A method for finding the cardinality and summation of the intersection of private sets that supports public validation of inputs.

Abstract

This application relates to a method and system for calculating the cardinality and summation of the intersection of private sets, supporting publicly verifiable inputs. After a user completes a transaction, a first ciphertext is generated based on the user ID and transaction amount, and sent to a public notice board. An advertiser generates a second ciphertext based on the user ID and sends it to both the publisher and the public notice board. The publisher receives the first and second ciphertexts from the public notice board and performs a consistency test on the first and second ciphertexts based on a transaction certificate, completing the first verification of the public input. The advertiser and publisher then perform a second verification of the public input and calculate the PSI cardinality sum based on an optimized fast PSI cardinality sum algorithm, outputting the cardinality sum of their respective private intersections. This application aims to securely calculate the intersection using publicly verifiable inputs instead of inputs that are assumed to be completely reliable.

Description

Technical Field

[0001] This application relates to the field of data encryption, and in particular to a method and system for calculating the cardinality and summation of the intersection of private sets that supports public verification of inputs. Background Technology

[0002] Online advertising has significantly boosted e-commerce, allowing advertisers to attract potential customers, increase brand awareness, and drive sales. Cost-per-sale (CPS) is a widely used e-commerce advertising pricing model where advertisers can choose multiple publishers (such as Google and Meta) to run ads promoting their products. These publishers display relevant ads to target users on their designated websites or applications. A sale is considered successful when a target user clicks on the ad and purchases the corresponding product or service. The advertiser then pays the publisher a pre-agreed fixed commission or percentage for each successful sale. Calculating CPS advertising fees requires aggregating sales data from advertisers and ad click data from publishers. This data aggregation process carries the risk of privacy breaches, and advertisers, for the purpose of protecting trade secrets and consumer privacy, are reluctant to disclose sales data.

[0003] Currently, a common solution to address the aforementioned privacy issues is to use PSI (Property Selection Index) to privately calculate the intersection of advertiser and publisher datasets. However, during the calculation process, any malicious party can forge input data to manipulate the intersection calculation results. Existing PSI solutions for these privacy scenarios assume that the data input from all parties during the privacy-preserving intersection calculation is authentic and complete. However, this assumption does not fit the actual situation. If any malicious participant forges input during the calculation, such as advertisers inputting false sales data or publishers inputting false click data, the intersection calculation results will be manipulated to some extent. While considering the privacy of the calculation process, ensuring the authenticity and integrity of the input data is crucial for CPS (Cost Per Sale) applications. Summary of the Invention

[0004] In view of this, embodiments of this application propose a private set intersection cardinality and summation method that supports publicly verifiable inputs, aiming to securely compute intersections using publicly verifiable inputs instead of inputs that are assumed to be completely trustworthy.

[0005] To achieve the above objectives, embodiments of this application provide a method for calculating the cardinality and summation of the intersection of private sets that supports public verification of inputs. The method includes: after a user completes a purchase, generating a first ciphertext based on the user ID and the purchase amount, and sending the first ciphertext to a public notice board; the advertiser generating a second ciphertext based on the user ID, and sending the second ciphertext to the publisher and the public notice board, wherein the second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs; the publisher receiving the first and second ciphertexts from the public notice board, and performing a consistency test on the first and second ciphertexts based on a transaction certificate to complete the first verification of the public input, wherein the transaction certificate is determined based on touchpoint data generated by the user clicking on the corresponding advertisement; the advertiser and publisher completing the second verification of the public input and calculating the PSI cardinality sum based on an optimized fast PSI cardinality sum algorithm, and outputting the cardinality sum of their respective private intersections, wherein the cardinality sum of the private intersections is used to characterize the number of users who viewed and made purchases in the CPS advertising model and the total purchase amount.

[0006] Optionally, after the user completes the consumption, a first encrypted message is generated based on the user ID and the consumption amount, and the first encrypted message is sent to the public notice board. This includes: the user encrypts the user ID using a preset scheme to obtain an encrypted identity code, encrypts the actual consumption amount using the ElGamal algorithm to obtain an encrypted amount, sends the encrypted identity code to the public notice board and the advertiser, and sends the encrypted amount to the public notice board.

[0007] Optionally, the advertiser generates a second ciphertext based on the user ID and sends the second ciphertext to the publisher and the public notice board, including: the advertiser obtains an encrypted identity code from the public notice board; the advertiser generates encrypted result A and encrypted result B based on the user ID and encrypted identity code, and sends encrypted result A and encrypted result B to the publisher and the public notice board, and sends two correspondingly constructed first zero-knowledge proofs.

[0008] Optionally, after performing the consistency test of the first ciphertext and the second ciphertext based on the transaction certificate, the method further includes: if the two first zero-knowledge proofs are consistent, the publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and a corresponding second zero-knowledge proof, and sends the first encrypted identifier and the corresponding second zero-knowledge proof to the advertiser; if the two first zero-knowledge proofs are inconsistent, the two first zero-knowledge proofs are deleted.

[0009] Optionally, the advertiser and publisher complete the second verification of the common input and the calculation of the PSI cardinality sum based on the optimized fast PSI cardinality sum algorithm, including: the advertiser verifies the validity of the second zero-knowledge proof and encrypts the first encrypted identifier to obtain the second encrypted identifier and the corresponding third zero-knowledge proof; obtains the third encrypted identifier and the corresponding fourth zero-knowledge proof based on the first randomized shuffled ciphertext, and decrypts the third encrypted identifier to obtain the first decrypted identifier and the corresponding fifth zero-knowledge proof; sends the first to second encrypted identifiers, the first decrypted identifier, and the third to fifth zero-knowledge proofs corresponding to each identifier to the publisher; the publisher verifies the third to fifth zero-knowledge proofs and performs a second encryption on the A encryption result to obtain the second encryption result and the corresponding sixth zero-knowledge proof; obtains the fourth encrypted identifier and the corresponding seventh zero-knowledge proof based on the second randomized shuffled ciphertext and sends it to the advertiser, and decrypts the fourth encrypted identifier to obtain the second decrypted identifier and the corresponding... The eighth zero-knowledge proof; and, based on the ciphertext obtained by the third randomization shuffling, the fifth encrypted identifier and the corresponding eighth zero-knowledge proof are obtained, and the second encryption result, the fourth to fifth encrypted identifiers, and the corresponding sixth to eighth zero-knowledge proofs are sent to the advertiser; the advertiser verifies the sixth to eighth zero-knowledge proofs, completes the second verification of the common input, and calculates the PSI cardinality of the first decryption identifier and the second decryption identifier, calculates the sum of the fifth encrypted identifiers through homomorphic addition, obtains the encrypted total consumption amount, decrypts the encrypted consumption amount, obtains the unencrypted total consumption amount, and sends the encrypted total consumption amount and the unencrypted total consumption amount to the publisher, as well as the ninth zero-knowledge proof; the publisher verifies the ninth zero-knowledge proof, calculates the intersection cardinality of the first decryption identifier and the second decryption identifier through the ciphertext re-randomization algorithm, calculates the sum of the fifth encrypted identifiers through homomorphic addition, and determines the PSI cardinality sum based on the intersection cardinality and the sum of the fifth encrypted identifiers.

[0010] Optionally, the method further includes: the advertiser generating a key pair (pk) for liftedElGamal encryption. A ,sk A ), and send pk to the public notice board. A ; and, set the public parameter w = (g0, g1, g2, h0, g) in the public notice board. a ,h a ,q,pk A ).

[0011] Optionally, the user encrypts their user ID using a preset scheme to obtain an encrypted identity code, encrypts the actual consumption amount using the ElGamal algorithm to obtain an encrypted amount, and sends the encrypted identity code to the public notice board and advertisers. Additionally, the encrypted amount is sent to the public notice board, including: each user's U iRandomly select r i ,s i ∈Z q ;calculate Obtain the encrypted identity code Send encrypted identity codes to advertisers Calculation based on ElGamal algorithm Get encrypted amount Send the encrypted identity code and encrypted amount to the public notice board.

[0012] Optionally, the advertiser generates encryption results A and B based on the user ID and encrypted identity code, and sends encryption results A and B to the publisher and public notice board. Additionally, it sends two corresponding first zero-knowledge proofs, including: the advertiser randomly selects a random key k. a ∈Z q ,calculate Among them, Z q Represent the key space; for i∈[1,n]: compute the encryption result A. And B encryption result Where n represents the number of user IDs; based on the encryption results of A and B, the following is adopted: Encryption algorithms, and Construct two first-degree zero-knowledge proofs; send encryption results A and B to a public bulletin board, and send the two first-degree zero-knowledge proofs.

[0013] Optionally, the publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and a corresponding second zero-knowledge proof, including: the publisher selecting a random key k. p ∈Z q For j∈[1,m], compute the first encryption identifier. And determine the second zero-knowledge proof based on the first cryptographic identifier. Where m represents the number of transaction certificates a user possesses.

[0014] To achieve the above objectives, embodiments of this application also provide a system for supporting a private set intersection cardinality summation method for publicly verified inputs, comprising: a user device, an advertiser device, and a publisher device; wherein, the user device generates a first ciphertext based on the user ID and the consumption amount after the user completes a consumption, and sends the first ciphertext to a public notice board; the advertiser device generates a second ciphertext based on the user ID, and sends the second ciphertext to the publisher and the public notice board, wherein the second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs; the publisher receives the first and second ciphertexts from the public notice board, and performs a consistency test on the first and second ciphertexts based on a transaction certificate to complete the first verification of the public input, wherein the transaction certificate is determined based on the touchpoint data generated by the user clicking on the corresponding advertisement; the advertiser device and the publisher device are also used to complete the second verification of the public input and the calculation of the PSI cardinality sum based on an optimized fast PSI cardinality sum algorithm, and output the cardinality sum of their respective private intersections, wherein the cardinality sum of the private intersections is used to characterize the number of users who watch advertisements and make consumption in the CPS advertising model and the total consumption amount.

[0015] The embodiments of this application propose a method and system for finding the cardinality and intersection of private sets that supports publicly verified inputs. After a user completes a transaction, a first ciphertext is generated based on the user ID and transaction amount, and sent to a public bulletin board. Advertisers generate a second ciphertext based on the user ID and send it to both the publisher and the public bulletin board. The second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs. This application introduces a public "bulletin board" to record the integrity tags and corresponding signatures of advertisers verified by users. Any tags that fail verification are immediately marked and reported on the same bulletin board, ensuring the authenticity of the input data from advertisers and publishers, preventing tampering attacks, and designing zero-knowledge proofs to verify input consistency without disclosing user privacy, thus eliminating reliance on trusted third parties. The system relies on the following steps: Publishers receive the first and second ciphertexts from the public bulletin board and perform a consistency test on the first and second ciphertexts based on the transaction certificate, completing the first verification of the public input. The transaction certificate is determined based on touchpoint data generated by users clicking on corresponding advertisements. Advertisers and publishers complete the second verification of the public input and calculate the PSI cardinality sum based on an optimized fast PSI cardinality sum algorithm, outputting the cardinality sum of their respective private intersections. The cardinality sum of the private intersections represents the number of users who view and consume advertisements in the CPS advertising model and the total consumption amount. Through the fast PSI cardinality sum algorithm, advertisers and publishers can quickly calculate the intersection of cardinality and the corresponding total sales amount, while protecting the privacy of inputs under malicious security models, thus achieving secure CPS advertising billing. Attached Figure Description

[0016] Figure 1This is a flowchart provided in one embodiment of the present application, which supports a method for calculating the cardinality of the intersection of private sets and the summation of publicly verified inputs. Figure 1 ;

[0017] Figure 2 This is a schematic diagram of a system model for a private set intersection cardinality and summation method that supports publicly verified inputs, provided in one embodiment of this application;

[0018] Figure 3 This is a flowchart of input verification for a private set intersection cardinality and summation method that supports public verification input, provided in one embodiment of this application;

[0019] Figure 4 This is a fast PSI cardinality and flowchart provided in one embodiment of the present application for a private set intersection cardinality and summation method that supports public verification input;

[0020] Figure 5 This is a comparison diagram of the execution results of the implementation of the private set intersection cardinality and summation method that supports public verification input provided by another embodiment of this application, and the solution of the prior art. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been presented in the various embodiments of this application to enable readers to better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0022] In cost-per-sale (CPS) advertising models, advertisers and publishers can capture consumers who view ads and successfully make purchases, along with the corresponding purchase amounts. To ensure privacy, both parties can use the widely used Private Set Intersection (PSI) protocol to privately compute the intersection of their data sets. However, existing technologies suffer from the following problems: 1. Lack of input data authenticity: Traditional PSI and PSI-sum protocols assume completely reliable input data, lacking verification mechanisms for data sources and integrity. This allows malicious actors to manipulate billing results by tampering with inputs, undermining system fairness. 2. Conflict between privacy protection and verification mechanisms: Existing solutions rely on trusted third-party signatures to verify input authenticity, but this requires exposing user identities or transaction details during verification, leading to privacy leakage risks. Furthermore, general verification methods based on zero-knowledge proofs are computationally complex and difficult to implement. 3. Difficulty in balancing efficiency and security: Existing malicious security models' PSI-sum protocols handle 2 20 The large volume of data requires approximately 3 days, which cannot meet the timeliness requirements of actual advertising billing scenarios; at the same time, most solutions only support a semi-honest model, making it difficult to resist real-world proactive attacks. 4. Conflict between distributed supervision and decentralization: Existing solutions rely on centralized verification or a single administrator, which violates the core principles of distributed scenarios such as consortium blockchains, and cannot achieve multi-party collaborative supervision.

[0023] Existing technologies for using PSI privacy to calculate the intersection of advertisers and publishers, such as cardinality-based PSI summation to calculate the intersection without disclosing the intersection and the summation of related values, do not adequately address real-world application scenarios. Their main drawbacks are as follows:

[0024] 1. Existing technologies focus primarily on the privacy of the input sets of computational participants, while neglecting the authenticity of the inputs. These technologies typically implicitly assume that the participants are honest and trustworthy, and that their inputs are genuine and unaltered during processing. This assumption does not align well with real-world scenarios. Furthermore, technologies supporting semi-honest models are vulnerable to real-world deliberate attacks.

[0025] 2: Current technologies generally rely on trusted third-party signatures to verify the authenticity of inputs such as user identity or transaction details, leading to privacy leakage risks; the verification mechanism is not reasonable enough, and general verification methods based on zero-knowledge proofs cannot be put into practical use due to high computational complexity.

[0026] 3. Existing technologies also have relatively low computational efficiency and require further improvement before practical application. Furthermore, some solutions use computation-based signature verification to ensure input authenticity, but the computational scale is enormous. Considering the large number of consumers in real-world scenarios, the huge computational burden makes this technology impractical.

[0027] 4. Many existing solutions rely on centralized third parties or single administrators to verify input, which violates the decentralized principle of distributed collaboration scenarios such as consortium blockchains and cannot achieve multi-party collaborative supervision, resulting in poor system scalability.

[0028] This application constructs a novel PSI protocol, called PSI Cardinum Sum with Verifiable Input, aiming to securely compute intersections using publicly verifiable inputs instead of inputs assumed to be completely trustworthy. By proposing a new input data authenticity verification protocol and introducing a public "billboard," which records the integrity tags and corresponding signatures of advertisers verified by users, any tags that fail verification are immediately marked and reported on the same billboard, ensuring the authenticity of the input data from advertisers and publishers and preventing tampering attacks. A lightweight batch-processing zero-knowledge proof (BatchZK-AoK) is designed to verify input consistency without compromising user privacy, eliminating reliance on trusted third parties. A reconstructed pseudo-random function based on exponential operations, combined with ciphertext re-randomization and parallel computation, improves the computational efficiency of the PSI-sum protocol under malicious models by 90%–95%. This meets the timeliness requirements of advertising billing.

[0029] To address this, this application proposes a Private Set Intersection Cardinality and Summation (PSI-with-PVI) protocol that supports public verification of inputs. By using integrity tags generated by trusted users, multi-party zero-knowledge verification, and an efficient malicious security computation framework, it resolves the contradiction between input data authenticity verification and privacy protection. Furthermore, it optimizes encryption operations and batch proof technology, improving computational efficiency by 90%–95%. At the same time, it supports advertisers and publishers to achieve transparent and verifiable billing results without mutual trust, resisting malicious attacks and meeting the needs of distributed scenarios.

[0030] One embodiment of this application proposes a method for calculating the cardinality and summation of the intersection of private sets that supports publicly verified inputs, applied to an electronic device. The electronic device can be a terminal or a server; this embodiment and subsequent embodiments use a server as an example. The implementation details of the method for calculating the cardinality and summation of the intersection of private sets that supports publicly verified inputs, as proposed in this embodiment, are described below. These details are provided for ease of understanding and are not essential for implementing this solution.

[0031] Specifically, refer to Figure 2This application's technical solution includes three entities: advertiser (A), publisher (P), and consumer / user (U). Advertiser A holds the user's ad ID and corresponding purchase amount data, and is responsible for generating encrypted integrity tags and participating in privacy calculations. Publisher P possesses touchpoint data of user clicks on corresponding ads; after a user clicks an ad and purchases the corresponding product, the corresponding transaction certificate is uploaded. Publisher P is responsible for verifying the authenticity of the data submitted by the advertiser and collaboratively calculating the intersection cardinality and total consumption. Consumer U, as the entity triggering the transaction, generates a trusted data source (such as a transaction certificate) through its payment behavior, which is then encrypted and uploaded to a public bulletin board (B). The public bulletin board (B), as a distributed storage node, is accessible to all relevant parties, and each message on it and its corresponding sender are publicly visible. It stores encrypted transaction certificates and integrity tags, ensuring data transparency and immutability.

[0032] Continue to refer to Figure 2 The first step involves generating evidence passively after user U completes the relevant consumption. This evidence records the user's ID and the amount consumed in encrypted form and uploads it to the public notice board (B).

[0033] The second step is for the advertiser (A) to generate a set of proofs for the inputs used to calculate PSI, record private user conversion data (user ID and spending amount) in encrypted form, and upload it to a public bulletin board (B).

[0034] The third step is for the publisher (P) to obtain evidence uploaded by advertisers (A) and users (U) from the public notice board and verify the consistency of the data.

[0035] The fourth step involves the advertiser (A) and publisher (P) jointly calculating the sum of privacy intersections with cardinality under the malicious security model.

[0036] The technical solution of this application will be further described below in conjunction with the accompanying drawings and embodiments. The following content is only for the convenience of understanding and is not necessary for implementing this example. The specific process of the private set intersection cardinality and summation method supporting public verification input proposed in this embodiment can be as follows: Figure 1 As shown, the method may include the following execution process:

[0037] S101. After the user completes the consumption, the first encrypted message is generated based on the user ID and the consumption amount, and then sent to the public notice board.

[0038] Specifically, step S101 may include the following execution process:

[0039] Users encrypt their user ID using a preset scheme to obtain an encrypted identity code, encrypt the actual consumption amount using the ElGamal algorithm to obtain an encrypted amount, and send the encrypted identity code to the public bulletin board and advertisers, as well as the encrypted amount to the public bulletin board.

[0040] For example, prior to this, the advertiser generates a key pair (pk) for liftedElGamal encryption. A ,sk A ), and send pk to the public notice board. A ; and, set the public parameter w = (g0, g1, g2, h0, g) in the public notice board. a ,h a ,q,pk A ).

[0041] It should be noted that this application proposes a method for constructing integrity tags, reducing the burden on users to create these tags and protecting their identities from threats. Integrity tags are generated by advertisers alongside their signatures. Users can then verify the accuracy of these tags, ensuring transparency. Verified integrity tags and their corresponding signatures are uploaded to a distributed storage public bulletin board, ensuring data immutability and traceability. Simultaneously, any tags that fail verification are promptly flagged and reported on the same bulletin board. This simplified process ensures reliability while protecting user identities.

[0042] Then, refer to Figure 3 Each user U i Randomly select r i ,s i ∈Z q Z q Represent the key space; compute Obtain the encrypted identity code Send encrypted identity codes to advertisers Calculation based on ElGamal algorithm Get encrypted amount Send the encrypted identity code and encrypted amount to the public notice board.

[0043] S102. The advertiser generates a second ciphertext based on the user ID and sends the second ciphertext to the publisher and the public bulletin board. The second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs. The publisher receives the first and second ciphertexts from the public bulletin board and performs a consistency test on the first and second ciphertexts based on the transaction certificate to complete the first verification of the public input. The transaction certificate is determined based on the touchpoint data generated by the user clicking on the corresponding advertisement.

[0044] refer to Figure 3 Specifically, the process of an advertiser generating a second ciphertext based on a user ID and sending the second ciphertext to a publisher and a public notice board may include the following steps: the advertiser obtains an encrypted identity code from the public notice board; the advertiser generates encrypted result A and encrypted result B based on the user ID and encrypted identity code, and sends encrypted result A and encrypted result B to the publisher and the public notice board, as well as sending the two first zero-knowledge proofs constructed accordingly.

[0045] For example, an advertiser generates encrypted result A and encrypted result B based on the user ID and encrypted identity code, and sends encrypted result A and encrypted result B to the publisher and public notice board. Sending the two correspondingly constructed first zero-knowledge proofs may include the following execution process:

[0046] The advertiser randomly selects a random key k a ∈Z q ,calculate

[0047] For i∈[1,n]: Calculate the encryption result of A. And B encryption result Where n represents the number of user IDs;

[0048] Based on the encryption results A and B, the following is adopted: Encryption algorithms, and Construct two first zero-knowledge proofs.

[0049] Send encrypted results A and B to a public notice board, and send two first zero-knowledge proofs.

[0050] In one embodiment of this application, after performing a consistency test on the first ciphertext and the second ciphertext based on the transaction certificate, the method may further include the following execution process:

[0051] If the two first zero-knowledge proofs match, the publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and the corresponding second zero-knowledge proof, and sends the first encrypted identifier and the corresponding second zero-knowledge proof to the advertiser.

[0052] If two first zero-knowledge proofs are inconsistent, then delete both first zero-knowledge proofs.

[0053] The publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and a corresponding second zero-knowledge proof, which may include the following execution process:

[0054] The publisher selects a random key k p ∈Z q ;

[0055] For j∈[1,m], calculate the first encryption identifier. And determine the second zero-knowledge proof based on the first cryptographic identifier. Where m represents the number of transaction certificates a user possesses.

[0056] Notably, this application proposes a novel input data authenticity protocol to prevent participants in the profit-sharing model of CPS advertising from falsifying their private privacy inputs during PSI calculations. It introduces a "public bulletin board" to record the integrity proof of consumer consumption evidence and advertiser touchpoint data, allowing publishers or any stakeholders to verify the consistency between advertiser data and consumer consumption evidence. In this process, hash-based non-interactive zero-knowledge proofs (Fiat-Shamir transformation) are used to eliminate reliance on trusted third parties. Even without consumer interaction, their consumption evidence is triggered and sent to the public bulletin board through the corresponding payment behavior.

[0057] S103. Advertisers and publishers complete the second verification of the common input and the calculation of the PSI cardinality sum based on the optimized fast PSI cardinality sum algorithm, and output the cardinality sum of their respective private intersections. The cardinality sum of the private intersections is used to represent the number of users who watch the ads and make consumption in the CPS advertising model and the total amount of consumption.

[0058] refer to Figure 4 For example, step S103 above may include the following execution process:

[0059] Advertiser A verifies the validity of all ZK-AOKs sent by service provider P. For j∈[1,m]: select t j ∈Z q Through calculation To encrypt P j and send And a ZK-AOK:

[0060]

[0061] To P; Advertiser A selects a pseudo-random permutation π on [1,m] and a random number ρ. j ∈Z q Through calculation Re-randomized shuffled ciphertext send And a ZK-AOK: To P;

[0062] Advertiser A calculated Decryption Send L j And a ZK-AOK: To P.

[0063] Service provider P verifies the validity of all ZK-AOKs sent by advertiser A. For i∈[1,n]: select d. j ∈Z q and SK P ∈Z q ,calculate And through calculation To encrypt A i ,send And a ZK-AOK: To A;

[0064] Service provider P selects a pseudo-random permutation π on [1,n]. ′ and a random number a i ∈Z q Through calculation Re-randomized shuffled ciphertext send And a ZK-AOK: To A;

[0065] Service provider P calculates To decrypt Send J i And a ZK-AOK: To A;

[0066] Service provider P randomly selects β i ∈Z q Through calculation To re-randomize and shuffle send And a ZK-AOK: Go to A.

[0067] The above steps complete the second step of public input validation.

[0068] Next, advertiser A verifies the validity of all ZK-AOKs sent by service provider P by calculating I=|L∩J|=|{t:L t ∈{J i ,i∈[1,n]|Determine the intersection I, and calculate the sum of the associated ciphertexts using additive homomorphism. Then decrypt to recover the intersection and Sum = Dec(sk) A Sum E ); Send (Sum E (,Sum) and a ZK-AOK:

[0069]

[0070] Service provider P calculates I = |L∩J| = |{t:J} t ∈{L j ,j∈[1,m]}}| Determine the intersection I; Calculate the sum of the associated ciphertexts using homomorphic addition. Verify all ZK-AOKs sent by advertiser A.

[0071] It is worth noting that this application designs a more efficient secure computation protocol, reconstructing a pseudo-random function based on exponential operations to replace the traditional OPRF structure, reducing the computational complexity of cross-encryption domain operations and improving computational efficiency. The privacy of intersection elements is protected through ciphertext re-randomization. Based on the above, advertisers and publishers can quickly calculate the intersection of cardinalities and the corresponding total sales, while protecting the privacy of inputs under malicious security models, thus achieving secure CPS advertising billing.

[0072] It should also be noted that this application differs from the default honesty and curiosity security model of previous solutions, implementing malicious security under the settings of malicious advertisers and publishers. Malicious advertisers may tamper with their input data to reduce advertising fees paid, including intentionally deleting consumers to reduce aggregation, or arbitrarily deviating from the protocol from the calculation process to the output. Malicious publishers can arbitrarily deviate from the protocol, threatening advertisers' privacy or sending advertisers malformed inputs and messages, leading to incorrect execution of the protocol. In the malicious model of this application, zero-knowledge proofs are used to force protocol participants to perform operations according to the rules; otherwise, the protocol is terminated. Simultaneously, two-way verification of advertisers and publishers is supported to prevent unilateral tampering with inputs or outputs.

[0073] Compared to state-of-the-art existing technologies, this application achieves significant improvements in input authenticity verification, computational efficiency, and defense against malicious attacks. Specific advantages are as follows:

[0074] 1. Input authenticity verification and anti-tampering capabilities

[0075] Existing technical solutions assume the input data is trustworthy, but fail to address the issue of advertisers or publishers falsifying input. Malicious participants can manipulate billing results by injecting tampered encrypted data, compromising system fairness. This application proposes an integrity label, generating an encrypted integrity label using a consumer transaction certificate and submitting it to a public bulletin board (B). Any participant can independently verify the consistency between advertiser input data and bulletin board data. Furthermore, a multi-party zero-knowledge verification framework is used, employing the Batch ZK-AoK protocol to verify data authenticity without exposing user identities. This prevents input data tampering attacks and ensures the authenticity and fairness of billing results.

[0076] 2. Efficient computational optimization under the malicious security model

[0077] Existing technical solutions handle malicious security models 2 20 The current data processing time is approximately 3 days, which is inefficient and cannot meet the timeliness requirements of actual advertising billing scenarios. This application not only achieves verifiable PSI privacy input but also redesigns the PSI cardinality and computation protocol by utilizing reconstructed pseudo-random functions, ciphertext re-randomization and parallelization, and batch processing techniques. Efficiency is compared with existing solutions under different input dimensions. Experimental results show that, under the same malicious security model, for 2... 12 For 2 entries, the computation time was reduced by 95%, for 2 20 The computation time for each entry was reduced by 90%, significantly improving computational efficiency. This demonstrates that this application significantly improves the processing efficiency of large-scale datasets, meeting the real-time requirements of advertising billing.

[0078] It should be noted that the steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0079] Another embodiment of this application proposes a system for calculating the cardinality and summation of the intersection of private sets of publicly verified inputs. The system may include: a user device, an advertiser device, and a publisher device. The user device generates a first ciphertext based on the user ID and the amount consumed after a user completes a purchase, and sends the first ciphertext to a public notice board. The advertiser device generates a second ciphertext based on the user ID and sends the second ciphertext to the publisher and the public notice board. The second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs. The publisher receives the first and second ciphertexts from the public notice board and performs a consistency test on the first and second ciphertexts based on a transaction certificate, completing the first verification of the public input. The transaction certificate is determined based on touchpoint data generated by the user clicking on the corresponding advertisement. The advertiser device and the publisher device are also used to complete the second verification of the public input and calculate the PSI cardinality sum based on an optimized fast PSI cardinality sum algorithm, and output the cardinality sum of their respective private intersections. The cardinality sum of the private intersections represents the number of users who viewed and consumed advertisements in the CPS advertising model and the total amount consumed.

[0080] It is not difficult to see that this embodiment is a system embodiment corresponding to the above method embodiments, and this embodiment can be implemented in conjunction with the above method embodiments. The relevant technical details and technical effects mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

[0081] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A method for finding the cardinality and summation of the intersection of private sets that supports publicly validated inputs, characterized in that, include: After a user completes a purchase, a first encrypted message is generated based on the user ID and the purchase amount, and then sent to the public notice board. The advertiser generates a second ciphertext based on the user ID and sends it to the publisher and the public bulletin board. The second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs. The publisher receives the first and second ciphertexts from the public bulletin board and performs a consistency test on the first and second ciphertexts based on the transaction certificate to complete the first verification of the public input. The transaction certificate is determined based on the touchpoint data generated by the user clicking on the corresponding advertisement. Advertisers and publishers complete the second verification of the common input and calculate the PSI cardinality sum based on the optimized fast PSI cardinality sum algorithm, and output the cardinality sum of their respective private intersections. The cardinality sum of the private intersections is used to represent the number of users who watch ads and make purchases in the CPS advertising model and the total amount of purchases. After a user completes a transaction, a first encrypted message is generated based on the user ID and the transaction amount, and then sent to the public notice board. This first encrypted message includes: Users encrypt their user ID using a preset scheme to obtain an encrypted identity code, encrypt the actual consumption amount using the ElGamal algorithm to obtain an encrypted amount, and send the encrypted identity code to the public notice board and advertisers, as well as the encrypted amount to the public notice board. The advertiser generates a second encrypted message based on the user ID and sends the second encrypted message to the publisher and the public bulletin board, including: Advertisers obtain encrypted identity codes from public notice boards; Advertisers generate encrypted result A and encrypted result B based on user ID and encrypted identity code, and send encrypted result A and encrypted result B to publishers and public notice boards, as well as send the two first zero-knowledge proofs constructed accordingly; After performing the consistency test on the first ciphertext and the second ciphertext based on the transaction certificate, the method further includes: If the two first zero-knowledge proofs match, the publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and the corresponding second zero-knowledge proof, and sends the first encrypted identifier and the corresponding second zero-knowledge proof to the advertiser. If two proofs of first zero knowledge are inconsistent, then delete both proofs of first zero knowledge. The advertisers and publishers complete the second verification of the common input and the calculation of the PSI cardinality sum based on the optimized fast PSI cardinality sum algorithm, including: The advertiser verifies the validity of the second zero-knowledge proof and encrypts the first encrypted identifier to obtain the second encrypted identifier and the corresponding third zero-knowledge proof; based on the first randomized shuffled ciphertext, the advertiser obtains the third encrypted identifier and the corresponding fourth zero-knowledge proof, and decrypts the third encrypted identifier to obtain the first decrypted identifier and the corresponding fifth zero-knowledge proof; and sends the first to second encrypted identifiers, the first decrypted identifier, and the third to fifth zero-knowledge proofs corresponding to each identifier to the publisher. The publisher verifies the third to fifth zero-knowledge proofs and performs secondary encryption on the A encryption result to obtain the secondary encryption result and the corresponding sixth zero-knowledge proof; based on the second randomized shuffled ciphertext, the publisher obtains the fourth encryption identifier and the corresponding seventh zero-knowledge proof and sends it to the advertiser; the publisher decrypts the fourth encryption identifier to obtain the second decryption identifier and the corresponding eighth zero-knowledge proof; and based on the third randomized shuffled ciphertext, the publisher obtains the fifth encryption identifier and the corresponding eighth zero-knowledge proof, sends the secondary encryption result, the fourth and fifth encryption identifiers, and the corresponding sixth to eighth zero-knowledge proofs to the advertiser. The advertiser verifies the sixth to eighth zero-knowledge proofs, completes the second verification of the common input, calculates the PSI cardinality of the first and second decryption identifiers, calculates the sum of the fifth encryption identifiers through homomorphic addition, obtains the encrypted total consumption amount, decrypts the encrypted consumption amount to obtain the unencrypted total consumption amount, and sends the encrypted total consumption amount and the unencrypted total consumption amount to the publisher, as well as the ninth zero-knowledge proof; The publisher verifies the ninth zeroth knowledge proof, calculates the intersection cardinality of the first and second decryption identifiers using the ciphertext rerandomization algorithm, calculates the sum of the fifth encryption identifiers using homomorphic addition, and determines the PSI cardinality sum based on the intersection cardinality and the sum of the fifth encryption identifiers.

2. The method for finding the cardinality and summation of the intersection of private sets supporting publicly verified inputs as described in claim 1, characterized in that, The method further includes: Advertisers generate a key pair for liftedElGamal encryption. and send to the public notice board ; In addition, set public parameters on the public notice board. .

3. The method for finding the cardinality and summation of the intersection of private sets supporting publicly verified inputs as described in claim 2, characterized in that, The user encrypts their user ID using a preset scheme to obtain an encrypted identity code, encrypts the actual consumption amount using the ElGamal algorithm to obtain an encrypted amount, and sends the encrypted identity code to the public notice board and advertisers, as well as sending the encrypted amount to the public notice board, including: Each user Random selection ,in, Represents the key space; calculate Obtain the encrypted identity code and send encrypted identity codes to advertisers. ; Calculation based on ElGamal algorithm Get encrypted amount And send the encrypted identity code and encrypted amount to the public notice board. .

4. The method for finding the cardinality and summation of the intersection of private sets supporting publicly verified inputs as described in claim 3, characterized in that, The advertiser generates encrypted result A and encrypted result B based on the user ID and encrypted identity code, and sends encrypted result A and encrypted result B to the publisher and public bulletin board, as well as sending two corresponding constructed first zero-knowledge proofs, including: The advertiser randomly selects a random key. ,calculate ; for Calculate the encryption result of A And B encryption result ,in, Indicates the number of user IDs; Based on the encryption results A and B, the following is adopted: Encryption algorithms, and Construct two first-degree zero-knowledge proofs, send encryption results A and B to a public bulletin board, and send the two first-degree zero-knowledge proofs.

5. The method for finding the cardinality and summation of the intersection of private sets supporting publicly verified inputs as described in claim 4, characterized in that, The publisher encrypts the user's transaction certificate to obtain a first encrypted identifier and a corresponding second zero-knowledge proof, including: The publisher selects a random key ; for Calculate the first encrypted identifier And determine the second zero-knowledge proof based on the first cryptographic identifier. ,in, This indicates the number of transaction certificates a user possesses.

6. A system for calculating the cardinality and summation of the intersection of private sets that supports publicly verified inputs, employing the method for calculating the cardinality and summation of the intersection of private sets that supports publicly verified inputs as described in any one of claims 1-5, characterized in that... include: User devices, advertiser devices, and publisher devices: The user equipment is used to generate a first encrypted message based on the user ID and the amount of consumption after the user completes the consumption, and then send the first encrypted message to the public notice board. The advertiser's device is used to generate a second ciphertext based on the user ID and send the second ciphertext to the publisher and the public bulletin board. The second ciphertext is based on the encrypted user ID and a corresponding set of zero-knowledge proofs. The publisher receives the first and second ciphertexts from the public bulletin board and performs a consistency test on the first and second ciphertexts based on the transaction certificate to complete the first verification of the public input. The transaction certificate is determined based on the touchpoint data generated by the user clicking on the corresponding advertisement. The advertiser device and publisher device are also used to complete the second verification of the common input and the calculation of the PSI cardinality sum based on the optimized fast PSI cardinality sum algorithm, and output the cardinality sum of their respective private intersections, where the cardinality sum of the private intersections is used to characterize the number of users who watch ads and make consumption in the CPS advertising model and the total amount of consumption.

Images