Method and system for constructing a linearly complex set union protocol with enhanced security and privacy

Abstract

The present invention discloses a method for constructing a privacy set union protocol with enhanced security of linear complexity, and relates to the field of cryptography. The method comprises the steps of: defining and setting protocol parameters; defining and defining the functions of a permuted non-member conditional random number generation component, constructing a permuted non-member conditional random number generation component; and constructing a privacy set union protocol with enhanced security based on the permuted non-member conditional random number generation component. The present invention realizes a privacy set union protocol with enhanced security of linear complexity for the first time. Compared with the traditional PSU protocol with enhanced security, linear complexity can be achieved, and the computational and communication overheads during protocol operation are minimized; compared with the traditional PSU protocol with linear complexity, enhanced security can be achieved, and there is no process leakage problem during protocol operation.

Description

Technical Field

[0001] The present invention relates to the field of cryptography technology, and in particular to a method and system for constructing a linear complexity enhanced security and privacy set union protocol. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of information technologies such as cloud computing, big data, the Internet of Things, mobile internet, and artificial intelligence, various new service models and data applications are constantly emerging, and data in various fields is experiencing massive and explosive growth. Data resources have become the most important production factor in the digital age. While data interoperability creates enormous value, it also poses unprecedented challenges to data security. Private set operations can complete specific set operations while ensuring the privacy of all input sets. This provides a data circulation model where "data is available but not visible." It is a key cryptographic technology that currently balances data circulation and privacy protection, and has become a powerful cryptographic tool for solving the current "data silo" problem.

[0004] Private Set Union (PSU) involves two parties, each holding a private data set, jointly computing the union of the sets without disclosing any other information. Private Set Union has a wide range of practical applications. For example, two internet companies can analyze joint IP blacklists and vulnerability data for network risk assessment and management. Or, an organization that needs to survey residents' current housing purchase and rental needs can perform a Private Set Union on the real estate agency data while maintaining the privacy of the agency's data. In e-commerce, private set unions can be used to calculate user preference data without exposing individual privacy, enabling the establishment of cross-platform recommendation systems, helping businesses achieve targeted marketing and increase sales.

[0005] In the early days, the PSU protocol was mainly implemented based on additive homomorphic encryption technology, but the complex public key encryption and decryption operations resulted in very low protocol efficiency, making it difficult to use efficiently in practical applications. In recent years, the PSU protocol has been mainly completed based on symmetric cryptographic components, which can achieve linear complexity, making the practical application of PSU possible. However, Jia et al. pointed out that the existing efficient PSU protocol is mainly based on the multi-query reverse privacy membership test protocol (mqRPMT) construction, and the mqRPMT protocol leaks the membership relationship of the sender's set elements (that is, during the protocol process, the receiver knows the sender's membership relationship, and then uses the oblivious transfer protocol to select non-member elements to obtain the union), resulting in the problem of process leakage in the PSU protocol. Subsequently, the definition of the enhanced PSU was given and the construction was given based on permutation sharing. However, this enhanced PSU construction can only achieve superlinear complexity, making it difficult to apply efficiently in practice.

[0006] In summary, how to construct an enhanced PSU protocol with linear complexity is an urgent problem to be solved in this field. Summary of the Invention

[0007] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a method and system for constructing a set union protocol with enhanced security and privacy of linear complexity, define permuted non-member conditional random number generation (pnMCRG), and design an instantiation construction of linear complexity. Based on this component, the present invention provides the first PSU protocol with linear complexity and enhanced security.

[0008] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0009] A first aspect of the present invention provides a method for constructing a linear complexity enhanced security and privacy set union protocol, comprising the following steps:

[0010] Define and set protocol parameters;

[0011] Define the function of the permuted non-member conditional random number generation component and construct the permuted non-member conditional random number generation component;

[0012] A privacy set merging protocol with enhanced security is constructed based on a permutation-based non-membership conditional random number generation component.

[0013] A second aspect of the present invention provides a linear complexity enhanced security and privacy set merging protocol construction system, comprising:

[0014] a parameter setting module, configured to define and set protocol parameters;

[0015] The component design module is configured to define the function of the permuted non-member conditional random number generation component and construct the permuted non-member conditional random number generation component;

[0016] The protocol construction module is configured to construct a privacy set union protocol with enhanced security based on a permuted non-member conditional random number generation component.

[0017] The third aspect of the present invention provides a medium on which a program is stored. When the program is executed by a processor, it implements the steps in the method and system for constructing a linear complexity enhanced security and privacy set union protocol as described in the first aspect of the present invention.

[0018] The fourth aspect of the present invention provides a device comprising a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps in the method and system for constructing a linear complexity enhanced security and privacy set union protocol as described in the first aspect of the present invention are implemented.

[0019] One or more of the above technical solutions have the following beneficial effects:

[0020] The present invention discloses a method and system for constructing a linearly complex enhanced security privacy set union protocol, which addresses the process leakage problem existing in the existing multi-query reverse privacy membership test (mqRPMT) protocol. The present invention proposes a new cryptographic component - permuted non-member conditional random number generation (pnMCRG), gives a formal definition of its function, and designs an instantiation construction of linear complexity. The present invention provides the first linearly complex enhanced security PSU protocol based on the permuted non-member conditional random number generation component. Compared with the traditional PSU protocol, the enhanced security PSU protocol constructed by the present invention not only improves the security of the protocol, but also greatly reduces the computing and communication overhead, thereby improving the operating efficiency of the protocol.

[0021] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0023] Figure 1 This is a flow chart of a method for constructing a linear complexity enhanced security and privacy set union protocol according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0025] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations;

[0026] Example 1:

[0027] The first embodiment of the present invention provides a method for constructing a linear complexity enhanced security and privacy set union protocol, such as Figure 1 As shown, the following steps are included:

[0028] Step 1: Define and set protocol parameters.

[0029] This embodiment defines and explains the symbols for the constructed permuted non-member conditional random number generation component as follows:

[0030] 1.S represents the set X={x1,…,x m}, R represents the sender with the set Y={y1,…,y n}receiver.

[0031] 2. For any positive integer n, the symbol [n] = {1,…,n}.

[0032] 3.π represents random permutation.

[0033] 4.Bold lowercase letters represent vectors.

[0034] 5. The symbol || means concatenating two strings into one string.

[0035] 6. To represent Cuckoo Hashing. Specifically, this expression refers to the use of hash functions h1,h2,h3:{0,1} * →[B] Set X = {x i} i∈[m] Cuckoo hashes into B buckets. X c =(X c [1],…,X c [m c ]), where for every x∈X, there exists some i∈{1,2,3} such that X c [h i (x)]=x||i.

[0036] In addition, before constructing the PSU protocol, this embodiment first introduces the functions of the required related cryptographic components, including the batch oblivious pseudorandom function (bOPRF), the secret sharing privacy equivalence test protocol (ssPEQT), the randomized oblivious transfer protocol (ROT), and the oblivious key-value store (OKVS):

[0037] A. Batch Oblivious Pseudo-Random Function (bOPRF) Function: Participant R inputs set X = {x i} i∈[m] Run the bOPRF protocol with participant S, so that S obtains the pseudo-random function (PRF) key {k1,…,k m}, R obtains the corresponding PRF value {F(k1,x1),…,F(k m ,x m )}. That is, bOPRF can calculate the PRF values ​​of all elements of the receiver and send all PRF values ​​to the receiver R; different locations use different PRF keys, and all keys are sent to the sender S.

[0038] The specific protocol functions are described as follows:

[0039] A1. Receive the input {x1,…,x m}.

[0040] A2. Select a random PRF key {k1,…,k m}.

[0041] A3. Calculate the corresponding PRF values ​​{F(k1,x1),…,F(k m ,x m )}.

[0042] A4. Send to Simulator <request>.

[0043] A5. When receiving the Simulator<Request,OK> When PRF key {k1,…,k m }, send PRF values ​​{F(k1,x1),…,F(k m ,x m )}.

[0044] B. Secret Sharing Privacy Equivalence Test Protocol (ssPEQT) Function: Participant S inputs vector e = [e i ] i∈[m] , participant R inputs vector d=[d i ] i∈[m] , the two parties run the ssPEQT protocol so that S obtains the bit vector a=[a i ] i∈[m] and b=[b i ] i∈[m] , where for all i∈[m], if e i =d i , then a i ⊕b i =0, otherwise a i ⊕b i = 1. That is, ssPEQT can share the secret characteristics of whether the elements at the same position are equal, and send the secret sharing to the participants S and R respectively: for position i∈[m], if e i =d i , indicating that the feature is 0, generating a secret sharing i and b i , so that a i ⊕b i = 0. If e i ≠d i , indicating that the feature is 1, generating secret sharing a i and b i , so that a i ⊕b i =1.

[0045] The specific protocol functions are described as follows:

[0046] B1. Receive the input vector e=[e i ] i∈[m] .

[0047] B2. Receive the input vector d=[d i ] i∈[m] .

[0048] B3. Select two random bit vectors a = [a i ] i∈[m] and b=[b i ] i∈[m] , for all i∈[m], if e i =d i , then a i ⊕b i =0, otherwise a i ⊕b i =1.

[0049] B4. Send to Simulator <request>.

[0050] B5. When receiving the Simulator<Request,OK> When , bit vector a is sent to S and bit vector b is sent to R.

[0051] C. Random Oblivious Transfer (ROT) Protocol Function: Participant R inputs bits b∈{0,1} and participant S runs the ROT protocol, so that S obtains two random values ​​r0 and r1. R obtains a random value r b That is, ROT can output two random values ​​r0 and r1 to S according to the input bit b∈{0,1} of R, and output a random value r b To R.

[0052] The specific protocol functions are described as follows:

[0053] C1. Receive input bits b∈{0,1} from participant R.

[0054] C2. Select two random strings r0, r1←{0,1} of length l l .

[0055] C3. Send to Simulator Sim <request>.

[0056] C4. When receiving the simulator Sim sent<Request,OK> When sending random string r0, r1 to S, sending random string r to R b .

[0057] D. Oblivious Key-Value Store (OKVS): OKVS is a data structure that compactly represents a mapping from a set of keys to corresponding values. Specifically, OKVS encodes a set of participants R as key-value pairs. Upon receiving the encoded structure, the recipient can input the key and decode it to obtain the corresponding value. OKVS ensures both correctness and obliviousness.

[0058] The specific definitions are as follows:

[0059] D1.OKVS contains a key set K={k1,…,k n } and the corresponding value set V={v1,…,v n }, with two algorithms:

[0060] (1)Encode({(k1,v1),…,(k n ,v n )})→D: Input key-value pairs Output a code D (or output ⊥ with negligible probability in a statistical sense, where ⊥ represents an error symbol).

[0061] (2)Decode(D,k)→v: Input the code D and a key k, and output the value v∈V.

[0062] D2. Correctness: For all sets with distinct keys If (k,v)∈A and Encode(A)→D≠⊥, then Decode(D,k)→v.

[0063] D3. Casualness: For all different and If Encode is and If ⊥ is not output, the distribution With another distribution is computationally indistinguishable.

[0064] Step 2: Define the function of the permuted non-member conditional random number generation component and construct a secure and efficient permuted non-member conditional random number generation component.

[0065] Step 2.1: Define the function of permuted non-membership conditional random number generation (pnMCRG): Participant S inputs the set X = {x i } i∈[m] and a permutation π on the vector [m], the participant R inputs the set {Y i } i∈[m] , where each Y i Represents a subset containing multiple elements. S and R run the permutation non-member conditional random number generation protocol so that S obtains the vector u = [u i ] i∈[m] and R to obtain the vector v = [v i ] i∈[m] , where for all i∈[m], if Then u i =v i , otherwise u i ≠v i That is, pnMCRG can perform the same permutation π on the corresponding positions of sets X and Y, and then calculate the element x at the corresponding position i of the permuted set. π(i) and set Y π(i) , generate the same or different random numbers, that is, if Then generate the same random number u i =v i , if x π(i) ∈Y π(i) Then generate different random numbers u i ≠v i Finally, S obtains u i , R obtains v i .

[0066] The specific protocol functions are defined as follows:

[0067] Step 2.1.1: Initialize an ideal state for participant U Where U∈{S,R}; if U is destroyed, the simulator Sim can access the state state U .

[0068] Step 2.1.2: When receiving input X from S = {x i } i∈[m] and a permutation π on [m], update the state state S =<X,π> , and send to Sim<Request,S> .

[0069] Step 2.1.3: When receiving the input {Y i } i∈[m] When the state is updated R =<{Y i } i∈[m] > and send to Sim<Request,R> .

[0070] Step 2.1.4: When receiving the<Request,OK> When generating two random vectors u=u i ] i∈[m] and v=[v i ] i∈[m] , where for all i∈[m], if Then u i =v i , otherwise u i ≠v i .

[0071] Step 2.1.5: Add to state S ,Will <v>Add to state R .

[0072] Step 2.1.6: Output u = [u i ] i∈[m] Give S. Output v = [v i ] i∈[m] To R.

[0073] Step 2.2: Construct pnMCRG with linear complexity: Participant S inputs set X = {x i } i∈[m] and a permutation π on the vector [m], the participant R inputs the set {Y i } i∈[m] Among them, linear complexity means that the communication and computational complexity of the entire protocol is linearly related to the number of elements in the set.

[0074] The specific protocol structure is as follows:

[0075] Step 2.2.1: S and R call the bOPRF function:

[0076] 1) S inputs a set X={x i } i∈[m] .

[0077] 2) S obtains all elements x i The PRF value F(k i ,x i ),i∈[m]; R obtains the corresponding PRF key {k1,…,k m },i∈[m].

[0078] Step 2.2.2: For each i∈[m], R calculates Y i The PRF value of each element y ij =F(k i ,Y i [j]), where Y i [j] represents Y i The jth element in .

[0079] Step 2.2.3: R to {Y i } i∈[m] Perform OKVS encoding:

[0080] 1) R selects m random values ​​[t i ] i∈[m] ,definition

[0081] 2) R calculates OKVS: D = Encode(P) and sends D to S.

[0082] Step 2.2.4: S decoding s i =Decode(D,x i )⊕F(k i ,x i ),i∈[m].

[0083] Step 2.2.5: R selects a random value And calculate t' for all i∈[m] i =H(t i ) β , where H(·) represents a random oracle machine, and the output is the group Then set t'=[t' i ] i∈[m] Send to S.

[0084] Step 2.2.6: S selects a random value For t'=[t' i ] i∈[m] , calculate each position of i∈[m] and Next, S uses the same permutation π to permute and Get the permuted vector and Then Send to R.

[0085] Step 2.2.7: S Settings And output e=[e i ] i∈[m] .R Settings And output d=[d i ] i∈[m] .

[0086] Step 2.2.8: S and R call the ssPEQT function:

[0087] 1) S and R input vector e=[e i ] i∈[m] and d=[d i ] i∈[m] .

[0088] 2) S and R output bit vector a = [a i ] i∈[m] and b=[b i ] i∈[m] , where for all i∈[m], if e i =d i , then a i ⊕b i =0, otherwise a i ⊕b i =1.

[0089] Step 2.2.9: S and R call the ROT function in batches for each i∈[m]:

[0090] 1) For each i∈[m], R inputs b i .

[0091] 2) S obtains r i,0 and r i,1 ,i∈[m]. R obtains

[0092] Step 2.2.10: For all i∈[m], S sets R Settings

[0093] Step 2.2.11: S outputs the vector u = [u i ] i∈[m] . R output vector v = [v i ] i∈[m] .

[0094] Linear complexity implementation: The underlying construction components bOPRF, OKVS, ssPEQT, and ROT required for the construction of pnMCRG can all achieve linear communication and computational complexity, and the processes from steps 2.2.5 to 2.2.7 can also achieve linear communication and computational complexity. Therefore, the overall protocol pnMCRG construction can still achieve linear complexity.

[0095] Step 3: Construct a privacy set union protocol with enhanced security based on the permutation non-membership conditional random number generation component.

[0096] The PSU protocol with enhanced security based on linear complexity constructed by pnMCRG and cuckoo hash function: Participant S inputs the set X = {x i } i∈[m] , participant R inputs set Y = {y i } i∈[n] .

[0097] The specific protocol structure is as follows:

[0098] Step 3.1: S inserts the set X into the cuckoo hash table and fills the empty position with the virtual item d agreed in advance by both parties, where the cuckoo hash table X c =(X c [1],…,X c [m c ]) contains m c buckets, each containing only one element X c [i].

[0099] Step 3.2: R inserts the set Y into a simple hash table named by m using the same hash functions h1, h2, and h3. c Buckets Composition, each bucket contains B i =|Y i | elements.

[0100] Note: S and R use cuckoo hashing and simple hashing to get the set X = {x i } i∈[m] , and the set Y={y i } i∈[n] , perform element alignment: elements with the same hash value are placed in the same position, that is, for position i∈[m c ], if x i ∈Y, then x i ∈Y i ,if but So, x i It only needs to be compared with the elements in the corresponding bucket, and there is no need to compare with all elements of Y.

[0101] Step 3.3: S and R call the pnMCRG function: pnMCRG performs the same permutation π on corresponding positions in sets X and Y. Then, based on the bucket membership relationship of the element at position i in the permuted set, it generates the same or different random numbers. Specifically, if there is a membership relationship, a different random number is generated, and if there is a non-membership relationship, a different random number is generated. This random number is generated so that the non-membership element can be sent using a one-time pad, allowing the receiver to obtain the union element.

[0102] The specific steps are as follows:

[0103] 1) S selects [m c ] and input the set X c =(X c [1],…,X c [m c ]), and R input

[0104] 2) S obtain R obtain For i∈[m c ],if u i =v i , otherwise u i ≠v i .

[0105] Step 3.4: S calculates and c i =u i ⊕(X c [π(i)]||h(X c [π(i)])),i∈[m c ] is sent to R, where h is a pre-negotiated hash function used to distinguish real items from random values.

[0106] Step 3.5: R calculates m i ||m' i =v i ⊕c i , where i∈[m c For i∈[m c ], if m' i =h(m i ) and m i ≠d, then let Z=Y∪{m i }. R outputs the union Z. S outputs Finished.

[0107] Linear complexity implementation: The underlying construction components pnMCRG and cuckoo hash function required for the construction of PSU can achieve linear communication and computational complexity, so the overall protocol PSU construction can still achieve linear complexity.

[0108] Enhanced security implementation: The PSU protocol constructed based on pnMCRG and cuckoo hash function. During the operation of the protocol, both parties calculate the hash operation locally without leaking their respective information. Then both parties call the pnMCRG function, and S and R respectively obtain the permutation random sharing of the membership relationship of the elements of the S set. That is, for the permutation position that belongs to the membership relationship, both parties obtain different random numbers; for the permutation position that does not belong to the membership relationship, both parties obtain the same random number; (this operation does not leak the membership relationship); finally, the sender uses a method similar to the one-time pad to send the non-member elements to the receiver, so that R obtains the union.

[0109] To better demonstrate the enhanced effect of the permuted non-member conditional random number generation component constructed in this invention and achieve the proposed enhanced PSU with linear complexity, this invention is compared with the state-of-the-art work [JSZG24] in terms of communication and runtime under different network environments. [JSZG24] stands for Yanxue Jia, Shi-Feng Sun, Hong-Sheng Zhou, and Dawu Gu. Scalable private set union with stronger security. USENIX Security 2024.

[0110] Experimental platform: 8-core Intel Xeon Platinum CPU (16 threads) and 128GB of memory. Local area network (LAN) settings: Two-way communication with 10Gbps throughput and 0.2ms round-trip time (RTT). Three wide area network (WAN) settings: 100Mbps, 10Mbps, and 1Mbps bandwidth, with an RTT of 80ms for each setting. This example sets the computational security parameter to 128 bits and the statistical security parameter to 40 bits.

[0111]

[0112] Table 1 shows the comparison results with the state-of-the-art enhanced PSU [JSZG24] in terms of communication volume and running time. The best results in each case are marked in light red. As shown in Table 1, the enhanced PSU protocol of this embodiment performs well when the set size is from 2 10 to 2 20 The communication cost is reduced by 2.2 to 8.8 times in the range of [JSZG24]. Since the PSU complexity of [JSZG24] is superlinear, while the PSU complexity of the present invention is linear, the advantage of the PSU of the present invention is more obvious when the set size is larger. For a set size of 2 10 The PSU protocol in this embodiment runs 2.2 to 8.6 times faster than [JSZG24]. 20 ,In the bandwidth range of 1Mbps to 100Mbps, our protocol runs 1.5 to 8.3 times faster than [JSZG24].

[0113] Example 2:

[0114] A second embodiment of the present invention provides a system for constructing a linear complexity enhanced security and privacy set union protocol, including:

[0115] a parameter setting module, configured to define and set protocol parameters;

[0116] The component design module is configured to define the function of the permuted non-member conditional random number generation component and construct the permuted non-member conditional random number generation component;

[0117] The protocol construction module is configured to construct a privacy set union protocol with enhanced security based on a permuted non-member conditional random number generation component.

[0118] Example 3:

[0119] A third embodiment of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps in the method for constructing a linear complexity enhanced security and privacy set union protocol as described in the first embodiment of the present invention are implemented.

[0120] Example 4:

[0121] Embodiment 4 of the present invention provides a device, including a memory, a processor, and a program stored in the memory and runnable on the processor. When the processor executes the program, the steps in the method for constructing a linear complexity enhanced security and privacy set union protocol as described in Embodiment 1 of the present invention are implemented.

[0122] The steps involved in the above embodiments 2, 3 and 4 correspond to those in the method embodiment 1. For the specific implementation methods, please refer to the relevant description part of the embodiment 1.

[0123] Those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computer device. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0124] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.< / v> < / request> < / request> < / request>

Claims

1. A method for constructing a linear complexity enhanced security and privacy set union protocol, characterized in that: The following steps are involved: Define and set protocol parameters; Define the function of the permuted non-member conditional random number generation component and construct the permuted non-member conditional random number generation component. The function of the permuted non-member conditional random number generation component is described as follows: Participant S input set and vector A permutation on , participants Input Collection , each of which Represents a subset containing multiple elements, S and Run the permuted non-membership conditional random number generation protocol so that Get vector and Get vector , where for all ,if ,but ,otherwise ; The specific protocol construction process is as follows: S and R call the bOPRF function; S input a set , S gets all elements PRF value , ; R obtains the corresponding PRF key , ; For each , R calculation The PRF value of each element ,in express The elements; R pair Perform OKVS encoding; R selection Random values ,definition ; R calculates OKVS: , and Send to S; S decoding , ; R chooses a random value , and for all calculate ,in represents a random oracle machine whose output is the group , and then Send to S; S chooses a random value ,right Calculate each position and , then, S uses the same permutation To replace and , get the permuted vector and , then Send to R; S Settings And output , R settings And output ; S and R call the ssPEQT function; S and R input vectors and , S and R output bit vectors and , where for all ,like ,but ,otherwise ; S and R for each Batch call ROT function; For each , R input , SGet and , R obtains , For all , S settings , R settings ; S output vector , R output vector ; Constructing a privacy set union protocol with enhanced security based on a permutation-based non-member conditional random number generation component; Based on the permutation non-member conditional random number generation component and the cuckoo hash function, a privacy set union protocol with enhanced security is constructed. The specific steps are as follows: S inserts the set X into the cuckoo hash table and fills the empty position with the virtual item d agreed in advance by both parties, where the cuckoo hash table Include buckets, each containing only one element ; Use the same hash function will be collected Insert into a simple hash table consisting of Buckets Composition, each bucket contains elements; S and R call the pnMCRG function; S calculates and Sent to R, h is a pre-negotiated hash function used to distinguish real items from random values; R calculation ,in ,for ,if and , then let , R outputs the union , S output .

2. The method for constructing a linear complexity enhanced security and privacy set union protocol according to claim 1, wherein: The permuted non-member conditional random number generation component function is defined as: For participants Initialize an ideal state ,in ;if Destroyed, simulator Access Status ; When receiving from Input and in A permutation on Update status , and to send ; When receiving from Input Update status , and to send ; When receiving from of When , two random vectors are generated and , where for all ,if ,but ,otherwise ; Will Add to Status ,Will Add to Status ; Output Give , output Give .

3. A linear complexity enhanced security and privacy set union protocol construction system, characterized by: A method for constructing a linear complexity enhanced security and privacy set merging protocol according to any one of claims 1 to 2, comprising: a parameter setting module, configured to define and set protocol parameters; The component design module is configured to define the function of the permuted non-member conditional random number generation component and construct the permuted non-member conditional random number generation component; The protocol construction module is configured to construct a privacy set union protocol with enhanced security based on a permuted non-member conditional random number generation component.

4. A computer-readable storage medium, characterized in that A plurality of instructions are stored therein, which are suitable for being loaded and executed by a processor of a terminal device. The method for constructing a linear complexity enhanced security and privacy set union protocol according to any one of claims 1-2 is disclosed.

5. A terminal device, characterized in that: The invention comprises a processor and a computer-readable storage medium, wherein the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the method for constructing a linear complexity enhanced security and privacy set union protocol according to any one of claims 1-2.

Images