Unbalanced privacy set intersection calculation method and system based on Hash proof system

Abstract

The invention relates to an unbalanced privacy set intersection calculation method and system based on a Hash proof system. The method comprises the following steps: 1.1, key generation and parameter exchange; 1.2, preprocessing by a client; for local elements of a client, inserting all the elements into a cuckoo hash table by using three groups of hash functions H1, H2 and H3; 1.3, preprocessing at the server side; inserting all elements into a simple hash table by using three groups of hash functions H1, H2 and H3; 2.1, intersection is carried out; 2.2, verification is carried out; according to the method, the intersection of the two sets can be safely obtained by the client on the premise of not leaking the privacy data of the participants, only one round of communication is needed in the protocol online stage, and the total communication traffic is only in linear relation with the size of the small set and is irrelevant to the size of the large set.

Description

Technical Field

[0001] The present invention relates to a method and system for calculating the intersection of unbalanced privacy sets based on a hash proof system, and belongs to the technical field of multi-party secure computing. Background Art

[0002] With the rapid development of information technology and the surge in data generation, the importance of data privacy protection has become increasingly prominent. In fields such as healthcare, finance, and advertising, different organizations and institutions hold a large amount of sensitive data. This data includes not only personal identity information, but also business secrets, financial information, and health records. For compliance, ethical, and commercial confidentiality reasons, data sharing needs to be carried out on the basis of privacy protection, which poses a challenge to data sharing. Traditional data sharing methods usually rely on centralized data storage or trusted third parties to regulate and manage data access.

[0003] However, these methods have the following problems: 1) Single point failure: Once the centrally stored data is breached, the data security of all participants will be threatened; 2) Privacy leakage risk: During the data sharing process, the data of all participants may be overexposed, exceeding the original purpose of data sharing; 3) Trust issue: In the absence of a trusted third party, how to ensure the security and integrity of data is a huge challenge. Therefore, without relying on a trusted third party, it becomes a key requirement to achieve secure data sharing and privacy protection through cryptographic methods. At the same time, in data sharing and collaboration, the data sets of different data holders are often unbalanced: the data set of one data holder may be much larger than the data set of another data holder. For example: in the medical field, large hospitals have a large number of patient records, while small clinics or research institutions have relatively small data sets; in the field of advertising and marketing, advertising platforms may have millions of user data, while the data sets of specific enterprises or advertisers may be relatively small; in financial services, large banks and financial institutions have far more customer data than small financial companies or third-party credit assessment agencies. Since this unbalanced data scenario may cause the party with the large data set to have significantly higher communication and computational overhead than the party with the small data set, research on unbalanced private set intersection (UPSI) has emerged. The UPSI protocol is specifically designed for interaction between two parties with significantly different data sets. However, existing UPSI protocols often require the party with the small set to store and compute data related to the size of the large set, which is unacceptable for parties with scarce computing and storage resources (such as mobile devices, etc.). Therefore, it is necessary to design a UPSI protocol with low communication and computational overhead that can be accepted by mobile devices. Summary of the invention

[0004] In view of the shortcomings of the prior art, in order to efficiently obtain the intersection from two privacy-protected sets of two parties under the premise of protecting the privacy security of both parties, the present invention proposes an efficient unbalanced privacy set intersection protocol based on a discrete logarithm generated key hash proof system, which can securely obtain the intersection of two sets by the client without leaking the privacy data of the participants. The protocol only requires one round of communication and the total communication volume is only linearly related to the size of the small set and has nothing to do with the size of the large set.

[0005] Terminology explanation:

[0006] 1. Simple hash table: Map element x to a simple hash table through hash function H(). If the hash table is st, H(x) = 3, then put element x in the third hash bucket st of hash table st. 3 In , each hash bucket can store multiple elements, and so on;

[0007] 2. Hash Proof System: Hash Proof System is a cryptographic construct first proposed by Cramer and Shoup in 2002. It is a tool for proving that specific information meets certain conditions and is widely used in cryptographic protocols, especially public key encryption, proof and verification. Hash Proof System provides a mechanism that allows users to generate a proof that a ciphertext is encrypted in a specific way without revealing the content of the message. In other words, HPS allows the prover to prove that a value belongs to a specific set without revealing other information. The system can be used in many scenarios in cryptographic protocols, such as set membership proof, private set intersection (PSI), etc.

[0008] 3. Cuckoo Hash: Cuckoo Hash is a hash table technology proposed by Rasmus Pagh and Flemming Friche Rodler in 2001 to solve the hash conflict problem. It refers to the biological habits of cuckoos in nature. The core idea is to use two or more hash functions to insert each element into the corresponding slot. If the slot is occupied, the existing element will be "evicted" and reinserted into its other hash slot. This "eviction" mechanism enables Cuckoo Hash to maintain efficient search performance at high load factors.

[0009] The technical solution of the present invention is:

[0010] A method for calculating the intersection of unbalanced private sets based on a hash proof system, comprising:

[0011] The present invention involves two participants: a client and a server. The client input set is X={x1 ,x 2 ,…,x n}, the server input set is Y = {y 1 ,y 2 ,…,y m}; The number of candidate buckets for cuckoo hash is 3; The client and server jointly discuss three sets of hash functions H 1 , H 2 , H 3 ; The specific process is as follows:

[0012] 1. Offline setup phase:

[0013] 1.1 Key generation and parameter exchange;

[0014] The server selects a private key from the private key space and executes the key generation algorithm to generate a public key. After randomly selecting a vector a, the server sends the parameter information including the random vector a, the public key pk, the random matrix A, and the HPS modulus N to the client. After receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N. i , and then let g i for The primitive root of , and choose the appropriate proof w i , the client will modulus N i and i Send to the server;

[0015] 1.2 Client preprocessing;

[0016] For the local elements of the client, three sets of hash functions H are used 1 , H 2 , H 3 Insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0017] 1.3 Server-side preprocessing;

[0018] For local elements on the server side, three sets of hash functions H are used 1 , H 2 , H 3Insert all elements into a simple hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0019] Use the private key and random vector a to encrypt the elements on the server side bit by bit;

[0020] 2. Online calculation stage:

[0021] 2.1 Seek intersection;

[0022] The client uses the random vector a and the proof w to encrypt the local element to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext with the private key and subtracts it from the ciphertext encrypted with its own local private key. Then, the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element is exponentially compressed and the exponentially compressed result is returned to the client.

[0023] 2.2 Verification;

[0024] After receiving the ciphertext subtraction result after exponential compression, the client calculates through local private parameters to check whether a result is an intersection result. If it is an intersection result, the intersection element is output.

[0025] Preferably, according to the present invention, key generation and parameter exchange include:

[0026] First, the server selects a private key sk from the private key space SK and executes the key generation algorithm Gen( ) to generate a public key pk, satisfying pk = sk·A mod N; A is a random matrix, N is the modulus of HPS, and HPS refers to the hash proof system;

[0027] Then, randomly select t random vectors {a 1 ,a 2 ,…,a t}, t is the bit length of the element, {pk,A,a 1 ,a 2 ,…,a t ,N} sent to the client;

[0028] The client selects a random large prime number p i And a random number k, k ≥ 2, let p i is a randomly selected large prime number, k is a random number, N i is the modulus of the client-side processed element, And p i |N i , That is N i Euler function, let g i for The original root, satisfied The client selects the certificate w i So that it satisfies pk·w i =p i , i∈[n]; n is the number of client elements;

[0029] Finally, the client will {N 1 ,N 2 ,…,N n ,g 1 ,g 2 ,…,g n}Sent to the server.

[0030] Preferably, according to the present invention, client preprocessing includes:

[0031] For each element x of the client i , using three sets of hash functions H 1 , H 2 , H 3 , insert all elements into a cuckoo hash table;

[0032] First, traverse position H 1 (x i ), H 2 (x i ), H 3 (x i ), H 1 (x i ), H 2 (x i ), H 3 (x i ) refer to the i-th element in the client set X being hashed by three sets of hash functions H 1 , H 2 , H 3 The processed hash value points to three positions in the hash table; if there is an empty position, insert it directly, otherwise, randomly kick out an element x j , and calculate x j In addition to the kicked out position, if there is another candidate position that is empty, insert it directly, otherwise, kick out another element x k , and repeat the above operation until the maximum number of cycles is reached. The size of the client's cuckoo hash table is b, b = fn and is linearly related to n. The remaining part of the client's hash table is supplemented with virtual elements.

[0033] Preferably, according to the present invention, server-side preprocessing includes:

[0034] For each element y on the server side j , using three sets of hash functions H 1 , H 2 , H 3 , insert all elements into a simple hash table st of size b , In; the server needs to insert 3m elements in total, and the bucket size of the simple hash table is max b , max b The average size of a simple hash table is 3M / B. i The remaining space is also supplemented with virtual elements.

[0035] Preferably, according to the present invention, the elements on the server side are bitwise encrypted using a private key and a random vector a; comprising:

[0036] The server uses the private key sk and the random vector a r For each simple hash table st i The y in j Perform bitwise encryption to obtain ciphertext y j,r That is, the rth position of the jth element on the server side in the simple hash table, max b The bucket size for a simple hash table.

[0037] Preferably, according to the present invention, finding the intersection includes:

[0038] The client calculates b ciphertexts: pc i =i i,r x i,r a r +Aw i mod N,i∈[b],r∈[t],x i,r is the rth position of the i-th element of the client, a r is the rth random vector a; and {pc 1 ,pc 2 ,…,pc b}Send to the server;

[0039] On the server side, {pc 1 ,pc 2 ,…,pc b}, use the private key sk to log each pc i Encrypt and get For i∈[1,2,…,b],j∈[1,2,…,max b ],calculate z i,j is an intermediate parameter, which means the result of subtracting the ciphertext of the client element from the server element; z i,j After that, calculate Ans i is the intermediate parameter, which is to convert m z i,j Multiply and put it in the generator g i on the index of; and {Ans 1 ,Ans 2 ,…,Ans b}Return to the client.

[0040] Preferably, according to the present invention, verification comprises:

[0041] The client receives {Ans 1 ,Ans 2 ,…,Ans b}, then e i is the intermediate calculation parameter, That is N i Euler function of ; check Is the value of 1, i∈[1,2,…,b], if z i,j =p i ,but If it is 1, add the element to set R and finally output the intersection set R.

[0042] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a method for calculating the intersection of unbalanced private sets based on a hash proof system are implemented.

[0043] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for calculating the intersection of unbalanced private sets based on a hash proof system.

[0044] A non-balanced privacy set intersection calculation system based on a hash proof system, comprising:

[0045] The key generation and parameter exchange module is configured as follows: the server selects a private key from the private key space and executes the key generation algorithm to generate a public key, then randomly selects a vector a and sends parameter information including random vector a, public key pk, random matrix A, and HPS modulus N to the client; after receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N i , and then let g i for The primitive root of , and choose the appropriate proof wi , the client will modulus N i and i Send to the server;

[0046] The client preprocessing module is configured to: for the local elements of the client, use three sets of hash functions H 1 , H 2 , H 3 Insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0047] The server-side preprocessing module is configured to: for the local elements on the server side, use three sets of hash functions H 1 , H 2 , H 3 Insert all elements into a simple hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, inserting directly if there is an empty candidate position, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; using the private key and random vector a to encrypt the elements on the server side bit by bit;

[0048] The intersection module is configured as follows: the client encrypts the local element using the random vector a and the proof w to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext using the private key and subtracts the ciphertext from the ciphertext encrypted by the private key locally, then exponentially compresses the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element, and returns the exponentially compressed result to the client.

[0049] The verification module is configured as follows: after the client receives the ciphertext subtraction result after exponential compression, it calculates through local private parameters to check whether a certain result is an intersection result, and if it is an intersection result, outputs the intersection element.

[0050] The beneficial effects of the present invention are:

[0051] 1. The present invention proposes an efficient unbalanced private set intersection protocol based on a key hash proof system generated by discrete logarithms. The client can securely obtain the intersection of two sets without leaking the private data of the participants. The protocol only requires one round of communication in the online stage, and the total communication volume is only linearly related to the size of the small set and has nothing to do with the size of the large set (that is, the communication complexity is O(n)).

[0052] 2. In the offline setup phase based on matching hashes before the online phase of the protocol, different hash setup strategies are used between the server and the client to reduce the number of elements that each client needs to compare from m to max. b (The average size is 3m / b), reducing the computational overhead on the server side.

[0053] 3. The private key sk and public key pk in the protocol can be reused in different rounds, which reduces the overhead required for repeated encryption on the server side compared to the scheme based on homomorphic encryption.

[0054] 4. During the key generation phase on the client, the modulus N i The generation method is changed from multiplying two large prime numbers to the kth power of a large prime number, and the difficult problem is changed from the large integer decomposition problem to a special discrete logarithm problem, which reduces the key length and enhances security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of a method for calculating the intersection of unbalanced private sets based on a hash proof system of the present invention;

[0056] Figure 2 The client-side cuckoo hash representation of the present invention is intended;

[0057] Figure 3 This is a simple hash representation of the server side of the present invention;

[0058] Figure 4 The maximum number of elements in 30 random hash buckets on the server side after matching hash optimization b Schematic diagram;

[0059] Figure 5 A schematic diagram comparing the number of elements that need to be compared during the intersection process before and after matching hash optimization. DETAILED DESCRIPTION

[0060] The present invention will be further defined below in conjunction with the accompanying drawings and embodiments, but is not limited thereto.

[0061] Example 1

[0062] A method for calculating the intersection of unbalanced private sets based on a hash proof system, comprising:

[0063] The present invention involves two participants: a client and a server. The client input set is X={x 1 ,x 2 ,…,x n}, the server input set is Y = {y 1 ,y 2 ,…,y m}; The number of candidate buckets for cuckoo hash is 3; The client and server jointly discuss three sets of hash functions H 1 , H 2 , H 3 ; The specific process is as follows:

[0064] 1. Offline setup phase:

[0065] 1.1 Key generation and parameter exchange;

[0066] The server selects a private key from the private key space and executes the key generation algorithm to generate a public key. After randomly selecting a vector a, the server sends the parameter information including the random vector a, the public key pk, the random matrix A, and the HPS modulus N to the client. After receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N. i , and then let g i for The primitive root of , and choose the appropriate proof w i , the client will modulus N i and i Send to the server;

[0067] 1.2 Client preprocessing;

[0068] For the local elements of the client, three sets of hash functions H are used 1 , H 2 , H 3 Insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0069] 1.3 Server-side preprocessing;

[0070] For local elements on the server side, three sets of hash functions H are used 1 , H 2 , H 3Insert all elements into a simple hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0071] Use the private key and random vector a to encrypt the elements on the server side bit by bit;

[0072] 2. Online calculation stage:

[0073] 2.1 Seek intersection;

[0074] The client uses the random vector a and the proof w to encrypt the local element to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext with the private key and subtracts it from the ciphertext encrypted with its own local private key. Then, the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element is exponentially compressed and the exponentially compressed result is returned to the client.

[0075] 2.2 Verification;

[0076] After receiving the ciphertext subtraction result after exponential compression, the client calculates through local private parameters to check whether a result is an intersection result. If it is an intersection result, the intersection element is output.

[0077] Example 2

[0078] The difference between the unbalanced privacy set intersection calculation method based on the hash proof system described in Example 1 is that:

[0079] Key generation and parameter exchange; including:

[0080] First, the server selects a private key sk from the private key space SK and executes the key generation algorithm Gen() to generate a public key pk, satisfying pk = sk·A mod N; A is a random matrix, N is the modulus of HPS, and HPS refers to the Hash Proof System.

[0081] Then, randomly select t random vectors {a 1 ,a 2 ,…,a t}, t is the bit length of the element, {pk,A,a 1 ,a 2 ,…,a t ,N} sent to the client;

[0082] The client selects a random large prime number p i And a random number k, k ≥ 2, let p i is a large prime number randomly selected, the length is a security parameter such as 128, 256, etc., k is a random number, N i is the modulus of the client-side processed element, And p i |N i , That is N i Euler function, let g i for The original root, satisfied The client selects the certificate w i So that it satisfies pk·w i =p i , i∈[n]; n is the number of client elements;

[0083] Finally, the client will {N 1 ,N 2 ,…,N n ,g 1 ,g 2 ,…,g n}Sent to the server.

[0084] Client-side preprocessing; including:

[0085] For each element x of the client i , using three sets of hash functions H 1 , H 2 , H 3 , three sets of hash functions H 1 , H 2 , H 3 Three different sets of hash functions that are as evenly distributed as possible can be used, such as SHA-256; insert all elements into a cuckoo hash table;

[0086] First, traverse position H 1 (x i ), H 2 (x i ), H 3 (x i ), H 1 (x i ), H 2 (x i ), H 3 (c i ) refer to the i-th element in the client set X being hashed by three sets of hash functions H 1 , H 2 , H 3The processed hash value points to three positions in the hash table; if there is an empty position, insert it directly, otherwise, randomly kick out an element x j , and calculate x j In addition to the kicked out position, there are two other candidate positions. For example, if x j From H 1 (x j ) is kicked out, then H 2 (x j ), H 3 (x j ) are the other two candidate positions, and so on; if there is an empty candidate position, insert it directly, otherwise, kick out another element x k , and repeat the above operation until the maximum number of cycles is reached. The size of the client's cuckoo hash table is b, b = fn (b is slightly larger than n, the relationship between b and n depends on the load factor f of the cuckoo hash, f = n / b, usually around 1.2-1.3) and is linearly related to n. The remaining part of the client's hash table is supplemented with virtual elements. The client inserts the cuckoo hash table as follows Figure 2 shown.

[0087] Server-side preprocessing; including:

[0088] For each element y on the server side j , using three sets of hash functions H 1 , H 2 , H 3 , insert all elements into a simple hash table st of size b i In; the server needs to insert 3m elements in total, and the bucket size of the simple hash table is max b , max b The average size of a simple hash table is 3M / B. i The remaining part of is also supplemented with virtual elements. At this time, in the subsequent intersection process, the average number of server-side elements that each client element needs to compare is max b , server-side simple hash table insertion such as Figure 3 shown.

[0089] Use the private key and random vector a to encrypt the server-side elements bit by bit; including:

[0090] The server uses the private key sk and the random vector a r For each simple hash table st i The y in j Perform bitwise encryption to obtain ciphertext y j,r That is, the rth position of the jth element on the server side in the simple hash table, max bThe bucket size for a simple hash table.

[0091] Request for intersection; including:

[0092] The client calculates b ciphertexts: pc i =∑ i,r x i,r a r +Aw i mod N,i∈[b],r∈[t],x i,r is the rth position of the i-th element of the client, a r is the rth random vector a; and {pc 1 ,pc 2 ,…,pc b}Send to the server;

[0093] On the server side, {pc 1 ,pc 2 ,…,pc b}, use the private key sk to log each pc i Encrypt and get For i∈[1,2,…,b],j∈[1,2,…,max b ],calculate z i,j is an intermediate parameter, which means the result of subtracting the ciphertext of the client element from the server element. Obviously, if element x is equal to element y, then z i,j =p i , we get z i,j After that, calculate Ans i is the intermediate parameter, which is to convert m z i,j Multiply and put it in the generator g i on the index of; and {Ans 1 ,Ans 2 ,…,Ans b}Return to the client.

[0094] Verification; including:

[0095] The client receives {Ans 1 ,Ans 2 ,…,Ans b}, then e i is the intermediate calculation parameter, That is N i Euler function of ; check Is the value of 1, i∈[1,2,…,b], if z i,j =pi ,but If it is 1, the element is added to the set R, and finally the intersection set R is output. The protocol flow chart is as follows Figure 1 shown.

[0096] This embodiment designs an experiment to verify the correctness of the matching hash strategy in the offline phase and the exponential and modulo operations in the online phase. The matching hash is mainly achieved by using the same hash function on both the client and the server but executing different hash strategies: the client uses cuckoo hashing and the server uses simple hashing. This ensures that for each client element x i , if there is an element y equal to it on the server side j , then y j Must be in the i-th bucket st in the server-side hash table i The number of elements in the bucket is max. b That is, the number of elements that the client element needs to compare. The number of server-side elements that each client element needs to compare is reduced from m to an average of 3m / b. The maximum number of elements in 30 random hash buckets on the server after matching hash optimization is b like Figure 4 As shown, when m = 10000 and b = 100, max b The average size of is only 300, such as Figure 5 The figure shows the number of elements m and max that need to be compared before and after matching hash optimization. b comparison.

[0097] Example 3

[0098] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method for calculating the intersection of unbalanced private sets based on a hash proof system described in embodiment 1 or 2 are implemented.

[0099] Example 4

[0100] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the unbalanced privacy set intersection calculation method based on a hash proof system described in Example 1 or 2.

[0101] Example 5

[0102] A non-balanced privacy set intersection calculation system based on a hash proof system, comprising:

[0103] The key generation and parameter exchange module is configured as follows: the server selects a private key from the private key space and executes the key generation algorithm to generate a public key, then randomly selects a vector a and sends parameter information including random vector a, public key pk, random matrix A, and HPS modulus N to the client; after receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N i , and then let g i for The primitive root of , and choose the appropriate proof w i , the client will modulus N i and i Send to the server;

[0104] The client preprocessing module is configured to: for the local elements of the client, use three sets of hash functions H 1 , H 2 , H 3 Insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of loops is reached;

[0105] The server-side preprocessing module is configured to: for the local elements on the server side, use three sets of hash functions H 1 , H 2 , H 3 Insert all elements into a simple hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, inserting directly if there is an empty candidate position, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; using the private key and random vector a to encrypt the elements on the server side bit by bit;

[0106] The intersection module is configured as follows: the client encrypts the local element using the random vector a and the proof w to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext using the private key and subtracts the ciphertext from the ciphertext encrypted by the private key locally, then exponentially compresses the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element, and returns the exponentially compressed result to the client.

[0107] The verification module is configured as follows: after the client receives the ciphertext subtraction result after exponential compression, it calculates through local private parameters to check whether a certain result is an intersection result, and if it is an intersection result, outputs the intersection element.

Claims

1. A method for calculating the intersection of unbalanced private sets based on a hash proof system, characterized in that: include:

1. Offline setup phase: 1.1 Key generation and parameter exchange; The server selects a private key from the private key space and executes the key generation algorithm to generate a public key. After randomly selecting a vector a, the server sends parameter information including random vector a, public key pk, random matrix A, and HPS modulus N to the client. After receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N i , and then let g i for The primitive root of , and choose the appropriate proof w i , the client will modulus N i and i Send to the server; 1.2 Client preprocessing; For the local elements of the client, use three sets of hash functions H1, H2, and H3 to insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three sets of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; 1.3 Server-side preprocessing; For local elements on the server side, three sets of hash functions H1, H2, and H3 are used to insert all elements into a simple hash table: including: traversing the index positions calculated by the three sets of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is an empty candidate position, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; Use the private key and random vector a to encrypt the elements on the server side bit by bit; 2. Online calculation stage: 2.1 Seek intersection; The client uses the random vector a and the proof w to encrypt the local element to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext with the private key and subtracts it from the ciphertext encrypted with its own local private key. Then, the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element is exponentially compressed and the exponentially compressed result is returned to the client. 2.2 Verification; After receiving the ciphertext subtraction result after exponential compression, the client calculates through local private parameters to check whether a result is an intersection result. If it is an intersection result, the intersection element is output.

2. According to claim 1, a method for calculating the intersection of unbalanced private sets based on a hash proof system is characterized in that: Key generation and parameter exchange; including: First, the server selects a private key sk from the private key space SK and executes the key generation algorithm Gen() to generate a public key pk, satisfying pk = sk·A mod N; A is a random matrix, N is the modulus of HPS, and HPS refers to the hash proof system; Then, randomly select t random vectors {a1, a2, …, a t }, t is the bit length of the element, {pk,A,a1,a2,…,a t ,N} sent to the client; The client selects a random large prime number p i And a random number k, k ≥ 2, let p i is a randomly selected large prime number, k is a random number, N i is the modulus of the client-side processed element, and That is N i Euler function, let g i for The original root, satisfied The client selects the certificate w i So that it satisfies pk·w i =p i , i∈[n]; n is the number of client elements; Finally, the client sends {N1,N2,…,N3,g1,g2,…,g3} to the server.

3. According to claim 1, a method for calculating the intersection of unbalanced private sets based on a hash proof system is characterized in that: Client-side preprocessing; including: For each element x of the client i , using three sets of hash functions H1, H2, and H3, insert all elements into a cuckoo hash table; First, traverse position H1(x i )、H2(x i )、H3(x i ), H1(x i )、H2(x i )、H3(x i ) refer to the hash values ​​of the i-th element in the client set X after being processed by three sets of hash functions H1, H2, and H3, pointing to three positions in the hash table; if there is an empty position, insert it directly, otherwise, randomly kick out an element x j , and calculate x j In addition to the kicked out position, if there is another candidate position that is empty, insert it directly, otherwise, kick out another element x k , and repeat the above operation until the maximum number of cycles is reached. The size of the client's cuckoo hash table is b, b = fn and is linearly related to n. The remaining part of the client's hash table is supplemented with virtual elements.

4. According to claim 1, a method for calculating the intersection of unbalanced private sets based on a hash proof system is characterized in that: Server-side preprocessing; include: For each element y on the server side j , using three sets of hash functions H1, H2, H3, insert all elements into a simple hash table st of size b i In; the server needs to insert 3m elements in total, and the bucket size of the simple hash table is max b , max b The average size of a simple hash table is 3M / B. i The remaining space is also supplemented with virtual elements.

5. According to claim 1, a method for calculating the intersection of unbalanced private sets based on a hash proof system is characterized in that: Use the private key and random vector a to encrypt the server-side elements bit by bit; including: The server uses the private key sk and the random vector a r For each simple hash table st i The y in j Perform bitwise encryption to obtain ciphertext j∈[max b ],r∈[t],y j,r That is, the rth position of the jth element on the server side in the simple hash table, max b The bucket size for a simple hash table.

6. The method for calculating the intersection of unbalanced private sets based on a hash proof system according to claim 1, characterized in that: Request for intersection; including: The client calculates b ciphertexts: pc i =∑ i,r x i,r a r +Aw i mod N,i∈[b],r∈[t],x i,r is the rth position of the i-th element of the client, a r is the rth random vector a; and {pc1,pc2,…,pc b }Send to the server; When the server receives {pc1,pc2,…,pc b }, use the private key sk to log each pc i Encrypt and get i∈[1,2,…,b], for i∈[1,2,…,b], j∈[1,2,…,max b ],calculate z i,j is an intermediate parameter, which means the result of subtracting the ciphertext of the client element from the server element; z i,j After that, calculate Ans i is the intermediate parameter, which is to convert m z i,j Multiply and put it in the generator g i on the index of; and {Ans1,Ans2,…,Ans b }Return to the client.

7. The method for calculating the intersection of unbalanced private sets based on a hash proof system according to claim 1, characterized in that: Verification; including: The client receives {Ans1,Ans2,…,Ans b }, then e i is the intermediate calculation parameter, That is N i Euler function of ; check Is the value of 1, i∈[1,2,…,b], if z i,j =p i ,but If it is 1, add the element to set R and finally output the intersection set R.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the unbalanced privacy set intersection calculation method based on the hash proof system described in any one of claims 1-7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the unbalanced privacy set intersection calculation method based on a hash proof system described in any one of claims 1 to 7 are implemented.

10. An unbalanced privacy set intersection calculation system based on a hash proof system, characterized in that: include: The key generation and parameter exchange module is configured as follows: the server selects a private key from the private key space and executes the key generation algorithm to generate a public key, and then randomly selects a vector a and sends parameter information including random vector a, public key pk, random matrix A, and HPS modulus N to the client; After receiving the parameter information, the client randomly selects a large prime number and a random number to generate a modulus N i , and then let g i for The primitive root of , and choose the appropriate proof w i , the client will modulus N i and i Send to the server; The client preprocessing module is configured to: for the local elements of the client, use three groups of hash functions H1, H2, and H3 to insert all elements into a cuckoo hash table: including: traversing the index positions calculated by the three groups of hash functions, directly inserting if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked out position, if there is a candidate position that is empty, directly inserting, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; The server-side preprocessing module is configured to: for local elements on the server side, use three groups of hash functions H1, H2, and H3 to insert all elements into a simple hash table: including: traversing the index positions calculated by the three groups of hash functions, inserting directly if there is an empty position, otherwise randomly kicking out an element, and calculating the other two candidate positions of the kicked element except the kicked-out position, if there is a candidate position that is empty, inserting directly, otherwise kicking out another element, and repeating the above operations until the maximum number of cycles is reached; using the private key and the random vector a to encrypt the elements on the server side bit by bit; The intersection module is configured as follows: the client encrypts the local element using the random vector a and the proof w to obtain the ciphertext and then sends the ciphertext to the server. After receiving the ciphertext sent by the client, the server encrypts the ciphertext using the private key and subtracts the ciphertext from the ciphertext encrypted by the private key locally, then exponentially compresses the subtraction result of all elements in the hash box of the simple hash table corresponding to the client element, and returns the exponentially compressed result to the client. The verification module is configured as follows: after the client receives the ciphertext subtraction result after exponential compression, it calculates through local private parameters to check whether a certain result is an intersection result, and if it is an intersection result, outputs the intersection element.

Images