Unbalanced privacy set intersection method suitable for untrusted cloud

Abstract

The invention discloses an unbalanced privacy set intersection method suitable for an untrusted cloud. The client C has a set X = {x1,..., xn}, the server S has a private set Y = {y1,..., yN}, and the untrusted cloud server H has no input, nlt; lt; the method comprises the following steps: (1) initializing a system; and (2) data blinding. And (3) data outsourcing. And (4) the untrusted cloud and the server side carry out interactive calculation. And (5) calculating an intersection. According to the method, firstly, an efficient casual privacy equivalence test protocol is designed; by encoding the set elements and combining with the casual transmission extension protocol, the cloud server and the service provider can carry out equality test on the set elements in a secrecy manner. And secondly, blind processing is carried out on the private set, and the main calculation task of the client C is outsourced to the untrusted cloud H, so that the calculation burden of the client C is reduced. And finally, by introducing a Pedersen commitment and a zero-knowledge proof mechanism, possible malicious behaviors of the untrusted cloud H can be resisted, and the security of the system is enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of privacy computing and involves a specific application problem under the multi-party secure computing framework: Private Set Intersection (PSI). Specifically, the present invention delegates the main computing tasks of the client to the cloud server, and through technologies such as inadvertent privacy equivalence testing, Pedersen commitments and zero-knowledge proofs, the present invention can effectively protect the privacy and data security of the client when facing malicious behaviors of the cloud server. Background Art

[0002] In the digital economy era, data is a key production factor, and its safe and efficient circulation is of vital importance. To this end, it is necessary to establish a full-process compliance supervision system through a series of rule designs and technical means to ensure the security and efficiency of data circulation. As the key to solving data security and privacy protection issues in the process of data collaborative computing, secure multi-party computing technology can achieve effective use of data without exposing the original data, that is, to achieve "available but invisible" data. As a special secure multi-party computing, private set intersection allows two or more participants to jointly calculate the intersection of sets in a distributed scenario without disclosing other privacy information. It is widely used in medical, financial, government affairs and other fields.

[0003] PSI can be divided into three scenarios according to the size of the set of participants: small set-small set, large set-large set, and large set-small set. In the past few years, academia and industry have paid more attention to balanced PSI in which the set size and computing power of each participant are roughly equal. In the small set-small set scenario, key agreement and polynomial interpolation techniques are often used to construct PSI. Polynomial interpolation is used to map the elements of the participant set to the key space of key agreement, and the intersection is obtained by comparing the output keys. In the large set-large set scenario, researchers often achieve high running efficiency by constructing cryptographic primitives with high computational efficiency properties, such as the Oblivious Transfer Extension (OTE). OTE generates a large number of OT instances through a small number of public key encryption operations, and the number of public key encryption operations is only related to the security parameters but not the size of the set. Therefore, the PSI protocol built on OTE has an efficient running time in the large set scenario.

[0004] In practical applications, one party participating in PSI calculation is often a weak client holding a small device such as a smartphone or smartwatch, which has relatively weak computing power and limited storage space, and may only contain hundreds or thousands of private data; the other party is a large service provider with millions or even tens of millions of data. In this scenario, balanced PSI will incur large computing and communication overheads, and there is a risk of privacy information leakage. Chen et al. constructed a PSI protocol based on homomorphic encryption. The client encrypts the data set and sends it to the server. The server calculates the intersection in the ciphertext state and returns the result to the participants. The PSI protocol based on homomorphic encryption can achieve a communication complexity that is only related to the set size of the weak client, reducing the communication complexity of the unbalanced PSI protocol. With the rise of cloud computing, clients with limited resources can outsource computing tasks to cloud servers to reduce the client's computing costs. Abadi et al. proposed an outsourcing PSI based on homomorphic encryption, which allows clients to outsource their private data sets and entrust PSI calculations to cloud servers. However, the performance issues of homomorphic encryption algorithms may reduce the practicality of the PSI protocol. Wei Lifei et al. designed a semi-trusted cloud server-assisted privacy set intersection protocol, which effectively solved the problem of secure outsourcing of privacy set intersection calculation by using an inadvertent two-party distributed pseudo-random function to test the equality of set elements. The protocol is secure under a semi-honest model. When the cloud server is untrustworthy, the client's private information will be leaked.

[0005] In response to the above problems, the present invention proposes an unbalanced PSI protocol suitable for untrusted cloud servers, which allows clients to delegate a large number of computing tasks to cloud servers and can effectively protect the privacy and data security of participants under malicious behavior of cloud servers. By designing an efficient inadvertent privacy equivalence test protocol and combining Pedersen commitment and zero-knowledge proof technology, a secure and efficient unbalanced privacy set intersection protocol is constructed. The invention enables clients and service providers to verify whether the elements of a set are equal without exposing any sensitive information, thereby resisting malicious attacks from cloud servers and preventing them from modifying the elements of the set sent by the client. Ultimately, the protocol reduces the computational burden of weak clients while ensuring the privacy data security of the participants. Summary of the invention

[0006] The present invention provides an unbalanced private set intersection method suitable for untrusted clouds, which aims to outsource the computing tasks of weak clients to cloud servers to reduce the computing overhead of weak clients. At the same time, in order to protect the security of the private data of the participants, Pedersen commitment and zero-knowledge proof technology are introduced to resist malicious attacks from cloud servers and prevent them from modifying the set elements sent by the client.

[0007] The present invention is achieved through the following technical solutions:

[0008] An unbalanced private set intersection method for untrusted cloud, with three participants: client C, server S and cloud server H. Client C has a set X = {x1,…,x n}, the server S has a private set Y = {y1,…,y N}, the untrusted cloud server H has no input, where n<<N, including the following steps:

[0009] (1) System initialization: Client C and server S negotiate set Q (the intersection of Q, X, and Y is an empty set), random number seed, and hash function Hash. k ={h1,h2,…,h k}.

[0010] (2) Data blinding: Client C and server S use random number seeds to blind their respective private sets.

[0011] (3) Data outsourcing: Client C and server S collect Add it to the blinded private set and map it to the cuckoo hash table and the naive hash table respectively through the hash function. Client C sends the cuckoo hash table to the untrusted cloud H.

[0012] (4) The untrusted cloud and the server perform interactive computing: The untrusted cloud H and the server S jointly perform the inadvertent privacy equivalence test and generate the corresponding Pedersen commitment and zero-knowledge proof. The untrusted cloud H returns the test results to the client C.

[0013] (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification passes, the intersection is calculated.

[0014] As a preferred embodiment, the step (1) further includes setting the size t of the random number set, the size β of the cuckoo hash table and the size β of the naive hash table to be 1.5(tn+|Q|).

[0015] As a preferred embodiment, the step (2) comprises the following steps:

[0016] (21) The client C and the server S generate a number set D = {d1,…,d t}←PRG(seed).

[0017] (22) For every x i ∈X,i∈{1,…,n}, client C calculates Get Collection The server S blinds the input set Y using the same random number set D to obtain the set Ys .

[0018] As a preferred embodiment, the step (3) comprises the following steps:

[0019] (31) Client C adds set Q to set X c In the example, the server S randomly selects a subset Q of the set Q s Add to collection Y s middle.

[0020] (32) Client C uses the Cuckoo Hash algorithm Π CH Set X c Mapped into the cuckoo hash table and sent to the cloud server H, T c [b] represents the element in row b of the cuckoo hash table.

[0021] (33) The server S uses the naive hash algorithm Π SH Set Y s Mapped into a naive hash table, T s [b] represents the set of all elements in the b-th row of the naive hash table.

[0022] As a preferred embodiment, the step (4) comprises the following steps:

[0023] (41) The untrusted cloud H is used as the sender input set T c [b], the server S acts as the receiver and inputs the set T s [b].

[0024] (42) For x∈T c Each bit x of [b] i , the untrusted cloud H selects a random number s i , generating the matrix

[0025]

[0026] Among them, if x i =0, then If x i =1, then

[0027] (43) Untrusted Cloud H Computing The commitment value E and the non-interactive zero-knowledge proof π(SS2) prove that SS1 in SS2=x+SS1 is the same value as SS1 in the commitment E. The untrusted cloud H publishes the commitment E and the zero-knowledge proof π(SS2).

[0028] (44) The server S converts each bit of y into i As a selection bit.

[0029] (45) Untrusted Cloud H Input Matrix The server S inputs the selected string y and jointly executes the oblivious transfer extension protocol. The server S obtains the output

[0030] (46) Server-side S calculation And calculate the result Sent to client C.

[0031] (47) Untrusted Cloud H Computing And calculate the result Sent to client C.

[0032] As a preferred embodiment, the specific steps adopted in step (43) are: the untrusted cloud H selects a random number r and calculates the commitment value E=pc(SS1,r)=SS1×g+r×h of SS1. The untrusted cloud H calculates the zero-knowledge proof ZKP[S=(x+SS1)×h∧E=SS1×g+r×h] to prove that SS1 in SS2=x+SS1 is the same value as SS1 in the commitment E. The untrusted cloud H selects random numbers t1, t2, and calculates a=hash(S||E), T1=(t1-a×x)×h, T2=t1×g+t2×h, e1=t1+a×SS1, e2=t2+a×r. The untrusted cloud H publishes T1, T2, e1, and e2.

[0033] As a preferred embodiment, the step (5) comprises the following steps:

[0034] (51) Client C verifies the zero-knowledge proof π(SS2), that is, calculates a = hash(S||E), and verifies T1+a×S=e1×h, T2+a×E=e1×g+e2×h in combination with T1, T2, e1, e2 published by the untrusted cloud H. If the verification is successful, then calculate I′={x′|x′=x out -y out ,x′∈X c}.

[0035] (52) Client C performs deblinding on set I' and obtains the intersection

[0036] An unbalanced private set intersection method for untrusted clouds has three participants: client C, server S and cloud server H.

[0037] Client C includes:

[0038] The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set.

[0039] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0040] The intersection calculation model verifies the correctness of the data based on the received data and calculates the correct result of the intersection.

[0041] The server S includes:

[0042] The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set.

[0043] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0044] The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test.

[0045] Untrusted Cloud H includes:

[0046] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0047] The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test.

[0048] The Pedersen commitment module is used to keep the calculation commitment value confidential and prevent the untrusted cloud from modifying the data during the calculation process.

[0049] Beneficial effects of the present invention:

[0050] (1) The present invention designs an Oblivious Private Equality Test (OPEQT) protocol. By encoding the set elements and combining it with the oblivious transfer extension protocol, the cloud server and the service provider can confidentially perform equality tests on the set elements, thus ensuring the privacy of the test results.

[0051] (2) This paper constructs an unbalanced private set intersection protocol for untrusted cloud servers. The main computing tasks of weak clients are outsourced to cloud servers, which effectively reduces the computing burden of clients. At the same time, by introducing Pedersen commitment and zero-knowledge proof mechanism, the possible malicious behavior of untrusted cloud servers is resisted, thus enhancing the security of the protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a schematic diagram of the model structure of the present invention.

[0053] Figure 2 It is a schematic diagram of the operation flow of the present invention. DETAILED DESCRIPTION

[0054] The following is a detailed description of an embodiment of the present invention in conjunction with the accompanying drawings: This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiments.

[0055] like Figure 1 , 2 As shown in Figure 1, a non-balanced private set intersection method suitable for untrusted clouds has three participants: client C, server S, and cloud server H. Among them, client C has a set X = {x1,…,x n}, the server S has a private set Y = {y1,…,y N}, the untrusted cloud server H has no input. The specific implementation is as follows:

[0056] (1) System initialization: Client C and server S negotiate the set Q (the intersection of Q and X, Y is an empty set), the random number seed, the size of the random number set t, and the hash function Hash k ={h1,h2,…,h k}, the size of the cuckoo hash table and the naive hash table is β=1.5(tn+|Q|).

[0057] (2) Data blinding: Client C and server S use random number seeds to blind their respective private sets.

[0058] (21) The client C and the server S generate a number set D = {d1,…,d t}←PRG(seed).

[0059] (22) For every x i ∈X,i∈{1,…,n}, client C calculates Get Collection The server S blinds the input set Y using the same random number set D to obtain the set Y s .

[0060] (3) Data outsourcing: Client C and server S collect Add it to the blinded private set and map it to the cuckoo hash table and the naive hash table respectively through the hash function. Client C sends the cuckoo hash table to the untrusted cloud H.

[0061] (31) Client C adds set Q to set X c In the example, the server S randomly selects a subset Q of the set Q s Add to collection Y s middle.

[0062] (32) Client C uses the Cuckoo Hash algorithm Π CH Set X c Mapped into the cuckoo hash table and sent to the cloud server H, T c [b] represents the element in row b of the cuckoo hash table.

[0063] (33) The server S uses the naive hash algorithm Π SH Set Y s Mapped into a naive hash table, T s [b] represents the set of all elements in the b-th row of the naive hash table.

[0064] (4) Untrusted cloud and server perform interactive computation: Untrusted cloud H and server S jointly perform the inadvertent privacy equivalence test and generate the corresponding Pedersen commitment and non-interactive zero-knowledge proof. Untrusted cloud H returns the test results to client C.

[0065] (41) The untrusted cloud H is used as the sender input set T c [b], the server S acts as the receiver and inputs the set T s [b].

[0066] (42) For x∈T c Each bit x of [b] i , the untrusted cloud H selects a random number s i , generating the matrix

[0067]

[0068] Among them, if x i =0, then If x i =1, then

[0069] (43) Untrusted cloud H selects a random number r and calculates the commitment value of SS1 E = pc(SS1, r) = SS1 × g + r × h. Untrusted cloud H calculates the zero-knowledge proof ZKP[S = (x + SS1) × h ∧ E = SS1 × g + r × h] to prove that SS1 in SS2 = x + SS1 is the same value as SS1 in commitment E. Untrusted cloud H selects random numbers t1, t2 and calculates a = hash(S||E), T1 = (t1-a×x) × h, T2 = t1×g + t2×h, e1 = t1 + a×SS1, e2 = t2 + a×r. Untrusted cloud H publishes T1, T2, e1, e2.

[0070] (44) The server S converts each bit of y into i As a selection bit.

[0071] (45) Untrusted Cloud H Input Matrix The server S inputs the selected string y and jointly executes the oblivious transfer extension protocol. The server S obtains the output

[0072] (46) Server-side S calculation And calculate the result Sent to client C.

[0073] (47) Untrusted Cloud H Computing And calculate the result Sent to client C.

[0074] (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification passes, the intersection is calculated.

[0075] (51) Client C verifies the non-interactive zero-knowledge proof π(SS2), that is, calculates a = hash(S||E), and verifies T1+a×S=e1×h, T2+a×E=e1×g+e2×h in combination with T1, T2, e1, e2 published by the untrusted cloud H. If the verification is successful, then calculate I′={x′|x′=x out -y out ,x′∈X c}.

[0076] (52) Client C performs deblinding on set I' and obtains the intersection

[0077] An unbalanced private set intersection method for untrusted clouds has three participants: client C, server S and cloud server H.

[0078] Client C includes:

[0079] The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set.

[0080] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0081] The intersection calculation model verifies the correctness of the data based on the received data and calculates the correct result of the intersection.

[0082] The server S includes:

[0083] The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set.

[0084] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0085] The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test.

[0086] Untrusted Cloud H includes:

[0087] Data transmission and receiving module, used to outsource private data or receive data from other parties.

[0088] The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test.

[0089] The Pedersen commitment module is used to keep the calculation commitment value confidential and prevent the untrusted cloud from modifying the data during the calculation process.

[0090] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A non-balanced private set intersection method applicable to untrusted clouds, characterized in that: There are three participants: client C, server S and cloud server H. Client C has a set X = {x1,…,x n }, the server S has a private set Y = {y1,…,y N }, the untrusted cloud server H has no input, where n<<N, including the following steps: (1) System initialization: Client C and server S negotiate set Q (the intersection of Q, X, and Y is an empty set), random number seed, and hash function Hash. k ={h1,h2,…,h k }. (2) Data blinding: Client C and server S use random number seeds to blind their respective private sets. (3) Data outsourcing: Client C and server S collect Add it to the blinded private set and map it to the cuckoo hash table and the naive hash table respectively through the hash function. Client C sends the cuckoo hash table to the untrusted cloud H. (4) The untrusted cloud and the server perform interactive computing: The untrusted cloud H and the server S jointly perform the inadvertent privacy equivalence test and generate the corresponding Pedersen commitment and zero-knowledge proof. The untrusted cloud H returns the test results to the client C. (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification passes, the intersection is calculated.

2. According to claim 1, the unbalanced private set intersection method applicable to untrusted cloud is characterized in that: The step (1) further includes setting the size t of the random number set, the size β of the cuckoo hash table and the size β of the naive hash table to be 1.5(tn+|Q|).

3. The unbalanced private set intersection method applicable to untrusted cloud according to claim 1, characterized in that: The step (2) comprises the following steps: (21) The client C and the server S generate a number set D = {d1,…,d t }←PRG(seed). (22) For every x i ∈X,i∈{1,…,n}, client C calculates Get Collection The server S blinds the input set Y using the same random number set D to obtain the set Y s .

4. The unbalanced private set intersection method applicable to untrusted cloud according to claim 1, characterized in that: The step (3) comprises the following steps: (31) Client C adds set Q to set X c In the example, the server S randomly selects a subset Q of the set Q s Add to collection Y s middle. (32) Client C uses the Cuckoo Hash algorithm Π CH Set X c Mapped into the cuckoo hash table and sent to the cloud server H, T c [b] represents the element in row b of the cuckoo hash table. (33) The server S uses the naive hash algorithm Π SH Set Y s Mapped into a naive hash table, T s [b] represents the set of all elements in the b-th row of the naive hash table.

5. The unbalanced private set intersection method applicable to untrusted cloud according to claim 1, characterized in that: The step (4) comprises the following steps: (41) The untrusted cloud H is used as the sender input set T c [b], the server S acts as the receiver and inputs the set T s [b]. (42) For x∈T c Each bit x of [b] i , the untrusted cloud H selects a random number s i , generating the matrix Among them, if x i =0, then If x i =1, then (43) Untrusted Cloud H Computing The untrusted cloud H publishes the commitment E and the non-interactive zero-knowledge proof π(SS2), proving that SS1 in SS2=x+SS1 is the same value as SS1 in the commitment E. The untrusted cloud H publishes the commitment E and the zero-knowledge proof π(SS2). (44) The server S converts each bit of y into i As a selection bit. (45) Untrusted Cloud H Input Matrix The server S inputs the selected string y and jointly executes the oblivious transfer extension protocol. The server S obtains the output (46) Server-side S calculation And calculate the result Sent to client C. (47) Untrusted Cloud H Computing And calculate the result Sent to client C.

6. The unbalanced private set intersection method applicable to untrusted cloud according to claim 5, characterized in that: The specific steps adopted in step (43) are as follows: the untrusted cloud H selects a random number r and calculates the commitment value E=pc(SS1,r)=SS1×g+r×h of SS1. The untrusted cloud H calculates the zero-knowledge proof ZKP[S=(x+SS1)×h∧E=SS1×g+r×h] to prove that SS1 in SS2=x+SS1 is the same value as SS1 in the commitment E. The untrusted cloud H selects random numbers t1, t2 and calculates a=hash(S||E), T1=(t1-a×x)×h, T2=t1×g+t2×h, e1=t1+a×SS1, e2=t2+a×r. The untrusted cloud H publishes T1, T2, e1, and e2.

7. The unbalanced private set intersection method applicable to untrusted cloud according to claim 1, characterized in that: The step (5) comprises the following steps: (51) Client C verifies the zero-knowledge proof π(SS2). If the verification is successful, it calculates I′={x′|x′=x out -y out ,x′∈X c }. (52) Client C performs deblinding on set I' and obtains the intersection 8. The unbalanced private set intersection method applicable to untrusted cloud according to claim 7, characterized in that: The specific steps adopted in step (51) are: the client C calculates a=hash(S||E), combines T1, T2, e1, e2 published by the untrusted cloud H, and verifies T1+a×S=e1×h, T2+a×E=e1×g+e2×h.

9. A non-balanced private set intersection method applicable to untrusted clouds, characterized in that: There are three parties involved: client C, server S and cloud server H. Client C includes: The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set. Data transmission and receiving module, used to outsource private data or receive data from other parties. The intersection calculation model verifies the correctness of the data based on the received data and calculates the correct result of the intersection. The server S includes: The data blinding calculation module calculates the random number set based on the random number seed and blinds the private data set. Data transmission and receiving module, used to outsource private data or receive data from other parties. The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test. Untrusted Cloud H includes: Data transmission and receiving module, used to outsource private data or receive data from other parties. The privacy equivalence test module is used to test the equality of the privacy data elements of both parties involved in the confidentiality test. The Pedersen commitment module is used to keep the calculation commitment value confidential and prevent the untrusted cloud from modifying the data during the calculation process.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images