Inter-mechanism sensitive data set secrecy calculation intersection and union method with shared secrecy requirement

Abstract

The invention discloses an inter-mechanism sensitive data set secrecy calculation intersection and union method with shared secrecy requirements, and belongs to the technical field of secrecy. The invention aims to solve the problem that the traditional security multi-party calculation formula still has the risk of insufficient calculation efficiency and easy data leakage under the challenge of a potential malicious mechanism. According to the method, firstly, data of n participants performing confidential calculation are coded, the participants encrypt own coding vectors by using a threshold NTRU encryption system, and one participant calculates information published to other participants according to ciphertext matrixes of all the participants; each participant decrypts to obtain a plaintext vector and determines an intersection and union of the data sets based on the plaintext vector. The intersection set and union set of multiple sets can be calculated under the semi-honesty model and the malicious model, and the intersection set and union set pass safety certification, so that the safety of the method is verified, and the method has relatively high calculation efficiency.

Description

Technical Field

[0001] This invention belongs to the field of security technology, and specifically relates to an information security calculation method. Background Technology

[0002] Secure multi-party computation (MPC) is a privacy-preserving computational method that allows multiple participants to complete computations without disclosing sensitive data. MPC can be widely applied in finance, healthcare, e-commerce, and other fields to ensure user privacy and data security. MPC originated from the "Millionaire Problem" proposed by computer scientist Professor Andrew Yao in 1982. Since then, researchers such as Goldreich have conducted in-depth research on MPC, covering areas such as confidential data mining, confidential computational geometry and set problems, confidential scientific computing, confidential statistical analysis, and confidential database querying. [17-19] These studies have continuously propelled MPC forward and successfully solved many practical security problems.

[0003] It is worth noting that although considerable research has made progress in solving the problem of secure multi-party computation of sets, the computational overhead of protocols remains relatively high. Therefore, many potential research challenges still exist in this field, requiring further exploration and solutions.

[0004] Furthermore, in data sharing scenarios involving medical data or other institutions with confidentiality requirements, cross-institutional data collaboration faces the dual constraints of privacy protection and compliance requirements. For example, in clinical research, privacy set intersection (PSI) technology is needed to compare rare case databases from multiple hospitals, avoiding the exposure of non-intersecting patient information while identifying common research samples. In epidemic prevention and control, secure union computation can integrate suspected case data from multiple regions, completing epidemic heat map analysis in an encrypted state and ensuring that the original data does not leave the domain. These applications all need to meet the "data usable but not visible" requirement of the Data Security Law, employing technologies such as homomorphic encryption and obfuscated circuits to achieve compliant collaboration. While traditional secure multi-party computation (MPC) solutions can achieve privacy protection, they still face risks of insufficient computational efficiency and data leakage due to the potential for malicious organizations. Summary of the Invention

[0005] This invention aims to address the problem that traditional secure multi-party computation formulas still suffer from insufficient computational efficiency and the risk of data leakage when faced with challenges from potential malicious agencies.

[0006] A method for securely calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements includes the following steps:

[0007] S100, There are n participants P who need to perform confidential computations. iLet i = 1, 2, ..., n and n > 2, each possessing an ordered set of sensitive data corresponding to an organization with shared confidentiality requirements. t i It is the number of elements contained in the dataset of each participant; each participant P i Your own data set Encoded as Where N u For n participants P i The agreed-upon complete data set U = [0, N] u ], such that the set of participants X i Data x in ij Both belong to U and 0 < x ij <N u j = 1, 2, ..., t i ;

[0008] S200, P i Select a random polynomial r ik (x), and using r ik (x) will encode its own vector V i Each element in the data is encrypted using a threshold NTRU encryption system, resulting in... For the encoding vector V i Each element in the encryption process is encrypted using threshold NTRU encryption; during the encryption process, all participants P i Obtain the sub-secret y respectively i Participant P t Each of them sets its own ciphertext vector E(V) t Send the data to P1, where t = 2, 3, ..., n;

[0009] S300 and P1 will combine all E(V) i This forms a ciphertext matrix E(V) and a ciphertext vector E(V). i ) corresponds to the i-th row of E(V):

[0010]

[0011] P1 calculates E(a) based on E(V) and in the following manner. k ):

[0012]

[0013] P1 command And announce it to other participants;

[0014] S400, P i Using their respective sub-secrets i They jointly decrypt E(A); ultimately, each participant obtains the plaintext vector.

[0015] S500, P i Let the data in A Except for a0, take the difference between any two adjacent data points, i.e., l1 = a2 - a1, l2 = a3 - a2, ..., Then let

[0016] S600, P i make Inter(x) is the intersection, and Union(x) is the union;

[0017] Based on the data in L, if l z =n, z = 1,2,…,N u -1, then let Inter(x)←Inter(x)∪z; if l z If ≠ 0, then let Union(x) ← Union(x) ∪ z; ultimately, P i We obtain the complete intersection Inter(x) and union Union(x).

[0018] Furthermore, each participant P i Your own data set Encoded as The process includes:

[0019] Each participant P i An N is obtained by encoding it in the following manner. u +1-dimensional vector V i :

[0020] Based on vector V i Middle element v is The ordinal number s, if 0 ≤ s < x i1 , let v is =0; if x i1 ≤s<x i2 , let v is =1; if x i2 ≤s<x i3 , let v is =1+1; and so on, if Let v is =t i .

[0021] Furthermore, using r ik (x) will encode its own vector V i The process of encrypting each element using the threshold NTRU encryption system includes:

[0022] E(v ik ) = vik +pr ik (x)h(x)(modq,mod x N -1),

[0023] Where k = 0, 1, ..., N u “E” represents the encryption operation; N, p, q are the parameters of the threshold NTRU encryption algorithm, and h(x) is the public key.

[0024] A method for securely calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements includes the following steps:

[0025] (1) There are n participants P who need to perform confidential calculations. i Let i = 1, 2, ..., n and n > 2, each possessing an ordered set of sensitive data corresponding to an organization with shared confidentiality requirements. t i It is the number of elements contained in the dataset of each participant; each participant P i Your own data set Encoded as Where N u For n participants P i The agreed-upon complete data set U = [0, N] u ], such that the set of participants X i Data x in ij Both belong to U and 0 < x ij <N u j = 1, 2, ..., t i ;

[0026] (2)P i Select a random polynomial r ik (x), and using r ik (x) will encode its own vector V i Each element in the data is encrypted using a threshold NTRU encryption system, resulting in... in For the encoding vector V i The encryption result of each element in the data using threshold NTRU encryption;

[0027] P i Calculate separately Where p is the parameter of the threshold NTRU encryption algorithm, h(x) is the public key; participant P t Each of them sets its own ciphertext vector E(V) t Send the data to P1, where t = 2, 3, ..., n;

[0028] (3) P1 verifies using the public key h(x):

[0029] h(x)prove tk (modq,modx N -1)=E(v tk ),

[0030] Where N and q are the parameters of the threshold NTRU encryption algorithm;

[0031] If the verification passes, proceed to the next step; otherwise, stop the protocol.

[0032] (4) P1 will put all E(V) i This forms a ciphertext matrix E(V) and a ciphertext vector E(V). i ) corresponds to the i-th row of E(V):

[0033]

[0034] P1 calculates E(a) based on E(V) and in the following manner. k ):

[0035]

[0036] P1 command And E(V), E(A) and prove 1k Disclose to other participants;

[0037] (5) P2,…,P n Verify separately

[0038] h(x)prove 1k (modq,modx N -1)=E(v 1k ),

[0039] When k≠0,

[0040] If the verification passes, proceed to the next step; otherwise, the agreement terminates.

[0041] (6)P i Using their respective sub-secrets i They jointly decrypt E(A); ultimately, each participant obtains the plaintext vector.

[0042] (7)P i Let the data in A Except for a0, take the difference between any two adjacent data points, i.e., l1 = a2 - a1, l2 = a3 - a2, ..., Then let

[0043] (8) Each participant P i make Inter(x) is the intersection, and Union(x) is the union;

[0044] Based on the data in L, if l z =n, z = 1,2,…,N u -1, then let Inter(x)←Inter(x)∪z; if l z If ≠ 0, then let Union(x) ← Union(x) ∪ z; ultimately, P i We obtain the complete intersection Inter(x) and union Union(x).

[0045] Furthermore, each participant P i Your own data set Encoded as The process includes:

[0046] Each participant P i An N is obtained by encoding it in the following manner. u +1-dimensional vector V i :

[0047] Based on vector V i Middle element v is The ordinal number s, if 0 ≤ s < x i1 , let v is =0; if x i1 ≤s<x i2 , let v is =1; if x i2 ≤s<x i3 , let v is =1+1; and so on, if Let v is =t i .

[0048] Furthermore, using r ik (x) will encode its own vector V i The process of encrypting each element using the threshold NTRU encryption system includes:

[0049] E(v ik ) = v ik +pr ik (x)h(x)(modq,mod x N -1),

[0050] Where k = 0, 1, ..., N u “E” represents the encryption operation; N, p, q are the parameters of the threshold NTRU encryption algorithm, and h(x) is the public key.

[0051] Beneficial effects:

[0052] This invention addresses the privacy protection needs of organizations sharing confidential data and designs secure computation protocols supporting multi-party set joint operations. Employing a threshold NTRU encryption algorithm and a novel encoding method, this invention proposes for the first time secure multi-party computation protocols for set intersections and unions in a semi-honest model and a deception-resistant scenario. Both protocols can simultaneously compute the intersection and union of multi-party sets, or compute only one or more results, satisfying diverse needs and demonstrating strong applicability. The correctness of both protocols has been analyzed, and their security has been proven through simulation examples. Furthermore, this invention exhibits high computational efficiency. Performance analysis, experimental testing, and comparisons with related solutions demonstrate the efficiency of both protocols, validating the practicality of this invention. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the secure computation process for the intersection and union of multiple sets under a semi-honest model.

[0054] Figure 2 This is a simulation diagram of secure computation of the intersection and union of multiple sets under a semi-honest model.

[0055] Figure 3 This is a flowchart for secure computation of the intersection and union of multiple sets under a malicious model.

[0056] Figure 4 This is a security computation simulation diagram for the intersection and union of multiple sets under a malicious model.

[0057] Figure 5 The trend of the protocol's runtime as m changes.

[0058] Figure 6 The communication delay time of the protocol changes with m.

[0059] Figure 7 The trend of the protocol's runtime as n changes.

[0060] Figure 8 The communication delay time of the protocol changes with n. Detailed Implementation

[0061] To address the problems existing in the background technology, this invention proposes two novel set-based confidential computing protocols: 1) a semi-honest model protocol based on threshold NTRU, supporting efficient computation of intersection and union of multi-party data; 2) an enhanced protocol against malicious deception, ensuring the reliability of computation results through verifiable encryption and distributed verification mechanisms. Before providing a detailed explanation of specific implementation methods, the basic concepts will first be explained.

[0062] NTRU encryption is a lattice-based public-key cryptography algorithm that is resistant to quantum attacks and offers high speed and security. The following section, "Threshold NTRU Public-Key Encryption Schemes," presents a threshold NTRU encryption scheme. In this scheme, an authorized subset of participants can decrypt the ciphertext, while an unauthorized subset cannot.

[0063] Symbol explanation:

[0064] (1) Let the polynomial f(x) = f N-1 x N-1 +…+f1x+f0 is an N-dimensional vector (f N-1 ,…,f1,f0).

[0065] (2) a×b, ab or * represents general scalar multiplication or multiplication between polynomials. This refers to the multiplication of vectors and matrices.

[0066] The system's publicly available parameters are (N, p, q). N is a large prime number, and p and q are positive integers that satisfy the greatest common divisor gcd(p, q) = 1. Three modulo operations (mod p), (mod q), and (mod x) will be used during encryption and decryption. N -1). The result of a(x)(modp) refers to taking the bivariate polynomial corresponding to the polynomial a(x).

[0067] Secret share distribution: Let D1 be a trusted key distributor, and let the number of participants be n. The authorized subset B = {p1, p2, ..., p...} l}, l≤n. The steps for D1 to distribute the secret share are as follows:

[0068] (1) Choose the group secret f(x) = (f N-1 ,…,f1,f0) and g(x)=(g N-1 ,…,g1,g0), calculate the group public key:

[0069] h(x)=f(x) -1 g(x)(modq modx N -1)

[0070] (2) Randomly select v2,…,v r ∈Z q [x] / (x N -1), let v = (v1, v2, ..., v r ) T , where v1=(f N-1 ..., f1, f0) = f(x). We can see that v is an r×N dimensional matrix, and... calculate

[0071] (3) The parameters N, p, q, and h(x) are public, while f(x) and g(x) are kept secret. The sub-secret y is also public. i Distributed to participant p i (i = 1, 2, ..., l).

[0072] Encryption: The plaintext m(x) is a binary polynomial of degree no more than N-1. A random binary polynomial r(x) of degree no more than N-1 is selected, and the ciphertext e(x) = m(x) + pr(x)h(x) (mod q mod x) is calculated. N -1).

[0073] Deciphering:

[0074] (1) In the authorized subset B = {p1, p2, ..., p...} l Participant p in} i calculate:

[0075] s i (x)=e(x)*y i (modq)(i = 1, 2, ..., l).

[0076] (2) The members in B will each calculate s i (x) Send to the specified plaintext generator β (β can also be a member of B).

[0077] (3) β is calculated on the integer ring Z: c i =detD i / detX. D i For the meaning of X, please refer to "Threshold NTRU Public Key Encryption Scheme".

[0078] (4) Calculate I = e(1) - r(1)h(1)(mod q), place I between (Nq / 2, N+q / 2), and let:

[0079] A=(p(1)r(1)g(1)+I*f(1)) / N.

[0080] (5) β calculation Then, if a(x) is placed between (Aq / 2, A+q / 2), the plaintext corresponding to the ciphertext e(x) is m(x) = a(x) (mod p).

[0081] Security model and security proof:

[0082] In secure multi-party computation (MPC) protocols, participants are categorized into two models based on their behavior: semi-honest and malicious. In a semi-honest MPC protocol, participants strictly adhere to each step of the protocol, refraining from providing false information, interrupting execution, or colluding with other participants to attack the protocol. However, they may record publicly available information in the protocol to attempt to deduce information about other participants. In a malicious MPC protocol, some participants intentionally violate rules, deliberately leak information, or attempt to terminate the computation process. These malicious participants may take various actions to compromise the privacy and security of the computation.

[0083] In secure multi-party computation protocols, simulation paradigms are widely accepted methods for proving security. This invention primarily employs simulation paradigms to prove the security of the protocol, specifically demonstrating that the output of the actual protocol execution is indistinguishable from the output of the ideal protocol execution. The simulation paradigm proof model is described below.

[0084] Let participant P i (i = 1, 2, ..., n) each have a private ordered data set X i .

[0085] (1) Let set X = {X1, X2, ..., X} n Let f(X) = (f(X1), ..., f(X2)). n )) is a probabilistic polynomial time function, and π is the protocol for confidential computation f.

[0086] (2) When π is executed, let P be the value of P. i The resulting information sequence is: Where r i P represents i The selected random value, P represents i The j-th piece of information obtained, f i (X) represents P i The result obtained.

[0087] (3) Let the set of participants be... remember

[0088]

[0089] Theorem 1 For f and π, if for each set of participants There exists a probabilistic polynomial-time algorithm S such that:

[0090]

[0091] Then the confidential calculation function for π, f, This refers to calculations that are indistinguishable.

[0092] The present invention will now be described in detail with reference to specific embodiments. Specific implementation method one:

[0094] This implementation method is a secure multi-party computation scheme for the intersection and union of sensitive data sets between organizations with shared confidentiality requirements. It is based on a semi-honest model. This implementation method uses a medical institution as an example for illustration.

[0095] There are n participants P in the confidential computation. i Let i = 1, 2, ..., n and n > 2, each possessing an ordered dataset corresponding to sensitive medical institution data. (t i It is the number of elements contained in the data sets of each participant), data set X i All data in the data are distinct and satisfy the following conditions: Each participant wants to perform a set operation together in secrecy, calculating the intersection Inter(x) and union Union(x) of all participant sets. After the joint computation is completed, each participant knows Inter(x) and Union(x), but does not have access to the private sets of the other participants.

[0096] This invention proposes an encoding method and obtains the results Inter(x) and Union(x) by performing the following steps.

[0097] (1) n participants P i (i = 1, 2, ..., n) agree on a complete data set U = [0, N] u ], such that the set of participants X i Data x in ij (j = 1, 2, ..., t) i All x belong to U, and 0 < x ij <N u .

[0098] (2) Each participant P i Based on your own dataset X i Construct an N with the universal set U u +1-dimensional vector V i :

[0099]

[0100] Where s represents vector V i Middle element v is The index, if 0 ≤ s < x i1 , let v is =0; if x i1 ≤s<x i2 , let vis =1; if x i2 ≤s<x i3 , let v is = 1 + 1; and so on, if x iti ≤s≤N u , let v is =t i .

[0101] (3) Participant P i Vector V i Construct a matrix V (of size n×(N)) u +1)), vector V i Corresponding to the i-th row of V (i = 1, ..., n):

[0102]

[0103] (4) Each participant P i Based on matrix V, calculate a as follows: k (k = 0, 1, ..., N) u ), and ordered

[0104]

[0105] (5) Let the data in A Take the difference between any two adjacent data points (excluding a0), that is, let l1 = a2 - a1, l2 = a3 - a2, ..., set up

[0106] (6) In L, if l z =n(z=1,2,…,N) u -1, where n is the number of participants), then participant P i set X i The data that is equal to z, i.e., x ij =z(j=1,…,t) i Let Inter(x) be the data in the intersection of the sets of all participants. According to this method, each participant P... i All participants' data sets can be obtained as Inter(x);

[0107] If l z If ≠ 0, then the universal set U = [0, N] u The data in ] that is equal to z, i.e., u k =z(k=0,1,…,N) u Let P be the data in Union(x), the union of all participants. According to this method, each participant P... iAll participants' data sets can be obtained as the union of Union(x).

[0108] Proposition 1: Let X = {X1, X2, ..., X} n} for each participant P i Given the union set, equation (2) can correctly calculate the ascending multi-sort position a of each element in X. k (Identical elements occupy the same sorting position. If there are K identical elements, the sorting position of the next larger element increases by K positions.) Therefore, let the data in A... The total set can be obtained by taking the difference between any two pairs of elements (excluding a0). Each element u in k (k = 0, 1, ..., N) u ) In all participants P i The number of elements existing in the joint data set X is determined, and then, through the judgment in step (6) above, each participant P... i This allows us to obtain the intersection and union of the sets of all participants.

[0109] Proof: Let the union set X be represented as Where x1,…,x m For participant P i The distinct elements in the union set, where x1 < ... < x m ;d1,…,d m They are x1, ..., x m The number of repetitions.

[0110] (1) Based on The composition, The sorting positions of each element in the array are as follows: the sorting position of x1 should be a1 = 1; the sorting position of x2 should be a2 = d1 + 1; x j The sorting position should be a j =d1+…+d j-1 +1; x m The sorting position should be a m =d1+…+d m-1 +1.

[0111] (2) Based on the vector V constructed by each participant i Constructing matrix V in the same way, the sum of the elements in each column of matrix V is as follows: the sum of the elements in each column before the (x1+1)th column is e1 = 0; from the (x1+1)th column to the x2th column, the sum of the elements in each column is e2 = d1; from the xth column... j +1 column to x j+1 Columns, where the sum of the elements in each column is e. j+1 =d1+d2+…+d j From xm-1 +1 column to x m Columns, where the sum of the elements in each column is e. m =d1+d2+…+d m-1 .

[0112] Let j∈[1,m]. For each j, by using a in (1) above... j and (2) in e j By comparison, we can see that a j =e j +1, that is element x in j The sorting position is equal to the x-th position in matrix V. j The sum of the series plus 1. Proposition 1 is proved.

[0113] This embodiment is actually a method for confidentially calculating the intersection and union of sensitive data sets between medical institutions. Considering the confidentiality and special nature of sensitive data between medical institutions, this embodiment uses ordinary data to represent the sensitive data of medical institutions for illustration. Participants P1, P2, and P3 each have ordered and distinct sets X1 = {1, 3, 4, 6}, X2 = {2, 3, 5, 6, 7}, and X3 = {1, 2, 5, 6, 8}, and N is taken as N. u =10, that is, U=[0,10]. P1, P2, P3 respectively construct an 11-dimensional vector V1, V2, V3 according to equation (1), and then V1, V2, V3 form a 3×11-dimensional matrix V:

[0114]

[0115] Participants P1, P2, and P3 calculated the following based on matrix V and equation (2):

[0116] A={0,1,3,5,7,8,10,13,14,15,15},

[0117] Let the data in A be subtracted pairwise, i.e., let l1 = 3 - 1, l2 = 5 - 3, ..., l9 = 15 - 15, then:

[0118] L={l1,l2,…,l9}={2,2,2,1,2,3,1,1,0},

[0119] In L, since l6 = n = 3, then the data x in the sets X1, X2, X3 of participants P1, P2, P3 that are equal to 6 are... 14 x 24 x 34 This refers to the data in Inter(x), the intersection of the sets of all participants. Ultimately, participants P1, P2, and P3 obtain the intersection of the data sets of all participants, Inter(x) = {6}.

[0120] Since the values ​​of l1, l2, ..., l8 are not 0, the data u2, u3, ..., u9 in the universal set U = [0, 10] that are equal to 1, 2, ..., 8 respectively are the data in the union of the sets of all participants, Union(x). Finally, participants P1, P2, and P3 obtain the union of the data sets of all participants, Union(x) = {1, 2, 3, 4, 5, 6, 7, 8}.

[0121] The specific agreement is as follows:

[0122] Based on the above problem description and solutions, a secure multi-party computation protocol for set intersections and unions under a semi-honest model (Protocol 1 shown in Table 1) is designed in conjunction with the threshold NTRU encryption system. The flowchart of Protocol 1 is as follows: Figure 1 The simulation diagram is as follows Figure 2 .

[0123] Table 1

[0124]

[0125]

[0126] Correctness analysis:

[0127] Protocol 1 can correctly calculate the intersection and union of the sets of multiple participants. The following is an analysis of the correctness of Protocol 1.

[0128] (1) In step (1) of protocol 1, each participant P i They all have their own data sets After encoding according to equation (1), each piece of data from each participant will correspond one-to-one in the whole set U. Therefore, in step (3) of the protocol, participant P1 calculates E(a) sequentially based on the ciphertext matrix E(V) and equation (3). k ) is correct.

[0129] (2) In step (2) of protocol 1, participant P i Both use the threshold NTRU encryption algorithm with additive homomorphism to encrypt their data. Therefore, in step (3) of protocol 1, participant P1 computes the encryption in the ciphertext state. That is correct.

[0130] (3) In steps (3) and (4) of Protocol 1, after P1 calculates and publishes the ciphertext vector E(A), since the threshold NTRU encryption algorithm is used, the decryption process of E(A) requires all participants to use their own secret share y. i (i = 1, ..., n) will participate in the decryption together, and the plaintext information will be generated by all participants P. iJoint generation ensures the correctness of the calculation results. Because step (4) of the protocol requires the plaintext vector to be generated... If the elements in the table are subtracted, then E(a) is calculated in step (3) of the protocol. k After that, each E(a) can be separated from the one in equation (2) as shown. k Adding "1" does not affect the final calculation result; the difference operation eliminates the effect of "1".

[0131] (4) After each participant obtains the plaintext calculation result A in steps (4)-(6) of Protocol 1, each participant can represent the data in A by adding "1" (except for a0). i The joint data set X = {X1, X2, ..., X} n Given the ascending multiple sorting positions of the data in A (identical elements occupy the same sorting position; if there are K identical elements, the sorting position of the next larger element increases by K positions), then: ① It is impossible to deduce the individual participants P from the data in A. i Private data set X i The information in L, and therefore, the information in each participant's private data set, cannot be deduced from the data in L. ② Let the data in A... By subtracting each pair of elements (excluding a0), we can obtain every element u in the universal set U. k (k = 0, 1, ..., N) u ) In all participants P i The number of elements existing in the joint data set X, and then, through the judgment in step (6) of protocol 1, the number of each participant P. i This allows us to obtain the intersection and union of the sets of all participants.

[0132] Security verification:

[0133] The following uses a simulation example method, that is, by constructing a simulator S, to demonstrate the security of the protocol 1 of this invention.

[0134] Proposition 2: Protocol 1 of this invention can securely compute the intersection and union of sets of multiple participants.

[0135] Proof: Since each participant P1,…P n Since all participants are equal in Protocol 1, it is sufficient to prove that the private data of one participant is secure within Protocol 1. The following proves P... n Private data is secure. Let P = {P1, ..., P2}. n-1}, X P ={X1,…,X n-1 For P, construct a simulator S. S constructs a threshold NTRU encryption system with additive homomorphism and simulates the execution process of Protocol 1, as follows:

[0136] (1) Simulator S receives input information (P,X) P ,f P (X P ,X n After that, randomly select And it satisfies:

[0137] f P (X P ,X n )=f P (X P ,X′ n ).

[0138] (2) The simulator S uses the data sets X1,…,X of each participant according to equation (1). n-1 ,X′ n The encoding is: V1,…,V n-1 ,V′ n .

[0139] (3) Simulator S uses a threshold NTRU encryption system to encode vectors V1,…,V n-1 ,V′ n Each element in the vector is encrypted, and the encrypted vector is represented as E(V1),...,E(V2). n-1 ),E(V′ n The encryption process is as follows:

[0140]

[0141] Where i = 1, ..., n, k = 0, 1, ..., N u .

[0142] (4) Simulator S will convert E(V1),...,E(V) n-1 ),E(V′ n This forms a ciphertext matrix E(V′)(n×(N)). u +1)):

[0143]

[0144] Let each element in the universal set U be u. k (k = 0, 1, ..., N) u The simulator S calculates E(a′) based on E(V′) and in the following manner. k (k = 0, 1, ..., N) u ):

[0145]

[0146] Then let

[0147] (5) The simulator S uses the sub-secrets y of each participant. i Decrypting the ciphertext vector E(A′) yields the plaintext vector.

[0148] (6) Simulator S sets the data in A′ The differences between each pair (excluding a′0) are: l′1 = a′2 - a′1, l′2 = a′3 - a′2. make

[0149] (7) Based on the judgment of L′ and step (7) of protocol 1, simulator S obtains the intersection of all participants Inter′(x) and the union of all participants Union′(x).

[0150] Let π denote the protocol 1 of this invention. f represents the sequence of information obtained during the execution of Protocol 1. P (X P ,X n () indicates the output result after executing protocol 1 of this invention. Existing:

[0151]

[0152] Let S(X) P ,f P (X P ,X n )) represents the information sequence obtained during the execution of protocol 1 in simulator S, f P (X P ,X′ n () indicates the output result after the simulation ends. Existing:

[0153] S(X P ,f P (X P ,X n ))={X P ,E(V′),E(A′),f P (X P ,X′ n )}.

[0154] Protocol 1 of this invention employs a threshold NTRU encryption system with semantic security, where each participant P... i The private encoded vector V iThe ciphertext obtained after the data in the protocol is encrypted can only be decrypted jointly by all participants. Even if all members of the member set P conspire to decrypt it, they cannot decrypt any of the ciphertext generated during the protocol execution process. Therefore, E(V) and E(V′) are computationally indistinguishable; since the element E(a) in E(A) k (k = 0, 1, ..., N) u E(L) is calculated in the ciphertext state using the additive homomorphism of the threshold NTRU encryption system; therefore, E(L) and E(L′) are computationally indistinguishable. Furthermore, because f... P (X P ,X n )=f P (X P ,X′ n Therefore, we have:

[0155]

[0156] in, This means that they are indistinguishable in terms of calculation.

[0157] Therefore, Protocol 1 of this invention is secure. Specific Implementation Method Two:

[0159] This implementation method is a secure multi-party computation scheme for the intersection and union of sensitive data sets among medical institutions. It is based on a malicious model and is therefore a secure multi-party computation scheme resistant to malicious deception. This implementation method is also illustrated using a medical institution as an example.

[0160] By analyzing the shortcomings of the set-based secure multi-party computation protocol (protocol 1) under the semi-honest model when participants commit deception, a set-based secure multi-party computation scheme resistant to malicious deception is designed.

[0161] Malicious Behavior Analysis:

[0162] Under the condition of malicious participation, the following deceptive behaviors may occur under Agreement 1:

[0163] (a) The ciphertext entered by the participant may be incorrect. Participant P i In step (2) of protocol 1, data E(V2),…,E(V) that was not encrypted using the threshold NTRU encryption algorithm but was correctly encrypted may be included. n Send to P1.

[0164] (b) The results output by the participants may be incorrect. Participant P1 may not have correctly calculated E(a) in step (3) of Protocol 1. k Or, disclose incorrect ciphertext vectors to other participants.

[0165] (1) Verify the correctness of the input ciphertext. In steps (2) and (3) of protocol 1, enable participant P1 to access P2, ..., P n The transmitted ciphertext vectors E(V2),…,E(V) n The correctness of P2, ..., P is verified without disclosing information from the private data sets of each participant. n The correctness of the ciphertext vector E(V1) sent by P1 can be verified without revealing the private data of each participant.

[0166] (2) Verify the correctness of the calculation results. In step (3) of Protocol 1, after P1 publishes E(A) to the other participants, the other participants can verify whether the calculation process of E(A) is correct.

[0167] The specific agreement is as follows:

[0168] Based on the above solutions and Protocol 1, and combined with the threshold NTRU encryption system, a secure multi-party computation protocol resistant to malicious spoofing is designed (Protocol 2 shown in Table 2). The flowchart of Protocol 2 is as follows: Figure 3 As shown in the simulation diagram Figure 4 As shown.

[0169] Table 2

[0170]

[0171]

[0172]

[0173] Correctness analysis:

[0174] Protocol 2 can correctly calculate the intersection and union of the sets of multiple participants. The following is an analysis of the correctness of Protocol 2.

[0175] (1) In step (1) of protocol 2, each participant P i They all have their own data sets After encoding according to equation (1), each piece of data from each participant will correspond one-to-one in the whole set U. Therefore, in step (4) of the protocol, participant P1 calculates E(a) sequentially based on the ciphertext matrix E(V) and equation (4). k ) is correct.

[0176] (2) In step (2) of protocol 2, participant P i Both use the threshold NTRU encryption algorithm (which has additive homomorphism) to encrypt their data. Therefore, in step (4) of protocol 2, participant P1 calculates in the ciphertext state. That is correct.

[0177] (3) In step (2) of protocol 2, P t (t=2,3,…,n) respectively, the ciphertext vector E(V) t ) and verification information prove tk If sent to P1, then in step (3) of protocol 2, P1 can verify h(x) tk =E(v) ik (k = 0, 1, ..., N) u To determine P t Is the transmitted ciphertext correct? Because if E(V) t If all of the above are correct, then:

[0178]

[0179] v tk +pr tk (x)h(x)(modq,modx N -1)=E(v tk )

[0180] (4) In step (4) of protocol 2, P1 publishes E(V), E(A) and prove 1k Afterwards, other participants can verify h(x) in step (5) of protocol 2. 1k =E(v) 1k To determine the ciphertext generated by P1 in E(V) Is this correct? Because if Both are correct, then:

[0181]

[0182] v 1k +pr 1k (x)h(x)(modq,modx N -1)=E(v 1k )

[0183] (5) In step (5) of Protocol 2, other participants can verify To determine the ciphertext calculated by P1 in E(A). Whether it is correct or not, this verification process is equivalent to participant P. t Simulate the calculation process of E(A) once each.

[0184] (6) Due to the use of the threshold NTRU encryption algorithm, the decryption process of E(A) in step (6) of protocol 2 requires all participants to use their own secret share y i(i = 1, ..., n) participate in the decryption together, and the plaintext information is jointly generated by all participants, which ensures the correctness of the calculation result.

[0185] (7) In steps (6) and (7) of protocol 2, since the data in A represents the joint data set X = {X1, X2, ..., X...} n Given the ascending multiple sorting positions of the data in A and L, then: ① It is impossible to deduce the individual participants P from the data in A and L. i Private data set X i Information in ②A. After taking the difference between each pair of elements (excluding a0), we can obtain each element u in the universal set U. k (k = 0, 1, ..., N) u ) In all participants P i The number of elements existing in the joint data set X is determined by the judgment in step (8) of protocol 2, and each participant can obtain the intersection and union of the sets of multiple participants.

[0186] Security proof:

[0187] The following uses a simulation example method, that is, by constructing a simulator S, to demonstrate the security of the protocol 2 of this invention.

[0188] Proposition 3: Protocol 2 of this invention can securely compute the intersection and union of sets of multiple participants.

[0189] Proof: Since each participant P1,…P n Since all participants are equal in Protocol 2, it is sufficient to prove that the private data of one participant is secure within Protocol 2. The following proves P... n Private data is secure. Let P = {P1, ..., P2}. n-1}, X P ={X1,…,X n-1 For P, construct a simulator S. S constructs a threshold NTRU encryption system with additive homomorphism and simulates the execution process of protocol 2, as follows:

[0190] (1) Simulator S receives input information (P,X) P ,f P (X P ,X n After that, randomly select And it satisfies:

[0191] f P (X P ,X n )=f P (X P ,X′ n ).

[0192] (2) During the simulation of Protocol 2, S generates the following information:

[0193] prove′ nk ,E(V′),E(A′),f P (X P ,X′ n ).

[0194] Let S(X) P ,f P (X P ,X n )) represents the information sequence obtained during the execution of protocol 2 in simulator S, f P (X P ,X′ n () indicates the output result after the simulation ends. Existing:

[0195] S(X P ,f P (X P ,X n ))={X P ,prove′ nk ,E(V′),E(A′),f P (X P ,X′ n )}.

[0196] Let π denote the protocol 2 of this invention. f represents the sequence of information obtained during the execution of Protocol 2. P (X P ,X n This indicates the output result after executing protocol 2 of this invention. It exists that:

[0197]

[0198] Due to the calculation process There are two unknowns v in it nk and r nk (x), other participants P1,…P n-1 Unable to be proven nk The values ​​of h(x) and p derive P n private information v nk or r nk (x), therefore prove nk with prove′ nk Computationally indistinguishable; Protocol 2 of this invention employs a threshold NTRU encryption system with semantic security, where each participant's private encoded vector V... iThe ciphertext obtained after the data in the protocol is encrypted can only be decrypted jointly by all participants. Even if all members of the member set P conspire to decrypt it, they cannot decrypt any of the ciphertext generated during the protocol execution process. Therefore, E(V) and E(V′) are computationally indistinguishable; since the element E(a) in E(A) k (k = 0, 1, ..., N) u E(L) is calculated in the ciphertext state using the additive homomorphism of the threshold NTRU encryption system; therefore, E(L) and E(L′) are computationally indistinguishable. Furthermore, because f... P (X P ,X n )=f P (X P ,X′ n Therefore, we have:

[0199]

[0200] in, This refers to something that is indistinguishable in terms of calculation.

[0201] Therefore, Protocol 2 of this invention is secure.

[0202] The advantages of this invention were analyzed and compared through computational and communication complexity analysis and experimental testing. The symbol m represents the cardinality of the universal set U, n represents the number of participants, and M represents the multiplication operation. p M represents modulo exponentiation. q This indicates a modular multiplication operation.

[0203] Computational complexity analysis:

[0204] Protocols 1 and 2 in *Privacy-preserving mixedset operation* employ the threshold ElGamal encryption scheme, achieving confidential computation of multi-party unions and intersections under a semi-honest model. The computational complexity analysis of these protocols focuses primarily on the relatively time-consuming modular exponentiation operations. Therefore, Protocol 1 (Protocol 2) in *Privacy-preserving mixedset operation* requires a total of m(3n+1) modular exponentiation operations.

[0205] Protocol 2 in "Securely Computing Protocol of Set Intersection under the Malicious Model" implements a two-party confidential computation set intersection protocol under the Malicious Model based on the Pailler encryption algorithm, which requires a total of 112m modulo exponentiation operations.

[0206] Protocol 1 and Protocol 2 in "Secret Computation of Two-Party Rational Number Multisets" utilize a secret inner product protocol to implement secret computation of the intersection and union of two-party rational number multisets under a semi-honest model. Protocol 1 (Protocol 2) in "Secret Computation of Two-Party Rational Number Multisets" does not use a public-key encryption / decryption algorithm. The computational complexity of the protocol is calculated in terms of the number of multiplication operations, requiring a total of l(3l+4)+4k(3d+1) multiplication operations, where l represents the integer agreed upon by both participants, k represents the cardinality of the intersection or union of the standard multisets, and d is the maximum multiplicity of the multiset elements.

[0207] Protocol 1 and Protocol 2 of this invention employ a threshold NTRU encryption system to respectively implement confidential set computation of multiple participants in a semi-honest model and a deception-resistant scenario.

[0208] In step (2) of protocol 1, each participant P i Each needs to be encrypted m (m = N) u +1) times, all participants need to encrypt a total of mn times; in step (4) of protocol 1, each participant needs to jointly decrypt m times. Therefore, the total number of modular multiplication operations in protocol 1 of this invention is m(n+1) times.

[0209] In step (2) of protocol 2, each participant P i Each needs to be encrypted m (m = N) u +1) times, calculate prove ik m calculations are required, and all participants need to perform a total of 2mn calculations; in step (3) of protocol 2, participant P1 needs to perform m(n-1) verification calculations; in step (5) of protocol 2, participant P t (t=2,3,…,n) requires 2m-1 verification calculations each, for a total of (2m-1)(n-1) verification calculations; in step (6) of protocol 2, each participant needs to jointly decrypt m times. Therefore, the total number of modular multiplication operations in protocol 2 of this invention is m(5n-2)-n+1 times.

[0210] The following analysis of the number of communication rounds in the protocol determines the communication complexity of the protocol.

[0211] In the Privacy-preserving mixed set operation, Protocol 1 and Protocol 2 require n-1 rounds of communication during the construction of the public key, the calculation of the intersection also requires n-1 rounds of communication, and the joint decryption process also requires n-1 rounds of communication. Therefore, Protocol 1 (Protocol 2) in the Privacy-preserving mixed set operation requires a total of 3n-3 rounds of communication throughout the entire process.

[0212] The execution of Protocol 2 in "Securely Computing Protocol of Set Intersection under the Malicious Model" requires a total of 5 rounds of communication.

[0213] Protocol 1 for "Secret Computation of Multisets of Two Rational Numbers" requires 7 rounds of communication, while Protocol 2 requires 8 rounds of communication.

[0214] In the preparation phase of Protocol 1 of this invention, the sub-secrets y of each participant i The distribution of (i = 1, 2, ..., n) requires n rounds of communication; in step (2) of protocol 1, participant P t (t=2,3,…,n) respectively assign their ciphertext vector E(V) t ) is sent to P1, and then in step (3) of protocol 1, P1 sends to the other participants P t The announcement of E(A) requires n-1 rounds of communication in steps (2) and (3) of Protocol 1; in step (4) of Protocol 1, all participants jointly decrypt the ciphertext vector E(A), requiring n-1 rounds of communication. In summary, Protocol 1 of this invention requires a total of 3n-2 rounds of communication.

[0215] In the preparation phase of Protocol 2 of this invention, the sub-secrets y of each participant i The distribution of (i = 1, 2, ..., n) requires n rounds of communication; in step (2) of protocol 2, P t (t=2,3,…,n) respectively E(V t ) and prove tk Send to P1, and then in step (4) of protocol 2, P1 sends to the other participants P t Publish E(V), E(A) and prove 1k In Protocol 2, steps (2) and (4) require a total of n-1 rounds of communication; in step (6) of Protocol 2, all participants jointly decrypt the ciphertext vector E(A), which requires n-1 rounds of communication. In summary, Protocol 2 of this invention requires a total of 3n-2 rounds of communication.

[0216] Table 3 presents a performance comparison of Protocol 1 and Protocol 2 of this invention with the protocols in "Privacy-preserving mixed set operation" (Table 3,

[26] ), "Securely Computing Protocol of Set Intersection under the Malicious Model" (Table 3,

[33] ), and "Secure Computation of Two-Party Rational Number Multisets" (Table 3,

[34] ). Protocol 1 and Protocol 2 of this invention allow multiple participants. In terms of computational complexity, Protocol 1 of this invention has linear computational complexity, which is lower than that of the protocol in "Privacy-preserving mixed set operation" and has higher computational efficiency. Since Protocol 2 of this invention is a protocol for preventing malicious deception, it adds the computational step of verifying the ciphertext, and its computational complexity is higher than that of Protocol 1 under the semi-honest model and the protocol in "Privacy-preserving mixed set operation". In terms of communication complexity, Protocol 1 and Protocol 2 of this invention have the same linear communication complexity and are slightly lower than that of the protocol in "Privacy-preserving mixed set operation".

[0217] The protocols described in "Privacy-preserving mixed set operation" demonstrate that, overall, protocols 1 and 2 of this invention have low computational and communication complexity and high computational and communication efficiency.

[0218] Table 3 Comparison of Protocol Performance

[0219]

[0220] To verify the efficiency of Protocol 1 and Protocol 2 of the present invention, simulation experiments were conducted on Protocol 1 and Protocol 2 of the present invention using the Python 3.12.2 programming language on the PyCharm 2023.3.5 platform, and the results were compared with related solutions.

[0221] Experimental environment: The computer configuration is Windows 11 64-bit system, Intel(R) Core(TM) i7-12700H CPU@2.3GHz, 16GB RAM. The communication bandwidth is 100Mbps.

[0222] Experimental parameter settings: In the experiment, the key length of the threshold ElGamal encryption algorithm, Paillier encryption algorithm and threshold NTRU encryption algorithm is 512 bits, and the length of the random number is 64 bits.

[0223] Experiment 1: With a fixed number of participants n (assuming n = 20), simulate the execution time and communication delay time of Protocol 1 and Protocol 2 of this invention and the protocol in "Privacy-preserving mixed set operation" as a function of the potential m of the universal set U. Perform 1000 experiments and take the average of the results. The trends of execution time and communication delay time as a function of m are shown below. Figure 5 and Figure 6 As shown.

[0224] from Figure 5 It can be concluded that, when the number of participants n is constant, the execution time of Protocol 1 and Protocol 2 of this invention exhibits a linear growth trend with the increase of the potential m of the universal set U, and the growth rate is relatively low. Under the same value of m, the execution time of Protocol 1 of this invention is less than that of the protocol in "Privacy-preserving mixed set operation," indicating higher execution efficiency. Since Protocol 2 of this invention is a protocol for anti-spoofing scenarios, it adds a verification step; therefore, the execution time of Protocol 2 of this invention is longer than that of the protocol in "Privacy-preserving mixed set operation." Figure 6 As can be seen, when the number of participants n is constant, the communication latency of Protocol 1 and Protocol 2 of this invention increases linearly with the increase of the potential m of the universal set U. The overall communication latency is low, the growth rate is low, and the communication efficiency is high. Under the same value of m, the communication latency of Protocol 1 and Protocol 2 of this invention is lower than that of the protocol in "Privacy-preserving mixed set operation," while the communication latency of Protocol 2 of this invention is slightly higher than that of Protocol 1. In practice, the latency may vary between different networks.

[0225] Experiment 2: With a constant potential m of the universal set U (assuming m = 30), simulate the execution time and communication delay time of Protocol 1, Protocol 2, and the protocol in "Privacy-preserving mixed set operation" as a function of the number of participants n. Perform 1000 experiments and take the average of the results. The trends of execution time and communication delay time as a function of n are shown below. Figure 7 and Figure 8 As shown.

[0226] from Figure 7It can be concluded that when the potential m of the universal set U is constant, the execution time of Protocol 1 and Protocol 2 of this invention increases linearly with the increase of the number of participants n, and the growth rate is relatively low. Under the same value of n, the execution time of Protocol 1 of this invention is less than that of the protocol in "Privacy-preserving mixed set operation", and the execution efficiency is higher. Since Protocol 2 of this invention is a protocol for anti-spoofing scenarios, it adds a verification step, therefore the execution time of Protocol 2 of this invention is slightly longer than that of the protocol in "Privacy-preserving mixed set operation". Figure 8 As can be seen, when the potential m of the entire set U is constant, the communication latency of Protocol 1 and Protocol 2 of this invention exhibits a linear growth trend with the increase of the number of participants n. Overall, the communication latency is low, the growth rate is low, and the communication efficiency is high. Under the same value of n, the communication latency of Protocol 1 and Protocol 2 of this invention is lower than that of the protocols in "Privacy-preserving mixed set operation," while the communication latency of Protocol 2 of this invention is higher than that of Protocol 1. In practice, the latency may vary between different networks.

[0227] Therefore, the present invention has the following characteristics:

[0228] (1) By adopting the threshold NTRU encryption algorithm and a new encoding method, this invention proposes a secure multi-party computation protocol for the intersection and union of sets under a semi-honest model. This protocol can simultaneously compute the intersection and union of multi-party sets, meet various needs, and has strong applicability.

[0229] (2) To address the problem of malicious user deception, this invention proposes a deception-resistant secure multi-party computation protocol based on a semi-honest model. This protocol enables the verification of both the input ciphertext and the computation result, ensuring the correctness of the final computation result. This protocol can also meet various computational needs.

[0230] (3) This invention performs correctness analysis on both protocols and proves their security through simulation examples. Performance analysis, experimental testing, and comparison with existing related solutions verify the efficiency and practicality of both protocols.

[0231] This invention may have other embodiments. Without departing from the spirit and essence of this invention, those skilled in the art can make various corresponding changes and modifications according to this invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.

Claims

1. A method for securely calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements, characterized in that: Includes the following steps: S100, There are n participants P who need to perform confidential computations. i Let i = 1, 2, ..., n and n > 2, each possessing an ordered set of sensitive data corresponding to an organization with shared confidentiality requirements. t i It is the number of elements contained in the dataset of each participant; each participant P i Your own data set Encoded as Where N u For n participants P i The agreed-upon complete data set U = [0, N] u ], such that the set of participants X i Data x in ij Both belong to U and 0 < x ij <N u j = 1, 2, ..., t i ; S200, P i Select a random polynomial r ik (x), and using r ik (x) will encode its own vector V i Each element in the data is encrypted using a threshold NTRU encryption system, resulting in... For the encoding vector V i Each element in the encryption process is encrypted using threshold NTRU encryption; during the encryption process, all participants P i Obtain the sub-secret y respectively i Participant P t Each of them sets its own ciphertext vector E(V) t Send the data to P1, where t = 2, 3, ..., n; S300 and P1 will combine all E(V) i This forms a ciphertext matrix E(V) and a ciphertext vector E(V). i ) corresponds to the i-th row of E(V): P1 calculates E(a) based on E(V) and in the following manner. k ): P1 command And announce it to other participants; S400, P i Using their respective sub-secrets i They jointly decrypt E(A); ultimately, each participant obtains the plaintext vector. S500, P i Let the data in A Except for a0, take the difference between any two adjacent data points, i.e., l1 = a2 - a1, l2 = a3 - a2, ..., Then let S600, P i make Inter(x) is the intersection, and Union(x) is the union; Based on the data in L, if l z =n, z = 1,2,…,N u -1, then let Inter(x)←Inter(x)∪z; if l z If ≠ 0, then let Union(x) ← Union(x) ∪ z; ultimately, P i We obtain the complete intersection Inter(x) and union Union(x).

2. The method for calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements, as described in claim 1, is characterized in that... Each participant P i Your own data set Encoded as The process includes: Each participant P i An N is obtained by encoding it in the following manner. u +1-dimensional vector V i : Based on vector V i Middle element v is The ordinal number s, if 0 ≤ s < x i1 , let v is =0; if x i1 ≤s<x i2 , let v is =1; if x i2 ≤s<x i3 , let v is =1+1; and so on, if Let v is =t i .

3. A method for calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements, as described in claim 1 or 2, characterized in that: Using r ik (x) will encode its own vector V i The process of encrypting each element using the threshold NTRU encryption system includes: E(v ik )=v ik +pr ik (x)h(x)(mod q,mod x N -1), Where k = 0, 1, ..., N u "E" indicates encryption operation; N, p, q are the parameters of the threshold NTRU encryption algorithm, and h(x) is the public key.

4. A method for calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements, characterized in that: Includes the following steps: (1) There are n participants P who need to perform confidential calculations. i Let i = 1, 2, ..., n and n > 2, each possessing an ordered set of sensitive data corresponding to an organization with shared confidentiality requirements. t i It is the number of elements contained in the dataset of each participant; each participant P i Your own data set Encoded as Where N u For n participants P i The agreed-upon complete data set U = [0, N] u ], such that the set of participants X i Data x in ij Both belong to U and 0 < x ij <N u j = 1, 2, ..., t i ; (2)P i Select a random polynomial r ik (x), and using r ik (x) will encode its own vector V i Each element in the data is encrypted using a threshold NTRU encryption system, resulting in... in For the encoding vector V i The encryption result of each element in the data using threshold NTRU encryption; P i Calculate separately Where p is the parameter of the threshold NTRU encryption algorithm, h(x) is the public key; participant P t Each of them sets its own ciphertext vector E(V) t Send the data to P1, where t = 2, 3, ..., n; (3) P1 verifies using the public key h(x): h(x)prove tk (mod q,mod x N -1)=E(v tk ), Where N and q are the parameters of the threshold NTRU encryption algorithm; If the verification passes, proceed to the next step; otherwise, stop the protocol. (4) P1 will put all E(V) i This forms a ciphertext matrix E(V) and a ciphertext vector E(V). i ) corresponds to the i-th row of E(V): P1 calculates E(a) based on E(V) and in the following manner. k ): P1 command And E(V), E(A) and prove 1k Disclose to other participants; (5) P2,…,P n Verify separately h(x)prove 1k (mod q,modx N -1)=E(v 1k ), When k≠0, If the verification passes, proceed to the next step; otherwise, the agreement terminates. (6)P i Using their respective sub-secrets i They jointly decrypt E(A); ultimately, each participant obtains the plaintext vector. (7)P i Let the data in A Except for a0, take the difference between any two adjacent data points, i.e., l1 = a2 - a1, l2 = a3 - a2, ..., Then let (8) Each participant P i make Inter(x) is the intersection, and Union(x) is the union; Based on the data in L, if l z =n, z = 1,2,…,N u -1, then let Inter(x)←Inter(x)∪z; if l z If ≠ 0, then let Union(x) ← Union(x) ∪ z; ultimately, P i We obtain the complete intersection Inter(x) and union Union(x).

5. A method for calculating the intersection and union of confidentiality of sensitive data sets between organizations with shared confidentiality requirements, as described in claim 4, is characterized in that... Each participant P i Your own data set Encoded as The process includes: Each participant P i An N is obtained by encoding it in the following manner. u +1-dimensional vector V i : Based on vector V i Middle element v is The ordinal number s, if 0 ≤ s < x i1 , let v is =0; if x i1 ≤s<x i2 , let v is =1; if x i2 ≤s<x i3 , let v is =1+1; and so on, if Let v is =t i .

6. A method for calculating the intersection and union of sensitive data sets between organizations with shared confidentiality requirements, as described in claim 4 or 5, characterized in that... Using r ik (x) will encode its own vector V i The process of encrypting each element using the threshold NTRU encryption system includes: E(v ik )=v ik +pr ik (x)h(x)(mod q,mod x N -1), Where k = 0, 1, ..., N u "E" indicates encryption operation; N, p, q are the parameters of the threshold NTRU encryption algorithm, and h(x) is the public key.

Images