Non-equilibrium privacy set union set method and union set system based on full homomorphic encryption

Abstract

The application discloses a non-balance privacy set union method and a union set system based on full homomorphic encryption, and the method comprises the following steps: a sending end sends a first to-be-unionized ciphertext set to a receiving end; the receiving end obtains a comparison result ciphertext by comparing the data difference between a first to-be-unionized set and a second to-be-unionized set according to the first to-be-unionized ciphertext set based on assignment, rotation and multiplication operation, and sends the comparison result ciphertext to the sending end; the sending end decrypts the comparison result ciphertext to obtain a blinded comparison result, and sends the blinded comparison result to the receiving end; and the receiving end determines the union set of the first to-be-unionized set and the second to-be-unionized set according to the blinded comparison result. The application can reduce the calculation amount and improve the communication speed while avoiding privacy leakage.

Description

Technical Field

[0001] This invention belongs to the field of encrypted data processing technology, specifically relating to a non-balanced privacy set union method and a union set system based on fully homomorphic encryption. Background Technology

[0002] In the era of big data and artificial intelligence, data has become a fundamental resource. Through data sharing, various parties gain access to more resources, extracting a wealth of valuable information, leading to better user experiences and greater value creation. However, in the process of massive data mining, the leakage of sensitive user information is becoming increasingly serious, making it difficult to guarantee citizens' privacy and security. Privacy set union technology is needed in many scenarios, which has garnered widespread attention. For example, in financial risk control, different banks or payment platforms need to share blacklist information without disclosing their own user data to improve fraud detection capabilities. However, in server-client models and scenarios involving small organizations interacting with large platforms, the dataset sizes of the participating parties often vary significantly. Traditional privacy set union schemes are mainly designed for datasets of similar size, leading to inefficient computation and communication costs in imbalanced scenarios. Traditional privacy set unions may impose unnecessary computational overhead on smaller sets and overburden their communication.

[0003] To address this, various imbalanced privacy set union protocols have been proposed, with the cuckoo hash table-based approach being a typical example. However, this method carries the risk of information leakage because the sender embeds its smaller data set into the cuckoo hash table, while the receiver stores its larger data set in a simple hash table using the same hash function. Both the cuckoo hash table and the simple hash table have the same length, determined by the size of the smaller set. Research indicates that this approach is unsuitable for privacy set union protocols. Furthermore, the risk of information leakage increases with the degree of imbalance in data size.

[0004] Other methods that do not use the Cuckoo Hash Table are usually compared with the method of high-order polynomials. Because the order of the polynomial is high, the circuit depth of its implementation is large, which makes the method too complicated to calculate and thus slow in communication speed. Summary of the Invention

[0005] This invention provides an unbalanced privacy set union method and a union system based on fully homomorphic encryption, which can solve the problems of privacy leakage or slow communication speed in current privacy set union methods.

[0006] In a first aspect, embodiments of the present invention provide a method for unbalanced privacy set union based on fully homomorphic encryption, the method being applied to a union set system, the system including a sender and a receiver, the method comprising:

[0007] The sending end sends a first ciphertext set to be merged to the receiving end, wherein the first ciphertext set to be merged is obtained by encoding, rearranging and encrypting the first set to be merged in sequence;

[0008] The receiving end, based on assignment, rotation, and multiplication operations, compares the data difference between the first set of ciphertexts to be merged and the second set of ciphertexts to be merged to obtain the comparison result ciphertext; and sends the comparison result ciphertext to the sending end.

[0009] The sending end decrypts the ciphertext of the comparison result to obtain a blinded comparison result, and sends the blinded comparison result to the receiving end;

[0010] The receiving end determines the union of the first set to be merged and the second set to be merged based on the blinded comparison result.

[0011] Secondly, embodiments of the present invention provide a merging set system, including a sending end and a receiving end;

[0012] The sending end is used to send a first ciphertext set to be merged to the receiving end, wherein the first ciphertext set to be merged is obtained by encoding, rearranging and encrypting the first set to be merged;

[0013] The receiving end is used to obtain a comparison result ciphertext by comparing the data difference between the first set to be merged and the second set to be merged based on assignment, rotation, and multiplication operations; and to send the comparison result ciphertext to the sending end.

[0014] The sending end is also used to decrypt the ciphertext of the comparison result to obtain a blinded comparison result, and send the blinded comparison result to the receiving end;

[0015] The receiving end is also used to determine the union of the first set to be merged and the second set to be merged based on the comparison result of the blinding.

[0016] The beneficial effects of the embodiments of the present invention compared with the prior art are as follows: Since the method provided by the present invention does not use the cuckoo hash structure to compare the data of the first set to be merged and the second set to be merged, the privacy leakage problem caused by the cuckoo hash structure can be avoided, and the robustness of communication is enhanced; in addition, since the system can obtain the ciphertext of the comparison result by only performing operations with small computational load such as assignment, rotation and multiplication, compared with the traditional method of comparison using high-order polynomials, the present invention has a smaller computational load, lower circuit depth and higher communication speed. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the structure of a merging set system provided in an embodiment of the present invention;

[0018] Figure 2 A flowchart illustrating the implementation of an unbalanced privacy set union method based on fully homomorphic encryption, provided in an embodiment of the present invention;

[0019] Figure 3 A flowchart illustrating the implementation of a method for comparing the data difference between a first set to be merged and a second set to be merged, provided in an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of an assigned ciphertext matrix provided in an embodiment of the present invention. Detailed Implementation

[0021] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0022] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0023] It should also be understood that the term “and / or” as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0025] Furthermore, in the description of this invention and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of the invention include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0027] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0028] Figure 1 The diagram shown illustrates the structure of a merging set system according to an embodiment of the present invention. By way of example and not limitation, system 100 may include a transmitter S and a receiver R.

[0029] For example, see Figure 1 The sending end S can sequentially encode, rearrange, and encrypt its own first set to be merged X to obtain the first ciphertext set to be merged Enc. f (W X ), and then Enc f (W X The data is sent to the receiving end. The receiving end can compare the values ​​in the Enc array based on assignment, rotation, and multiplication operations. f (W X The data difference between X and its second set to be merged, Y, is used to obtain the ciphertext of the comparison result. Since the ciphertext of the comparison result is encrypted data, the receiving end sends it to the sending end for decryption to obtain the blinded comparison result. Finally, the union of X and Y is determined based on the blinded comparison result.

[0030] Since the system provided by this invention does not use a cuckoo hash structure to compare the data of the first and second sets to be merged, it can avoid the privacy leakage problem caused by the cuckoo hash structure and enhance communication robustness. Furthermore, since the system can obtain the ciphertext of the comparison result through operations with low computational complexity such as assignment, rotation, and multiplication, compared with the traditional method of comparison using high-order polynomials, the computational complexity of this invention is lower, the circuit depth is lower, and the communication speed is higher.

[0031] Figure 2The diagram shown illustrates an implementation flowchart of an unbalanced privacy set union method based on fully homomorphic encryption, provided by an embodiment of the present invention. As an example and not a limitation, this method can be applied to the aforementioned system and may include steps S201-S205, which are described below.

[0032] S201, the sending end sends the first set of ciphertexts to be merged to the receiving end.

[0033] Accordingly, the receiving end accepts the first set of encrypted texts to be merged.

[0034] In one possible implementation, before sending the first set of ciphertexts to be merged, the sending end can first encode, rearrange, and encrypt the first set of ciphertexts to be merged in sequence to obtain the first set of ciphertexts to be merged.

[0035] In one example, if the first set to be merged is short, the sender can directly use the permutation function π. S Permuting the first set to be merged X, we get X′=π S (X); then, constant repetition encoding is performed on each element in X′ to generate the first encoded set W to be merged. X Then, extract W. X From the data of the t1th bit of each codeword, we obtain the t1th encoding vector; [the text abruptly ends here, likely due to an incomplete sentence or a formatting error.] The 1, ..., S are combined together to obtain t combined encoded vectors; finally, a fully homomorphic encryption scheme is used to encrypt the combined encoded vectors S1, ..., S2. t Encryption is performed to obtain the first ciphertext set to be merged, Enc. f (W X )={Enc f (S1),...,Enc f (S t )}, where Enc f (S i ) is the i-th combined encoding vector S i The encrypted text.

[0036] For example, the first set to be merged, W X If the total number of bits in each codeword can be w, then the total number of encoded vectors (the maximum value of t1) is also w. The number of elements in the first set to be merged can be n. The length of the combined encoded vector can be slot, and the total number of combined encoded vectors (the maximum value of t) can be...

[0037] In another example, if the first set to be merged is long, after permuting X, the sender can sequentially encode each element in X′ using a virtual Bloom filter and split it into two equal parts, obtaining... Where ∥ represents cascading. Then for each and Performing constant repetition encoding yields a constant length of w. and Similarly, the sending end extracts W X Each element The t1th bit forms the encoded subvector Extract the t1th bit to form the vector Each indivual and Combined together, we obtain a combined encoding vector of length slot. and Finally, a fully homomorphic encryption scheme is used for encryption. and Obtain the first set of encrypted texts to be merged and

[0038] For example, express The ciphertext, express The encrypted text.

[0039] S202, the receiving end, based on assignment, rotation, and multiplication operations, compares the data difference between the first set to be merged and the second set to be merged to obtain the comparison result ciphertext.

[0040] In one possible implementation, the receiving end can first assign and rotate the original ciphertext matrix according to the first set of ciphertexts to be merged to obtain the effective ciphertext matrix; then compare each bit of data in the second set of ciphertexts to be merged with the effective ciphertext matrix to obtain k updated comparison vectors; and multiply and rotate the updated comparison vectors to obtain the comparison result ciphertext.

[0041] Specifically, the number of ciphertext matrices can be determined based on the size of the first set to be merged / the second set to be merged.

[0042] For example, the first set to be merged and the second set to be merged are the same size.

[0043] In one example, to prevent potential attackers from inferring the size of the merged set from the ciphertext of the comparison result, the updated comparison vector can be multiplied and rotated first to obtain the original ciphertext Enc of the comparison result. f (b) and then by giving Enc f (b) Add a random vector r to complete the process for Enc f (b) Randomization yields the comparison result ciphertext Enc f (b r ).

[0044] S203, the receiving end sends the encrypted comparison result to the sending end.

[0045] Accordingly, the sending end receives the encrypted comparison result.

[0046] S204, the sending end decrypts and compares the ciphertext to obtain a blinded comparison result.

[0047] In one example, the sender S can decrypt the ciphertext of the comparison result to obtain the blinded comparison result b. r .

[0048] S205, the sending end sends the blinding comparison results to the receiving end.

[0049] S206, the receiving end determines the union of the first set to be merged and the second set to be merged based on the blinded comparison results.

[0050] In one possible implementation, the receiver can base its actions on the blinded comparison result b. r The result is obtained by comparing the original number of bits with the random vector r.

[0051] For example, each element in the comparison result of the original number of bits can be composed of 0 or 1. If it is 0, it means that the data of this bit in the first set to be merged is the same as that in the second set to be merged; if it is 1, it means that the data of this bit in the first set to be merged is different from that in the second set to be merged.

[0052] In one example, if the first set to be merged is small, it can be directly calculated using the formula b = b r -r, to get the comparison result b of the original number of bits.

[0053] In another example, if the first set to be merged is large, then b can be used. r The i2nd data b r [i2] minus the i2th element of the random number r[i2]; if b r When [i2]-r[i2] is 0 or 1, let the i2th bit of b, b[i2] = 0; when it is 2, let b[i2] = 1.

[0054] In one possible implementation, the sender and receiver can invoke the Unintentional Transport Extension Protocol to transmit non-intersection information from the first set to be merged.

[0055] For example, sender S, as the sender of the Unintentional Transport Extensions protocol, receives the following message: The receiver R, acting as the recipient of the Unintentional Transmission Extension Protocol (UTP), takes input b as its input. After the protocol is executed, R obtains the output.

[0056] Specifically, Let b[i] represent the first and second messages of the i2th unintentional transmission instance of the unintentional transmission protocol, respectively. Let X′[i2] be the i2th bit of X′. When b[i2] = 0, When b[i2] = 1, ⊥ is a special symbol agreed upon beforehand by S and R, used to fill in data, and has no practical meaning.

[0057] For example, the union Z of the first set to be merged and the second set to be merged satisfies: Z = {m} i,b[i] |m i,b[i] ≠⊥}∪Y.

[0058] Since the method provided by this invention does not use a cuckoo hash structure to compare the data in the first and second sets to be merged, it avoids the privacy leakage problem caused by the cuckoo hash structure and enhances communication robustness. Furthermore, because the system can obtain the ciphertext of the comparison result through only computationally inexpensive operations such as assignment, rotation, and multiplication, compared to traditional methods that use high-order polynomials for comparison, this invention has lower computational complexity, lower circuit depth, and higher communication speed.

[0059] Furthermore, by randomizing the comparison results of the original bit count, it can be ensured that the size of the data intersection will not be unintentionally exposed, thereby effectively preventing the participants from speculating on the other party's data distribution and enhancing the privacy and security of the protocol.

[0060] Figure 3 The diagram illustrates a flowchart of a method for comparing the data difference between a first set to be merged and a second set to be merged, provided by an embodiment of the present invention. This is an example, not a limitation, and can be a specific possible implementation of step S202 described above. The method may include steps S301-S303, which are described below.

[0061] S301, extract the effective information of each encoded vector in the first ciphertext set to be merged, and perform assignment and rotation operations on the original ciphertext matrix in sequence to obtain the effective ciphertext matrix.

[0062] For example, each element in the original ciphertext matrix can be a preset encrypted value. Referring to the pseudocode of the method shown in Table 1 below, each element in the original ciphertext matrix can be an Enc value. f (0), which is the ciphertext of 0.

[0063] For example, the original ciphertext matrix can have w rows. See Table 1 below. When the set to be merged is small, one original ciphertext matrix is ​​sufficient; see Table 2 below. When the set to be merged is large, two original ciphertext matrices can be prepared.

[0064] In one example, the receiver can respond to Encf (S i After performing homomorphic multiplication, the result is placed in the j+(i-1)·t row and j column of the original ciphertext matrix. Then, for each S... i After iteratively processing each encoded vector, the resulting ciphertext matrix is ​​obtained. (See also...) Figure 4 The colored fill is based on different S i The multiplication results obtained have different values ​​represented by the same color, only the assignment position is different.

[0065] For example, the assigned ciphertext matrix can satisfy the following formula:

[0066] Cipher[j+(i-1)·t][j]:=Enc f (S i )*ExPlan[j] (1.1)

[0067] Where Cipher[j+(i-1)·t][j] represents the data in the j+(i-1)·t row and j column of the assigned ciphertext matrix; Enc f (S i ) represents the i-th combined coding vector S i The ciphertext; ExPlain[j] is a vector of length slot, where the (j-1)·n+1th to the j·nth data are 1 and the rest are 0;

[0068] Specifically, ExPlain[j] can be used to extract valid information from the encoded vector.

[0069] In particular, when the set to be merged is large, it can be done based on the above formula (1.1) by... Assign values ​​to the first original ciphertext matrix, through Assign values ​​to the second original ciphertext matrix.

[0070] In one example, after obtaining the copied ciphertext matrix, the positions of the assigned values ​​can be rotated and shifted to the left to obtain the valid ciphertext matrix.

[0071] For example, an effective ciphertext matrix can satisfy the following formula:

[0072]

[0073] in, This represents the j+(i-1)·t-th row in the effective ciphertext matrix Cipher1. The column data, Rotate(Cipher[j+(i-1)·t][j],o·n) means rotating Cipher[j+(i-1)·t][j] by o·n degrees.

[0074] Similarly, when the set to be merged is large, two valid ciphertext matrices can be obtained based on the above formula (1.2).

[0075] S302, based on each bit of data in the second set to be merged, update the k comparison vectors with the effective ciphertext matrix to obtain the k updated comparison vectors.

[0076] In one possible implementation, the second set to be merged, Y, can be constant-repetition encoded to obtain the encoded set W. Y Each codeword has a length of w; see Table 1 below, and then W can be searched cyclically. Y If each piece of data in the database is retrieved... Then update the pre-set comparison vector. After all searches are completed, k updated comparison vectors can be obtained.

[0077] For example, the updated comparison vector can satisfy the following formula:

[0078] Temp[ind]:=Temp0[ind]+Cipher1[t1][j1+1] (1.3)

[0079] in, This indicates the second set to be merged after encoding. The data in row t1 and column t1 is represented by Temp[ind], which is the ind-th updated comparison vector, and Temp0[ind], which is the ind-th comparison vector. Cipher1[t1][j1+1] represents the data in row t1 and column j1+1 of the effective ciphertext matrix, where ind = 1,...,k. t1 = 1, ..., w m is the number of ciphertext slots.

[0080] For example, each element in the comparison vector can be an encrypted value with a preset value, such as ciphertext that is also 0.

[0081] Similarly, when the set to be merged is large, the second set Y to be merged can be divided into two equal parts and encoded with constant weight for retrieval. Based on the above formula (1.3), 2k updated comparison vectors are obtained. Here, v = 1, 2; This represents the set after the first part is encoded. This represents the set after the second part is encoded.

[0082] S303, perform a chain multiplication and rotation on the k updated comparison vectors to obtain the ciphertext of the comparison result.

[0083] For example, the ciphertext resulting from the comparison of the original number of bits can satisfy the following formula:

[0084]

[0085] The ciphertext is the result of comparing the original number of bits;

[0086] in:

[0087] Enc f (b)1=Enc f (b)0+Temp j (1.5)

[0088] Enc f (b) 0 is a value related to Enc f (b) A vector of encrypted values ​​with the same dimensions, where each element is the preset value.

[0089] Similarly, when the set to be merged is large, the ciphertext of the comparison result of the two original bits can be obtained based on the above formulas (1.4) and (1.5), and these two ciphertexts can be concatenated together for subsequent randomization processes.

[0090] According to the comparison method provided by this invention, the ciphertext of the comparison result is obtained by performing k multiplication operations. This optimizes the calculation process and reduces the computational complexity of the protocol while ensuring privacy and security. Compared with existing schemes that simultaneously avoid leakage of intersection size and cuckoo hash information, this invention can complete the calculation in a shorter time, reducing computational and communication overhead, making it more suitable for large-scale data scenarios.

[0091] Table 1

[0092]

[0093]

[0094]

[0095] Table 2

[0096]

[0097]

[0098]

[0099] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

Claims

1. A non-balanced privacy set union method based on fully homomorphic encryption, characterized in that, The method is applied to a merge set system, the system including a sender and a receiver, the method comprising: The sending end sends a first ciphertext set to be merged to the receiving end, wherein the first ciphertext set to be merged is obtained by encoding, rearranging and encrypting the first set to be merged in sequence; The receiving end, based on assignment, rotation, and multiplication operations, compares the data difference between the first set of ciphertexts to be merged and the second set of ciphertexts to be merged to obtain the comparison result ciphertext; and sends the comparison result ciphertext to the sending end. The sending end decrypts the ciphertext of the comparison result to obtain a blinded comparison result, and sends the blinded comparison result to the receiving end; The receiving end determines the union of the first set to be merged and the second set to be merged based on the comparison result of the blinding process; The method further includes, before the sending end sends the first set of ciphertexts to be merged to the receiving end: The sending end performs constant-repetition encoding on the first set to be merged, and extracts the data with the same number of bits for each codeword in the encoded first set to be merged. encoded vectors, where The total number of bits for each codeword in the first set to be merged after encoding; Each The encoded vectors are combined together to obtain 3 combined encoded vectors, where , The length of the combined encoding vector, The number of elements in the first set to be merged; The combined encoded vector is encrypted to obtain the first ciphertext set to be merged; The receiving end, based on assignment, rotation, and multiplication operations, compares the data difference between the first and second sets of ciphertext to be merged to obtain the comparison result ciphertext, including... Extract the valid information of each encoded vector in the first ciphertext set to be merged, and perform assignment and rotation operations on the original ciphertext matrix in sequence to obtain the valid ciphertext matrix, wherein each element in the original ciphertext matrix is ​​a preset encrypted value; Update the effective ciphertext matrix based on each bit of data in the second set to be merged. k By comparing vectors, we obtain k The updated comparison vector; Regarding the k The updated comparison vectors are multiplied together and rotated to obtain the ciphertext of the comparison result.

2. The method according to claim 1, characterized in that, The assigned ciphertext matrix satisfies the following formula: in, This indicates the first element in the ciphertext matrix after assignment. OK Column data; Indicates the first Combined encoding vectors The encrypted text; For a length of The vector, which is the first... Ranked first One bit is 1 and the rest are 0. Encoding of long vectors; , .

3. The method according to claim 2, characterized in that, The effective ciphertext matrix satisfies the following formula: in, Represents the valid ciphertext matrix The Middle OK The data in the column, Indicates will Rotation Spend, .

4. The method according to claim 1, characterized in that, like Then the updated comparison vector satisfies the following formula: in, This indicates the second set to be merged after encoding. OK The data in the column, For the first The updated comparison vector, For the first Comparison vectors Indicates the th element in the valid ciphertext matrix Line 1 The data in the column, , , , , This represents the number of ciphertext slots.

5. The method according to claim 4, characterized in that, The above k The updated comparison vectors are multiplied together and rotated to obtain the ciphertext of the comparison result, including: Regarding the k Multiply and rotate the updated comparison vectors to obtain the original comparison result ciphertext; The original bit comparison result ciphertext is randomized to obtain the comparison result ciphertext.

6. The method according to claim 5, characterized in that, The ciphertext resulting from the comparison of the original bits satisfies the following formula: , The ciphertext is the result of comparing the original number of bits; in: For a with A vector of encrypted values ​​with the same dimensions, where each element is the preset value. .

7. The method according to claim 5, characterized in that, The encrypted comparison result satisfies the following formula: in, The comparison result is encrypted. It is a random vector.

8. A merge set system, characterized in that, Includes the sending end and the receiving end; The sending end is used to send a first ciphertext set to be merged to the receiving end, wherein the first ciphertext set to be merged is obtained by encoding, rearranging and encrypting the first set to be merged; The receiving end is used to obtain a comparison result ciphertext by comparing the data difference between the first set to be merged and the second set to be merged based on assignment, rotation, and multiplication operations; and to send the comparison result ciphertext to the sending end. The sending end is also used to decrypt the ciphertext of the comparison result to obtain a blinded comparison result, and send the blinded comparison result to the receiving end; The receiving end is also used to determine the union of the first set to be merged and the second set to be merged based on the comparison result of the blinding; Before sending the first set of ciphertexts to be merged to the receiving end, the sending end is further configured to: The sending end performs constant-repetition encoding on the first set to be merged, and extracts the data with the same number of bits for each codeword in the encoded first set to be merged. encoded vectors, where The total number of bits for each codeword in the first set to be merged after encoding; Each The encoded vectors are combined together to obtain 3 combined encoded vectors, where , The length of the combined encoding vector, The number of elements in the first set to be merged; The combined encoded vector is encrypted to obtain the first ciphertext set to be merged; The receiving end is specifically used for: Extract the valid information of each encoded vector in the first ciphertext set to be merged, and perform assignment and rotation operations on the original ciphertext matrix in sequence to obtain the valid ciphertext matrix, wherein each element in the original ciphertext matrix is ​​a preset encrypted value; Update the effective ciphertext matrix based on each bit of data in the second set to be merged. k By comparing vectors, we obtain k The updated comparison vector; Regarding the k The updated comparison vectors are multiplied together and rotated to obtain the ciphertext of the comparison result.

Images