Method and device for jointly carrying out set operation

Abstract

The embodiment of the invention provides a method and a device for jointly performing set operation, an auxiliary encryption party and a set calculation party are introduced into a multi-party security calculation framework in which a plurality of set holding parties jointly perform predetermined set operation, and each set holding party performs security interaction encryption with the auxiliary encryption party respectively. The method comprises the steps that firstly, a local set is encrypted through a secret key of an auxiliary encryption party to obtain disordered first set ciphertexts of a local set, then a set calculation party obtains all the first set ciphertexts corresponding to all set holding parties respectively, preset set operation is carried out to obtain first result ciphertexts, and then a result obtaining party obtains ciphertext data corresponding to the first result ciphertexts and sends the ciphertext data to the auxiliary encryption party; and performing secure interaction decryption with the auxiliary encryption party to obtain plaintext data of the first result ciphertext. According to the embodiment, the effectiveness of the multi-party security computing application can be improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of secure computing technology, and more particularly, to a method and apparatus for jointly performing collective operations. Background Art

[0002] Secure Multi-Party Computation (SMPC or MPC), also known as multi-party secure computing, solves the problem of collaborative computing between a group of mutually distrusting parties to protect privacy, such as multiple parties jointly calculating the result of a function without revealing the input data of each party of the function, and the result of the calculation is made public to one or more of the parties. For example, typical applications of secure multi-party computing include privacy intersection and joint learning. Secure multi-party computing allows the participating parties to calculate business processing results such as statistical results and machine learning results based on the joint data of all parties without exposing their original data.

[0003] Set operation is one of the common operations in secure multi-party computing. For example, in the scenario of joint machine learning, each participant of MPC can align sample data through private intersection (PSI). For another example, each participant hopes to find common customers for joint marketing through private intersection (PSI), etc. It can be understood that private intersection is the intersection operation of sets. Set operation can also be a union operation. In practice, set operation can include one of intersection, union, complement, difference or a mixed operation. In a specific scenario, B and C are blacklists maintained by participants P1 and P2 respectively, and A is a user list provided by participant P0. Through the set operation A∩(B∪C), users in A on the blacklist can be found. Users can be marked by mobile phone numbers, identity identification numbers, etc. The data privacy issues involved in set operation are: data holders do not want to directly output private data in plain text to the outside world to prevent data leakage during the transmission process and data storage and illegal dissemination by the other party after transmission; on the other hand, data cooperation requires all parties to perform set operations without leaking other information other than the results.

[0004] Therefore, how to perform arbitrary collective operations is called an important technical issue in multi-party secure computing. Summary of the invention

[0005] One or more embodiments of the present specification describe a method and apparatus for jointly performing a set operation to solve one or more problems mentioned in the background technology.

[0006] According to the first aspect, a method for jointly performing set operations is provided, which is used for multiple set holders to jointly perform predetermined set operations, and a single set holder holds at least one set; the method includes: each set holder interacts securely with an auxiliary encryption party to obtain a first set ciphertext of the local set, and the first set ciphertext is a ciphertext encrypted and scrambled by the key of the auxiliary encryption party; the set calculation party obtains each first set ciphertext corresponding to each set holder, performs the predetermined set operation on each first set ciphertext, and obtains a first result ciphertext; the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and interacts securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0007] In one embodiment, the multiple set holders include a first party, which holds a first set. The various set holders each interact securely with an auxiliary encryption party to obtain a first set ciphertext of a local set, including: encrypting the first set with a local encryption key to obtain a first ciphertext; providing the first ciphertext to the auxiliary encryption party so that the auxiliary encryption party can feed back a second ciphertext obtained by re-encrypting the first ciphertext with the auxiliary encryption key and scrambling it; and decrypting the second ciphertext fed back by the auxiliary encryption party with a local decryption key to obtain a first set ciphertext corresponding to the first set.

[0008] In one embodiment, there are multiple auxiliary encryption parties, and each of the set holders interacts securely with the auxiliary encryption party respectively, and the first set ciphertext of the local set is obtained, including: a single set holder interacts securely with each auxiliary encryption party in turn, and finally obtains the first set ciphertext of the local set that is multiply encrypted and scrambled with the keys of each auxiliary encryption party; or, a single set holder encrypts the local set with the local encryption key to obtain the first ciphertext of the local set and sends it to any auxiliary encryption party, and each auxiliary encryption party encrypts the received set ciphertext with the local auxiliary key in turn and passes it to other auxiliary encryption parties, and performs scrambling operations through at least one auxiliary encryption party until the last auxiliary encryption party feeds back the multiply encrypted auxiliary ciphertext to the single set holder; the single set holder decrypts the auxiliary ciphertext to obtain the first set ciphertext corresponding to the local set.

[0009] In one embodiment, when the set holder is not the result acquirer and the set calculator at the same time, each set holder interacts securely with the auxiliary encryption party to obtain the first set ciphertext of the local set, including: the auxiliary encryption party provides the auxiliary encryption key to each set holder, so that each set holder can encrypt the local set respectively to obtain the corresponding first set ciphertext.

[0010] In one embodiment, when there are multiple auxiliary encryption parties including the single set holder, each of the set holders interacts securely with at least one auxiliary encryption party to obtain the first set ciphertext of the local set, including: the single set holder encrypts the first ciphertext obtained by encrypting the local set with the local encryption key and passes it to other auxiliary encryption parties; each auxiliary encryption party encrypts the received set ciphertext with the local auxiliary key in turn, and at least one auxiliary encryption party performs random operations on the ciphertext until the last auxiliary encryption party completes the encryption operation to obtain the corresponding first set ciphertext, and the last auxiliary encryption party that completes the encryption operation provides the first set ciphertext to the set calculation party.

[0011] In one embodiment, the predetermined set operation is: an operation of obtaining at least one of the intersection, union, complement, and difference between multiple sets.

[0012] In one embodiment, the result acquirer obtains the ciphertext data corresponding to the first result ciphertext, including: in the case where a single result acquirer obtains the result of a set operation, the ciphertext data corresponding to the first result ciphertext is the first result ciphertext itself, and the single result acquirer obtains the first result ciphertext from a set calculation party; in the case where a secret sharing form of the result of a set operation is obtained by multiple result acquirers, the first result ciphertext can be split into multiple fragments by the set calculation party, and each result acquirer obtains a single fragment from the set calculation party as the ciphertext data corresponding to the first result ciphertext.

[0013] In one embodiment, the set computing party is a result acquiring party, and the set computing party locally acquires the ciphertext data corresponding to the first result ciphertext as the result acquiring party.

[0014] In one embodiment, the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and interacts securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext, including: encrypting the ciphertext data using a local encryption key to obtain a third ciphertext; providing the third ciphertext to the auxiliary encryption party so that the auxiliary encryption party can feedback a fourth ciphertext obtained by decrypting the third ciphertext using an auxiliary decryption key and scrambling the third ciphertext; and decrypting the fourth ciphertext fed back by the auxiliary encryption party using a local decryption key, thereby obtaining the plaintext data of the first result ciphertext.

[0015] In one embodiment, the result acquisition party is an auxiliary encryption party. The result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and interacts securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext, including: providing the ciphertext data corresponding to the first result ciphertext to other auxiliary encryption parties, so that each auxiliary encryption party can feedback the fifth ciphertext obtained by decrypting the ciphertext data corresponding to the first result ciphertext using the auxiliary decryption key and scrambling it; using the local decryption key to decrypt the fifth ciphertext, thereby obtaining the plaintext data of the first result ciphertext.

[0016] According to the second aspect, a method for jointly performing set operations is provided, which is used for multiple set holders to jointly perform predetermined set operations, and a single set holder holds at least one set; the multiple set holders include a first party, and the first party holds a first set. The method is executed by the first party, including: securely interacting with an auxiliary encryption party to obtain a first set ciphertext of a first set, wherein the first set ciphertext is a ciphertext encrypted and scrambled with the key of the auxiliary encryption party; providing a first set ciphertext corresponding to the first set to a set calculation party, so that the set calculation party can use the first set ciphertexts obtained from each set holder respectively to perform the predetermined set operation to obtain a first result ciphertext, so that the result acquisition party, when obtaining the ciphertext data corresponding to the first result ciphertext, securely interacts with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0017] In one embodiment, when the first party is a set computing party, the method further includes: obtaining each first set ciphertext of other sets from each other set holder respectively; and performing the predetermined set operation on each first set ciphertext to obtain a first result ciphertext.

[0018] In one embodiment, when the first party is the result acquirer, the method further includes: acquiring ciphertext data corresponding to the first result ciphertext; and securely interacting with the auxiliary encryption party to decrypt the ciphertext data corresponding to the first result ciphertext to obtain the plaintext data of the first result ciphertext.

[0019] According to a third aspect, a system for jointly performing a set operation is provided, comprising a plurality of set holders, an auxiliary encryption party and a set calculation party, for the plurality of set holders to jointly perform a predetermined set operation, a single set holder holds at least one set, and the plurality of set holders include at least one result acquisition party; wherein:

[0020] The single set holder is configured to interact securely with the auxiliary encryption party to obtain a first set ciphertext of the local set, where the first set ciphertext is a ciphertext encrypted by the key of the auxiliary encryption party and in a disordered order;

[0021] The auxiliary encryption party is configured to encrypt ciphertext obtained from the set holder or other auxiliary encryption parties, and to decrypt ciphertext obtained from the result obtainer or other auxiliary encryption parties;

[0022] The set calculation party is configured to obtain each first set ciphertext corresponding to each set holder, perform the predetermined set operation on each first set ciphertext, and obtain a first result ciphertext;

[0023] The result acquisition party is configured to acquire the ciphertext data corresponding to the first result ciphertext, so as to securely interact with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0024] According to a fourth aspect, there is provided a device for jointly performing a set operation, for multiple set holders to jointly perform a predetermined set operation, wherein a single set holder holds at least one set; the multiple set holders include a first party, the first party holds a first set, and the device is provided at the first party, comprising:

[0025] An encryption unit is configured to interact securely with the auxiliary encryption party to obtain a first set of first set ciphertexts, wherein the first set of ciphertexts is ciphertexts encrypted by a key of the auxiliary encryption party and in a scrambled order;

[0026] A providing unit is configured to provide the first set ciphertext of the first set to the set computing party, so that the set computing party can use the first set ciphertexts respectively obtained from the set holders to perform the predetermined set operation to obtain the first result ciphertext, so that the result acquiring party can obtain the ciphertext data corresponding to the first result ciphertext through secure interaction with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0027] According to a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method of the second aspect.

[0028] According to a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method of the second aspect is implemented.

[0029] Through the method and device provided by the embodiments of this specification, in a multi-party secure computing architecture where multiple set holders jointly perform predetermined set operations, an auxiliary encryption party and a set computing party are introduced, and each set holder performs secure interactive encryption with the auxiliary encryption party to obtain the first set ciphertext of the local set encrypted and scrambled by the key of the auxiliary encryption party, and then the set computing party obtains each first set ciphertext corresponding to each set holder to perform the predetermined set operation to obtain the first result ciphertext, and then the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and performs secure interactive decryption with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext. This technical concept combines the sequential crossover of deterministic encryption and the position information of the scrambled set elements, so that the set computing party can directly perform set operations under homomorphic ciphertexts, reduce computing overhead, reduce related business processing costs, and improve the effectiveness of multi-party secure computing applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0031] Figure 1 A schematic diagram of a system architecture for performing a collective operation in conjunction with an embodiment of the technical concept of this specification is shown;

[0032] Figure 2 An interactive flow chart of jointly performing a set operation according to an embodiment of the technical concept of this specification is shown;

[0033] Figure 3 It is a flow chart of a method for performing a collective operation on a single collective holder in conjunction with an embodiment of the technical concept of this specification;

[0034] Figure 4 It is a schematic block diagram of an apparatus for performing a joint collective operation provided in a single collective holder according to an embodiment. DETAILED DESCRIPTION

[0035] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0036] First, some professional terms that may be used in this manual are clarified:

[0037] Private Set Intercetion, Private Set Intersection protocol, referred to as PSI. The private set intersection protocol is used by two data holders to determine the data intersection. Specifically, the two data holders each hold a private data set, for example, represented as X and Y respectively. In the process of calculating the intersection X∩Y of the data sets X and Y, the elements not included in the intersection are not disclosed, that is, the information of any party other than the intersection is not disclosed. Conventional PSI technologies include ECDH (Elliptic Curve Diffie-Hellman key Exchange), KKRT (an efficient OT-based PSI protocol constructed by combining Cuckoo hash and batched OPRF), etc., which will not be repeated here.

[0038] Set operation, in this specification, refers to the operation performed on a set, which can also be called set operation. Set is a basic concept in mathematics, which represents the totality of some certain and different elements. Set operation represents various calculations generated by comparing or merging elements between sets, for example, including calculating the intersection, union, difference and complement of sets, such as calculating the intersection of set A and the union of set B and set C, that is, A∩(B∪C). The set operation here does not include interactive operations such as addition and subtraction between elements.

[0039] Deterministic encryption, the encryption scheme is deterministic, one plaintext corresponds to one ciphertext, and the ciphertext obtained by encrypting the same plaintext each time is the same. Encryption algorithms that implement deterministic encryption include DH algorithm, RSA algorithm, etc. Deterministic encryption is interchangeable. For example, a value M is encrypted twice using two different encryption keys k1 and k2. The encryption result does not change when the keys are used in different orders. When decrypting, the decryption order can be the same as or different from the encryption order. For example, assuming that the decryption keys corresponding to encryption keys k1 and k2 are d1 and d2 respectively, then: k2k1(M)=k1k2(M), d1[k2k1(M)]=d1[k1k2(M)]=k2(M), d2[k2k1(M)]=d2[k1k2(M)]=k1(M), d1d2[k2k1(M)]=d1d2[k1k2(M)]=d2d1[k2k1(M)]=d2d1[k1k2(M)]=M.

[0040] Arbitrary set operations under the conventional MPC architecture usually represent the set as a polynomial (all roots of the polynomial are all elements of the set). Set operations are performed through polynomial operations. By homomorphically encrypting the polynomials, polynomial operations are performed in a secret state. The disadvantage is that the complexity of polynomial multiplication is large and the overhead of homomorphic encryption is large, which may result in low computing performance.

[0041] In view of this, this specification provides an architecture for joint set operations, using a deterministic encryption method, and in addition to the set holder who holds the set data, an auxiliary encryption party and a set calculation party (which can be the set holder) are introduced to perform set operations based on the replacement of the key. Figure 1 As shown, each set holder can interact securely with the auxiliary encryption party to perform key replacement and obtain the local set encrypted by the auxiliary encryption party's key and in scrambled order. The set calculation party obtains the set ciphertexts corresponding to each set holder, and performs a predetermined set operation to obtain the ciphertext of the operation result. The result acquisition party can obtain the ciphertext data of the operation result, and perform secure interactive decryption with the auxiliary encryption party to obtain the corresponding plaintext data.

[0042] There may be at least one result acquirer, and optionally, a single result acquirer may be a single set holder. In addition, in some embodiments, when there are multiple auxiliary encryption parties, the auxiliary computing party may also be a set holder. It is worth noting that a set holder cannot be both a result acquirer and an auxiliary encryption party at the same time.

[0043] Under this technical concept, the permutability of deterministic encryption is fully utilized, and disorder is used to ensure that the privacy of data location is not leaked. Since it only involves secure interaction for key replacement and communication overhead between the set holder and the set calculator, and the calculation process is implemented under homomorphic ciphertext (the same elements have the same ciphertext), it can greatly reduce the complexity of set operations, save communication and computing overhead, and improve the efficiency of multi-party joint set operations.

[0044] Reference below Figure 2 As shown, the technical concept of this specification is described in detail by taking the case where there are two set holders as an example.

[0045] like Figure 2 As shown, it is assumed that the first party and the second party are set holders, holding sets M0 and M1 respectively. The key pair held by the first party is recorded as (k0, d0), and the key pair held by the second party is recorded as (k1, d1). k0 and k1 are encryption keys, and d0 and d1 are decryption keys. d0 can decrypt data encrypted by k0, and d1 can decrypt data encrypted by k1. In the case of multiple encryption, the decryption process is not limited by the encryption order.

[0046] The first party and the second party need to jointly perform set operations on M0 and M1, such as calculating the intersection, union, complement of the intersection of the two in M0, etc. It is assumed here that the first party is the result acquisition party. Under the implementation framework of this specification, an auxiliary encryption party and a set calculation party are also introduced. The auxiliary encryption party also adopts deterministic encryption, for example, holding a corresponding key pair (F, dF), where F is an encryption key and dF is a decryption key, and dF can decrypt data encrypted by F.

[0047] like Figure 2 As shown, the process of jointly performing set operations provided by the embodiments of this specification can be divided into three stages. In the first stage, in step 201, each set holder performs secure interactive encryption with the auxiliary encryption party, and each obtains the first set ciphertext of the local set encrypted and scrambled by the encryption key of the auxiliary encryption party; in the second stage, in step 202, the set calculation party obtains each first set ciphertext corresponding to each set holder, performs a predetermined set operation in a secret state, and obtains the secret form of the set operation result, such as the first result ciphertext; in the third stage, in step 203, the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and performs secure interactive decryption with the auxiliary encryption party to obtain the plaintext data corresponding to the first result ciphertext.

[0048] First, in step 201, each set holder performs secure interactive encryption with the auxiliary encryption party, and each obtains a first set ciphertext of the local set encrypted with the auxiliary encryption party's encryption key and in scrambled order.

[0049] A single set holder and an auxiliary encryption party can interact securely without disclosing the privacy of the set data, thereby encrypting the set data held by the set holder and obtaining a set ciphertext encrypted with the encryption key of the auxiliary encryption party. In order to make the data more secure, the elements in the set can also be shuffled during the encryption process. The encrypted and shuffled set ciphertext is recorded as the first set ciphertext. Here, a single first set ciphertext is the ciphertext obtained by encrypting a single set in the first stage, and each set corresponds to each first set ciphertext. The auxiliary encryption party can be a trusted third party relative to each set holder, or it can be a set holder. In other words, a set holder can also serve as an auxiliary encryption party.

[0050] According to one possible design, when the set holder is not the auxiliary encryptor, the set holder can perform secure key replacement with the auxiliary encryptor, and the set holder can obtain the first set ciphertext encrypted by the encryption key of the auxiliary encryptor.

[0051] refer to Figure 2As shown, taking the set M0 held by the first party as an example, the key replacement process is as follows: For the set M0 held by the first party, the first party encrypts it using the local encryption key k0, such as being recorded as the first ciphertext k0M0. The first party provides k0M0 to the auxiliary encryption party, and the auxiliary encryption party scrambles and re-encrypts the ciphertext elements in the first ciphertext k0M0. Among them, the order of scrambling and re-encryption is not limited. Since the set operations involved in this specification do not involve operations between elements, the scrambling can be performed using a pre-generated scrambling rule or a random scrambling method. Assume that the set corresponding to the scrambled set ciphertext has become M0′. The auxiliary encryption party uses the key F for re-encryption, and the encrypted second ciphertext is recorded as Fk0M0′, for example. It can be understood that in the case of first scrambling, the scrambled set ciphertext k0M0′ is encrypted using F to obtain Fk0M0′, and in the case of first re-encryption, the set ciphertext Fk0M0 is first obtained, and then scrambled to Fk0M0′.

[0052] The auxiliary encryption party feeds back the second ciphertext Fk0M0′ to the first party. The first party uses the decryption key d0 to decrypt the second ciphertext Fk0M0′, that is, to decrypt the data encrypted by k0. Due to the alternation of the decryption process, it is not affected by the encryption order, which is equivalent to releasing a layer of encryption of k0. The set ciphertext obtained after decryption is the first set ciphertext FM0′ corresponding to the set M0. In this way, the first party completes the key replacement process, and obtains the first ciphertext set FM0′ encrypted by the auxiliary encryption party's encryption key F after the set M0 is scrambled.

[0053] Similarly, the second party can first encrypt the local set M1 with the local key k1 in a similar manner, obtain the first ciphertext k1M1 and provide it to the auxiliary encryption party, the auxiliary encryption party re-encrypts the first ciphertext k1M1 and scrambles it to obtain the second ciphertext k1M1′ and feeds it back to the second party. The second party decrypts the second ciphertext k1M1′ with d1, and obtains the first set ciphertext FM1′ that is encrypted and scrambled by the auxiliary encryption party's encryption key F.

[0054] The first set ciphertext FM0′ obtained by the first party and the first set ciphertext FM1′ obtained by the second party are homomorphic ciphertexts in an encrypted state with the encryption key F. Optionally, a single set holder may hold multiple sets, and for each set, the set holder may interact with the auxiliary encryption party respectively to obtain the first set ciphertext corresponding to each set.

[0055] In some optional implementations, there may be multiple auxiliary encryption parties. In this case, the first ciphertexts k0M0, k1M1, etc. may be encrypted multiple times by each auxiliary encryption party in turn, and at least one auxiliary encryption party may scramble the collective ciphertexts received or provided after encryption.

[0056] According to one embodiment, assuming that the number of auxiliary encryption parties is m, the first party and the second party as set holders can each send the first ciphertext of the local set encrypted under the local key to the first auxiliary encryption party. The first auxiliary encryption party can encrypt the received first ciphertext with its encryption key and scramble it, and then send it to the second auxiliary encryption party. The second auxiliary encryption party encrypts the received ciphertext set with its encryption key, scrambles it, and then sends it to the next auxiliary encryption party... until the mth auxiliary computing party encrypts the received set ciphertext with its local key and scrambles it, and finally obtains the homomorphic ciphertext encrypted by multiple keys and sends it to the corresponding set holder (such as the first party or the second party) for decryption.

[0057] According to another embodiment, the first party and the second party as the set holder can each send the local first ciphertext to the first auxiliary encryption party, and the first auxiliary encryption party can use its encryption key to re-encrypt the received first ciphertext and feed it back in random order to the set holder of the corresponding set source (i.e., the first party or the second party). The first party and the second party then send the re-encrypted set ciphertext (current set ciphertext) to the second auxiliary encryption party, and the second auxiliary encryption party encrypts the received ciphertext set with its encryption key and feeds it back in random order to the set holder of the corresponding set source... until the mth auxiliary computing party encrypts the received set ciphertext with its local key and scrambles it, and finally obtains the multi-key encrypted homomorphic ciphertext and sends it to the corresponding set holder, i.e., the first party or the second party. In this case, the auxiliary encryption parties do not need to communicate with each other, thereby reducing the complexity of business interaction between the auxiliary encryption parties.

[0058] Among them, when there are multiple auxiliary encryption parties, all or part (at least one) of them can perform the disorder operation. The disorder of the set ciphertext by the auxiliary encryption party can disrupt the correspondence between the plaintext and the ciphertext, and prevent malicious set holders and set calculation parties from colluding to steal the plaintext information corresponding to the ciphertext of other set holders.

[0059] In some optional implementations, a single auxiliary encryption party may also be any party that serves as a set holder. In the case where there is only one auxiliary encryption party, the set holder that serves as an auxiliary encryption party may not exchange keys with the auxiliary encryption party, but directly encrypt the first ciphertext of the local set with the local key as the corresponding first set ciphertext. In the case where there are multiple auxiliary encryption parties, the set holder that serves as the auxiliary encryption party does not need to exchange keys, and the keys of the set holders that are not auxiliary encryption parties can be replaced, and the encryption of the local encryption key can be removed by the local decryption key. At this time, the key replacement (i.e., removal of the encryption of the local encryption key) of the set holders that are not auxiliary encryption parties can be performed after the encryption of any auxiliary encryption party to ensure that the corresponding set is transmitted in a ciphertext state.

[0060] According to one embodiment, when all set holders are auxiliary encryption parties, each set holder does not need to perform key replacement, but instead transmits the first ciphertext corresponding to the local set to the next set holder for encryption and scrambling, and the multiple set ciphertexts obtained after the set of a single set holder is encrypted and scrambled by all set holders (who are also auxiliary encryption parties) are used as the corresponding first set ciphertext. At this time, the homomorphic ciphertexts of each set are the state of the set being repeatedly encrypted by the encryption keys of each set holder.

[0061] by Figure 2 For example, assuming that both the first and second parties are auxiliary encryption parties, the first party can provide the first ciphertext k0M0 to the second party, and the second party further encrypts and scrambles it with the local key k1 to obtain the first set ciphertext k1k0M0′. Similarly, the second party can provide the first ciphertext k1M1 to the first party, and the first party further encrypts and scrambles it with the local key k0 to obtain the first set ciphertext k0k1M1′.

[0062] According to another possible design, when the set holder is not the result acquirer and the set calculator at the same time, the secure interactive encryption performed by each set holder with the auxiliary encryption party may be: the auxiliary encryption party provides the local encryption key (such as recorded as the auxiliary encryption key) to each set holder, so that each set holder can use the encryption key of the auxiliary encryption party to encrypt the local set to obtain the corresponding first set ciphertext.

[0063] In more embodiments, the first set ciphertext may be determined in more ways, which will not be described in detail here.

[0064] Next, through step 202, the set computing party obtains each first set ciphertext corresponding to each set holder, performs a predetermined set operation in a secret state, and obtains a secret form of the set operation result, which is recorded as a first result ciphertext.

[0065] It can be understood that the set operations in this specification may include at least one of intersection, union, complement, difference, etc. These operations are usually implemented by comparing elements, without involving interactions such as addition, subtraction, multiplication, and division between elements.

[0066] In this way, the first set ciphertexts (such as FM0′, FM1′, etc.) corresponding to each set can be provided to the same set computing party for related set operations. Here, the set computing party can be a trusted third party or any one of the set holders (such as the first party and the second party). Since the first set ciphertexts are in the same encryption state, the ciphertexts of the same element encrypted by each encryption key in no particular order are the same, so the set computing party can complete the set operation by comparing the element ciphertexts in a secret state.

[0067] exist Figure 2 In the example, the set operation is recorded as f (such as f(A, B) = A∩B), then the operation result on FM0′ and FM1′ can be recorded as: f(FM0′, FM1′) = FM0′∩FM1′. ∩ indicates the intersection. The operation result is the ciphertext form of the set operation result, and the encryption state is consistent with the first set ciphertext, for example, it is the common encryption form of the encryption keys of each auxiliary encryption party. The above operation result f(FM0′, FM1′) is equivalent to F[f(M0′, M1′)]. The plaintext of the set operation result is recorded as Mr = f(M0′, M1′), and the operation result can be further recorded as FMr, which is called the first result ciphertext in this specification.

[0068] Then, in step 203, the result acquisition party acquires the ciphertext data corresponding to the first result ciphertext, and performs secure interactive decryption with the auxiliary encryption party to obtain the plaintext data corresponding to the first result ciphertext.

[0069] It can be understood that the result acquisition party can be any one or more of the collection holders. The collection computing party can provide the confidential collection operation result (i.e., the first result ciphertext such as FMr) to the result acquisition party. The so-called result acquisition party is the collection holder that obtains the collection operation result. The result acquisition party can be one party or multiple parties. According to business needs, when there are multiple result acquisition parties, it is possible to distinguish between a single result acquisition party obtaining the complete operation result and the situation where each result acquisition party jointly and securely holds the operation result. In the case where each result acquisition party jointly and securely holds the operation result, the collection computing party can also split the confidential collection operation result into different ciphertext fragments, such as FMr=FMr1+FMr2, and distribute each fragment as the ciphertext data corresponding to the first result ciphertext to each result acquisition party, such as passing FMr1 and FMr2 to the first party and the second party respectively.

[0070] In a possible design, the result acquisition party can be a set computing party. In this case, the result acquisition party can directly obtain the first result ciphertext as the ciphertext data corresponding to the first result ciphertext through the set operation in the encrypted state. In the case where multiple result acquisition parties jointly and securely hold the operation results, the result acquisition party cannot be used as a set computing party. This is because, if the result acquisition party splits the encrypted set operation result into multiple identical copies, it may cause the acquisition of the fragmented plaintext, which means the operation result is leaked.

[0071] According to one embodiment, since the result of the collective operation is in an encrypted state with the encryption key of the auxiliary encryption party, the plain text information of the result of the collective operation can be obtained through key replacement, etc. In order not to disclose the data position relationship before and after the collective operation, the data can be further shuffled during the secure interaction with the auxiliary encryption party.

[0072] Figure 2 In the example given, the result acquisition party is a single set holder, such as the first party. After the first party obtains the first result ciphertext FMr of the ciphertext set of the result of the set operation, it can perform the following key replacement process with the auxiliary encryption party: the first party uses the local encryption key k0 to encrypt the first result ciphertext FMr twice to obtain the third ciphertext k0FMr, and provides it to the auxiliary encryption party. The auxiliary encryption party uses the decryption key dF to decrypt the encryption key F in the third ciphertext and scramble it to obtain the fourth ciphertext k0Mr′ and feed it back to the first party. The first party decrypts the fourth ciphertext k0Mr′ with the local decryption key d0 to obtain the plaintext data Mr′ of the result of the set operation. In this way, when the result acquisition party is the first party, the plaintext information of the result of the set operation can be obtained.

[0073] It is worth noting that when the result acquirer is a plurality of set holders, each result acquirer can interact securely with the auxiliary encryption party to obtain the plaintext of the corresponding set operation result or its fragment, that is, the plaintext data of the first result ciphertext.

[0074] In an optional embodiment, there are multiple auxiliary encryption parties. After receiving the ciphertext data corresponding to the first result ciphertext (such as the first result ciphertext itself, or its fragments), the result acquisition party can encrypt the result set ciphertext with a local encryption key to obtain a third ciphertext, and provide the third ciphertext to each auxiliary encryption party in turn for decryption to obtain a fourth ciphertext, wherein the ciphertext provided to the k+1th auxiliary encryption party is the ciphertext decrypted by the kth auxiliary encryption party. Since the encryption and decryption order is not in order under the determined encryption method, the result acquisition party can interact securely with each auxiliary encryption party in turn to gradually release the encryption of each auxiliary encryption party in the third ciphertext, or provide the third ciphertext to one of the auxiliary encryption parties, which is passed between the auxiliary encryption parties to release the corresponding key encryption in turn. Each auxiliary encryption party uses the auxiliary decryption key to decrypt the third ciphertext and obtains the decryption result in disorder, such as being recorded as the fourth ciphertext. The fourth ciphertext is the ciphertext encrypted by the decryption key of the result acquisition party, and can eventually be fed back to the result acquisition party. The result acquisition party decrypts the fourth ciphertext to obtain the plaintext data of the first result ciphertext, that is, the plaintext data of the set operation result.

[0075] In an optional implementation, the result acquirer may be one of the auxiliary encryption parties. The result acquirer may provide the ciphertext data corresponding to the first result ciphertext to other auxiliary encryption parties, so that the first result ciphertext may be decrypted in turn by each auxiliary encryption party and the decryption result may be transmitted, and finally the fifth ciphertext may be obtained by decryption by each other auxiliary encryption party, and the feedback value may be returned to the result acquirer.

[0076] In an optional embodiment, in order to eliminate the position correspondence of the elements of the set, during the encryption process, the received or locally decrypted ciphertext set may also be shuffled by at least one auxiliary encryption party.

[0077] In more embodiments, based on the technical concept of this specification, there may be other implementation methods not listed here, which will not be described in detail here.

[0078] Figure 2 The specific example depicts the process in which the set holder, the auxiliary encryption party and the result acquisition party cooperate with each other to perform predetermined set operations from the perspective of the overall implementation architecture. Figure 3 The process performed by a single collection holder in a joint collection operation is also shown. Figure 3The execution subject of the process shown can be any computer, device, or server with certain computing capabilities. Assuming that any one of the multiple set holders is recorded as the first party, and the first party holds at least the first set, the process of jointly performing set operations performed by the first party may include: step 301, securely interacting with the auxiliary encryption party to obtain the first set ciphertext of the first set, the first set ciphertext is the ciphertext encrypted and disordered by the key of the auxiliary encryption party; step 302, providing the first set ciphertext corresponding to the first set to the set calculation party, so that the set calculation party can use the first set ciphertexts obtained from each set holder to perform a predetermined set operation to obtain the first result ciphertext, so that the result acquisition party can securely interact with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext when obtaining the ciphertext data corresponding to the first result ciphertext.

[0079] First, in step 301, secure interaction is performed with an auxiliary encryption party to obtain a first set of ciphertexts of a first set.

[0080] The first party and the auxiliary encryption party can interact securely without disclosing the privacy of the set data, thereby encrypting the first set and obtaining the set ciphertext encrypted by the auxiliary encryption party's encryption key. For greater security, the auxiliary encryption party can also shuffle the elements in the set during the encryption process. The encrypted and shuffled set ciphertext is recorded as the first set ciphertext. The first set ciphertext is the ciphertext obtained by encrypting a single set in the first stage, and each set corresponds to each first set ciphertext. The auxiliary encryption party can be a trusted third party or a set holder. In other words, a set holder can also serve as an auxiliary encryption party.

[0081] In one embodiment, the first party may obtain the encryption key of the auxiliary encryption party, and use the encryption key of the auxiliary encryption party to encrypt the first set to obtain the corresponding first set ciphertext.

[0082] In another embodiment, when the first party is not the auxiliary encryption party, it can perform secure key replacement with the auxiliary encryption party, and the first party obtains the first set ciphertext obtained by encrypting the first set with the encryption key of the auxiliary encryption party.

[0083] In another embodiment, there are multiple auxiliary encryption parties, and the first party can provide the local collective ciphertext (such as the first ciphertext) encrypted with the local key to each auxiliary encryption party for multiple encryption in sequence. At this time, the first party can perform secure interactions with each auxiliary encryption party for multiple encryption, or provide the first ciphertext to one of the auxiliary encryption parties, and the ciphertext is passed between the auxiliary encryption parties until each auxiliary encryption party completes the encryption. It is worth noting that during the multiple encryption process of the collective ciphertext by multiple auxiliary encryption parties, at least one auxiliary encryption party can shuffle it. In addition, when the first party is not an auxiliary encryption party, after any auxiliary encryption party completes the encryption, the first party can release the local key (i.e., use the local decryption key to decrypt the ciphertext). When the first party is one of the auxiliary encryption parties, the first party does not need to decrypt.

[0084] In more embodiments, more methods may be used to encrypt the first set held by the first party using the auxiliary encryption key provided by the auxiliary encryption party to ensure that the first set and the set data of other set holders are in the same encrypted form, which are not listed one by one here.

[0085] Next, through step 302, the first set ciphertext corresponding to the first set is provided to the set calculation party.

[0086] The first party may provide the first set ciphertext corresponding to the first set to the set calculation party. Thus, the set calculation party may use the first set ciphertexts obtained from the set holders to perform a predetermined set operation to obtain the first result ciphertext. The set operation here may include at least one of intersection, union, complement, difference, etc.

[0087] According to a possible design, when the first party is a set calculation party, the first party can also obtain each first set ciphertext of other sets from each other set holder, and perform a predetermined set operation on each first set ciphertext to obtain a first result ciphertext.

[0088] The collective computing party may provide the predetermined result acquisition party with the ciphertext data of the first result ciphertext, such as the first result ciphertext itself, or a fragment of the first result ciphertext. When the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, it interacts securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext. When the collective computing party is also the result acquisition party, the collective computing party may not need to feed back the ciphertext data of the first result ciphertext to other parties.

[0089] According to a possible design, the first party may be the result acquisition party. At this time, the first party may obtain the ciphertext data corresponding to the first result ciphertext, and interact securely with the auxiliary encryption party, thereby decrypting the ciphertext data corresponding to the first result ciphertext to obtain the plaintext data of the first result ciphertext. According to one embodiment, since the result of the set operation is in an encrypted state of the encryption key of the auxiliary encryption party, the plaintext information of the result of the set operation may be obtained through key replacement and other methods. In order not to disclose the data position relationship before and after the set operation and leak data information, further shuffling may be performed during the secure interaction with the auxiliary encryption party.

[0090] It is worth mentioning that Figure 3 The illustrated embodiments and Figure 2 The embodiments shown are all specific embodiments of the technical concept of this specification. Figure 2 The process shown is Figure 3 The process executed by any set holder in , therefore, Figure 2 , Figure 3 The relevant descriptions in can be adapted to each other in actual business needs.

[0091] Looking back at the above process, in a multi-party secure computing architecture where multiple set holders jointly perform predetermined set operations, an auxiliary encryption party and a set computing party are introduced. Each set holder performs secure interactive encryption with the auxiliary encryption party to obtain the first set ciphertext of the local set encrypted and scrambled by the auxiliary encryption party's key. Then the set computing party obtains the first set ciphertexts corresponding to each set holder, and performs predetermined set operations to obtain the first result ciphertext. Then, the result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and performs secure interactive decryption with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext. This technical concept combines the sequential crossover of deterministic encryption and the position information of the scrambled set elements, so that the set computing party can directly perform set operations under homomorphic ciphertexts, reduce computing overhead, reduce related business processing costs, and improve the effectiveness of multi-party secure computing applications.

[0092] According to another embodiment, a system for jointly performing a set operation is also provided, including multiple set holders, an auxiliary encryption party and a result acquisition party, for multiple set holders to jointly perform a predetermined set operation, and the system architecture is as follows: Figure 1As shown. A single set party holds at least one set. Then: the single set holder is configured to interact securely with the auxiliary encryption party, so as to obtain the first set ciphertext of the local set encrypted and scrambled by the auxiliary encryption party's key; the auxiliary encryption party is configured to encrypt the ciphertext obtained from the set holder or other auxiliary encryption parties, and to decrypt the ciphertext obtained from the result acquisition party or other auxiliary encryption parties; the set calculation party is configured to obtain each first set ciphertext corresponding to each set holder, and perform a predetermined set operation on each first set ciphertext to obtain a first result ciphertext; the result acquisition party is configured to obtain the ciphertext data corresponding to the first result ciphertext, so as to interact securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0093] According to another embodiment, there is also provided a device for performing a joint collective operation that can be set in a single set holder. The device for performing a joint collective operation provided in this specification is used for multiple set holders to jointly perform a predetermined collective operation, and a single set holder holds at least one set. Assuming that any one of the multiple set holders is a first party, and the first party holds a first set, the device for performing a joint collective operation set in the first party is described as an example.

[0094] like Figure 4 As shown, the device 400 for jointly performing set operations on the first party may include: an encryption unit 401, configured to interact securely with the auxiliary encryption party to obtain a first set ciphertext of the first set that is encrypted and scrambled by the auxiliary encryption party's key; a providing unit 402, configured to provide the first set ciphertext of the first set to the set calculation party, so that the set calculation party can use the first set ciphertexts obtained from each set holder to perform a predetermined set operation to obtain a first result ciphertext, so that the result acquisition party can obtain the ciphertext data corresponding to the first result ciphertext by securely interacting with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

[0095] In the case where the first party is a set computing party, the device 400 may further include a computing unit (not shown), configured to: obtain each first set ciphertext of other sets from each other set holder; perform a predetermined set operation on each first set ciphertext to obtain a first result ciphertext.

[0096] In the case where the first party is the result acquirer, the device 400 may further include a decryption unit (not shown), configured to: obtain ciphertext data corresponding to the first result ciphertext; and securely interact with the auxiliary encryption party to decrypt the ciphertext data corresponding to the first result ciphertext to obtain the plaintext data of the first result ciphertext.

[0097] It is worth mentioning that Figure 4 The device shown is Figure 3 The method embodiments shown correspond to, and may correspond to Figure 2 The first party or the second party in the embodiment shown, therefore, Figure 2 The description of the first party and the second party in Figure 3 The corresponding description in the method embodiment can also be applied to Figure 4 The device 400 shown is not described in detail here.

[0098] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 3 The method described by et al.

[0099] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 3 The method described by et al.

[0100] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0101] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above description is only the specific implementation method of the technical concept of this specification, and is not used to limit the protection scope of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the protection scope of the technical concept of this specification.

Claims

1. A method for jointly performing a set operation, for multiple set holders to jointly perform a predetermined set operation, wherein a single set holder holds at least one set; the method comprises: Each set holder interacts securely with the auxiliary encryption party to obtain a first set ciphertext of the local set, where the first set ciphertext is a ciphertext encrypted by the key of the auxiliary encryption party and in a disordered order; The set computing party obtains each first set ciphertext corresponding to each set holding party, performs the predetermined set operation on each first set ciphertext, and obtains a first result ciphertext; The result acquisition party obtains the ciphertext data corresponding to the first result ciphertext, and interacts securely with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext.

2. The method of claim 1, wherein: The multiple set holders include a first party, the first party holds a first set, and each of the set holders interacts securely with the auxiliary encryption party to obtain a first set ciphertext of the local set, including: Encrypting the first set using a local encryption key to obtain a first ciphertext; Providing the first ciphertext to the auxiliary encryption party, so that the auxiliary encryption party feeds back a second ciphertext obtained by re-encrypting the first ciphertext using the auxiliary encryption key and scrambling the first ciphertext; The second ciphertext fed back by the auxiliary encryption party is decrypted using the local decryption key to obtain the first set ciphertext corresponding to the first set.

3. The method of claim 1, wherein: There are multiple auxiliary encryption parties, and each set holder interacts securely with the auxiliary encryption party to obtain the first set ciphertext of the local set, including: A single set holder interacts securely with each auxiliary encryption party in turn, and finally obtains the first set ciphertext of the local set that is encrypted multiple times and in a disordered order with the keys of each auxiliary encryption party; or, A single set holder will use the local encryption key to encrypt the local set to obtain the first ciphertext of the local set and send it to any auxiliary encryption party. Each auxiliary encryption party will in turn use the local auxiliary key to encrypt the received set ciphertext and pass it to other auxiliary encryption parties, and perform random operations through at least one auxiliary encryption party until the last auxiliary encryption party feeds back the multi-encrypted auxiliary ciphertext to the single set holder; the single set holder decrypts the auxiliary ciphertext to obtain the first set ciphertext corresponding to the local set.

4. The method of claim 1, wherein: In the case where there are multiple auxiliary encryption parties including a single set holder, each of the set holders securely interacts with at least one auxiliary encryption party, and the first set ciphertext of the local set obtained includes: A single set holder encrypts the local set using the local encryption key to obtain the first ciphertext and transmits it to other auxiliary encryption parties; Each auxiliary encryption party uses the local auxiliary key to encrypt the received collective ciphertext in turn, and at least one auxiliary encryption party performs random operations on the ciphertext until the last auxiliary encryption party completes the encryption operation to obtain the corresponding first collective ciphertext, and the last auxiliary encryption party that completes the encryption operation provides the first collective ciphertext to the collective calculation party.

5. The method of claim 1, wherein: The predetermined set operation is: an operation of finding at least one of the intersection, union, complement, and difference between multiple sets.

6. The method of claim 1, wherein: The result acquisition party acquires the ciphertext data corresponding to the first ciphertext result, and interacts securely with the auxiliary encryption party to obtain the plaintext data of the first ciphertext result, including: Encrypting the ciphertext data using a local encryption key to obtain a third ciphertext; Providing the third ciphertext to the auxiliary encryption party, so that the auxiliary encryption party feeds back a fourth ciphertext obtained by decrypting the third ciphertext using the auxiliary decryption key and scrambling the third ciphertext; The fourth ciphertext fed back by the auxiliary encryption party is decrypted using the local decryption key, thereby obtaining the plaintext data of the first result ciphertext.

7. The method of claim 1, wherein: The result acquisition party is an auxiliary encryption party. The result acquisition party acquires ciphertext data corresponding to the first result ciphertext and interacts securely with the auxiliary encryption party. The plaintext data of the first result ciphertext obtained includes: Providing the ciphertext data corresponding to the first result ciphertext to other auxiliary encryption parties, so that each auxiliary encryption party can feedback a fifth ciphertext obtained by decrypting the ciphertext data corresponding to the first result ciphertext using the auxiliary decryption key and scrambling the ciphertext data; The fifth ciphertext is decrypted using a local decryption key to obtain plaintext data of the first result ciphertext.

8. A method for jointly performing a set operation, for multiple set holders to jointly perform a predetermined set operation, a single set holder holding at least one set; The plurality of set holders include a first party, the first party holds a first set, and the method is performed by the first party, including: Interact securely with the auxiliary encryption party to obtain a first set of first set ciphertexts, where the first set of ciphertexts is ciphertexts encrypted by the auxiliary encryption party's key and in scrambled order; The first set ciphertext corresponding to the first set is provided to the set computing party, so that the set computing party can use the first set ciphertexts respectively obtained from the set holders to perform the predetermined set operation to obtain the first result ciphertext, so that the result acquiring party can securely interact with the auxiliary encryption party to obtain the plaintext data of the first result ciphertext when obtaining the ciphertext data corresponding to the first result ciphertext.

9. The method according to claim 8, wherein when the first party is a result acquisition party, the method further comprises: Obtaining ciphertext data corresponding to the first ciphertext result; Securely interact with the auxiliary encryption party to decrypt the ciphertext data corresponding to the first result ciphertext to obtain the plaintext data of the first result ciphertext.

10. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 8 to 9 is implemented.

Images