the m pairs of groups of both parties in step 2, that is 4. A prediction method for two-party private set intersection based on batch grouping parallel intersection according to claim 1, characterized in that The two participating parties satisfy the following conditions: The private set of the sender is The private set of the receiver is When the two participating parties complete the calculation of the intersection of private sets, the receiver obtains the intersection of private sets I = X ∩ Y; In addition, the two parties agree that the hash function h: {0, 1} * → {0, 1} l , the two parties agree that the number of groups of the private set is m, and let m = 2 k , the private set intersection protocol is These m protocols are the same or different; Denote 1 ≤ i ≤ n as i ∈ [n]; Denote 1 < a ≤ j ≤ b as j ∈ [a, b].

5. A prediction system for two-party private set intersection based on batch grouping parallel intersection for the method according to claim 1, characterized in that It includes: A hash grouping module, which is used in Step 1 to group the hash function agreed upon by the two participating parties, namely the sender and the receiver; A parallel intersection module, which is used in Step 2 to, according to the grouping results of the two parties in Step 1, enable the sender and the receiver to solve the intersection of the privacy sets of the groups with the same number through parallelization to complete the parallel intersection; An intersection merging module, which is used in Step 3 for the receiver to merge the intersection solution results of the privacy sets of the m pairs of groups of both parties.

6. A prediction device for two-party private set intersection based on batch grouping parallel intersection, characterized in that, It includes: A memory, which is used to store computer programs; A processor, which is used to implement the prediction method of the intersection of two-party privacy sets based on batch grouping parallel intersection described in Steps 1 to 3 in Claim 1 when executing the computer program.

7. A computer-readable storage medium for storing a computer program, characterized in that, When the computer program is executed by the processor, it can perform the prediction of the intersection of two-party privacy sets for the prediction method of the intersection of two-party privacy sets based on batch grouping parallel intersection described in Steps 1 to 3 in Claim 1.

Images