A non-equilibrium privacy set intersection method suitable for untrusted cloud

Abstract

The application discloses a non-equilibrium privacy set intersection method suitable for an untrusted cloud. A client C has a set X={x1,...,x n}, a server S has a private set Y={y1,...,y N}, and an untrusted cloud server H has no input, wherein n

Description

Technical Field

[0001] This invention belongs to the field of privacy computing and relates to a specific application problem within a multi-party secure computation framework: Private Set Intersection (PSI). Specifically, this invention delegates the client's primary computational tasks to a cloud server and, through techniques such as inadvertent privacy equivalence testing, Pedersen commitments, and zero-knowledge proofs, effectively protects the client's privacy and data security even in the face of malicious behavior from the cloud server. Background Technology

[0002] In the digital economy era, data, as a key production factor, requires secure and efficient circulation. Therefore, a comprehensive compliance and regulatory system needs to be established through a series of rule designs and technical means to ensure the security and efficiency of data circulation. Secure multi-party computation technology, as a key solution to data security and privacy protection issues in collaborative data computation, enables the effective use of data without exposing the original data, achieving "usable but invisible" data. Privacy set intersection, as a special type of secure multi-party computation, allows two or more participants to jointly compute the intersection of sets in a distributed scenario without disclosing other private information, and is widely used in fields such as healthcare, finance, and government.

[0003] Based on the size of the participating sets, PSI can be categorized into three scenarios: small-set-small-set, large-set-large-set, and large-set-small-set. In recent years, academia and industry have focused on balanced PSI where participating sets are roughly equal in size and computational power. In small-set-small-set scenarios, key negotiation and polynomial interpolation techniques are commonly used to construct PSI. Polynomial interpolation maps the elements of the participating sets to the key space of the key negotiation, and the intersection is obtained by comparing the output keys. In large-set-large-set scenarios, researchers often construct cryptographic primitives with high computational efficiency, such as the Oblivious Transfer Extension (OTE), to achieve high runtime efficiency. OTE generates a large number of OT instances with a small number of public-key encryption operations, and the number of public-key encryption operations depends only on the security parameters and is independent of the set size. Therefore, PSI protocols built on OTE have high runtime efficiency in large-set scenarios.

[0004] In practical applications, one party participating in PSI computation is often a weak client with a small device such as a smartphone or smartwatch, whose computing power is relatively weak and storage space is limited, possibly containing only a few hundred or a few thousand pieces of private data; the other party is a large service provider with millions or even tens of millions of data. In this scenario, balanced PSI incurs significant computational and communication overhead and carries the risk of privacy leakage. Chen et al. constructed a PSI protocol based on homomorphic encryption, whereby the client encrypts and sends its dataset to the server, and the server computes the intersection in the encrypted state and returns the result to the participants. The homomorphic encryption-based PSI protocol ensures that the communication complexity is only related to the size of the weak client set, reducing the communication complexity of unbalanced PSI protocols. With the rise of cloud computing, resource-limited clients can outsource computational tasks to cloud servers to reduce their computing costs. Abadi et al. proposed an outsourced PSI based on homomorphic encryption, allowing clients to outsource their private datasets and delegate PSI computation to cloud servers. However, the performance issues of homomorphic encryption algorithms may reduce the practicality of the PSI protocol. Wei Lifei et al. designed a semi-trusted cloud server-assisted privacy set intersection protocol. By using an unintentional two-party distributed pseudo-random function to perform equality tests on set elements, they effectively solved the problem of secure outsourcing of privacy set intersection computation. This protocol is secure under a semi-honest model. However, when the cloud server is untrusted, it can leak the client's private information.

[0005] To address the aforementioned issues, this invention proposes an unbalanced PSI protocol suitable for untrusted cloud servers. This protocol allows clients to delegate significant computational tasks to cloud servers while effectively protecting the privacy and data security of participants even in the event of malicious actions by the cloud server. By designing an efficient unintentional privacy equivalence test protocol and combining Pedersen commitments and zero-knowledge proofs, a secure and efficient unbalanced privacy set intersection protocol is constructed. This invention enables clients and service providers to verify the equality of set elements without exposing any sensitive information, thereby resisting malicious attacks from cloud servers and preventing them from modifying the set elements sent by the client. Ultimately, the protocol reduces the computational burden on weak clients while ensuring the privacy and data security of participating parties. Summary of the Invention

[0006] This invention provides a method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds. Its purpose is to outsource the computational tasks of weak clients to cloud servers to reduce the computational overhead of weak clients. At the same time, to protect the security of the privacy data of the participants, Pedersen commitment and zero-knowledge proof technologies are introduced to resist malicious attacks from cloud servers and prevent them from modifying the set elements sent by the client.

[0007] This invention is achieved through the following technical solution:

[0008] A method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds, with three participants: client C, server S, and cloud server H. Client C has a set... Server S has a private collection The untrusted cloud server H was not entered, among which... This includes the following steps:

[0009] (1) System initialization: Client C and server S negotiate set The set The intersection of X and Y is an empty set; random number seed. Hash function ;

[0010] (2) Data blinding: Client C and server S respectively use random number seed to blind their private sets;

[0011] (3) Data outsourcing: Client C and server S respectively outsource the collection After being added to the blinded private set, it is mapped to the Cuckoo Hash Table and the Naive Hash Table respectively using a hash function. Client C sends the Cuckoo Hash Table to the untrusted cloud H.

[0012] (4) Untrusted cloud and server perform interactive computation: Untrusted cloud H and server S jointly perform unintentional privacy equivalence tests and generate corresponding Pedersen commitments and zero-knowledge proofs. Untrusted cloud H returns the test results to client C. The specific steps are as follows:

[0013] (41) Untrusted cloud H as the sender input element The This represents the element in the b-th bucket of the Cuckoo Hash Table received by the untrusted cloud H, with the server S serving as the input set for the receiver. The Let S represent the set of the b-th bucket in the naive hash table of server S;

[0014] (42) For Each bit of element x Unreliable cloud H selects random numbers Generate matrix

[0015] ;

[0016] Among them, if ,but , ;like 1, then , ;

[0017] (43) Untrusted cloud H calculation Commitment value and zero-knowledge proofs ,prove In With commitment E If the values ​​are the same, the untrusted cloud H will commit to E and zero-knowledge proofs. To be announced;

[0018] (44) Server S will Each bit As a selection bit;

[0019] (45) Untrusted cloud H input matrix Server S inputs a selection string They jointly execute the Unintentional Transfer Extensions protocol, and the server S receives the output. ;

[0020] (46) Server-side S calculation and the calculation results Send to client C;

[0021] (47) Untrusted cloud H calculation and the calculation results Send to client C;

[0022] (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification passes, the intersection is calculated. The specific steps are as follows:

[0023] (51) Client C verifies zero-knowledge proof If the verification passes, then calculate ;

[0024] (52) Client C on the set After unblinding, the intersection is obtained. .

[0025] In a preferred embodiment, step (1) further includes setting the size of the random number set D. Size of the Cuckoo Hash Table and the Naive Hash Table .

[0026] In a preferred embodiment, step (2) includes the following steps:

[0027] (21) Client C and server S use a random number seed Generate a set of random numbers ;

[0028] (22) For each Client C calculation , obtain the set Server S uses the same set of random numbers. For the input set Blinding is performed to obtain the set. .

[0029] In a preferred embodiment, step (3) includes the following steps:

[0030] (31) Client C will collect Add to collection In the middle, the server S randomly selects a set. A subset Add to collection middle;

[0031] (32) Client C uses the Cuckoo Hash Algorithm set Mapped to the Cuckoo Hash Table and sent to cloud server H;

[0032] (33) Server S uses the naive hash algorithm set Mapped to a naive hash table.

[0033] As a preferred embodiment, the specific steps of step (43) are as follows: Untrusted cloud H selects a random number. ,calculate Commitment value Untrusted cloud computing zero-knowledge proofs To prove In With commitment E They are the same value; Unreliable cloud H selects random numbers ,calculate , , , , Unreliable cloud H Announced.

[0034] In a preferred embodiment, step (51) includes the following steps:

[0035] Client C verifies zero-knowledge proofs That is, calculation Combined with the information released by the untrusted cloud provider H ,verify , If the verification passes, then calculate. .

[0036] A system for finding intersections of unbalanced privacy sets applicable to untrusted clouds, characterized in that it includes a client C, a server S, and a cloud server H; the system is used to execute the aforementioned method for finding intersections of unbalanced privacy sets applicable to untrusted clouds.

[0037] Client C includes:

[0038] The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset;

[0039] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0040] The intersection calculation model verifies the correctness of the received data and calculates the correct intersection result.

[0041] Server S includes:

[0042] The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset;

[0043] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0044] The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test.

[0045] Untrusted cloud H includes:

[0046] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0047] The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test.

[0048] The Pedersen commitment module is used to confidentially calculate commitment values, preventing untrusted clouds from modifying data during the calculation process.

[0049] The beneficial effects of this invention are:

[0050] (1) This invention designs an Oblivious Private Equality Test (OPEQT) protocol. By encoding the elements of the set and combining it with the Oblivious Transport Extension Protocol, the cloud server and the service provider can confidentially perform equality tests on the elements of the set, ensuring the privacy of the test results.

[0051] (2) This invention constructs an unbalanced privacy set intersection protocol for untrusted cloud servers. By outsourcing the main computational tasks of weak clients to the cloud server, the computational burden on the client is effectively reduced. At the same time, by introducing Pedersen commitments and zero-knowledge proof mechanisms, the protocol's security is enhanced to resist possible malicious behavior from untrusted cloud servers. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the model structure of the present invention.

[0053] Figure 2 This is a schematic diagram of the operation process of the present invention. Detailed Implementation

[0054] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings: These embodiments are implemented based on the technical solution of the present invention, and provide detailed implementation methods and specific operation procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0055] like Figure 1 , 2 As shown, an intersection method for unbalanced privacy sets applicable to untrusted clouds is proposed, involving three participants: client C, server S, and cloud server H. Client C has a set... Server S has a private collection The untrusted cloud server H did not provide any input. The specific implementation method is as follows:

[0056] (1) System initialization: Client C and server S negotiate set The set and The intersection of these sets is an empty set, and the random number seed is... The size of the random number set D Hash function Size of the Cuckoo Hash Table and the Naive Hash Table ;

[0057] (2) Data blinding: Client C and server S respectively use random number seed to blind their private sets;

[0058] (21) Client C and server S use a random number seed Generate a set of random numbers ;

[0059] (22) For each Client C calculation , obtain the set Server S uses the same set of random numbers. For the input set Perform blinding to obtain the set ;

[0060] (3) Data outsourcing: Client C and server S respectively outsource the collection After being added to the blinded private set, it is mapped to the Cuckoo Hash Table and the Naive Hash Table respectively using a hash function. Client C sends the Cuckoo Hash Table to the untrusted cloud H.

[0061] (31) Client C will collect Add to collection In the middle, the server S randomly selects a set. A subset Add to collection middle;

[0062] (32) Client C uses the Cuckoo Hash Algorithm set Mapped to the Cuckoo Hash Table and sent to cloud server H;

[0063] (33) Server S uses the naive hash algorithm set Mapped to a naive hash table;

[0064] (4) The untrusted cloud H and the server perform interactive computation. The untrusted cloud H and the server S jointly perform an unintentional privacy equivalence test and generate the corresponding Pedersen commitment and zero-knowledge proof. The untrusted cloud H returns the test results to the client C. The specific steps are as follows:

[0065] (41) Untrusted cloud H as the sender input element The This represents the element in the b-th bucket of the Cuckoo Hash Table received by the untrusted cloud H, with the server S serving as the input set for the receiver. The Let S represent the set of the b-th bucket in the naive hash table of server S;

[0066] (42) For Each bit of element x Unreliable cloud H selects random numbers Generate matrix

[0067] ;

[0068] Among them, if ,but , ;like 1, then , ;

[0069] (43) Untrusted cloud H selects random numbers ,calculate Commitment value Untrusted cloud computing zero-knowledge proofs To prove In With commitment E They are the same value; Unreliable cloud H selects random numbers ,calculate , , , , Unreliable cloud H Announced.

[0070] (44) Server S will Each bit As a selection bit;

[0071] (45) Untrusted cloud H input matrix Server S inputs a selection string They jointly execute the Unintentional Transfer Extensions protocol, and the server S receives the output. ;

[0072] (46) Server-side S calculation and the calculation results Send to client C;

[0073] (47) Untrusted cloud H calculation and the calculation results Send to client C;

[0074] (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification is successful, the intersection is calculated.

[0075] (51) Client C verifies zero-knowledge proof That is, calculation Combined with the information released by the untrusted cloud provider H ,verify , If the verification passes, then calculate. ;

[0076] (52) Client C on the set After unblinding, the intersection is obtained. .

[0077] A system for finding intersections of unbalanced privacy sets applicable to untrusted clouds, characterized in that it includes a client C, a server S, and a cloud server H; the system is used to execute the aforementioned method for finding intersections of unbalanced privacy sets applicable to untrusted clouds.

[0078] Client C includes:

[0079] The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset;

[0080] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0081] The intersection calculation model verifies the correctness of the received data and calculates the correct intersection result.

[0082] Server S includes:

[0083] The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset;

[0084] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0085] The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test.

[0086] Untrusted cloud H includes:

[0087] The data transmission receiving module is used to outsource private data or receive data from other participants.

[0088] The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test.

[0089] The Pedersen commitment module is used to confidentially calculate commitment values, preventing untrusted clouds from modifying data during the calculation process.

[0090] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds, characterized in that, There are three participants: client C, server S, and cloud server H. Client C has a set. Server S has a private collection The untrusted cloud server H was not entered, among which... This includes the following steps: (1) System initialization: Client C and server S negotiate set The set The intersection of X and Y is an empty set; random number seed. Hash function ; (2) Data blinding: Client C and server S respectively use random number seed to blind their private sets; (3) Data outsourcing: Client C and server S respectively outsource the collection The data is added to the blinded private set and mapped to the Cuckoo Hash Table and the Naive Hash Table respectively using a hash function; Client C sends the Cuckoo Hash Table to the untrusted cloud H; (4) Untrusted cloud and server perform interactive computation: Untrusted cloud H and server S jointly perform unintentional privacy equivalence tests and generate corresponding Pedersen commitments and zero-knowledge proofs. Untrusted cloud H returns the test results to client C. The specific steps are as follows: (41) Untrusted cloud H as the sender input element The This represents the element in the b-th bucket of the Cuckoo Hash Table received by the untrusted cloud H, with the server S serving as the input set for the receiver. The Let S represent the set of the b-th bucket in the naive hash table of server S; (42) For Each bit of element x Unreliable cloud H selects random numbers Generate matrix ； Among them, if ,but , ;like 1, then , ; (43) Untrusted cloud H calculation Commitment value and zero-knowledge proofs ,prove In With commitment E If the values ​​are the same, the untrusted cloud H will commit to E and zero-knowledge proofs. To be announced; (44) Server S will Each bit As a selection bit; (45) Untrusted cloud H input matrix Server S inputs a selection string They jointly execute the Unintentional Transfer Extensions protocol, and the server S receives the output. ; (46) Server-side S calculation and the calculation results Send to client C; (47) Untrusted cloud H calculation and the calculation results Send to client C; (5) Calculate the intersection: Client C verifies the message returned by the untrusted cloud. If the verification passes, the intersection is calculated. The specific steps are as follows: (51) Client C verifies zero-knowledge proof If the verification passes, then calculate ; (52) Client C on the set After unblinding, the intersection is obtained. .

2. The method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds according to claim 1, characterized in that, Step (1) also includes setting the size of the random number set D. Size of the Cuckoo Hash Table and the Naive Hash Table .

3. The method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds according to claim 1, characterized in that, Step (2) includes the following steps: (21) Client C and server S use a random number seed Generate a set of random numbers ; (22) For each Client C calculation , obtain the set Server S uses the same set of random numbers. For the input set Blinding is performed to obtain the set. .

4. The method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds according to claim 1, characterized in that, Step (3) includes the following steps: (31) Client C will collect Add to collection In the middle, the server S randomly selects a set. A subset Add to collection middle; (32) Client C uses the Cuckoo Hash Algorithm set Mapped to the Cuckoo Hash Table, and sent to cloud server H; (33) Server S uses the naive hash algorithm set Mapped to a naive hash table.

5. The method for finding the intersection of unbalanced privacy sets applicable to untrusted clouds according to claim 1, characterized in that, The specific steps in step (43) are as follows: Untrusted cloud H selects a random number. ,calculate Commitment value Untrusted cloud computing zero-knowledge proofs To prove In With commitment E They are the same value; Unreliable cloud H selects random numbers ,calculate , , , , Unreliable cloud H Announced.

6. The intersection method for unbalanced privacy sets applicable to untrusted clouds according to claim 1, characterized in that, The specific steps in step (51) are as follows: Client C calculates... Combined with the information released by the untrusted cloud provider H ,verify , .

7. A non-equilibrium privacy set intersection system applicable to untrusted clouds, characterized in that, This includes the client (C), the server (S), and the cloud server (H). The system is used to perform the method of claim 1; Client C includes: The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset; The data transmission receiving module is used to outsource private data or receive data from other participants. The intersection calculation model verifies the correctness of the received data and calculates the correct intersection result. Server S includes: The data blinding calculation module calculates a random number set based on a random number seed, thus blinding the private dataset; The data transmission receiving module is used to outsource private data or receive data from other participants. The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test. Untrusted cloud H includes: The data transmission receiving module is used to outsource private data or receive data from other participants. The privacy equivalence test module is used to test the equivalence of privacy data elements between the participating parties in a confidentiality test. The Pedersen commitment module is used to confidentially calculate commitment values, preventing untrusted clouds from modifying data during the calculation process.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 6.

Images