Privacy set intersection methods, apparatuses, devices, and systems

Abstract

Embodiments of the present application provide a private set intersection method, device, equipment and system, and relate to the field of information security. The method comprises: generating at least one index data, and sending the i-th index data to a second computing device; wherein the i-th index data is used to obtain the i-th confusion data; the i-th confusion data is based on the selection result of the OT operation of the i-th blind data; receiving the i-th confusion data sent by the second computing device; and determining the first hash value of each second private data in the second private set according to the i-th confusion data and the second private set of the first computing device; receiving the second hash value of the i-th first private data sent by the second computing device; and determining the intersection according to the second hash value and each first hash value. The method of the present application reduces the number of overall data interactions, improves the operation and communication efficiency.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method, apparatus, device and system for obtaining the intersection of privacy sets. Background Art

[0002] Privacy computing technology is a key technology for achieving "available but invisible" data. Among them, privacy set intersection is an important branch of secure multi-party computing. It allows data-holding participants to obtain the intersection data between the privacy sets of each participant through calculation without leaking any data information other than the intersection data, such as user data or device data and other privacy data that needs to be protected.

[0003] In the existing technology, based on the Oblivious Transfer (OT) design framework, the classic OT protocol is used to randomly blindly transmit private data in the privacy set to be intersected, and perform intersection processing to achieve the effect of privacy protection.

[0004] However, in the above method, the oblivious transmission method is adopted, and the number of times the OT protocol is performed is related to the data format. For each privacy set with a longer data format, the more times the OT protocol needs to be operated, resulting in an increase in the communication overhead required for the calculation process, affecting the overall computing efficiency. Summary of the Invention

[0005] The embodiments of the present application provide a privacy set intersection method, apparatus, device, and system to solve the technical problem that the longer the data format of each privacy set, the more times the OT protocol needs to be operated, resulting in an increase in the communication overhead required for the calculation process and affecting the overall computing efficiency.

[0006] In a first aspect, an embodiment of the present application provides a privacy set intersection method, the method being applied to a first computing device in a secure computing system; the secure computing system also includes a second computing device; the method comprising:

[0007] Generate at least one subscript data and send the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is selected based on the result of performing an oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained based on processing the i-th first private data in the first privacy set of the second computing device;

[0008] receiving an i-th obfuscated data sent by the second computing device; and determining a first hash value of each second private data in the second private set based on the i-th obfuscated data and the second private set of the first computing device;

[0009] Receive a second hash value of the i-th first private data sent by the second computing device; and determine an intersection based on the second hash value and each of the first hash values; wherein the intersection includes private data common to the first privacy set and the second privacy set.

[0010] In one possible implementation, determining, based on the i-th obfuscated data and the second privacy set of the first computing device, a first hash value of each second private data in the second privacy set includes:

[0011] Determining a target encryption algorithm; and generating a target pseudo-random function based on the target encryption algorithm;

[0012] Determine a first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data.

[0013] In one possible implementation, generating a target pseudorandom function according to the target encryption algorithm includes:

[0014] Determining public key parameters and private key parameters; and sending the public key parameters to the second computing device; wherein the public key parameters are used to generate encrypted information, the encrypted information including obfuscation parameter information and key information of the target encryption algorithm;

[0015] receiving the encrypted information sent by the second computing device; and decrypting the encrypted information according to the private key parameters to obtain obfuscation parameter information and key information of the target encryption algorithm;

[0016] The target pseudo-random function is generated according to the key information, the obfuscation parameter information and the target encryption algorithm.

[0017] In one possible implementation, generating the target pseudo-random function according to the key information, the obfuscation parameter information, and the target encryption algorithm includes:

[0018] The target pseudo-random function is generated according to the key information, the obfuscation parameter information, the target encryption algorithm and the encryption parameter information of the target encryption algorithm; wherein the encryption parameter information represents the parameter form of the target encryption algorithm.

[0019] In one possible implementation, determining the first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data includes:

[0020] determining, according to the i-th obfuscated data, the target pseudo-random function, and the second private data, comparison data corresponding to the second private data;

[0021] Perform a hash operation on the comparison data to obtain a first hash value of the second private data.

[0022] In one possible implementation, determining, according to the i-th obfuscated data, the target pseudo-random function, and the second private data, comparison data corresponding to the second private data includes:

[0023] Performing calculation processing on the j-th second private data according to the target pseudo-random function to obtain a calculation result corresponding to the j-th second private data;

[0024] Determine the comparison data corresponding to the j-th second private data based on the calculation result corresponding to the j-th second private data, the i-th obfuscated data, and the target obfuscation parameter; wherein the target obfuscation parameter is the obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device.

[0025] In a possible implementation manner, the comparison data corresponding to the j-th second private data is in, is the i-th obfuscated data, is the target confusion parameter, F k (x j ) is the calculation result corresponding to the j-th second private data.

[0026] In one possible implementation, determining a target encryption algorithm includes:

[0027] The target encryption algorithm is determined according to data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0028] In a possible implementation, determining an intersection according to the second hash value and each of the first hash values ​​includes:

[0029] If it is determined that the first hash value corresponding to the j-th second private data among the first hash values ​​is equal to the second hash value, the j-th second private data is determined to be the public private data in the intersection.

[0030] In a second aspect, an embodiment of the present application provides a privacy set intersection method, the method being applied to a second computing device in a secure computing system; the secure computing system also includes a first computing device; the method comprising:

[0031] Determine a random private key corresponding to each first private data in the first privacy set of the second computing device; and hide the i-th first private data according to the i-th random private key to obtain the i-th blinded data;

[0032] Receive the i-th subscript data sent by the first computing device; and simultaneously send the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transfer (OT) operation; and the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device;

[0033] Determine a second hash value of the i-th first private data; and send the second hash value to the first computing device; wherein the first hash value and each second hash value are used to generate an intersection; the intersection includes the private data common between the first privacy set and the second privacy set.

[0034] In one possible implementation, hiding the i-th first private data according to the i-th random private key to obtain the i-th blinded data includes:

[0035] Determining a target encryption algorithm, and generating a target pseudo-random function based on the target encryption algorithm;

[0036] The i-th first private data is hidden according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

[0037] In one possible implementation, generating a target pseudorandom function according to the target encryption algorithm includes:

[0038] The target pseudo-random function is generated according to the target encryption algorithm and the key information of the target encryption algorithm; at the same time, obfuscation parameter information is generated; wherein the obfuscation parameter information includes a first obfuscation parameter and a second obfuscation parameter.

[0039] In one possible implementation, the method further includes:

[0040] receiving a public key parameter sent by the first computing device; and encrypting the key information and the obfuscation parameter information according to the public key parameter to obtain encrypted information;

[0041] The encrypted information is sent to the first computing device.

[0042] In one possible implementation, performing hiding processing on the i-th first private data according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data includes:

[0043] performing calculation processing on the i-th first private data according to the target pseudo-random function to obtain a calculation result of the i-th first private data;

[0044] Generate obfuscation parameter information; and obtain the i-th blinded data based on the obfuscation parameter information, the i-th random private key, and a calculation result of the i-th first private data.

[0045] In one possible implementation, obtaining the i-th blinded data according to the obfuscation parameter information, the i-th random private key, and a calculation result of the i-th first private data includes:

[0046] Obtaining a first blinding value in the i-th blinded data according to a calculation result of the first obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the i-th first private data;

[0047] Obtain a second blinding value in the i-th blinded data according to a calculation result of the second obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the i-th first private data.

[0048] In a possible implementation, the first blinding value in the i-th blinding data is Among them, k i is the i-th random private key, α0 is the first obfuscation parameter, F k (y i ) is the calculation result of the i-th first private data;

[0049] the second blinding value in the i-th blinding data Wherein, α1 is the second confusion parameter.

[0050] In one possible implementation, determining a target encryption algorithm includes:

[0051] The target encryption algorithm is determined according to data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0052] In a third aspect, an embodiment of the present application provides a privacy set intersection apparatus, the apparatus being applied to a first computing device in a secure computing system; the secure computing system also includes a second computing device; the apparatus comprising:

[0053] a sending module, configured to generate at least one subscript data and send the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on performing an oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained by processing the i-th first private data in the first privacy set of the second computing device;

[0054] a first determining module configured to receive the i-th obfuscated data sent by the second computing device; and determine, based on the i-th obfuscated data and the second privacy set of the first computing device, a first hash value of each second private data in the second privacy set;

[0055] A second determination module is configured to receive a second hash value of the i-th first private data sent by the second computing device, and determine an intersection based on the second hash value and each of the first hash values; wherein the intersection includes the private data common to the first privacy set and the second privacy set.

[0056] In one possible implementation, the first determination module is specifically used to: determine a target encryption algorithm; and generate a target pseudo-random function based on the target encryption algorithm; and determine a first hash value of each second private data based on the i-th obfuscated data, the target pseudo-random function, and each second private data.

[0057] In one possible implementation, the first determination module is specifically configured to: determine public key parameters and private key parameters; and send the public key parameters to the second computing device; wherein the public key parameters are used to generate encrypted information, the encrypted information including obfuscation parameter information and key information of the target encryption algorithm; receive the encrypted information sent by the second computing device; and decrypt the encrypted information based on the private key parameters to obtain obfuscation parameter information and key information of the target encryption algorithm; and generate the target pseudo-random function based on the key information, the obfuscation parameter information, and the target encryption algorithm.

[0058] In a possible implementation, the first determination module is further specifically used to generate the target pseudo-random function based on the key information, the obfuscation parameter information, the target encryption algorithm, and the encryption parameter information of the target encryption algorithm; wherein the encryption parameter information represents the parameter form of the target encryption algorithm.

[0059] In one possible implementation, the first determination module is further specifically configured to: determine comparison data corresponding to the second private data based on the i-th obfuscated data, the target pseudo-random function, and the second private data; and perform a hash operation on the comparison data to obtain a first hash value of the second private data.

[0060] In one possible implementation, the first determination module is further specifically configured to: perform calculation processing on the j-th second private data according to the target pseudo-random function to obtain a calculation result corresponding to the j-th second private data; and determine comparison data corresponding to the j-th second private data according to the calculation result corresponding to the j-th second private data, the i-th obfuscated data, and a target obfuscation parameter; wherein the target obfuscation parameter is the obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device.

[0061] In a possible implementation manner, the comparison data corresponding to the j-th second private data is in, is the i-th obfuscated data, is the target confusion parameter, F k (x j ) is the calculation result corresponding to the j-th second private data.

[0062] In a possible implementation, the first determination module is further specifically configured to determine the target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0063] In a possible implementation, the second determination module is specifically configured to: if it is determined that among the first hash values, the first hash value corresponding to the j-th second private data is equal to the second hash value, determine that the j-th second private data is the public private data in the intersection.

[0064] In a fourth aspect, an embodiment of the present application provides a privacy set intersection apparatus, the apparatus being applied to a second computing device in a secure computing system; the secure computing system also including a first computing device; the apparatus comprising:

[0065] a determination module, configured to determine a random private key corresponding to each first private data in the first privacy set of the second computing device; and to perform a concealment process on the i-th first private data according to the i-th random private key to obtain an i-th blinded data;

[0066] a first sending module, configured to receive the i-th subscript data sent by the first computing device; and simultaneously send the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transfer (OT) operation; and the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device;

[0067] A second sending module is configured to determine a second hash value of the i-th first private data; and send the second hash value to the first computing device; wherein each of the first hash value and the second hash value is used to generate an intersection; and the intersection includes the private data common to the first privacy set and the second privacy set.

[0068] In one possible implementation, the determination module is specifically used to: determine a target encryption algorithm and generate a target pseudo-random function based on the target encryption algorithm; and hide the i-th first private data based on the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

[0069] In one possible implementation, the determination module is specifically used to: generate the target pseudo-random function based on the target encryption algorithm and the key information of the target encryption algorithm; and at the same time, generate obfuscation parameter information; wherein the obfuscation parameter information includes a first obfuscation parameter and a second obfuscation parameter.

[0070] In a possible implementation, the determination module is further specifically used to: receive the public key parameters sent by the first computing device; and encrypt the key information and the obfuscation parameter information according to the public key parameters to obtain encrypted information; and send the encrypted information to the first computing device.

[0071] In one possible implementation, the determination module is further specifically configured to: perform calculation processing on the i-th first private data according to the target pseudo-random function to obtain a calculation result of the i-th first private data; generate obfuscation parameter information; and obtain the i-th blinded data based on the obfuscation parameter information, the i-th random private key, and the calculation result of the i-th first private data.

[0072] In a possible implementation, the determination module is further specifically used to: obtain a first blinding value in the i-th blinded data based on the first obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the calculation result of the i-th first private data; and obtain a second blinding value in the i-th blinded data based on the second obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the calculation result of the i-th first private data.

[0073] In a possible implementation, the first blinding value in the i-th blinding data is Among them, k i is the i-th random private key, α0 is the first obfuscation parameter, F k (y i ) is the calculation result of the i-th first private data; the second blinding value in the i-th blinded data Wherein, α1 is the second confusion parameter.

[0074] In one possible implementation, the determination module is further specifically used to: determine the target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents the parameter form of the target encryption algorithm.

[0075] In a fifth aspect, an embodiment of the present application provides a first computing device, including: a memory, a processor;

[0076] The memory stores computer-executable instructions;

[0077] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method as described in the first aspect above.

[0078] In a sixth aspect, an embodiment of the present application provides a second computing device, including: a memory, a processor;

[0079] The memory stores computer-executable instructions;

[0080] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method as described in the second aspect above.

[0081] In a seventh aspect, an embodiment of the present application provides a secure computing system, which includes a first computing device and a second computing device; the first computing device is used to implement the method described in the first aspect above; the second computing device is used to implement the method described in the second aspect.

[0082] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect and / or the second aspect above.

[0083] In a ninth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in the first and / or second aspects above.

[0084] Embodiments of the present application provide a privacy set intersection method, apparatus, device, and system. In an oblivious transfer protocol, a first computing device sends i-th subscript data to a second computing device. The second computing device then sends i-th blinded data corresponding to the i-th first private data in the second computing device's first privacy set to the first computing device. Through an oblivious transfer (OT) operation, the first computing device receives i-th obfuscated data in the i-th blinded data, which is used to calculate a first hash value corresponding to each second private data in the first computing device's second privacy set. An intersection operation is performed on each first hash value and the second hash value corresponding to the i-th first private data sent by the second computing device to obtain the common private data between the first and second privacy sets. Furthermore, the first computing device uses the subscript data to obtain the obfuscated data sent by the second computing device after the OT operation based on the subscript data, and then performs an operation on its own private data. This ensures that the number of data transmissions is only related to the number of data in the privacy set and no longer to the data format of the private data. This reduces the number of data interactions in the overall oblivious transfer protocol and improves communication and computing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0086] Figure 1 A schematic diagram of an application scenario provided for this application;

[0087] Figure 2 A flowchart of a privacy set intersection method provided in an embodiment of the present application;

[0088] Figure 3 A flowchart of an OT operation process provided in an embodiment of the present application;

[0089] Figure 4 A flowchart of another method for finding the intersection of private sets provided in an embodiment of the present application;

[0090] Figure 5A flowchart of another method for finding the intersection of privacy sets provided in an embodiment of the present application;

[0091] Figure 6 A schematic diagram of a pseudo-random function generation process provided in an embodiment of the present application;

[0092] Figure 7 A schematic diagram of a nonlinear layer arrangement based on an instantiation of a symmetric cryptographic algorithm provided in an embodiment of the present application;

[0093] Figure 8 A flowchart of another privacy set intersection method provided in an embodiment of the present application;

[0094] Figure 9 A schematic diagram of the structure of a privacy set intersection device provided in an embodiment of the present application;

[0095] Figure 10 A schematic diagram of the structure of a privacy set intersection device provided in an embodiment of the present application;

[0096] Figure 11 A schematic diagram of the structure of a first computing device provided in an embodiment of the present application;

[0097] Figure 12 A schematic diagram of the structure of a second computing device provided in an embodiment of the present application.

[0098] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0099] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0100] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0101] It should be noted that the privacy set intersection method, device, equipment and system of the present application can be used in the field of information security, and can also be used in any field other than information security. The application field of the privacy set intersection method, device, equipment and system of the present application is not limited.

[0102] Figure 1 This is a schematic diagram of an application scenario provided by this application. Figure 1 As shown, the specific application scenario of the present application includes a first computing device 101 and a second computing device 102. The first computing device 101 and the second computing device 102 perform an intersection operation on each private data in the privacy sets of both parties through data interaction between the two parties to obtain the common private data in the privacy sets of both parties.

[0103] Privacy computing technology is a key technology for achieving "available but invisible" data. Among them, privacy set intersection is an important branch of secure multi-party computing. It allows data-holding participants to obtain the intersection data between the privacy sets of each participant through calculation without leaking any data information other than the intersection data, such as user data or device data and other privacy data that needs to be protected.

[0104] In one example, a framework based on the public key cryptography system is designed, such as homomorphic encryption, which encrypts elements and performs corresponding comparison operations on the ciphertext, and finally obtains the intersection of the two sets through private key decryption.

[0105] However, in the above method, the protocol based on the public key cryptography system has high computational overhead.

[0106] In another example, a framework based on the public key cryptography system is designed, such as homomorphic encryption, which encrypts elements and performs corresponding comparison operations on the ciphertext, and finally obtains the intersection of the two sets through private key decryption.

[0107] However, among the above methods, the protocol based on the garbled circuit has good versatility but low efficiency.

[0108] In another example, based on the oblivious transfer (OT) design framework, the classic OT protocol and pseudorandom function (PRF) are used to blind the elements of the set with random values ​​to achieve privacy protection, which requires completing a large number of OT operations.

[0109] However, in the above method, the number of OT operations in the privacy intersection protocol based on the OT protocol is related to the data bit length. The longer the data form, the more OT protocols are performed, and the communication overhead is very large, which affects the overall efficiency. Since the Advanced Encryption Standard (AES) algorithm is used for instantiation, the data form is relatively fixed. For other data type formats on the prime field that may appear in actual scenarios, preliminary processing is required to convert them into a form that conforms to the AES algorithm input, resulting in low computational efficiency.

[0110] To address the above technical issues, the present application proposes the following technical concept: A first computing device sends the i-th indexed data to a second computing device through an oblivious transfer protocol. The second computing device then sends the i-th blinded data corresponding to the i-th first private data in the second computing device's first privacy set to the first computing device. Through the oblivious transfer (OT) operation, the first computing device receives the i-th obfuscated data in the i-th blinded data, which is used to calculate the first hash value corresponding to each second private data in the first computing device's second privacy set. An intersection operation is performed on each first hash value and the second hash value corresponding to the i-th first private data sent by the second computing device to obtain the private data shared between the first and second privacy sets. This solves the problem in the prior art that the number of OT protocols performed using the oblivious transfer method is related to the data format. For privacy sets with longer data formats, more OT protocols need to be performed, resulting in increased communication overhead required for the calculation process and affecting overall computing efficiency.

[0111] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0112] Figure 2 A flowchart of a privacy set intersection method provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the method is applied to a first computing device in a secure computing system; the secure computing system also includes a second computing device, and the method includes:

[0113] 201. A first computing device generates at least one subscript data and sends the i-th subscript data to a second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on an oblivious transmission (OT) operation performed on the i-th blinded data; the i-th blinded data is obtained by processing the i-th first private data in the first privacy set of the second computing device.

[0114] For example, in a secure computing system, the first computing device has a set X={x1, . . . , x m}, the second computing device has a set Y = {y1, ...y n}, both parties perform privacy set intersection processing, and the first computing device generates a random subscript sequence, which includes at least one subscript data, such as W = {w1, ..., w n},w i ∈{0,1}, for each subscript data, in order, the i-th subscript data w i The first computing device sends the i-th subscript data to the second computing device. After receiving the i-th subscript data, the second computing device determines the i-th first private data from the second computing device's privacy set (i.e., the first privacy set) based on the sequence number i of the subscript data, and performs blinding processing on the i-th first private data to obtain the i-th blinded data. The first computing device and the second computing device can perform an oblivious transmission (OT) operation. That is, the first computing device sends the i-th subscript data to the second computing device based on a preset OT protocol, and the second computing device sends the i-th blinded data to the first computing device based on a preset OT protocol. Based on the OT operation of the OT protocol, the second computing device randomly selects from the i-th blinded data to obtain the i-th obfuscated data. The first computing device then receives the i-th obfuscated data.

[0115] For example, Figure 3 A flowchart of an OT operation process provided in an embodiment of the present application is shown as follows: Figure 3 As shown, for each i, the first computing device and the second computing device complete an OT operation, such as a 2-choose-1 OT operation, where the input of the first computing device is the subscript data w i , the input of the second computing device is the blinded data After this OT operation, the first computing device obtains the selection result of the OT operation in the blinded data The first computing device is unaware of the input from the second computing device. The second computing device does not know which of the two data is obtained by the first computing device.

[0116] 202. The first computing device receives the i-th obfuscated data sent by the second computing device; and determines a first hash value of each second private data in the second private set based on the i-th obfuscated data and the second private set of the first computing device.

[0117] For example, in combination Figure 3 Based on the OT operation of the OT protocol, a random selection is made from the i-th blinded data to obtain the i-th obfuscated data, and the first computing device receives the i-th obfuscated data. The first computing device performs computational processing on the i-th obfuscated data and each second private data in its own privacy set, i.e., each second private data in the second privacy set, based on a preset hash algorithm, to obtain a first hash value corresponding to each second private data in the second privacy set.

[0118] 203. The first computing device receives the second hash value of the i-th first private data sent by the second computing device, and determines an intersection based on the second hash value and each first hash value; wherein the intersection includes the private data common to the first privacy set and the second privacy set.

[0119] For example, the second computing device generates a second hash value corresponding to its own i-th first private data based on the i-th obfuscated data and sends it to the first computing device. The first computing device then receives the second hash value corresponding to the i-th first private data sent by the second computing device and, based on an intersection algorithm, intersects the second hash value with all first hash values ​​to obtain the private data shared between the first and second privacy sets, i.e., the intersection.

[0120] In this embodiment, a privacy set intersection method is provided, in which a first computing device obtains obfuscated data of an OT operation based on the subscript data sent by a second computing device through subscript data, so as to perform operations on its own private data. This makes the number of data transmissions only related to the number of data in the privacy set and no longer related to the data form of the private data, thereby reducing the number of data interactions in the overall oblivious transfer protocol and improving communication efficiency and computing efficiency.

[0121] Figure 4 A flow chart of another privacy set intersection method provided in an embodiment of the present application is shown as follows: Figure 4 As shown, the secure computing system includes a first computing device and a second computing device, and the method includes:

[0122] 301. The second computing device determines a random private key corresponding to each first private data in the first privacy set of the second computing device; and hides the i-th first private data according to the i-th random private key to obtain the i-th blinded data.

[0123] Exemplarily, the second computing device generates a random private key corresponding to each first privacy data for its own privacy set, that is, each first privacy data in the first privacy set, and blinds the i-th random private key and the i-th first privacy data based on a preset hiding algorithm or a blinding processing algorithm according to the order of each random private key to obtain the i-th blinded first privacy data, that is, the i-th blinded data.

[0124] For example, combined with Figure 3 The second computing device constructs a random private key set K = {k1…k n}, in, is the finite field parameter of the operation algorithm, and the privacy set Y of the second computing device itself is {y1,…y n}, each first private data has a corresponding random private key; for each first private data y i , through the blind processing algorithm, the i-th blind data is calculated To complete the y i Hiding.

[0125] 302. The first computing device generates at least one subscript data and sends the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on the oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained by processing the i-th first private data in the first privacy set of the second computing device.

[0126] For example, this step can refer to step 201 and will not be described in detail here.

[0127] 303. The second computing device receives the i-th subscript data sent by the first computing device; at the same time, sends the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transmission (OT) operation; the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device.

[0128] For example, in combination Figure 3 For each i, the first computing device and the second computing device complete an OT operation, where the input of the first computing device is the i-th subscript data w i , that is, the i-th subscript data w i Send to the second computing device, the input of the second computing device is the i-th blinded data The i-th blinded data Sent to the first computing device. After the OT operation, the first computing device obtains the selection result of the OT operation in the blinded data. The first computing device is unaware of the input from the second computing device. The second computing device is unaware of which of the two data items the first computing device obtained. After receiving the i-th obfuscated data item, the first computing device calculates each second private data item in the second private set of the first computing device based on the i-th obfuscated data item to obtain a first hash value for each second private data item.

[0129] 304. The first computing device receives the i-th obfuscated data sent by the second computing device; and determines a first hash value of each second private data in the second privacy set based on the i-th obfuscated data and the second privacy set of the first computing device.

[0130] For example, this step may refer to step 202 and will not be described in detail here.

[0131] 305. The second computing device determines a second hash value of the i-th first private data and sends the second hash value to the first computing device. Each first hash value and second hash value is used to generate an intersection. The intersection includes the private data common to the first privacy set and the second privacy set.

[0132] For example, in combination Figure 3 The second computing device calculates each first private data based on a preset hash algorithm to obtain a second hash value of each first private data, and sends the second hash value of the i-th first private data to the first computing device, so that the first computing device can perform an intersection operation on the second hash value and the first hash value of each second private data in the first computing device to obtain the private data common to the first privacy set in the second computing device and the second privacy set in the first computing device.

[0133] 306. The first computing device receives the second hash value of the i-th first private data sent by the second computing device, and determines an intersection based on the second hash value and each first hash value; wherein the intersection includes the private data common to the first privacy set and the second privacy set.

[0134] For example, this step may refer to step 203 and will not be described in detail here.

[0135] In this embodiment, based on the above embodiment, after the i-th random index is sent to the second computing device through the first device, the second computing device generates the i-th blinded data according to the random private key corresponding to the i-th private data in its own privacy set and transmits it to the first computing device. The first computing device operates on its own private data according to the i-th obfuscated data obtained by performing an OT operation on the i-th blinded data, and further performs an intersection operation to obtain the intersection; so that the number of times data is transmitted is only related to the number of data in the privacy set, and is no longer related to the data form, thereby reducing the number of interactions between the two parties in the overall transmission protocol and improving communication efficiency and computing efficiency.

[0136] Figure 5 A flowchart of another privacy set intersection method provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the secure computing system includes a first computing device and a second computing device, and the method includes:

[0137] 401. The second computing device determines a random private key corresponding to each first private data in the first privacy set of the second computing device; and hides the i-th first private data according to the i-th random private key to obtain the i-th blinded data.

[0138] For example, this step may refer to step 301 and will not be described in detail here.

[0139] 402. The first computing device generates at least one subscript data and sends the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on the oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained based on processing the i-th first private data in the first privacy set of the second computing device.

[0140] For example, this step can refer to step 201 and will not be described in detail here.

[0141] 403. The second computing device receives the i-th subscript data sent by the first computing device; at the same time, sends the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transmission (OT) operation; the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device.

[0142] For example, this step may refer to step 303 and will not be described in detail here.

[0143] 404. The first computing device receives the i-th obfuscated data sent by the second computing device.

[0144] For example, this step may refer to step 202 and will not be described in detail here.

[0145] 405. The first computing device determines a target encryption algorithm.

[0146] For example, Figure 6 A schematic diagram of a pseudo-random function generation process provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the first computing device calls a preset encryption algorithm, such as a symmetric encryption algorithm, and determines the preset encryption algorithm as a target encryption algorithm.

[0147] In one example, step 405 includes: determining a target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0148] For example, the first computing device or the second computing device or other third-party device can determine the data characteristics of each privacy data in the two privacy sets in advance based on the second privacy set of the first computing device and the first privacy set of the second computing device, such as data characteristics or data form. The first computing device can determine the target encryption algorithm corresponding to the data characteristics from multiple preset encryption algorithms based on the data characteristics; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents the parameter form of the target encryption algorithm. In order to obtain a PRF based on arithmetic operations, more emphasis is placed on arithmetic operations, such as operations on rings, finite fields, etc. and The algorithm functions are directly calculated through corresponding algebraic operations, eliminating the need for multiplication operations. Furthermore, the overall efficiency of the PRF operation is improved by reducing the number of multiplication operations in the algorithm. Symmetric cryptographic primitives designed based on this concept include Low Multiplicative Complexity (LowMC), Minimal Multiplicative Complexity* (MiMC), Generalized Minimal Multiplicative Complexity (GMiMC), and Hashing by Advanced Designs for Efficient and Secure Multiplicative Inverse Mixing Circuits (HADESMiMC).

[0149] For example, combining Figure 6The first computing device selects the symmetric cryptographic MiMC algorithm based on the data characteristics of the privacy sets of the first computing device and the second computing device, and determines the parameter form of the MiMC algorithm, that is, determines the finite field q = p or 2 n , round number r, round constant c i etc., among which the MiMC algorithm is based on finite fields Design, q is p or 2 n , gcd(3,p-1)=1, and its nonlinear operation is F(x)=x 3 , the round function of each round is F i (x)=(x+k+c i ) 3 , the entire encryption algorithm is k is the key, r is the number of rounds, c i is the wheel constant.

[0150] 406. The first computing device generates a target pseudo-random function according to the target encryption algorithm.

[0151] Exemplarily, the first computing device can generate the currently required target pseudorandom function (PRF) for data blinding or obfuscation processing by instantiating the determined target encryption algorithm in combination with a preset pseudorandom function form.

[0152] In one example, step 406 includes the following steps:

[0153] The first step of step 406 is to determine the public key parameters and the private key parameters; and send the public key parameters to the second computing device; wherein the public key parameters are used to generate encryption information, and the encryption information includes obfuscation parameter information and key information of the target encryption algorithm.

[0154] The second step of step 406 is to receive the encrypted information sent by the second computing device; and decrypt the encrypted information according to the private key parameters to obtain the obfuscation parameter information and the key information of the target encryption algorithm.

[0155] The third step of step 406 is to generate a target pseudo-random function according to the key information, the obfuscation parameter information and the target encryption algorithm.

[0156] For example, in combination Figure 6The first computing device generates public key parameters and private key parameters (Pk, Sk) based on a preset public key cryptographic algorithm, and sends the public key parameter Pk to the second computing device; the second computing device encrypts the key information and obfuscation parameter information generated by itself according to the public key parameter Pk to obtain encrypted information, which includes the obfuscation parameter information α0, α1 and the key information k of the target encryption algorithm. MiMC The first computing device receives the encrypted information sent by the second computing device and decrypts the encrypted information according to the private key parameters and decryption algorithm to obtain the obfuscation parameter information α0, α1 and the key information k of the target encryption algorithm. MiMC The first computing device uses the determined target encryption algorithm and combines the preset pseudo-random function form and the key information k MiMC , and the obfuscation parameter information α0, α1 are instantiated to generate the target pseudo-random function currently required for data blinding or obfuscation processing.

[0157] In one example, the third step of step 406 includes: generating a target pseudo-random function based on the key information, the obfuscation parameter information, the target encryption algorithm, and the encryption parameter information of the target encryption algorithm; wherein the encryption parameter information represents the parameter form of the target encryption algorithm.

[0158] Specifically, the first computing device obtains encryption parameter information of the target encryption algorithm according to the determined target encryption algorithm, that is, the parameter form that characterizes the target encryption algorithm, and calculates the encryption parameter information of the target encryption algorithm according to the determined target encryption algorithm and the encryption parameter information of the target encryption algorithm, and combines the preset pseudo-random function form and the key information k MiMC , and the obfuscation parameter information α0, α1 are instantiated to generate the target pseudo-random function currently required for data blinding or obfuscation processing.

[0159] For example, for the target encryption algorithm, the symmetric encryption algorithm MiMC algorithm, determine the finite field q = p or 2 n , round number r, round constant c i etc., according to the key information k MiMC , obfuscating parameter information α0, α1, the pseudo-random function PRF can be expressed as where f i (x) = (x + k MiMC +c i ) 3 .

[0160] For example, Figure 7 A schematic diagram of a nonlinear layer arrangement based on a symmetric cryptographic algorithm instantiation provided in an embodiment of the present application is shown as follows: Figure 7 As shown, taking the instantiation process of HADESMiMC as an example, it is designed based on the finite field Fp; the overall algorithm can be expressed as: The round function of each round can be expressed as: Fk(·) = k + M × S(·); k is the key, M is the linear layer (linear transformation); S is the non-linear layer (non-linear operation), and S(x) = x is set. 3 More generally, S(x) = x can be set. α α satisfies gcd(p - 1, α) = 1, and α is adjusted to adapt to different data situations; the algorithm structure feature is: by improving the classical non-linear layer structure, applying the full S-box in some function rounds, only applying 1 S-box in some function rounds, and not applying the S-box in the rest, that is, when the S-box is not applied in this part of the function rounds, the non-linear part of the corresponding part of the data remains unchanged, reducing the non-linear operation times in the overall algorithm. In the <PRF generation link> between the two parties, the implementation steps of PRF generation are general, and the main difference lies in the content of the PRF parameters to be secretly negotiated.

[0161] 407. The first computing device determines the first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data.

[0162] Exemplarily, in order to further enhance data security, the first computing device performs a hash calculation on the obtained i-th obfuscated data, the target pseudo-random function, and each second private data among each second private data to obtain the first hash value of each second private data.

[0163] In one example, step 407 includes the following steps:

[0164] The first step of step 407, according to the i-th obfuscated data, the target pseudo-random function, and the second private data, determines the comparison data corresponding to the second private data.

[0165] The second step of step 407, performs a hash operation on the comparison data to obtain the first hash value of the second private data.

[0166] Exemplarily, the first computing device performs a calculation on the obtained i-th obfuscated data, the target pseudo-random function, and each second private data based on a preset algorithm to obtain the comparison data corresponding to each second private data. Furthermore, the comparison set corresponding to all second private data is obtained. And based on a preset hash algorithm, performs a hash operation on the comparison data corresponding to each second private data to obtain the first hash value of each second private data.

[0167] In one example, the first step of step 407 includes:

[0168] Step 1: Perform calculation processing on the j-th second private data according to the target pseudo-random function to obtain a calculation result corresponding to the j-th second private data.

[0169] Step 2: Determine the comparison data corresponding to the j-th second private data based on the calculation result corresponding to the j-th second private data, the i-th obfuscated data, and the target obfuscation parameter; wherein the target obfuscation parameter is the obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device.

[0170] Among them, the comparison data corresponding to the j-th second private data in, is the i-th obfuscated data, is the target confusion parameter, F k (x j ) is the calculation result corresponding to the j-th second private data.

[0171] Specifically, combined Figure 3 The first computing device performs computation on each second private data, i.e., the j-th second private data, according to the computation form of the target pseudo-random function, and obtains the computation result F corresponding to the j-th second private data. k (x j ), according to the obtained i-th obfuscated data, determine the obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device, that is, the target obfuscation parameter, and calculate the calculation result F corresponding to the j-th second private data based on the preset algorithm. k (x j ), calculate the i-th obfuscated data and the target obfuscation parameter to obtain the comparison data corresponding to the j-th second private data Among them, the formula For the i-th obfuscated data Target obfuscation parameters And the calculation result F corresponding to the j-th second private data k (x j ) to calculate and process, and obtain the comparison data corresponding to the j-th second private data

[0172] 408. The second computing device determines a second hash value of the i-th first private data; and sends the second hash value to the first computing device; wherein each first hash value and the second hash value are used to generate an intersection; the intersection includes the private data common to the first privacy set and the second privacy set.

[0173] For example, this step may refer to step 305 and will not be described in detail here.

[0174] 409. The first computing device receives the second hash value of the i-th first private data sent by the second computing device; and if it is determined that the first hash value corresponding to the j-th second private data among the first hash values ​​is equal to the second hash value, then the j-th second private data is determined to be the public private data in the intersection.

[0175] For example, in combination Figure 3 The first computing device receives the second hash value of the i-th first private data sent by the second computing device, and for each first hash value and the second hash value H(k i ),Compare and H(k i ), if there exists j such that Then x j =y i , which is the common element of sets X and Y. After completing the above comparison for all elements in Y, we can get the common elements of both sets, that is, the intersection of the two sets. It is worth noting that if x j =y i , then F k (x j )=F k (y i ), corresponding With k i Equal, then If x j ≠y i , according to the PRF property F k (x j )≠F k (y i ), At this time, non-intersection elements will be excluded. Since the first computing device does not know the random private key k i , when y i If it is not in the set X, it cannot be obtained through And the hash value H(k i ) Inversely deduce element y i The original value of the first computing device is used to ensure that the information other than the intersection element is not leaked to the other party. The second computing device cannot know the additional information of the non-intersection in set X, which meets the requirement of privacy intersection.

[0176] For example, taking user data as an example, 18-bit data is converted into 2 binary 60Traditionally, information hiding for a single bit through OT requires about 60 OT interactions, which has a very large communication overhead. Algebraic operations are performed on the data itself. Only a pair of blinding parameters needs to be introduced, and information hiding can be completed through one OT, which reduces the number of communication interactions and the online computing overhead. On the other hand, since the blinding operation is also performed on the finite field Fp, it will increase some local computing overhead.

[0177] In this embodiment, based on the above embodiment, a PRF is formed by deriving from a symmetric cryptographic algorithm designed based on parameters such as a finite field. The advantage of this type of algorithm is that it can adapt to richer data formats and reduce data processing costs. At the same time, its design has fewer multiplication operations and can achieve higher computing efficiency compared to the existing PRF instantiated based on AES.

[0178] Figure 8 A flowchart of another privacy set intersection method provided in an embodiment of the present application is shown as follows: Figure 8 As shown, the secure computing system includes a first computing device and a second computing device, and the method includes:

[0179] 501. A second computing device determines a random private key corresponding to each first private data in a first privacy set of the second computing device.

[0180] For example, this step may refer to step 301 and will not be described in detail here.

[0181] 502. The second computing device determines a target encryption algorithm.

[0182] For example, in combination Figure 6 , the second computing device calls a preset encryption algorithm, such as a symmetric encryption algorithm, and determines the preset encryption algorithm as a target encryption algorithm.

[0183] In one example, step 502 includes the following steps: determining a target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0184] For example, in combination Figure 6 The first computing device or the second computing device or other third-party device can determine the data characteristics of each privacy data in the two privacy sets in advance based on the second privacy set of the first computing device and the first privacy set of the second computing device, such as data characteristics or data form. The second computing device can determine the target encryption algorithm corresponding to the data characteristic from multiple preset encryption algorithms based on the data characteristic; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents the parameter form of the target encryption algorithm.

[0185] 503. The second computing device generates a target pseudo-random function according to the target encryption algorithm.

[0186] Exemplarily, the first computing device can generate the currently required target pseudo-random function PRF for data blinding or obfuscation processing by instantiating the determined target encryption algorithm in combination with a preset pseudo-random function form.

[0187] In one example, step 503 includes the following steps: generating a target pseudo-random function based on the target encryption algorithm and the key information of the target encryption algorithm; and generating obfuscation parameter information at the same time; wherein the obfuscation parameter information includes a first obfuscation parameter and a second obfuscation parameter.

[0188] Exemplarily, the second computing device generates key information k of the target encryption algorithm according to the determined target encryption algorithm. MiMC , and based on the determined target encryption algorithm, combined with the preset pseudo-random function form and key information k MiMC By instantiating, the target pseudo-random function currently required can be generated for data blinding or obfuscation processing; at the same time, based on the determined target pseudo-random function, the obfuscation parameter information is determined; wherein; the obfuscation parameter information includes a first obfuscation parameter α0 and a second obfuscation parameter α1.

[0189] In one example, step 503 further includes:

[0190] Step 1: Receive the public key parameters sent by the first computing device; and encrypt the key information and obfuscation parameter information according to the public key parameters to obtain encrypted information.

[0191] Step 2: Send the encrypted information to the first computing device.

[0192] Specifically, combined Figure 6 The first computing device generates a public key parameter and a private key parameter of a preset public key cryptographic algorithm, and sends the public key parameter Pk to the second computing device. The second computing device receives the public key parameter sent by the first computing device and, based on the public key parameter, generates the generated obfuscated parameter information α0, α1 and the key information k. MiMC The encrypted information is encrypted and transmitted to the first computing device, so that the first computing device decrypts the encrypted information using the private key parameter to obtain the key information k MiMC and obfuscation parameter information α0, α1 to complete the generation of the PRF of the first computing device.

[0193] 504. The second computing device performs hiding processing on the i-th first private data according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

[0194] Exemplarily, the second computing device performs hiding processing on the i-th first private data based on a preset hiding algorithm, in combination with the generated i-th random private key and the determined target pseudo-random function, to obtain the i-th blinded data.

[0195] In one example, step 504 includes the following steps:

[0196] In the first step of step 504 , calculation processing is performed on the i-th first private data according to the target pseudo-random function to obtain a calculation result of the i-th first private data.

[0197] The second step of step 504 is to generate obfuscation parameter information; and obtain the i-th blinded data according to the obfuscation parameter information, the i-th random private key and the calculation result of the i-th first private data.

[0198] Exemplarily, the first computing device performs PRF calculation processing on the i-th first privacy data according to the determined target pseudo-random function to obtain the calculation result of the i-th first privacy data; and determines the obfuscation parameter information according to the target pseudo-random function, and based on the preset hiding algorithm, performs calculation processing on the obtained obfuscation parameter information, the i-th random private key and the calculation result of the i-th first privacy data to obtain the i-th blinded data.

[0199] In one example, the second step of step 504 includes:

[0200] Step 1: Obtain a first blinding value in the i-th blinded data according to the calculation result of the first obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the i-th first private data.

[0201] Step 2: Obtain a second blinding value in the i-th blinded data based on the second obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the calculation result of the i-th first private data.

[0202] Among them, the first blinding value in the i-th blinding data Among them, k i is the i-th random private key, α0 is the first confusion parameter, F k (y i ) is the calculation result of the i-th first private data; the second blinding value in the i-th blinded data Among them, α1 is the second confusion parameter.

[0203] Specifically, combined Figure 3, the obfuscation parameter information generated by the second computing device includes the first obfuscation parameter and the second obfuscation parameter. Based on the preset hiding algorithm, the calculation result of the first obfuscation parameter, the i-th random private key and the i-th first private data is calculated and processed to obtain the first blinded value in the i-th blinded data; wherein, the formula can be used Calculate the first blind value in the i-th blind data Among them, k i is the i-th random private key, α0 is the first confusion parameter, F k (y i ) is the calculation result of the i-th first private data; at the same time, the second computing device calculates and processes the second obfuscation parameter, the i-th random private key and the calculation result of the i-th first private data based on the preset hiding algorithm to obtain the second blinding value in the i-th blinded data; wherein, the formula Calculate the second blind value in the i-th blind data Among them, α1 is the second confusion parameter.

[0204] 505. The first computing device generates at least one subscript data and sends the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on the oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained based on processing the i-th first private data in the first privacy set of the second computing device.

[0205] For example, this step can refer to step 201 and will not be described in detail here.

[0206] 506. The second computing device receives the i-th subscript data sent by the first computing device; at the same time, sends the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transmission (OT) operation; the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device.

[0207] For example, this step may refer to step 303 and will not be described in detail here.

[0208] 507. The second computing device determines a second hash value of the i-th first private data and sends the second hash value to the first computing device. Each first hash value and second hash value is used to generate an intersection. The intersection includes the private data common to the first privacy set and the second privacy set.

[0209] For example, this step may refer to step 303 and will not be described in detail here.

[0210] 508. The first computing device receives the i-th obfuscated data sent by the second computing device; and determines a first hash value of each second private data in the second privacy set based on the i-th obfuscated data and the second privacy set of the first computing device.

[0211] For example, this step may refer to step 202 and will not be described in detail here.

[0212] 509. The first computing device receives the second hash value of the i-th first private data sent by the second computing device, and determines an intersection based on the second hash value and each first hash value; wherein the intersection includes the private data common to the first privacy set and the second privacy set.

[0213] For example, this step may refer to step 203 and will not be described in detail here.

[0214] In this embodiment, based on the above embodiment, the second computing device constructs a new data random blinding method based on the PRF characteristics, so that for each blinded data to be transmitted, the first computing device only needs to use 2-choose-1-OT once to obtain the corresponding value, thereby constructing a new matching data calculation method, which can assist in completing the comparison of the corresponding privacy data, thereby reducing the number of interactions between the two parties in the overall protocol and improving the efficiency of calculation and communication.

[0215] Figure 9 This is a structural diagram of a privacy set intersection device provided in an embodiment of the present application, such as Figure 9 As shown, the apparatus is applied to a first computing device in a secure computing system; the secure computing system also includes a second computing device; the apparatus includes:

[0216] The sending module 601 is configured to generate at least one subscript data and send the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on performing an oblivious transmission (OT) operation on the i-th blinded data; and the i-th blinded data is obtained by processing the i-th first private data in the first private set of the second computing device.

[0217] A first determining module 602 is configured to receive the i-th obfuscated data sent by the second computing device, and determine a first hash value of each second private data in the second private set based on the i-th obfuscated data and the second private set of the first computing device;

[0218] The second determination module 603 is configured to receive a second hash value of the i-th first private data sent by the second computing device, and determine an intersection based on the second hash value and each first hash value; wherein the intersection includes the private data common to the first privacy set and the second privacy set.

[0219] In one possible implementation, the first determination module 602 is specifically used to: determine a target encryption algorithm; and generate a target pseudo-random function based on the target encryption algorithm; and determine a first hash value of each second private data based on the i-th obfuscated data, the target pseudo-random function, and each second private data.

[0220] In one possible implementation, the first determination module 602 is specifically used to: determine public key parameters and private key parameters; and send the public key parameters to the second computing device; wherein the public key parameters are used to generate encrypted information, and the encrypted information includes obfuscation parameter information and key information of the target encryption algorithm; receive the encrypted information sent by the second computing device; and decrypt the encrypted information according to the private key parameters to obtain the obfuscation parameter information and the key information of the target encryption algorithm; generate a target pseudo-random function according to the key information, obfuscation parameter information and the target encryption algorithm.

[0221] In a possible implementation, the first determination module 602 is further specifically used to generate a target pseudo-random function based on key information, obfuscation parameter information, a target encryption algorithm, and encryption parameter information of the target encryption algorithm; wherein the encryption parameter information represents the parameter form of the target encryption algorithm.

[0222] In one possible implementation, the first determination module 602 is further specifically configured to: determine comparison data corresponding to the second private data based on the i-th obfuscated data, the target pseudo-random function, and the second private data; and perform a hash operation on the comparison data to obtain a first hash value of the second private data.

[0223] In one possible implementation, the first determination module 602 is further specifically configured to: perform calculation processing on the j-th second private data according to a target pseudo-random function to obtain a calculation result corresponding to the j-th second private data; and determine comparison data corresponding to the j-th second private data according to the calculation result corresponding to the j-th second private data, the i-th obfuscated data, and a target obfuscation parameter; wherein the target obfuscation parameter is an obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device.

[0224] In a possible implementation, the comparison data corresponding to the j-th second private data in, is the i-th obfuscated data, is the target confusion parameter, F k (x j ) is the calculation result corresponding to the j-th second private data.

[0225] In one possible implementation, the first determination module 602 is further specifically configured to determine a target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0226] In a possible implementation, the second determination module 603 is specifically configured to: if it is determined that among the first hash values, the first hash value corresponding to the j-th second private data is equal to the second hash value, determine that the j-th second private data is the public private data in the intersection.

[0227] The device of this embodiment can execute the technical solution in the above method. Its specific implementation process and technical principles are the same and will not be repeated here.

[0228] Figure 10 This is a structural diagram of a privacy set intersection device provided in an embodiment of the present application, such as Figure 10 As shown, the apparatus is applied to a second computing device in a secure computing system; the secure computing system also includes a first computing device; the apparatus includes:

[0229] Determination module 701 is configured to determine a random private key corresponding to each first private data in a first private set of a second computing device; and hide the i-th first private data according to the i-th random private key to obtain the i-th blinded data;

[0230] A first sending module 702 is configured to receive the i-th subscript data sent by the first computing device; and simultaneously send the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transfer (OT) operation; and the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device;

[0231] The second sending module 703 is configured to determine a second hash value of the i-th first private data and send the second hash value to the first computing device. The first hash value and each second hash value are used to generate an intersection set, and the intersection set includes the private data shared between the first privacy set and the second privacy set.

[0232] In one possible implementation, the determination module 701 is specifically configured to: determine a target encryption algorithm and generate a target pseudo-random function based on the target encryption algorithm; and perform hiding processing on the i-th first private data based on the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

[0233] In one possible implementation, the determination module 701 is specifically configured to: generate a target pseudo-random function based on a target encryption algorithm and key information of the target encryption algorithm; and simultaneously generate obfuscation parameter information; wherein the obfuscation parameter information includes a first obfuscation parameter and a second obfuscation parameter.

[0234] In a possible implementation, the determination module 701 is further specifically used to: receive a public key parameter sent by the first computing device; and encrypt the key information and the obfuscation parameter information according to the public key parameter to obtain encrypted information; and send the encrypted information to the first computing device.

[0235] In one possible implementation, the determination module 701 is further specifically configured to: perform calculation processing on the i-th first private data according to a target pseudo-random function to obtain a calculation result of the i-th first private data; generate obfuscation parameter information; and obtain the i-th blinded data based on the obfuscation parameter information, the i-th random private key, and the calculation result of the i-th first private data.

[0236] In one possible implementation, the determination module 701 is further specifically configured to: obtain a first blinding value in the i-th blinded data based on a calculation result of a first obfuscation parameter in the obfuscation parameter information, an i-th random private key, and the i-th first private data; and obtain a second blinding value in the i-th blinded data based on a calculation result of a second obfuscation parameter in the obfuscation parameter information, an i-th random private key, and the i-th first private data.

[0237] In a possible implementation, the first blinding value in the i-th blinding data Among them, k i is the i-th random private key, α0 is the first confusion parameter, F k (y i ) is the calculation result of the i-th first private data; the second blinding value in the i-th blinded data Among them, α1 is the second confusion parameter.

[0238] In a possible implementation, the determination module 701 is further specifically configured to determine a target encryption algorithm based on data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

[0239] The device of this embodiment can execute the technical solution in the above method. Its specific implementation process and technical principles are the same and will not be repeated here.

[0240] Figure 11 A schematic diagram of the structure of a first computing device provided in an embodiment of the present application is shown in FIG. Figure 11As shown, the first computing device includes: a memory 801 and a processor 802; the memory 801 is a memory for storing instructions executable by the processor 802.

[0241] The processor 802 is configured to execute the method provided in the above embodiment.

[0242] The first computing device further includes a receiver 803 and a transmitter 804. The receiver 803 is used to receive instructions and data sent by other devices, and the transmitter 804 is used to send instructions and data to external devices.

[0243] The specific implementation process of the processor can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0244] Figure 12 A schematic diagram of the structure of a second computing device provided in an embodiment of the present application is shown in FIG. Figure 12 As shown, the second computing device includes: a memory 901 and a processor 902; the memory 901 is a memory for storing instructions executable by the processor 902.

[0245] The processor 902 is configured to execute the method provided in the above embodiment.

[0246] The second computing device further includes a receiver 903 and a transmitter 904. The receiver 903 is used to receive instructions and data sent by other devices, and the transmitter 904 is used to send instructions and data to external devices.

[0247] The specific implementation process of the processor can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0248] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), etc. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0249] The memory may include a high-speed memory (Random Access Memory, referred to as RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory.

[0250] An embodiment of the present application provides a secure computing system, which includes a first computing device and a second computing device; the first computing device and the second computing device are both used to execute the technical solution of the processing method in the above embodiment.

[0251] An embodiment of the present application also provides a chip for executing instructions, which is used to execute the technical solution of the processing method in the above embodiment.

[0252] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed on a computer, the computer executes the technical solution of the processing method of the above embodiment.

[0253] The readable storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0254] An exemplary readable storage medium is coupled to a processor, such that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application-specific integrated circuit. Of course, the processor and the readable storage medium can also exist as discrete components in a device.

[0255] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when at least one processor executes the computer program, it can implement the technical solution of the processing method in the above embodiment.

[0256] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented by hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments.

[0257] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A method for finding intersection of private sets, characterized in that: The method is applied to a first computing device in a secure computing system; The secure computing system further includes a second computing device; and the method includes: Generate at least one subscript data and send the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is selected based on the result of performing an oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained based on processing the i-th first private data in the first privacy set of the second computing device; receiving an i-th obfuscated data sent by the second computing device; and determining a first hash value of each second private data in the second private set based on the i-th obfuscated data and the second private set of the first computing device; Receive a second hash value of the i-th first private data sent by the second computing device; and determine an intersection based on the second hash value and each of the first hash values; wherein the intersection includes the private data common to the first privacy set and the second privacy set; The determining, based on the i-th obfuscated data and the second privacy set of the first computing device, a first hash value of each second private data in the second privacy set includes: Determining a target encryption algorithm; and generating a target pseudo-random function based on the target encryption algorithm; Determine a first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data.

2. The method according to claim 1, characterized in that Generating a target pseudo-random function according to the target encryption algorithm includes: Determining public key parameters and private key parameters; and sending the public key parameters to the second computing device; wherein the public key parameters are used to generate encrypted information, the encrypted information including obfuscation parameter information and key information of the target encryption algorithm; receiving the encrypted information sent by the second computing device; and decrypting the encrypted information according to the private key parameters to obtain obfuscation parameter information and key information of the target encryption algorithm; The target pseudo-random function is generated according to the key information, the obfuscation parameter information and the target encryption algorithm.

3. The method according to claim 2, characterized in that Generating the target pseudo-random function according to the key information, the obfuscation parameter information, and the target encryption algorithm includes: The target pseudo-random function is generated according to the key information, the obfuscation parameter information, the target encryption algorithm and the encryption parameter information of the target encryption algorithm; wherein the encryption parameter information represents the parameter form of the target encryption algorithm.

4. The method according to claim 1, wherein Determining a first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data includes: determining, according to the i-th obfuscated data, the target pseudo-random function, and the second private data, comparison data corresponding to the second private data; Perform a hash operation on the comparison data to obtain a first hash value of the second private data.

5. The method according to claim 4, characterized in that Determining, according to the i-th obfuscated data, the target pseudo-random function, and the second private data, comparison data corresponding to the second private data, comprising: Performing calculation processing on the j-th second private data according to the target pseudo-random function to obtain a calculation result corresponding to the j-th second private data; Determine the comparison data corresponding to the j-th second private data based on the calculation result corresponding to the j-th second private data, the i-th obfuscated data, and the target obfuscation parameter; wherein the target obfuscation parameter is the obfuscation parameter corresponding to the i-th obfuscated data in the obfuscation parameter information sent by the second computing device.

6. The method according to claim 5, characterized in that The comparison data corresponding to the j-th second private data in, is the i-th obfuscated data, is the target confusion parameter, F k (x j ) is the calculation result corresponding to the j-th second private data.

7. The method according to claim 1, characterized in that Determine the target encryption algorithm, including: The target encryption algorithm is determined according to data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

8. The method according to any one of claims 1 to 7, characterized in that Determining an intersection according to the second hash value and each of the first hash values ​​includes: If it is determined that the first hash value corresponding to the j-th second private data among the first hash values ​​is equal to the second hash value, the j-th second private data is determined to be the public private data in the intersection.

9. A method for finding intersection of private sets, characterized in that: The method is applied to a second computing device in a secure computing system; the secure computing system also includes a first computing device; the method includes: Determine a random private key corresponding to each first private data in the first privacy set of the second computing device; and hide the i-th first private data according to the i-th random private key to obtain the i-th blinded data; Receive the i-th subscript data sent by the first computing device; and simultaneously send the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transfer (OT) operation; the i-th obfuscated data is used to generate a first hash value for each second private data in the second private set of the first computing device; and the i-th subscript data is used to obtain the i-th obfuscated data; Determine a second hash value of the i-th first private data; and send the second hash value to the first computing device; wherein each of the first hash value and the second hash value is used to generate an intersection; the intersection includes the private data common to the first privacy set and the second privacy set; The step of performing hiding processing on the i-th first private data according to the i-th random private key to obtain the i-th blinded data includes: Determining a target encryption algorithm, and generating a target pseudo-random function based on the target encryption algorithm; The i-th first private data is hidden according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

10. The method according to claim 9, characterized in that Generating a target pseudo-random function according to the target encryption algorithm includes: The target pseudo-random function is generated according to the target encryption algorithm and the key information of the target encryption algorithm; at the same time, obfuscation parameter information is generated; wherein the obfuscation parameter information includes a first obfuscation parameter and a second obfuscation parameter.

11. The method according to claim 10, characterized in that The method further comprises: receiving a public key parameter sent by the first computing device; and encrypting the key information and the obfuscation parameter information according to the public key parameter to obtain encrypted information; The encrypted information is sent to the first computing device.

12. The method according to claim 9, characterized in that Hiding the i-th first private data according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data includes: performing calculation processing on the i-th first private data according to the target pseudo-random function to obtain a calculation result of the i-th first private data; Generate obfuscation parameter information; and obtain the i-th blinded data based on the obfuscation parameter information, the i-th random private key, and a calculation result of the i-th first private data.

13. The method according to claim 12, characterized in that Obtaining the i-th blinded data according to the obfuscation parameter information, the i-th random private key, and a calculation result of the i-th first private data, including: Obtaining a first blinding value in the i-th blinded data according to a calculation result of the first obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the i-th first private data; Obtain a second blinding value in the i-th blinded data according to a calculation result of the second obfuscation parameter in the obfuscation parameter information, the i-th random private key, and the i-th first private data.

14. The method according to claim 13, characterized in that The first blinding value in the i-th blinding data Among them, k i is the i-th random private key, α0 is the first obfuscation parameter, F k (y i ) is the calculation result of the i-th first private data; the second blinding value in the i-th blinding data Wherein, α1 is the second confusion parameter.

15. The method according to claim 9, characterized in that Determine the target encryption algorithm, including: The target encryption algorithm is determined according to data features corresponding to the first privacy set and the second privacy set; wherein the target encryption algorithm has encryption parameter information, and the encryption parameter information represents a parameter form of the target encryption algorithm.

16. A privacy set intersection device, characterized in that: The apparatus is applied to a first computing device in a secure computing system; The secure computing system further includes a second computing device; the apparatus includes: a sending module, configured to generate at least one subscript data and send the i-th subscript data to the second computing device; wherein the i-th subscript data is used to obtain the i-th obfuscated data; the i-th obfuscated data is a selection result based on performing an oblivious transmission (OT) operation on the i-th blinded data; the i-th blinded data is obtained by processing the i-th first private data in the first privacy set of the second computing device; a first determining module configured to receive the i-th obfuscated data sent by the second computing device; and determine, based on the i-th obfuscated data and the second privacy set of the first computing device, a first hash value of each second private data in the second privacy set; a second determining module, configured to receive a second hash value of the i-th first private data sent by the second computing device; and determine an intersection based on the second hash value and each of the first hash values; wherein the intersection includes private data common to the first privacy set and the second privacy set; The first determining module is specifically configured to: Determining a target encryption algorithm; and generating a target pseudo-random function based on the target encryption algorithm; Determine a first hash value of each second private data according to the i-th obfuscated data, the target pseudo-random function, and each second private data.

17. A privacy set intersection device, characterized in that: The apparatus is applied to a second computing device in a secure computing system; the secure computing system also includes a first computing device; the apparatus includes: a determination module, configured to determine a random private key corresponding to each first private data in the first privacy set of the second computing device; and to perform a concealment process on the i-th first private data according to the i-th random private key to obtain an i-th blinded data; A first sending module, configured to receive the i-th subscript data sent by the first computing device; and simultaneously send the i-th blinded data to the first computing device; wherein the i-th blinded data is used to obtain the i-th obfuscated data based on the oblivious transfer (OT) operation; the i-th obfuscated data is used to generate a first hash value of each second private data in the second private set of the first computing device; and the i-th subscript data is used to obtain the i-th obfuscated data; a second sending module, configured to determine a second hash value of the i-th first private data; and send the second hash value to the first computing device; wherein each of the first hash value and the second hash value is used to generate an intersection; and the intersection includes the private data common to the first privacy set and the second privacy set; The determining module is specifically configured to: Determining a target encryption algorithm, and generating a target pseudo-random function based on the target encryption algorithm; The i-th first private data is hidden according to the i-th random private key and the target pseudo-random function to obtain the i-th blinded data.

18. A first computing device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 8.

19. A second computing device, characterized in that include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 9 to 15.

20. A secure computing system, characterized in that: The secure computing system includes a first computing device and a second computing device; the first computing device is used to implement the method according to any one of claims 1 to 8; the second computing device is used to implement the method according to any one of claims 9 to 15.

21. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method according to any one of claims 1 to 8 or the method according to any one of claims 9 to 15.

22. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 8 or the method according to any one of claims 9 to 15.

Images