Multi-party privacy set intersection method and system in unbalanced scene

Abstract

The invention provides a multi-party privacy set intersection method and system in an unbalanced scene, and the method comprises the steps: taking an input party with a minimum set as a central participant, taking the set as an anchor point, and embedding elements into a hash table through a hash function, each participant respectively runs a batch member condition random number generation protocol under a balance scene constructed based on a batch oblivious pseudo-random function and an oblivious key value pair storage protocol or a batch member condition random number generation protocol under a non-balance scene constructed based on the batch oblivious pseudo-random function and a fully homomorphic encryption technology; the member relationship of the elements is converted into a feature value equivalence relationship, and the central participant and other parameter parties jointly operate a joint privacy equivalence test protocol, so that the central participant obtains a corresponding feature vector, and multi-party privacy set intersection is realized. According to the method, the communication complexity can break through the linear boundary of a large set size, and any collusion attack can be resisted.

Description

Technical Field

[0001] The present invention belongs to the field of cryptography technology, and particularly relates to a method and system for multi-party private set intersection in an unbalanced scenario. Background Technique

[0002] The statements in this part only provide background technical information related to the present invention, and do not necessarily constitute prior art.

[0003] With the rapid development of information technologies such as cloud computing, big data, Internet of Things, and artificial intelligence, various new service models and data applications have emerged continuously, and data has become the most important production factor in the digital age. While the interconnection and interoperability of data create huge data value, it also brings unprecedented challenges to data security protection.

[0004] As a high-frequency and high-value dedicated secure computing protocol, private set operations can effectively solve the problem of secure data circulation. It is a key cryptography technology to achieve data availability without visibility, break through the "data island" problem, and release data value, and shows broad application prospects in aspects such as joint risk control, joint marketing, and joint supervision.

[0005] The private set intersection protocol (PSI) means that each participating party has a private data set, jointly calculates the intersection of the sets, and does not disclose other information. Private set intersection has important applications in privacy data analysis, DNA detection, pattern matching, etc. For example, in the field of medical and health, hospitals and research institutions can safely compare patient data through PSI to identify common cases for cooperative research while protecting patient privacy; in advertising and marketing, enterprises can accurately locate common customer groups to achieve joint promotion without disclosing the complete information of users; in financial risk control, banks and credit investigation institutions can use PSI to detect common fraud accounts and improve the anti-fraud efficiency; in social networks, PSI can help users discover common friends without exposing other social relationships.

[0006] Existing multi-party private set intersection (MPSI) protocols are mainly designed for application scenarios where the sizes of input sets are relatively balanced, and the communication complexity of the protocols is at least linearly related to the size of the large set. When the sizes of the input sets of the participating parties vary greatly, the efficiency of these protocols in practical applications is low. For example, some participating parties may be resource-constrained mobile devices (such as those with limited battery capacity, computing power, or storage space), while other participating parties may be servers with high-performance computing resources. In addition, the communication bandwidth between the participating parties may also be limited, which further affects the actual performance of the protocol in such an environment. The communication complexity of all existing MPSI protocols grows at least linearly with the size of the largest input set, making it difficult to efficiently deploy and run existing MPSI in practical application environments with large differences in the sizes of input sets. Summary of the Invention

[0007] To solve the above problems, the present invention proposes a multi-party private set intersection method and system for unbalanced scenarios. The present invention proposes a batch member conditional random number generation and joint private equality testing protocol, and constructs an efficient multi-party private set intersection protocol, which can achieve a communication complexity that breaks through the linear limit of the large set size and can resist any collusion attack.

[0008] According to some embodiments, the present invention adopts the following technical solutions:

[0009] A multi-party private set intersection method for unbalanced scenarios, comprising the following steps:

[0010] According to the sizes of the input sets of each participating party, select the participating party with the smallest set size as the central participating party, and determine whether the difference between the sizes of the input sets of the central participating party and other participating parties is greater than a set threshold. If not, construct a batch member conditional random number generation protocol for the balanced scenario based on the batch oblivious pseudorandom function and the oblivious key-value pair storage protocol;

[0011] If so, construct a batch member conditional random number generation protocol for the unbalanced scenario based on the batch oblivious pseudorandom function and the fully homomorphic encryption technology;

[0012] Using the set of the central participating party as an anchor point, embed the elements into the cuckoo hash table using the cuckoo hash technology, and each participating party embeds the elements into the naive hash table using the naive hash technology, and respectively run the corresponding batch member conditional random number generation protocol to convert the membership relationship of the elements into a feature value equality relationship. The central participating party and other parameter parties jointly run the joint private equality testing protocol respectively, so that the central participating party obtains the corresponding feature bits and realizes the multi-party intersection operation.

[0013] As an alternative implementation, the process of constructing a batch member conditional random number generation protocol in a balanced scenario based on the batch oblivious pseudorandom function and the oblivious key-value pair storage protocol includes: Party P1 inputs a set Party P2 inputs m mutually exclusive sets {Y i 2} i∈[m] ;

[0014] The two parties call the batch oblivious pseudorandom function. Party P1 obtains all PRF values where i ∈ [m]; Party P2 obtains the PRF keys {k1,...,k m};

[0015] For all i ∈ [m], Party P2 calculates the PRF value F(k i ,Y i 2 [j]), where Y i 2 [j] represents the j-th element in the set Y i 2 ;

[0016] Party P2 selects m random values [t i i∈[m] , calculates the set where i ∈ [m], j ∈ [|Y i 2 |];

[0017] Party P2 calculates the oblivious key-value pair storage protocol: D = Encode(A), and sends D to Party P1;

[0018] Party P1 decodes to obtain where i ∈ [m]; Party P1 outputs the vector s = [s i i∈[m] ; Party P2 outputs the vector t = [t i i∈[m] .

[0019] As an alternative implementation, the process of constructing an efficient batch member conditional random number generation protocol in an unbalanced scenario based on the batch oblivious pseudorandom function and the fully homomorphic encryption technology includes: Party P1 and P2 call the batch oblivious pseudorandom function. Party P1 obtains all PRF values i ∈ [m]; P2 obtains the PRF keys {k1,…,k m};

[0020] For each i ∈ [m], P2 calculates the PRF value where Y i ​​​2 [j] represents the j-th element in the set Y i 2 in the set, and the number of elements in the set is B i =|Y i 2 |;

[0021] The participant P2 selects a random vector t = [t i i∈[m] For each i ∈ [m], the participant P2 constructs an interpolation polynomial F i (x) = f i (x) + t i where for all j ∈ [B i , the participant P2 obtains the coefficient matrix A, where the i-th column is the coefficient of the polynomial F i ;

[0022] The participant P1 encrypts using the fully homomorphic encryption public key and sends the ciphertext for i ∈ [m] to P2;

[0023] For each ciphertext the participant P2 homomorphically calculates all powers of the ciphertext Then, P2 homomorphically calculates in the ciphertext state and sends all the resulting ciphertexts to P1;

[0024] The participant P1 decrypts the ciphertext to obtain s = [s i i∈[m] ;

[0025] The participant P1 outputs s = [s i i∈[m] , the participant P2 outputs t = [t i i∈[m] .

[0026] As an alternative implementation, the process of embedding elements into a hash table using a hash function includes: The central participant uses cuckoo hashing to embed into a cuckoo hash table in which, according to the function of cuckoo hashing, at most one element is embedded in each bin, and the remaining participants P k , k ∈ [2, T] use the same hash function and use the naive hashing technique to embed the set into a naive hash table, where each bin contains multiple elements, and according to the function of the hash function, the same elements are hashed to the same bin.

[0027] ​​​​As an alternative implementation, the process of the central participant and each other parameter participant jointly running the joint privacy equality test protocol includes: the central participant P1 and each P k , k ∈ [2, T] jointly run the joint privacy equality test protocol, so that P1 obtains the eigenvalue at the corresponding position.

[0028] As an alternative implementation, during the process of running the joint privacy equality test protocol, there are T participants P k , k ∈ [T], where the participant P1 inputs T - 1 vectors containing m elements The remaining T - 1 participants P k input a single vector containing m elements The T participants P k , k ∈ [T] run the joint privacy equality test protocol, so that P1 obtains the feature bit vector b = [b i i∈[m] , where for all i ∈ [m], if then b i = 1, otherwise b i = 0.

[0029] As an alternative implementation, the process of constructing the joint privacy equality test protocol based on the threshold additive homomorphic encryption technology includes: each party P k , k ∈ [T] runs TKeyGen(1 λ , T, t) → (pk, [sk i i∈[T] ), and each participant P k , k ∈ [T] respectively obtains the public key pk and the decryption private key sk k ; each P k , k ∈ [2, T] encrypts its input vector to obtain the corresponding ciphertext: and sends all the ciphertexts to the participant P1;

[0030] The participant P1 performs ciphertext calculation and after ciphertext re-randomization, sends the new ciphertext i ∈ [m] to the participant P2;

[0031] From k = 2 to k = T, the participant P k , k ∈ [2, T] selects m random values and performs ciphertext calculation and after ciphertext re-randomization, sends the new ciphertext to P k+1 ; P T sends to P1 and all P k ​​, where \(k\in[2,T - 1]\);

[0032] Each \(P\) k , where \(k\in[2,T]\), uses the decryption algorithm in the threshold encryption scheme to obtain the plaintext sharing share and sends the plaintext sharing to \(P1\);

[0033] The participating party \(P1\) decrypts to obtain the plaintext share and uses the combination algorithm in the threshold encryption scheme to combine all the plaintext sharings into the plaintext to obtain For \(i = 1\) to \(i = m\), if \(p\) i \(= 0\), then set \(b\) i \(= 1\), otherwise set \(b\) i \(= 0\). The participating party \(P1\) outputs the feature bit vector \(b=[b\) i i∈[m] .

[0034] As an alternative implementation, after the central participating party obtains the corresponding feature bits, according to the fact that the feature bit being 1 indicates that the corresponding element is an intersection element, and the feature bit being 0 indicates that the corresponding element is a non - intersection element, the central participating party outputs the intersection elements at the positions where the feature bits are 1, and outputs the intersection of the final multi - party sets.

[0035] A multi - party private set intersection system in a non - balanced scenario, including multiple participating parties, including:

[0036] A central participating party, which is the input party with the smallest set. Using its set as an anchor point, it embeds elements into a hash table using a hash function, determines whether the size gap between its own input set and the input sets of other participating parties it interacts with is greater than a set threshold. If not, it runs the batch membership conditional random number generation protocol in the balanced scenario constructed based on the batch oblivious pseudorandom function and the oblivious key - value pair storage protocol; if so, it runs the batch membership conditional random number generation protocol in the non - balanced scenario constructed based on the batch oblivious pseudorandom function and the fully homomorphic encryption technology, converts the membership relationship of elements into eigenvalue equivalence relationships, and jointly runs the joint private equivalence test protocol with each other parameter party to obtain the corresponding feature bits;

[0037] Other participating parties, respectively run the corresponding batch membership conditional random number generation protocol, convert the membership relationship of elements into eigenvalue equivalence relationships, and jointly run the joint private equivalence test protocol with the central participating party, so that the central participating party obtains the corresponding feature bits to achieve the intersection operation.

[0038] A computer - readable storage medium for storing computer instructions, when the computer instructions are executed by a processor, the steps in the above - mentioned method are completed.

[0039] ​An electronic device includes a memory, a processor, and computer instructions stored on the memory and running on the processor. When the computer instructions are run by the processor, the steps in the above method are completed.

[0040] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0041] The present invention proposes new cryptographic components: batch membership conditional random number generation and joint private equality testing protocol, gives a formal definition of its ideal function, and gives efficient instantiation constructions under balanced input conditions and unbalanced input conditions respectively. An efficient MPSI protocol is constructed based on the batch membership conditional random number generation and joint private equality testing protocol, and then multi-party private intersection operation is realized. The communication complexity of the present invention breaks through the linear bound of the large set size, is sub-linearly related to the large set and linearly related to the small set, and can resist any collusion attack.

[0042] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following specific preferred embodiments are given, and in conjunction with the accompanying drawings, the detailed description is as follows. Description of the Drawings

[0043] The specification drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention.

[0044] Figure 1 It is a schematic diagram of the multi-party private set operation process in an embodiment;

[0045] Figure 2 It is a schematic diagram of the multi-party private set operation process in the case of three participants in an embodiment; Figure 3 It is a comparison table of communication volume and running time in different network environments in an embodiment. Detailed Embodiments

[0046] The present invention will be further described below in conjunction with the drawings and embodiments.

[0047] It should be noted that the following detailed description is illustrative and is intended to provide a further description of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0048] Note that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly dictates otherwise, the singular forms are also intended to include the plural forms. In addition, it should be understood that when the terms "comprises" and / or "comprising" are used in this specification, they specify the presence of the stated features, steps, operations, devices, components, and / or combinations thereof.

[0049] In the case of no conflict, the embodiments in the present application and the features in the embodiments may be combined with each other.

[0050] Embodiment 1

[0051] For convenience, the meanings of the symbols are defined as follows: for any positive integers n and m, the symbol [n] = {1, …, n}, [m, n] = {m, m + 1, …, n}; in this embodiment, P k represents the k-th participant, and the input set is π represents a random permutation; bold lowercase letters represent vectors, such as y, and bold uppercase letters represent matrices, such as Y, where Y i represents the i-th column of Y. The symbol represents the encrypted inner product operation of vectors and ciphertext vectors; the symbol represents the homomorphic addition operation of ciphertexts; represents the scalar multiplication operation of ciphertexts. The symbol [z] represents the ciphertext of encrypted z; represents calculating the ciphertext of the B i th power of z. The symbol ‖ represents concatenating two strings into one string. In this embodiment, is used to represent Cuckoo Hashing. Specifically, this expression means using hash functions h1, h2, h3: {0, 1} * → [m c to Cuckoo hash the set X = {x i} i∈[m] into m c buckets, and the Cuckoo hash table is represented as X c = (X c [1], …, X c [m c ), where for each x ∈ X, there exists some i ∈ {1, 2, 3} such that X c [h i (x)] = x‖i. In this embodiment, is used to represent Simple Hashing. Specifically, this expression means using hash functions h1, h2, h3: {0, 1} * → [m c to hash the set Y = {yi} i∈[n] Use naive hashing into m c buckets. The naive hash table is represented as where each bin contains at most B i elements. For each y ∈ Y, insert all y‖i, i ∈ {1, 2, 3} into .

[0052] Before constructing the MPSI protocol, this embodiment first introduces the ideal functions of the relevant cryptographic components required, including the batch oblivious pseudorandom function (bOPRF), the oblivious key-value store (OKVS), and the threshold additive homomorphic encryption scheme (TAHE).

[0053] Ideal function of the batch oblivious pseudorandom function (bOPRF). Party P1 inputs the set X = {x i} i∈[m] and Party P2 runs the bOPRF protocol, so that P2 obtains the PRF keys {k1,..., k m}, and P1 obtains the corresponding PRF values {F(k1, x1),..., F(k m , x m ). The specific ideal function is described as follows:

[0054] 1. Receive the input {x1,..., x m} from P1.

[0055] 2. Select random PRF keys {k1,..., k m}, and calculate the corresponding PRF values

[0056] {F(k1, x1),..., F(k m , x m );

[0057] 3. Send the PRF keys {k1,..., k m} to P2, and send the PRF values {F(k1, x1),..., F(k m , x m )} to P1.

[0058] The oblivious key-value store (OKVS) is a data structure that can compactly represent the mapping of a set of keys to corresponding values. It is defined as follows:

[0059] OKVS contains a set of keys K = {k1,..., k n} and the corresponding set of values V = {v1,..., v n}, and has two algorithms:

[0060] Encode({(k1,v1),…,(k n ,v n )}) → D: Input key-value pairs Output an encoded D (or, with negligible probability in the statistical sense, output an error ⊥).

[0061] Decode(D, k) → v: Input the encoded D and a key k, output the value v ∈ V.

[0062] Correctness: For all sets of distinct keys If (k, v) ∈ A and Encode(A) → D ≠ ⊥, then Decode(D, k) → v.

[0063] Obliviousness: For all distinct and If Encode for and does not output ⊥, then the distribution {D | v i ← V, i ∈ [n], is computationally indistinguishable from another distribution .

[0064] The threshold additive homomorphic encryption scheme (TAHE) includes both threshold decryption functionality and additive homomorphic operation functionality, and mainly includes 5 probabilistic polynomial-time algorithms (TKeyGen, TEnc, TDec, Combine, AddEval). The specific algorithm functionality is described as follows:

[0065] TKeyGen(1 λ , T, t) → (pk, [sk i i∈[T] ): The threshold key generation algorithm inputs the security parameter, the number of users T, and the threshold parameter t, and outputs the public key pk of the threshold additive homomorphic encryption and the decryption private key sk of each user i .

[0066] TEnc(pk, m) → c: The encryption algorithm inputs the public key and the message m, and outputs the ciphertext c.

[0067] TDec(sk i , c) → m i : The decryption algorithm inputs the decryption private key of the user and the ciphertext c, and outputs the decryption share m of this user i .

[0068] The combination algorithm inputs any t decryption shares and outputs the decryption result m.

[0069] Addeval(pk, c1, c2) → c * ​: The additive homomorphic algorithm takes as input the public key pk, two ciphertexts c1←TEnc(pk,m1) and c2←TEnc(pk,m2), and outputs a new ciphertext c * = TEnc(pk,m1+m2).

[0070] First, the batched membership conditional randomness generation protocol is introduced below

[0071] The batched membership conditional randomness generation protocol (bMCRG) involves two parties, P1 and P2. P1 inputs a set containing m elements P2 inputs m mutually exclusive sets {Y i 2} i∈[m] , such that P1 obtains the vector u = [u i i∈[m] and P2 obtains the vector v = [v i i∈[m] , where for all i ∈ [m], if then u i = v i , otherwise u i ≠ v i .

[0072] The ideal functionality of the batched membership conditional randomness generation protocol is defined as follows in this embodiment:

[0073] 1. Receive the input from party P1

[0074] 2. Receive the m mutually exclusive sets {Y i 2} i∈[m] input by party P2, where each Y i 2 represents a set.

[0075] 3. Generate two random vectors u = [u i i∈[m] and v = [v i i∈[m] , where for all i ∈ [m], if then u i = v i , otherwise u i ≠ v i .

[0076] 4. Output u = [u i i∈[m] to P1. Output v = [v i ​​​​​​i∈[m] Give to P2.

[0077] Construction of the batch membership conditional random number generation protocol: For multiple parties P k , k ∈ [T], due to the differences in the set sizes between any two of them, it can be divided into two cases: 1) Balanced case: The set sizes input by the two parties are not very different; 2) Unbalanced case: The set sizes input by the two parties are very different.

[0078] For different cases, this embodiment gives different constructions:

[0079] (1) Construct an efficient batch membership conditional random number generation (bMCRG) protocol in the balanced scenario based on the batch oblivious pseudorandom function (bOPRF) and the oblivious key-value store protocol (OKVS) as follows:

[0080] Input: P1 inputs a set P2 inputs m mutually exclusive sets {Y i 2} i∈[m] .

[0081] Output: P1 outputs a vector s = [s i i∈[m] . P2 outputs a vector t = [t i i∈[m] .

[0082] The protocol construction is as follows:

[0083] 1. P1 and P2 call the bOPRF function:

[0084] (a) P1 inputs the set

[0085] (b) P1 obtains all PRF values where i ∈ [m]; P2 obtains the PRF keys {k1,..., k m}.

[0086] 2. For all i ∈ [m], P2 calculates the PRF value f(k i , Y i 2 [j]), where Y i 2 [j] represents the j-th element in the set Y i 2 .

[0087] 3. P2 encodes an OKVS:

[0088] (a) P2 selects m random values [t i i∈[m], Compute the set where \(i\in[m]\), \(j\in[|Y i 2 |]\);

[0089] (b) P2 computes the OKVS: \(D = Encode(A)\) and sends \(D\) to P1.

[0090] 4. P1 decodes to obtain where \(i\in[m]\).

[0091] 5. P1 outputs the vector \(s=[s i i∈[m] ; P2 outputs the vector \(t=[t i i∈[m] .

[0092] (2) Construct an efficient batch membership conditional random number generation protocol (bMCRG) in the unbalanced scenario based on the batch oblivious pseudorandom function (bOPRF) and the fully homomorphic encryption technology (FHE) as follows:

[0093] Input: P1 inputs a set P2 inputs \(m\) mutually exclusive sets \(\{Y i 2 \}\) i∈[m] .

[0094] Output: P1 outputs a vector \(s=[s i i∈[m] . P2 outputs a vector \(t=[t i i∈[m] .

[0095] The protocol is constructed as follows:

[0096] 1. P1 and P2 call the bOPRF function:

[0097] (a) P1 inputs the set

[0098] (b) P1 obtains all the PRF values for \(i\in[m]\); P2 obtains the PRF keys \(\{k_1,\ldots,k m \}\).

[0099] 2. For each \(i\in[m]\), P2 computes the PRF value where \(Y i 2 [j]\) represents the \(j\)-th element in the set \(Y i 2 , and the number of elements in the set \(B i = |Y i 2 |. ​​​​

[0100] 3. P2 selects a random vector \(t = [t i i∈[m] . For each \(i\in[m]\), P2 constructs a polynomial \(F i (x)=f i (x)+t i , where holds for all \(j\in[B i . Thus, P2 obtains the coefficient matrix \(A\), where the \(i\)-th column is the coefficient of the polynomial \(F i .

[0101] 4. P1 encrypts using its FHE public key and sends the ciphertext for \(i\in[m]\) to P2.

[0102] 5. For each ciphertext for \(i\in[m]\), P2 homomorphically computes the ciphertexts of all its powers Then, P2 homomorphically computes and sends all the resulting ciphertexts to P1.

[0103] 6. P1 decrypts the ciphertexts and obtains \(s = [s i i∈[m] .

[0104] 7. P1 outputs \(s = [s i i∈[m] , and P2 outputs \(t = [t i i∈[m] .

[0105] Next, the joint private equality test protocol is introduced:

[0106] The Joint Private EQuality Test (JPEQT) protocol consists of \(T\) parties \(P k , k\in[T]\), where party P1 inputs \(T - 1\) vectors of \(m\) elements The remaining \(T - 1\) parties \(P k input a single vector of \(m\) elements The \(T\) parties \(P k , k\in[T]\) run the joint private equality test protocol, such that P1 obtains the feature bit vector \(b = [b i i∈[m] , where for all \(i\in[m]\), if then \(b i = 1\), otherwise \(b i = 0\).

[0107] The specific ideal functionality description is as follows:

[0108] ​​​​​1. Receive T - 1 vectors with m elements from participant P1 k ∈ [2, T].

[0109] 2. Receive a single vector with m elements from the remaining T - 1 participants P k , k ∈ [2, T]

[0110] 3. Generate the bit vector b = [b i i∈[m] , where for all i ∈ [m], if then b i = 1, otherwise b i = 0.

[0111] Based on the threshold additive homomorphic encryption technology TAHE, an efficient and general construction of the joint privacy equal - value test protocol JPEQT is given as follows:

[0112] Input: P1 inputs T - 1 vectors The remaining T - 1 participants P k , k ∈ [2, T] input a vector

[0113] Output: P1 outputs the feature bit vector b = [b i i∈[m] .

[0114] The protocol construction is as follows:

[0115] 1. Each party P k , k ∈ [T] runs TKeyGen(1 λ , T, t) → (pk, [sk i i∈[T] ). Each P k , k ∈ [T] obtains sk k respectively.

[0116] 2. Each P k , k ∈ [2, T] encrypts its input vector : And sends all the ciphertexts to P1.

[0117] 3. P1 calculates and sends i ∈ [m] to P2.

[0118] 4. From k = 2 to k = T, P k , k ∈ [2, T] selects m random values and calculates Sends to P k+1 . P​​​T Send to P1 and all P k , k ∈ [2, T - 1].

[0119] 5. Each P k , k ∈ [2, T] decrypts to obtain the plaintext share and sends the plaintext share to P1.

[0120] 6. P1 decrypts to obtain the plaintext share and combines all the plaintexts to obtain For i = 1 to i = m, if p i = 0, then set b i = 1, otherwise set k i = 0. P1 outputs the feature bit vector b = [b i i∈[m] .

[0121] The decryption operation in Step 6 does not directly decrypt the final plaintext. It only needs to verify whether the decryption result is equal to 0. In this way, this embodiment can use an efficient threshold exponential ElGamal encryption scheme, which can avoid the complex operation of decrypting non - zero values. This threshold exponential ElGamal encryption scheme can resist any collusion attack. Therefore, the JPEQT constructed by the present invention also satisfies the security of resisting any collusion attack.

[0122] Construct a multi - party private set intersection protocol based on the cuckoo / naive hash function, combined with the batch membership relation random number generation protocol (bMCRG) and the joint private equality test protocol (JPEQT). The specific protocol construction is as Figure 1 shown.

[0123] A multi - party private set intersection method in a non - balanced scenario includes the following steps:

[0124] Select the input party with the smallest set as the central participating party P1, and use its set as the anchor point, and embed it into the cuckoo hash table using the cuckoo hash. According to the function of the cuckoo hash, at most one element is embedded in each bin. Subsequently, the remaining participating parties P , k ∈ [2, T] use the same hash function and the naive hash technology to embed the set k , k ∈ [2, T] into the naive hash table. Each bin contains multiple elements. According to the function of the hash function, the same elements are hashed into the same bin. Then P1 and each P , k ∈ [2, T] respectively run the bMCRG function to convert the membership relation of the elements into the eigenvalue equality relation, that is, as k , k ∈ [2, T] respectively run the bMCRG function to convert the membership relation of the elements into the eigenvalue equality relation, that is, as​Figure 1 As shown, the same color represents the same value, and white represents different values, because So So So Subsequently, P1 and each P k , k∈[2, T] jointly run JPEQT, so that P1 obtains the eigenvalue at the corresponding position, that is, because So b1 = 1, b i = 0, That is, the elements at the 1st and m1th positions in the cuckoo hash table belong to the intersection elements.

[0125] Input: P1 inputs a set The remaining T - 1 participating parties P k , k∈[2, T] respectively input sets

[0126] Output: The recipient P1 outputs the intersection

[0127] Specifically:

[0128] 1. P1 and each P k , k∈[2, T] jointly perform cuckoo / naive hashing operations:

[0129] (a) P1 inserts the set into the cuckoo hash table and fills the empty buckets with dummy elements ⊥, where the cuckoo hash table contains m c buckets, and each bucket contains only one element. For each there exists a hash function number γ∈{1, 2, 3} such that

[0130] (b) Each P k , k∈[2, T] uses the same hash function to insert Y k into the naive hash table. Each element is concatenated with the hash function index and inserted into the corresponding bucket respectively. The hash table has m c buckets

[0131] 2. P1 and each P k , k∈[2, T] respectively run the bMCRG function (according to P1 and P k, the difference in the set sizes of k∈[2,T] can be chosen to be balanced or unbalanced for efficient construction):

[0132] (a) P1 input P k , k∈[2,T] input

[0133] (b) P1 obtains a vector k∈[2,T], P k , k∈[2,T] obtains a vector k∈[2,T].

[0134] 3. P1 and each P k , k∈[2,T] jointly run the function JPEQT:

[0135] (a) P1 inputs a vector k∈[2,T, P k , k∈[2,Y] inputs a vector k∈[2,Y].

[0136] (b) P1 obtains the feature bit vector b = [b i i∈[m] .

[0137] 4. P1 outputs the intersection where for all i * ∈[m c satisfies

[0138] Correctness analysis: P1 and each P k , k∈[2,T] jointly execute the cuckoo / naive hashing operation to complete data alignment, that is, the same elements are embedded into the same bin. Subsequently, according to the difference in the set sizes of P1 and P k , k∈[2,Y], an efficient bMCRG function can be chosen to be balanced or unbalanced, and the membership relationship of the elements is transformed into an equivalent relationship of feature values, that is, after bMCRG is executed on P1 and P k , k∈[2,T] respectively, for each element in the cuckoo hash table if it belongs to the intersection elements of both, the same random feature value is output, otherwise different random feature values are output.

[0139] Subsequently, O1 and O k , k∈[2,T] uniformly run JPEQT to verify P1 and P k ​For the equal-value relationships between the eigenvalues of [[ID=]], k ∈ [2, T], when two eigenvalues are equal, P1 obtains b = 1; otherwise, P1 obtains b = 0. Finally, P1 outputs the elements in the cuckoo hash table corresponding to the positions where b = 1 as the intersection elements.

[0140] This embodiment gives three participating parties. The execution process of the MPSI protocol in the special case where P1 inputs a single element is as Figure 2 shown. Among them, P2 and P1 run an unbalanced bMCRG for the large set; P3 and P1 run a balanced bMCRG for the small set. Since P1 inputs a single element (which inherently contains an alignment operation), there is no need for cuckoo / naive hash operations for data alignment.

[0141] This embodiment compares the proposed method with the state-of-the-art works O-Ring and K-Star methods in terms of communication and running time under different network environments.

[0142] Experimental platform: Core i7-13700 CPU@5.20GHz, 128GB of memory. Local area network (LAN) settings: Two parties have a throughput of 10Gbps and a round-trip time (RTT) of 0.2ms. Three wide area network (WAN) settings, with bandwidths of 100Mbps, 10Mbps, and 1Mbps respectively, and the RTT for each setting is 80ms. The computational security parameter is set to 128 bits and the statistical security parameter is set to 40 bits.

[0143] As Figure 3 shown, where (N, M) represent the number of participating parties in the large set and the small set respectively. (|Y|, |X|) represent the size of the large set and the size of the small set respectively. The best results of our protocol in each case are marked in light red, and the best results of the comparative works are marked in blue. — indicates that the protocol cannot be executed in this case.

[0144] From Figure 3It can be seen that regardless of the number of participants, the method provided in this embodiment always exhibits significantly lower communication overhead than O-Ring and K-Star (Mingli Wu, Tsz Hon Yuen, and Kwan Yin Chan. O-ring and k-star: Efficient multi-party private set intersection. In 33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024. USENIX Association, 2024.), reducing the communication cost by 1.37 to 607.7 times. In particular, for the set size of (2 22 ,2 10 ) and the number of participants in the scenario of (1,5), the method provided in this embodiment only requires 3.816MB of communication volume, which is about 607 times lower than the communication overhead of 2318.981MB in the prior art. The communication complexity of the prior art is linearly related to the large set size, while the communication complexity of the method provided in this embodiment is logarithmically related to the large set size and linearly related to the small set size. Therefore, the greater the difference in set size or the more participants holding small sets, the more significant the advantage of the method provided in this embodiment.

[0145] As Figure 3 shown, in a low-bandwidth environment, the method provided in this embodiment is superior to the prior art in terms of running time. When there are more participants holding small sets (such as the scenarios of the number of participants of (5,10) and (10,10)), the method provided in this embodiment performs better. For the large set size from 2 14 to 2 16 , depending on the network environment, the running time of the method provided in this embodiment is 3.5 to 15.5 times faster than that of the prior art. For the large set size of 2 18 , regardless of the number of participants, the running time advantage of our protocol reaches 2.5 to 64.1 times. Specifically, at a 1Mbps bandwidth, for the scenario of the set size of (2 20 ,2 10 ) and the number of participants of (1,5), the method provided in this embodiment only requires 83.323 seconds, which is about 64 times faster than 5343.444 seconds of the prior art.

[0146] Generally speaking, in scenarios where communication and computing resources are limited, especially when the difference in set size is large and many participants hold small sets, the method provided in this embodiment has significant advantages.

[0147] Embodiment 2

[0148] A multi-party private set intersection system in an unbalanced scenario, including multiple participating parties, including:

[0149] The central participating party, which is the input party with the smallest set. Using its set as an anchor, it embeds elements into a hash table using a hash function, and determines whether the size gap between its own input set and the input sets of other participating parties it interacts with is greater than a set threshold. If not, it runs a batch member conditional random number generation protocol in a balanced scenario constructed based on a batch oblivious pseudorandom function and an oblivious key-value pair storage protocol; if so, it runs a batch member conditional random number generation protocol in an unbalanced scenario constructed based on a batch oblivious pseudorandom function and fully homomorphic encryption technology, converts the membership relationship of elements into eigenvalue equivalence relationships, and jointly runs a joint private equivalence test protocol with each other parameter party to obtain corresponding characteristic bits, and outputs intersection elements according to the special bits;

[0150] Other participating parties, which respectively run corresponding batch member conditional random number generation protocols, convert the membership relationship of elements into eigenvalue equivalence relationships, and jointly run a joint private equivalence test protocol with the central participating party, so that the central participating party obtains corresponding characteristic bits, and completes the multi-party private set intersection operation.

[0151] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0152] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of processes and / or blocks in the flowchart and / or block diagram can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in one Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0153] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction means that implements the function specified in one or more of the processes and / or blocks Figure 1 in the process Figure 1 or processes and / or blocks

[0154] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the function specified in one or more of the processes Figure 1 or processes and / or blocks Figure 1 or blocks.

[0155] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art without creative efforts within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for multi-party private set intersection in a non-equilibrium scenario, characterized in that It includes the following steps: According to the input set sizes of each participating party, select the participating party with the smallest set size as the central participating party, and determine whether the difference in the input set sizes between the central participating party and other participating parties is greater than a set threshold. If not, construct a batch member conditional random number generation protocol in a balanced scenario based on the batch oblivious pseudorandom function and the oblivious key-value pair storage protocol; If so, construct a batch member conditional random number generation protocol in an unbalanced scenario based on the batch oblivious pseudorandom function and the fully homomorphic encryption technology; Using the set of the central participating party as an anchor point, use the cuckoo hash technology to embed elements into the cuckoo hash table, and each participating party uses the naive hash technology to embed elements into the naive hash table, and respectively run the corresponding batch member conditional random number generation protocol to convert the membership relationship of the elements into eigenvalue equivalence relationships. The central participating party runs the joint privacy equivalence test protocol with each other participating party respectively, so that the central participating party obtains the corresponding characteristic bits to achieve the multi-party intersection operation.

2. The method for multi-party private set intersection in an unbalanced scenario according to claim 1, characterized in that, The process of constructing a batch member conditional random number generation protocol in a balanced scenario based on a batch oblivious pseudorandom function and an oblivious key-value pair storage protocol includes: Party P1 inputs a set Party P2 inputs m mutually exclusive sets {Y i 2} i∈[m] ; Two parties call a batch oblivious pseudorandom function, and party P1 obtains all PRF values where i ∈ [m]; party P2 obtains the PRF keys {k1,..., k m}; For all \(i\in[m]\), the participant \(P_2\) computes the PRF value \(F(k i ,Y i 2 [j])\), where \(Y i 2 [j]\) represents the \(j\)-th element in the set \(Y i 2 \); Participant P2 selects m random values [t i i∈[m] , and calculates the set where i ∈ [m], j ∈ [|Y i 2 |];​ Participating party P2 calculates the oblivious key-value pair storage protocol: D = Encode(A), and sends D to participating party P1; Participant P1 decodes to obtain where \(i\in[m]\); Participant P1 outputs vector \(s = [s i i∈[m] ; Participant P2 outputs vector \(t = [t i i∈[m] .​​ 3. The multi-party private set intersection method in an unbalanced scenario according to claim 1, characterized in that, The process of constructing an efficient batch member conditional random number generation protocol in an unbalanced scenario based on batch oblivious pseudorandom functions and fully homomorphic encryption technology includes: The participating parties P1 and P2 call the batch oblivious pseudorandom function, and the participating party P1 obtains all PRF values P2 obtains the PRF keys {k1,…,k m}; For each \(i\in[m]\), P2 computes the PRF value where \(Y\) i 2 [j] represents the \(j\)-th element in the set \(Y\) i 2 and the number of elements in the set \(B\) i \(=|Y\) i 2 |\); Party P2 selects a random vector t = [t i i∈[m] , for each i ∈ [m], Party P2 constructs a polynomial F i (x) = f i (x) + t i , where holds for all j ∈ [B i , Party P2 obtains the coefficient matrix A, where the i-th column is the coefficient of the polynomial F i ;​ Participant P1 encrypts using the fully homomorphic encryption public key and sends the ciphertext to P2; For each ciphertext Party P2 homomorphically computes the ciphertexts of all its powers Then, P2 homomorphically computes and sends all the resulting ciphertexts to P1; Party P1 decrypts the ciphertext to obtain s = [s i i∈[m] ;​ Participant P1 outputs s = [s i i∈[m] , and Participant P2 outputs t = [t i i∈[m] .​​ 4. The multi-party private set intersection method in an unbalanced scenario according to claim 1, characterized in that The process of the central participant and each other parameter party jointly running the joint privacy equivalence test protocol includes: the central participant P1 and each P k , k∈[2,T] jointly run the joint privacy equivalence test protocol, so that P1 obtains the characteristic bits at the corresponding positions.

5. The multi-party private set intersection method in an unbalanced scenario according to claim 1, wherein In the process of running the joint private equality testing protocol, there are T participating parties P k , k ∈ [T], where the participating party P1 inputs T - 1 vectors containing m elements The remaining T - 1 participating parties P k input a single vector containing m elements The T participating parties P k , k ∈ [T] run the joint private equality testing protocol, so that P1 obtains the bit vector b = [b i i∈[m] , where for all i ∈ [m], if then b i = 1, otherwise b i = 0.​ 6. The method for multi-party private set intersection in an unbalanced scenario according to claim 1, characterized in that The process of constructing a joint private equality test based on threshold additive homomorphic encryption technology includes: Each party P k ,k∈[T] runs TKeyGen(1 λ ,T,t)→(pk,[sk i i∈[T] ), and each participating party P k ,k∈[T] obtains sk k respectively; For each P k ,k∈[2,T], encrypt its input vector : and send all the ciphertexts to the participating party P1;​ Participant P1 calculates and sends it to Participant P2; From k = 2 to k = T, participant P k , k ∈ [2, T] selects m random values and calculates Sends to P k+1 ; P T Sends to P1 and all P k , k ∈ [2, T - 1]; Each \(P\) k , \(k\in[2,T]\) decrypts to obtain the plaintext share and sends the plaintext share to \(P_1\); The participant P1 decrypts to obtain the plaintext share and combines all the plaintexts to obtain For i = 1 to i = m, if p i = 0, then set b i = 1, otherwise set b i = 0. The participant P1 outputs the feature bit vector b = [b i i∈[m] .​ 7. The method for multi-party private set intersection in an unbalanced scenario according to claim 1, characterized in that, In the process of enabling the central participating party to obtain the corresponding characteristic bits, a characteristic bit of 1 indicates that the corresponding element is an intersection element, and a characteristic bit of 0 indicates that the corresponding element is a non-intersection element.

8. A multi-party private set intersection system in an unbalanced scenario, including multiple participating parties, characterized in that, It includes: The central participating party, which is the input party with the smallest set, uses its set as an anchor point, uses a hash function to embed elements into the hash table, and determines whether the difference in the input set sizes between itself and other participating parties with which it interacts is greater than a set threshold. If not, run the batch member conditional random number generation protocol in a balanced scenario constructed based on the batch oblivious pseudorandom function and the oblivious key-value pair storage protocol; if so, run the batch member conditional random number generation protocol in an unbalanced scenario constructed based on the batch oblivious pseudorandom function and the fully homomorphic encryption technology, convert the membership relationship of the elements into eigenvalue equivalence relationships, and run the joint privacy equivalence test protocol with each other participating party respectively to obtain the corresponding characteristic vectors; Other participating parties, respectively run the corresponding batch member conditional random number generation protocol, convert the membership relationship of the elements into eigenvalue equivalence relationships, and run the joint privacy equivalence test protocol with the central participating party, so that the central participating party obtains the corresponding characteristic bits to complete the multi-party private set intersection operation.

9. A computer-readable storage medium, characterized in that, For storing computer instructions, when the computer instructions are executed by a processor, the steps in the method described in any one of claims 1-7 are completed.

10. An electronic device, characterized in that, It includes a memory, a processor, and computer instructions stored on the memory and running on the processor. When the computer instructions are run by the processor, the steps in the method described in any one of claims 1-7 are completed.

Images