Two-party privacy set intersection method and system capable of hiding number of receiver elements

Abstract

The invention provides a two-party privacy set intersection method and system capable of hiding the number of receiver elements, and belongs to the technical field of privacy set intersection comparison protocols. According to the method, an elliptic curve encryption method and a partial homomorphic encryption method of multiplication homomorphism are adopted, only two rounds of communication are needed, the communication traffic of encryption is reduced, and meanwhile, the encryption efficiency is improved. According to the technical scheme, the data are preprocessed by the sender and the receiver, the calculation amount of the receiver is reduced, the calculation efficiency is improved, finally, the hash table is filled with the random mask with the blind effect, the total amount of transmitted data is consistent, it is guaranteed that the total amount of data of a user is not leaked, and the security and privacy protection strength of a protocol are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy set intersection comparison protocols, and in particular to a two-party privacy set intersection method and system that hides the number of receiving party elements. Background Art

[0002] With the advent of the big data era, data privacy protection has become increasingly important. Private set intersection technology can calculate the intersection of shared data of multiple participants without leaking their own data. This technology is crucial for complying with privacy regulations, protecting personal information, and ensuring data security, and provides strong technical support for data privacy protection.

[0003] In existing technologies, this technology can achieve data sharing without leaking private information. In the data preprocessing stage of federated learning, private set intersection technology can also be used to align data without leaking private data, which is crucial for protecting user privacy and applying federated learning on a large scale.

[0004] Existing private set intersection protocols often use methods related to public key encryption. Existing methods use fully homomorphic encryption schemes when comparing set elements. This design often leads to low computing performance and requires three rounds of interaction, resulting in large amounts of communication. Chen et al. proposed a fast PSI (Private Set Intersection) method using fully homomorphic encryption. The security and privacy of this method completely rely on the FHE (Fully Homomorphic Encryptio) scheme with circuit privacy, which limits its efficiency in practice. In addition, the existing PSI method cannot guarantee the total amount of user data without leaking it, in addition to ensuring the privacy and unlinkability of the sender and receiver. Summary of the invention

[0005] In order to solve the above problems in the prior art, the present invention provides a method and system for finding the intersection of two private sets that hides the number of elements of the receiver. The invention adopts elliptic curve encryption method and multiplication homomorphic partial homomorphic encryption method, which only requires two rounds of communication, reducing the amount of encrypted communication. At the same time, through the pre-processing of data by the sender and the receiver themselves, the amount of calculation of the receiver is reduced, and the efficiency of calculation is improved. Finally, a random mask with a blinding effect is established in the hash table to make the total amount of transmitted data consistent, ensuring that the total amount of user data is not leaked, and enhancing the security of the protocol and the privacy protection. To achieve the above purpose, the technical solution is as follows:

[0006] On the one hand, the present invention provides a method for finding the intersection of two private sets by hiding the number of elements of the receiving party, the method comprising:

[0007] S1. Based on the security parameters jointly selected by the receiver and the sender, the generator of the elliptic curve group and the large prime order of the elliptic curve group are obtained through a trusted third-party organization;

[0008] S2. Obtaining a multiplication group through a trusted third party agency based on the security parameters jointly selected by the receiver and the sender;

[0009] S3. Obtaining a first hash function through a trusted third party according to the multiplication group and the large prime order of the elliptic curve group;

[0010] S4. According to the number of elements of the sender, three hash functions with the same value range are obtained through a trusted third party organization;

[0011] S5. Obtain a process parameter set of the recipient through calculation according to the private set of the recipient, the multiplication group, the first hash function, the generator of the elliptic curve group, and the three hash functions with the same value range;

[0012] S6. Obtain the process parameter set of the sender through calculation according to the private collection of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range, and the process parameter set of the receiver;

[0013] S7. Send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

[0014] Optionally, in S4, three hash functions with the same value range are obtained through a trusted third-party organization according to the number of elements of the sender, including:

[0015] S41. Obtain the number of buckets of the hash function according to the number of elements of the sender;

[0016] S42. According to the number of buckets of the hash function, three hash functions with the same value range are obtained by mapping through formula (1). The three hash functions with the same value range include: a first cuckoo hash function, a second cuckoo hash function and a third cuckoo hash function.

[0017] (1)

[0018] Where: is the first cuckoo hash function, is the second cuckoo hash function, is the third cuckoo hash function, is the number of buckets of the hash function.

[0019] Optionally, in S5, the process parameter set of the receiver is obtained by calculation according to the private set of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range, including:

[0020] S51, according to the generators of the multiplication group and the elliptic curve group, respectively obtain the first operation unit of the receiving party and the second operation unit of the receiving party through formula (2) and formula (3),

[0021] (2)

[0022] (3)

[0023] Where: is the first computing unit of the receiver, is the second computing unit of the receiver, is the generator of the elliptic curve group, is a multiplication group, x and y are both multiplication groups A randomly selected element from

[0024] S52, obtaining a private set of the recipient after hash mapping according to the private set of the recipient and the first hash function;

[0025] S53, according to the private set of the recipient after the hash mapping, the first operation unit of the recipient, the second operation unit of the recipient and the generator of the elliptic curve group, the multi-factor index is obtained through the multi-factor exponential congruence operation formula (4),

[0026] (4)

[0027] Where: is a random element in the recipient's private collection after hash mapping, is the corresponding multi-factor index;

[0028] S54, obtaining a hash table of the recipient according to the recipient's private set after the hash mapping and the three hash functions with the same value range;

[0029] S55 , integrating the first computing unit of the receiver, the second computing unit of the receiver, the multi-factor index and the hash table of the receiver to obtain a process parameter set of the receiver.

[0030] Optionally, in S54, according to the private set of the recipient after the hash mapping and the three hash functions with the same value range, a hash table of the recipient is obtained, including:

[0031] S541. Obtain the number of rows in the hash table and three storage locations of the receiver according to the three hash functions with the same value range;

[0032] S542, obtaining the number of columns of the hash table according to the number of elements of the receiving party;

[0033] S543, according to the number of rows of the hash table, the number of columns of the hash table and the three storage locations of the receiver, the private set of the receiver after the hash mapping is stored in the three locations of the receiver respectively, to obtain a hash table with the private set;

[0034] S544: Fill the empty bucket positions of the hash table with the private set with a random mask to obtain the hash table of the recipient.

[0035] Optionally, the number of rows in the hash table includes: the number of rows in the hash table is the number of elements of the sender.

[0036] Optionally, the random mask includes 0 or 1.

[0037] Optionally, in S6, the process parameter set of the sender is obtained by calculation according to the private set of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range, and the process parameter set of the receiver, including:

[0038] S61. Perform a public key encryption operation on the multiplication group to obtain an encrypted multiplication group.

[0039] S62, obtaining a private set of the sender after hash mapping according to the private set of the sender and the first hash function;

[0040] S63, according to the private set of the sender after the hash mapping and the three hash functions with the same value range, using the cuckoo data structure, obtain the cuckoo hash table of the sender;

[0041] S64, according to the cuckoo hash table of the sender, the multiplication group and the process parameter set of the receiver, respectively obtain the first intermediate operation unit of the receiver and the second intermediate operation unit of the receiver through formula (5) and formula (6),

[0042] (5)

[0043] (6)

[0044] Where: is the first intermediate computing unit of the receiver, is the second intermediate computing unit of the receiver, is the first computing unit of the receiver, and are all random elements in the multiplication group, and t is the sequence number of the element in the sender's cuckoo hash table;

[0045] S65, according to the cuckoo hash table of the sender, the process parameter set of the receiver, the multiplication group and the second intermediate operation unit of the receiver, the third intermediate operation unit of the receiver is obtained by formula (7),

[0046] (7)

[0047] Where: is the third intermediate computing unit of the receiver, is the public key encryption operation function, is the second computing unit of the receiver, is the element in the sender's cuckoo hash table;

[0048] S66, integrating the encrypted multiplication group, the cuckoo hash table of the sender, the first intermediate operation unit of the receiver and the third intermediate operation unit of the receiver to obtain the process parameter set of the sender.

[0049] Optionally, in S63, according to the private set of the sender after the hash mapping and the three hash functions with the same value range, a cuckoo data structure is used to obtain the cuckoo hash table of the sender, including:

[0050] S631. Obtain the buckets of the cuckoo hash table of the sender and the three storage locations of the sender according to the three hash functions with the same value range;

[0051] S632: According to the bucket of the cuckoo hash table of the sender and the three storage locations of the sender, the private set of the sender after the hash mapping is randomly stored in one of the three storage locations of the sender to obtain a cuckoo hash table with the private set;

[0052] S633: Fill the empty bucket positions of the cuckoo hash table with the private set with a random mask to obtain the cuckoo hash table of the sender.

[0053] Optionally, in S7, the process parameter set of the receiver is compared with the process parameter set of the sender to obtain a data set required by the receiver, including:

[0054] S71, obtaining a multi-factor index and a hash table of the receiver according to the process parameter set of the receiver;

[0055] S72. According to the process parameter set of the sender, the multi-factor index and the hash table of the receiver, the corresponding element in the process parameter set of the sender is selected by comparison through formula (8). If the equation holds, the element in the process parameter set of the receiver participating in the operation is equal to the element in the process parameter set of the sender, that is, the intersection element is obtained, and the data set required by the receiver is obtained.

[0056] (8)

[0057] In the formula, is the encrypted multiplication group, is the multi-factor index of the element in row t and column m in the receiver's hash table.

[0058] On the other hand, the present invention provides a two-party private set intersection system for hiding the number of receiving party elements, the system is applied to a two-party private set intersection method for hiding the number of receiving party elements, the system comprising:

[0059] A first acquisition module is used to obtain, through a trusted third party organization, a generator of an elliptic curve group and a large prime order of the elliptic curve group according to security parameters jointly selected by a receiver and a sender;

[0060] A second acquisition module is used to obtain a multiplication group through a trusted third party institution according to a security parameter jointly selected by the receiver and the sender;

[0061] A third acquisition module is used to obtain a first hash function through a trusted third party institution according to the multiplication group and the large prime order of the elliptic curve group;

[0062] A fourth acquisition module is used to obtain three hash functions with the same value range through a trusted third party organization according to the number of elements of the sender;

[0063] A first calculation module is used to obtain a process parameter set of the receiver through calculation according to the private set of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range;

[0064] A second calculation module is used to obtain the process parameter set of the sender through calculation according to the private collection of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range and the process parameter set of the receiver;

[0065] The data corresponding module is used to send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

[0066] Compared with the prior art, the technical solution of the present invention has at least the following beneficial effects:

[0067] On the one hand, the above scheme adopts elliptic curve encryption method and multiplication homomorphic partially homomorphic encryption method, which only requires two rounds of communication, reducing the amount of encrypted communication. On the second hand, through the pre-processing of data by the sender and the receiver themselves, the amount of calculation of the receiver is reduced and the efficiency of the calculation is improved. On the third hand, a random mask with a blinding effect is established in the hash table to make the total amount of transmitted data consistent, ensuring that the total amount of user data is not leaked, and enhancing the security and privacy protection of the protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0069] Figure 1 is a flow chart of an embodiment of a method for finding the intersection of two private sets of a device for hiding the number of elements of a receiving party according to the present invention;

[0070] Figure 2 It is a flow chart of obtaining three hash functions with the same value range in an embodiment of a two-party private set intersection method for hiding the number of receiving party elements of the present invention;

[0071] Figure 3 It is a flow chart of obtaining a process parameter set of a receiver in an embodiment of a method for finding intersection of two private sets hiding the number of receiver elements of the present invention;

[0072] Figure 4 It is a flow chart of obtaining the hash table of the receiver in the embodiment of the method for finding the intersection of two private sets hiding the number of elements of the receiver of the present invention;

[0073] Figure 5 It is a flow chart of obtaining the process parameter set of the sender in the embodiment of the method for finding the intersection of two private sets hiding the number of elements of the receiver of the present invention;

[0074] Figure 6 It is a flow chart of obtaining the cuckoo hash table of the sender in the embodiment of the two-party private set intersection method for hiding the number of elements of the receiver of the present invention;

[0075] Figure 7 It is a flow chart of obtaining a data set required by a receiver in an embodiment of a two-party private set intersection method for hiding the number of receiver elements of the present invention;

[0076] Figure 8It is a system block diagram of an embodiment of a two-party private set intersection system for hiding the number of receiving party elements of the present invention. DETAILED DESCRIPTION

[0077] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0078] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0079] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0080] like Figure 1 The flowchart of an embodiment of the two-party private set intersection method of the present invention with the number of elements of the hidden receiver is shown. The present invention provides a two-party private set intersection method with the number of elements of the hidden receiver. The method is implemented by a two-party private set intersection system with the number of elements of the hidden receiver. The method includes:

[0081] S1. Based on the security parameters jointly selected by the receiver and the sender, the generator of the elliptic curve group and the large prime order of the elliptic curve group are obtained through a trusted third-party organization;

[0082] S2. Obtaining a multiplication group through a trusted third party agency based on the security parameters jointly selected by the receiver and the sender;

[0083] S3. Obtaining a first hash function through a trusted third party according to the multiplication group and the large prime order of the elliptic curve group;

[0084] Specifically, through formula (9), we get the first hash function:

[0085] (9)

[0086] Where: is the first hash function, is the multiplication group, is the large prime order of the elliptic curve group;

[0087] The elements of this multiplicative group are {1,2,...,p-1}.

[0088] S4. According to the number of elements of the sender, three hash functions with the same value range are obtained through a trusted third party organization;

[0089] Specifically, Figure 2 The flowchart of obtaining three hash functions with the same value range in the embodiment of the two-party private set intersection method for hiding the number of elements of the receiving party of the present invention is shown, and in S4, three hash functions with the same value range are obtained through a trusted third-party organization according to the number of elements of the sender, including:

[0090] S41. Obtain the number of buckets of the hash function according to the number of elements of the sender;

[0091] Furthermore, the relationship between the number of elements of the sender and the number of buckets of the hash function is shown in formula (10):

[0092] (10)

[0093] Where: is the number of buckets of the hash function, is the number of elements on the sender side.

[0094] S42. According to the number of buckets of the hash function, three hash functions with the same value range are obtained by mapping through formula (1). The three hash functions with the same value range include: a first cuckoo hash function, a second cuckoo hash function and a third cuckoo hash function.

[0095] (1)

[0096] Where: is the first cuckoo hash function, is the second cuckoo hash function, is the third cuckoo hash function, is the number of buckets of the hash function.

[0097] S5. Obtain a process parameter set of the recipient through calculation according to the private set of the recipient, the multiplication group, the first hash function, the generator of the elliptic curve group, and the three hash functions with the same value range;

[0098] Specifically, Figure 3 The flowchart of obtaining the process parameter set of the receiver in the embodiment of the method for obtaining the intersection of two private sets of hiding the number of elements of the receiver of the present invention is shown, and in S5, the process parameter set of the receiver is obtained by calculation according to the private set of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range, including:

[0099] S51, according to the generators of the multiplication group and the elliptic curve group, respectively obtain the first operation unit of the receiving party and the second operation unit of the receiving party through formula (2) and formula (3),

[0100] (2)

[0101] (3)

[0102] Where: is the first computing unit of the receiver, is the second computing unit of the receiver, is the generator of the elliptic curve group, is a multiplication group, x and y are both multiplication groups A randomly selected element from

[0103] S52, obtaining a private set of the recipient after hash mapping according to the private set of the recipient and the first hash function;

[0104] Furthermore, the recipient's private collection , is the number of elements on the receiving side,

[0105] For each , calculated by formula (11), we get the private set of the recipient after hash mapping,

[0106] (11)

[0107] Where: The elements in the recipient's private collection after hash mapping.

[0108] S53, according to the private set of the recipient after the hash mapping, the first operation unit of the recipient, the second operation unit of the recipient and the generator of the elliptic curve group, the multi-factor index is obtained through the multi-factor exponential congruence operation formula (4),

[0109] (4)

[0110] Where: is a random element in the recipient's private collection after hash mapping, is the corresponding multi-factor index;

[0111] S54, obtaining a hash table of the recipient according to the recipient's private set after the hash mapping and the three hash functions with the same value range;

[0112] S55 , integrating the first computing unit of the receiver, the second computing unit of the receiver, the multi-factor index and the hash table of the receiver to obtain a process parameter set of the receiver.

[0113] Furthermore, if Figure 4The flowchart of obtaining the hash table of the receiver in the embodiment of the method for obtaining the intersection of two private sets of hiding the number of elements of the receiver of the present invention is shown, and in S54, the hash table of the receiver is obtained according to the private set of the receiver after the hash mapping and the three hash functions with the same value range, including:

[0114] S541. Obtain the number of rows in the hash table and three storage locations of the receiver according to the three hash functions with the same value range;

[0115] The number of rows in this hash table is the number of elements on the sender side.

[0116] S542, obtaining the number of columns of the hash table according to the number of elements of the receiving party;

[0117] The number of columns in this hash table is fixed. When the number of elements on the receiving side does not exceed When , the number of columns of the hash table is 28;

[0118] S543, according to the number of rows of the hash table, the number of columns of the hash table and the three storage locations of the receiver, the private set of the receiver after the hash mapping is stored in the three locations of the receiver respectively, to obtain a hash table with the private set;

[0119] S544: Fill the empty bucket positions of the hash table with the private set with a random mask to obtain the hash table of the recipient.

[0120] The random mask consists of 0 or 1.

[0121] S6. Obtain the process parameter set of the sender through calculation according to the private collection of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range, and the process parameter set of the receiver;

[0122] Specifically, Figure 5 The flowchart of obtaining the process parameter set of the sender in the embodiment of the method for obtaining the intersection of two private sets of the present invention for hiding the number of elements of the receiver is shown, wherein in S6, the process parameter set of the sender is obtained by calculation according to the private set of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range and the process parameter set of the receiver, including:

[0123] S61. Perform a public key encryption operation on the multiplication group to obtain an encrypted multiplication group.

[0124] S62, obtaining a private set of the sender after hash mapping according to the private set of the sender and the first hash function;

[0125] S63, according to the private set of the sender after the hash mapping and the three hash functions with the same value range, using the cuckoo data structure, obtain the cuckoo hash table of the sender;

[0126] S64, according to the cuckoo hash table of the sender, the multiplication group and the process parameter set of the receiver, respectively obtain the first intermediate operation unit of the receiver and the second intermediate operation unit of the receiver through formula (5) and formula (6),

[0127] (5)

[0128] (6)

[0129] Where: is the first intermediate computing unit of the receiver, is the second intermediate computing unit of the receiver, is the first computing unit of the receiver, and are all random elements in the multiplication group, and t is the sequence number of the element in the sender's cuckoo hash table;

[0130] S65, according to the cuckoo hash table of the sender, the process parameter set of the receiver, the multiplication group and the second intermediate operation unit of the receiver, the third intermediate operation unit of the receiver is obtained by formula (7),

[0131] (7)

[0132] Where: is the third intermediate computing unit of the receiver, is the public key encryption operation function, is the second computing unit of the receiver, is the element in the sender's cuckoo hash table;

[0133] like is a random mask, then Set to 1.

[0134] S66, integrating the encrypted multiplication group, the cuckoo hash table of the sender, the first intermediate operation unit of the receiver and the third intermediate operation unit of the receiver to obtain the process parameter set of the sender.

[0135] Furthermore, if Figure 6 The flowchart of obtaining the sender's cuckoo hash table in the embodiment of the method for finding the intersection of two private sets of hiding the number of elements of the receiver of the present invention is shown. In S63, the sender's cuckoo hash table is obtained by using the cuckoo data structure according to the sender's private set after hash mapping and the three hash functions with the same value range, including:

[0136] S631. Obtain the buckets of the cuckoo hash table of the sender and the three storage locations of the sender according to the three hash functions with the same value range;

[0137] S632: According to the bucket of the cuckoo hash table of the sender and the three storage locations of the sender, the private set of the sender after the hash mapping is randomly stored in one of the three storage locations of the sender to obtain a cuckoo hash table with the private set;

[0138] S633: Fill the empty bucket positions of the cuckoo hash table with the private set with a random mask to obtain the cuckoo hash table of the sender.

[0139] S7. Send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

[0140] Specifically, Figure 7 The flowchart of obtaining the data set required by the receiver in the embodiment of the two-party private set intersection method for hiding the number of elements of the receiver of the present invention is shown, and S7 compares and selects the process parameter set of the receiver with the process parameter set of the sender to obtain the data set required by the receiver, including:

[0141] S71, obtaining a multi-factor index and a hash table of the receiver according to the process parameter set of the receiver;

[0142] S72. According to the process parameter set of the sender, the multi-factor index and the hash table of the receiver, the corresponding element in the process parameter set of the sender is selected by comparison through formula (8). If the equation holds, the element in the process parameter set of the receiver participating in the operation is equal to the element in the process parameter set of the sender, that is, the intersection element is obtained, and the data set required by the receiver is obtained.

[0143] (8)

[0144] In the formula, is the encrypted multiplication group, is the multi-factor index of the element in row t and column m in the receiver's hash table.

[0145] Furthermore, formula (8) satisfies the multiplication homomorphism.

[0146] like Figure 8The system block diagram of an embodiment of the two-party private set intersection system of the present invention for hiding the number of receiving party elements is shown. The present invention provides a two-party private set intersection system for hiding the number of receiving party elements. The system is applied to a two-party private set intersection method for hiding the number of receiving party elements. The system includes: a first acquisition module, a second acquisition module, a third acquisition module, a fourth acquisition module, a first calculation module, a second calculation module and a data corresponding module. Specifically,

[0147] A first acquisition module is used to obtain, through a trusted third party organization, a generator of an elliptic curve group and a large prime order of the elliptic curve group according to security parameters jointly selected by a receiver and a sender;

[0148] A second acquisition module is used to obtain a multiplication group through a trusted third party institution according to a security parameter jointly selected by the receiver and the sender;

[0149] A third acquisition module is used to obtain a first hash function through a trusted third party institution according to the multiplication group and the large prime order of the elliptic curve group;

[0150] A fourth acquisition module is used to obtain three hash functions with the same value range through a trusted third party organization according to the number of elements of the sender;

[0151] A first calculation module is used to obtain a process parameter set of the receiver through calculation according to the private set of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range;

[0152] A second calculation module is used to obtain the process parameter set of the sender through calculation according to the private collection of the sender, the multiplication group, the first hash function, the generator of the elliptic curve group, the three hash functions with the same value range and the process parameter set of the receiver;

[0153] The data corresponding module is used to send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

[0154] The present invention provides a method and system for finding the intersection of two private sets that hide the number of elements of the receiver. The invention adopts an elliptic curve encryption method and a multiplication homomorphic partial homomorphic encryption method, which only requires two rounds of communication and reduces the amount of encrypted communication. At the same time, through the preprocessing of data by the sender and the receiver themselves, the amount of calculation of the receiver is reduced and the efficiency of the calculation is improved. Finally, a random mask with a blinding effect is established in the hash table to make the total amount of transmitted data consistent, thereby ensuring that the total amount of user data is not leaked and enhancing the security of the protocol and the privacy protection.

[0155] It is to be understood that the present invention is described by the above embodiments and should not be construed as limiting the embodiments of the present invention and the scope of the present invention. It is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A method for finding the intersection of two private sets with the number of elements of the receiving party hidden, characterized in that: The method comprises: S1. Based on the security parameters jointly selected by the receiver and the sender, the generator of the elliptic curve group and the large prime order of the elliptic curve group are obtained through a trusted third-party organization; S2. Obtaining a multiplication group through a trusted third party institution according to the security parameters jointly selected by the receiver and the sender; S3. Obtaining a first hash function through a trusted third party according to the multiplication group and the large prime order of the elliptic curve group; S4. Obtain three hash functions with the same value range through a trusted third party organization according to the number of elements of the sender; S5. Obtain a process parameter set of the recipient through calculation according to the private collection of the recipient, the multiplication group, the first hash function, the generator of the elliptic curve group, and the three hash functions with the same range; S6. Obtain the process parameter set of the sender through calculation according to the private collection of the sender, the multiplication group, the first Hash function, the generator of the elliptic curve group, the three Hash functions with the same value range, and the process parameter set of the receiver; S7. Send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

2. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 1, characterized in that: In S4, three hash functions with the same value range are obtained through a trusted third-party organization according to the number of elements of the sender, including: S41, obtaining the number of buckets of the hash function according to the number of elements of the sender; S42. According to the number of buckets of the hash function, three hash functions with the same value range are obtained by mapping through formula (1), wherein the three hash functions with the same value range include: a first cuckoo hash function, a second cuckoo hash function and a third cuckoo hash function. （1） Where: is the first cuckoo hash function, is the second cuckoo hash function, is the third cuckoo hash function, is the number of buckets of the hash function.

3. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 1, characterized in that: In S5, the process parameter set of the receiver is obtained by calculation according to the private set of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range, including: S51, according to the generators of the multiplication group and the elliptic curve group, respectively obtain the first operation unit of the receiving party and the second operation unit of the receiving party through formula (2) and formula (3), （2） （3） Where: is the first computing unit of the receiver, is the second computing unit of the receiver, is the generator of the elliptic curve group, is a multiplication group, x and y are both multiplication groups A randomly selected element from S52, obtaining a private set of the recipient after hash mapping according to the private set of the recipient and the first hash function; S53, according to the private set of the recipient after the hash mapping, the first operation unit of the recipient, the second operation unit of the recipient and the generator of the elliptic curve group, a multi-factor index is obtained through the multi-factor exponential congruence operation formula (4), （4） Where: is a random element in the recipient's private collection after hash mapping, is the corresponding multi-factor index; S54, obtaining a hash table of the recipient according to the recipient's private set after hash mapping and the three hash functions with the same value range; S55 , integrating the first computing unit of the receiving party, the second computing unit of the receiving party, the multi-factor index and the hash table of the receiving party to obtain a process parameter set of the receiving party.

4. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 3, characterized in that: In S54, the hash table of the recipient is obtained according to the private set of the recipient after the hash mapping and the three hash functions with the same value range, including: S541. Obtain the number of rows in the hash table and three storage locations of the receiver according to the three hash functions with the same value range; S542, obtaining the number of columns of the hash table according to the number of elements of the receiving party; S543, according to the number of rows of the hash table, the number of columns of the hash table and the three storage locations of the receiver, the private set of the receiver after the hash mapping is stored in the three locations of the receiver respectively, to obtain a hash table with the private set; S544: Fill the empty bucket positions of the hash table with the private set with a random mask to obtain the hash table of the recipient.

5. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 4, characterized in that: The number of rows of the hash table includes: the number of rows of the hash table is the number of elements of the sender.

6. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 4, characterized in that: The random mask includes 0 or 1.

7. The method for finding the intersection of two private sets with the number of hidden receiver elements according to claim 1, characterized in that: In S6, the process parameter set of the sender is obtained by calculation according to the private set of the sender, the multiplication group, the first Hash function, the generator of the elliptic curve group, the three Hash functions with the same value range and the process parameter set of the receiver, including: S61, performing a public key encryption operation according to the multiplication group to obtain an encrypted multiplication group; S62, obtaining a private set of the sender after hash mapping according to the private set of the sender and the first hash function; S63, according to the private set of the sender after hash mapping and the three hash functions with the same value range, using a cuckoo data structure to obtain a cuckoo hash table of the sender; S64, according to the cuckoo hash table of the sender, the multiplication group and the process parameter set of the receiver, respectively obtain the first intermediate operation unit of the receiver and the second intermediate operation unit of the receiver through formula (5) and formula (6), （5） （6） Where: is the first intermediate computing unit of the receiver, is the second intermediate computing unit of the receiver, is the first computing unit of the receiver, and are all random elements in the multiplication group, and t is the sequence number of the element in the sender's cuckoo hash table; S65, according to the cuckoo hash table of the sender, the process parameter set of the receiver, the multiplication group and the second intermediate operation unit of the receiver, the third intermediate operation unit of the receiver is obtained by formula (7), （7） Where: is the third intermediate computing unit of the receiver, is the public key encryption operation function, is the second computing unit of the receiver, is the element in the sender's cuckoo hash table; S66. Integrate the encrypted multiplication group, the cuckoo hash table of the sender, the first intermediate operation unit of the receiver, and the third intermediate operation unit of the receiver to obtain a process parameter set of the sender.

8. The method for finding the intersection of two private sets with the number of elements of the hidden receiver according to claim 7, characterized in that: In S63, according to the private set of the sender after hash mapping and the three hash functions with the same value range, a cuckoo data structure is used to obtain the cuckoo hash table of the sender, including: S631. Obtain the buckets of the cuckoo hash table of the sender and three storage locations of the sender according to the three hash functions with the same value range; S632: According to the bucket of the cuckoo hash table of the sender and the three storage locations of the sender, randomly store the private set of the sender after hash mapping into one of the three storage locations of the sender to obtain a cuckoo hash table with the private set; S633: Fill the empty bucket positions of the cuckoo hash table with the private set with a random mask to obtain the cuckoo hash table of the sender.

9. The method for finding the intersection of two private sets with the number of elements of the hidden receiver according to claim 7, characterized in that: The step S7 compares and selects the process parameter set of the receiver with the process parameter set of the sender to obtain a data set required by the receiver, including: S71, obtaining a multi-factor index and a hash table of the receiver according to the process parameter set of the receiver; S72. According to the process parameter set of the sender, the multi-factor index and the hash table of the receiver, the corresponding element in the process parameter set of the sender is selected by comparison through formula (8). If the equation holds, the element in the process parameter set of the receiver participating in the operation is equal to the element in the process parameter set of the sender, that is, the intersection element is obtained, and the data set required by the receiver is obtained. （8） In the formula, is the encrypted multiplication group, is the multi-factor index of the element in row t and column m in the recipient's hash table.

10. A two-party private set intersection system for hiding the number of receiver elements, used to implement the two-party private set intersection method for hiding the number of receiver elements as claimed in any one of claims 1 to 9, characterized in that: The system comprises: A first acquisition module is used to obtain, through a trusted third party organization, a generator of an elliptic curve group and a large prime order of the elliptic curve group according to security parameters jointly selected by a receiver and a sender; A second acquisition module is used to obtain a multiplication group through a trusted third party institution according to the security parameters jointly selected by the receiver and the sender; A third acquisition module obtains a first hash function through a trusted third party institution according to the multiplication group and the large prime order of the elliptic curve group; A fourth acquisition module is used to obtain three hash functions with the same value range through a trusted third party organization according to the number of elements of the sender; A first calculation module is used to obtain a process parameter set of the receiver through calculation according to the private collection of the receiver, the multiplication group, the first hash function, the generator of the elliptic curve group and the three hash functions with the same value range; A second calculation module is used to obtain the sender's process parameter set by calculation according to the sender's private collection, the multiplication group, the first Hash function, the generator of the elliptic curve group, the three Hash functions with the same value range and the receiver's process parameter set; The data corresponding module is used to send the process parameter set of the sender to the receiver, and obtain the data set required by the receiver by comparing and selecting the process parameter set of the receiver with the process parameter set of the sender.

Images