Fast threshold multi-party privacy set intersection method

Abstract

The invention discloses a fast threshold multi-party privacy set intersection method, and relates to the technical field of data security. Each participant encrypts a private set of the participant by using a Bloom filter and a public key pk; the participants serving as the server execute homomorphic addition on the densely distributed filters of all the participants to obtain frequency information of all elements in the private sets of all the participants; the server performs homomorphic comparison on the frequency information and a preset threshold T to obtain a threshold intersection result in a ciphertext form; all participants change an encryption key of a threshold intersection result from a public key pk to a public key tpk according to whether a t-N threshold access structure is supported; and the participants serving as the receiver decrypt the threshold intersection result after the public key is switched by adopting the private key tsk corresponding to the public key tpk, and encrypt a dense filter according to the decryption result and the participants to obtain elements at least appearing in the private sets of the T participants. According to the method, the threshold intersection can be efficiently identified, more participants are supported, and the performance is not obviously influenced.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically relating to a fast threshold multi-party privacy set intersection method. Background Technology

[0002] Secure multi-party computation is a key technology for protecting user data. It allows multiple participants to perform secure computation on encrypted inputs and only reveals the final aggregate result, which is significant in supporting collaboration and innovation between individuals and institutions. Multiparty Private Set Intersection (MPSI) is a fundamental task in secure multi-party computation (MPC), allowing multiple untrusted participants to perform computations securely on encrypted inputs. Each holds a private collection Calculate the intersection together They can achieve this without revealing any additional information. However, because MPSI requires that the output strictly consist of elements that appear only in the set of all participants, they are not applicable in certain scenarios. For example, if a malicious participant inputs an empty set, these protocols cannot produce the correct intersection result.

[0003] Threshold Multiparty Private Set Intersection (TMPSI) is a variant of MPSI designed to address the aforementioned problem. TMPSI aims to return all elements in the set of participants that appear at least a threshold number. For example, it can be achieved through... Figure 1 To illustrate the functions of the MPSI and TMPSI protocols, the threshold for TMPSI is set to 2, and Party1, Party2, and Party3 represent three participating parties, as follows: Figure 1 As shown, the private sets of the three participants are {Black, Red, Blue}, {Black, Red, Pink}, and {Black, Green, White}, respectively. The MPSI method determines the intersection of these three sets as "Black", while the TMPSI method determines the intersection as "Black" and "Red". TMPSI provides a secure and privacy-preserving data sharing method, making it suitable for various application scenarios, such as preventing illegal activities through international cooperation, threshold voting, contact discovery, and network risk assessment.

[0004] Based on high-level construction, MPSI protocols can be divided into four main types: MPSI based on homomorphic encryption, MPSI based on oblivious linear computation, MPSI based on oblivious transfer, and MPSI based on garbled circuits. Kolesnikov et al. proposed a modular MPSI approach that can maintain security even in the presence of an arbitrary number of semi-honest participants. Their approach relies on an oblivious programmable pseudo-random function as a key component, allowing secure value sharing and computation without revealing sensitive data. Although this approach performs well when dealing with large sets, the computational complexity increases significantly as the number of participants increases due to the quadratic relationship between the performance of the protocol and the number of participants. Vos et al. proposed new MPSI and multi-party private set union (MPSU) constructions using elliptic curve-based efficient implementations of privacy and operations and privacy or operations. This approach improves performance to some extent, requiring only three rounds of communication.

[0005] Kissner and Song first proposed the concept of threshold and designed the corresponding threshold private set union and threshold private set intersection protocols. Their approach performs homomorphic computation through polynomial factorization, requiring a linear relationship between the number of communication rounds and the number of participants. Miyaji and Nishida implemented TMPSI based on Bloom filters and additive homomorphic encryption schemes, but they did not provide related security analysis. Based on their work, Bay et al. adopted a secure computation protocol (SCP) to further extend the protocol, implementing a TMPSI protocol based on the Paillier encryption system and providing the necessary security analysis. However, due to the inability of Paillier's homomorphic addition to perform batch processing, the computational efficiency is low, and the communication overhead of SCP is large, with a positive relationship between the number of communication rounds and the number of participants. In addition, their scheme does not consider the impact of the false positive probability of the Bloom filter on the protocol, so their scheme has a high false positive probability.

[0006] That is, the current work of TMPSI is mainly based on binary encoding, which encodes each participant's private set into a binary vector, and then estimates the frequency of each element in all sets to implement the TMPSI protocol. The threshold function can be implemented by comparing the frequency of each element with the threshold value using a secure comparison protocol. However, there are some limitations in the existing work. First, they need to traverse the entire binary vector and perform bit-by-bit comparison in a homomorphic manner to identify the intersection. Second, they do not optimize the protocol parameters to obtain the most accurate results, resulting in a higher false positive probability. Third, identifying elements with a frequency greater than the threshold value requires a secure comparison protocol between all participants, resulting in a linear relationship between the number of communication rounds and the number of participants. In multi-party participation protocols, all participants need to perform a series of interactive operations synchronously, especially in the joint key generation and joint decryption phases. Any sudden drop-out of a participant due to device failure or network instability will interrupt the entire protocol process, causing the protocol to fail to continue execution. If a participant suddenly drops out, the protocol needs to be re-executed, which not only wastes computing resources but also reduces efficiency. Therefore, in TMPSI schemes with a large number of participants, higher fault tolerance is required to deal with the situation where a participant drops out. A direct solution to improve protocol efficiency is to use batch processing technology based on error learning in multi-party homomorphic encryption schemes, rather than comparing the entire set of binary vectors bit by bit. However, direct application of batch processing will complicate the implementation of the subsequent threshold function, as error learning-based homomorphic encryption schemes do not support division calculations. In addition, due to the use of batch processing technology, individual secure comparison protocols cannot be performed on each frequency information. SUMMARY

[0007] To solve the above problems existing in the prior art, the present application provides a fast threshold multi-party private set intersection method.

[0008] The technical problem to be solved by the present application is solved by the following technical scheme: The present application provides a fast threshold multi-party private set intersection method, which comprises: Each participant in the plurality of participants uses a Bloom filter and a public key encrypts its own private set to obtain an encrypted Bloom filter of itself; The participant as a server in the plurality of participants performs homomorphic addition on the encrypted Bloom filters of the plurality of participants to obtain frequency information of all elements in the private sets of the plurality of participants; The server homomorphically compares the frequency information of all elements in the private sets of the plurality of participants with a preset threshold T to obtain a threshold intersection result in ciphertext form; The plurality of participants decrypt the threshold intersection result after switching to the public key according to whether the plurality of participants support a t-N threshold access structure Switch to public key t represents the number of online participants, and N represents the total number of the plurality of participants The public key is used by the participants in the plurality of participants as a receiver The corresponding private key The threshold intersection result after switching to the public key is decrypted, and the elements in the private set of at least T participants are obtained according to the decryption result and the encrypted Bloom filter of the self.

[0009] Compared with the prior art, the beneficial effects of the present application are: 1) The present application designs a novel threshold function, which can efficiently identify the threshold intersection under the batch processing of the ciphertext vector by batch comparing the element frequency with the given threshold through the homomorphic ciphertext, can support more participants without significantly affecting the performance, and provides a new idea for the design principle of efficient homomorphism.

[0010] 2) The present application supports a t-N threshold access structure, so that even if some participants drop out, the present application can still continue under the condition that at least t users are online, and the integrity and correctness of the threshold intersection identification are ensured.

[0011] 3) The present application is outstanding in efficiency, and compared with the existing scheme, the running time is greatly reduced, and only a constant number of communication rounds are required to determine the threshold intersection.

[0012] The present application will be further described in detail below in combination with the drawings and specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 is a functional diagram of MPSI and TMPSI Figure 2 is a flowchart of the fast threshold multi-party private set intersection method provided by the embodiment of the present application Figure 3 is a schematic diagram of the three participants performing the initialization phase provided by the embodiment of the present application Figure 4 is a principle diagram of the three participants generating their own encrypted Bloom filter according to their own private set, and performing homomorphic addition on all encrypted Bloom filters provided by the embodiment of the present application Figure 5 is a principle diagram of the Bloom filter Figure 6 is an action diagram of the threshold calculation function provided by the embodiment of the present application Figure 7 is a schematic diagram of key switching of a threshold intersection result according to whether a t-N threshold access structure is supported by three participants according to an embodiment of the present application, and determining a set of elements in a private set of at least T participants in plaintext form according to the threshold intersection result after key switching; Figure 8a is a comparison diagram of running efficiency of the present application and other schemes in the case of 25 participants according to an embodiment of the present application; Figure 8b is a comparison diagram of running efficiency of the present application and other schemes in the case of 35 participants according to an embodiment of the present application; Figure 8c is a comparison diagram of running efficiency of the present application and other schemes in the case of 45 participants according to an embodiment of the present application; Figure 9a is a comparison diagram of communication volume of the present application and other schemes in the case of α=3 according to an embodiment of the present application; Figure 9b is a comparison diagram of communication volume of the present application and other schemes in the case of α=5 according to an embodiment of the present application; Figure 10a is a comparison diagram of running efficiency of the present application and other schemes in the case of a size of a private set of each participant being 256 and a preset threshold being set to a number of participants according to an embodiment of the present application; Figure 10b is a comparison diagram of running efficiency of the present application and other schemes in the case of a size of a private set of each participant being 1024 and a preset threshold being set to a number of participants according to an embodiment of the present application. DETAILED DESCRIPTION

[0014] The present application will be further described in detail below with reference to specific embodiments, but the embodiments of the present application are not limited thereto.

[0015] To solve the problems in the background art, the present application proposes a fast threshold numerous participants private set intersection (TNPP) scheme. The main idea is to determine the elements with frequency exceeding the threshold from the batch encrypted ciphertext by substituting the frequency information of all set elements into a carefully designed threshold function. Specifically, the present application lets each participant first map the elements in its private set onto a Bloom filter, and then compresses the Bloom filter through batch processing and encryption before sending it to the server. The server calculates the frequency of all elements using homomorphic addition. Then the calculated frequency is substituted into the threshold function for homomorphic calculation to achieve threshold intersection identification. In addition, considering that some users may suddenly drop out of the occasional scene, which may cause the protocol to be interrupted. To solve this problem, the present application uses a t-out-of-N threshold access structure to enable the protocol to continue in the presence of at least t users online, ensuring the integrity and correctness of threshold intersection identification. The performance of the present application is linearly related to the length of the Bloom filter, and only one round of communication is needed to determine the threshold intersection.

[0016] Figure 2 is a flowchart of the fast threshold numerous participants private set intersection method provided by the embodiments of the present application, which is applied to the scene of multiple participants seeking set intersection. The multiple participants include a participant as a server, a participant as a receiver and other participants, each of which has a private set. As shown in Figure 2 , the method comprises: S101, each participant in the multiple participants uses a Bloom filter and a public key to encrypt its own private set to obtain its own encrypted Bloom filter.

[0017] S102, the participant as the server in the multiple participants obtains the frequency information of all elements in the private sets of the multiple participants by performing homomorphic addition on the encrypted Bloom filters of the multiple participants.

[0018] S103, the server compares the frequency information of all elements in the private sets of the multiple participants with a preset threshold T homomorphically to obtain a threshold intersection result in the form of ciphertext.

[0019] S104, the multiple participants switch the encryption key of the threshold intersection result from the public key to the public key according to whether the t-N threshold access structure is supported by the multiple participants, where t represents the number of online participants and N represents the total number of participants.

[0020] Here, the English expression of the t-N threshold access structure is "t-out-of-N-threshold access-structure", and the access structure is prior art, and the present application does not repeat it. It should be noted that whether the plurality of participants support the t-N threshold access structure is pre-negotiated by the plurality of participants.

[0021] S105, the participant in the plurality of participants as the receiver adopts the public key The corresponding private key Decrypt the threshold intersection result after switching the public key, and obtain the elements that appear in at least T private sets of the participants according to the decryption result and the encrypted Bloom filter of itself, wherein when the plurality of participants is not the first time to find the set intersection, the public key And the private key Is a pair of public and private keys generated by the receiver in the initialization stage when the plurality of participants is the first time to find the set intersection, the public key Is the public key generated by the plurality of participants in the initialization stage according to whether the plurality of participants support the t-N threshold access structure, and the private key is generated by the plurality of participants.

[0022] That is, when the plurality of participants is the Qth time to find the set intersection, and Q is greater than or equal to 2, then the public key And the private key Is a pair of public and private keys generated by the receiver in the initialization stage when the plurality of participants is the first time to find the set intersection, the public key Then the plurality of participants in the initialization stage according to whether the plurality of participants support the t-N threshold access structure, and the private key is generated by the plurality of participants. When the plurality of participants is the first time to find the set intersection, the initialization stage needs to be performed first to obtain the public key And the private key The private key of each participant, and the public key .

[0023] It should be noted that this invention can be applied to scenarios such as threshold voting, contact discovery, and network risk assessment. Specifically, in the threshold voting scenario, each voter is a participant, and the vote counting party is also a participant. The vote counting party acts as both the receiver and the server. Each voter's private set is the candidate they voted for or the hash of their vote (e.g., {candidate A}), and the vote counting party's private set is the complete set of all possible candidates (e.g., {candidate A, candidate B, candidate C}). The final intersection is the intersection of the sets of the counting party and the voters, representing which candidate they voted for, without revealing other voting information. When the number of votes reaches the threshold, it can be proven that a candidate's support rate has exceeded the limit. In the contact discovery scenario (e.g., friend recommendations in chat software), both the client user and the server are participants, and the client user is the receiver. The client user's private set is their own address book (e.g., {phone number A, phone number B, email C}), and the server's private set is the set of all registered user accounts (e.g., {phone number B, phone number D, email E}). The final intersection result, for example, is {phone number B}, indicating that someone in the user's contacts is already using the application, and it can be recommended to add them as a friend. In a network risk assessment scenario, each organization is a participant, such as organization A and organization B. Organization A's private set is its list of suspected or monitored high-risk accounts / devices / Internet Protocol (IP) addresses, while organization B's private set is its own risk blacklist or customer list. The final intersection result is the same risk object (such as a phone number / IP appearing on multiple blacklists), thus allowing for more confident marking of risk objects as high-risk.

[0024] In some embodiments, the initialization phase includes the following steps: S001. The receiver generates a public-private key pair and publishes the public key to the remaining participants. .

[0025] Specifically, the recipient uses the key generation algorithm in a multi-party homomorphic encryption algorithm to generate a public-private key pair. and announce .

[0026] S002. Multiple participants jointly generate a public key based on whether they support the tN threshold access structure. and relinearized key .

[0027] Here, when multiple participants do not support the tN threshold access structure, each participant generates its own private key. Subsequently, multiple participants used their own private keys Jointly generate public key and relinearized key Specifically, each participating party The private key is generated and stored using the key generation algorithm in multi-party homomorphic encryption. Afterwards, the participating parties utilized The public key is generated using the joint public key generation algorithm and the joint relinearization key generation algorithm in multi-party homomorphic encryption. and relinearized key .

[0028] Here, when multiple parties support the tN threshold access structure, each party generates its own private key, and each of at least t of the multiple parties generates its own additional key based on its own private key. At least t participants jointly generate a public key using their own additional keys. and relinearized key Specifically, each participating party The private key is generated and stored using the key generation algorithm in multi-party homomorphic encryption. Then, each of at least t participants draws from a predefined polynomial ring. Randomly select a polynomial As a common point, each of the at least t participants then generates its own additional key using the thresholding algorithm in the threshold multi-party homomorphic encryption algorithm, based on a randomly selected polynomial and its own private key. Then, these at least t participants utilized The public key is generated using the joint public key generation algorithm and the joint relinearization key generation algorithm in the threshold multi-party homomorphic encryption algorithm. and relinearized key .

[0029] For example, Figure 3 This is a schematic diagram illustrating the initialization phase performed by three participants: Participant 1, Participant 2, and Participant 3. , and These represent the private keys of participant 1, participant 2, and participant 3, respectively, and are shown outside the black dashed box. and These represent the public key and relinearization key jointly generated by the three participants using their private keys, assuming that none of the three participants support the tN threshold access structure. The black dashed box indicates... and Parties 1 and 2 generate an additional key by using their own private key, and then generate a joint public key and a relinearization key by using their own additional key.

[0030] In some embodiments, S101 is implemented by the following steps: S1011, each party generates its own Bloom filter according to a hash function pre-agreed by the parties.

[0031] S1012, each party converts its own private set into a binary vector by using its own Bloom filter, and performs batch processing on the binary vector by using a packing algorithm in the multi-party homomorphic encryption algorithm according to the length d of its own Bloom filter and a preset homomorphic encryption parameter n, and encrypts the binary vector after batch processing by using an encryption algorithm in the multi-party homomorphic encryption algorithm to obtain its own encrypted Bloom filter. S1012, each party converts its own private set into a binary vector by using its own Bloom filter, and performs batch processing on the binary vector by using a packing algorithm in the multi-party homomorphic encryption algorithm according to the length d of its own Bloom filter and a preset homomorphic encryption parameter n, and encrypts the binary vector after batch processing by using an encryption algorithm in the multi-party homomorphic encryption algorithm to obtain its own encrypted Bloom filter.

[0032] Specifically, each party converts its own private set into a binary vector by using its own Bloom filter, and then calculates the number of batch processing times , which represents the ceiling, and then divides the binary vector into segments, and performs batch processing on the segmented binary vector by using a packing algorithm in the multi-party homomorphic encryption algorithm, and after batch processing, encrypts the binary vector by using an encryption algorithm in the multi-party homomorphic encryption algorithm according to its own public key to obtain its own encrypted Bloom filter, wherein the encrypted Bloom filter has segments. Exemplarily, Figure 4 is a schematic diagram of the principle of generating encrypted Bloom filters by the three parties 1, 2 and 3 according to their own private sets, and performing homomorphic addition on all encrypted Bloom filters. As shown in Figure 4 , each party converts its own private set into a binary vector, and then performs batch processing and encryption by using a public key to obtain an encrypted Bloom filter (for example, each encrypted Bloom filter has two segments, batch 1 and batch 2), and then performs homomorphic addition on the encrypted Bloom filters of the three parties, so that the frequency information of all elements in the private sets of the three parties can be obtained, wherein represents an addition operation.

[0033] Exemplarily, Figure 5 is a schematic diagram of the principle of a Bloom filter. As shown in Figure 5 ​As shown, {black, red, blue} represents the private set of party 1, and the binary vector containing 0 and 1 under {black, red, blue} represents the encrypted Bloom filter of party 1 generated according to the private set {black, red, blue} of party 1, {black, red, pink} represents the private set of party 2, and the binary vector containing 0 and 1 under {black, red, pink} represents the encrypted Bloom filter of party 2 generated according to the private set {black, red, pink} of party 2, as shown in Figure 5 As shown, by calculating the Hadamard product between the encrypted Bloom filters of party 1 and party 2, a new encrypted Bloom filter can be obtained, which represents the intersection {black, red} of the private sets of party 1 and party 2, wherein, represents the Hadamard product.

[0034] Since the set is converted into a binary vector using the Bloom filter, the present application also provides guidance for selecting appropriate Bloom filter parameters after analyzing the influence of the false positive rate of the Bloom filter on the accuracy of the TMPSI protocol, specifically: when the false positive probability of the Bloom filter is 0.1%, and the size of the private set of each party is represented as Set Size, N-T=α, the selection of the length FL of the Bloom filter can refer to the following schemes: When Set Size=64, and α is 1, 3, 5 respectively, FL is 1261, 4495, 7714 respectively; When Set Size=128, and α is 1, 3, 5 respectively, FL is 2521, 18057, 30854 respectively; When Set Size=256, and α is 1, 3, 5 respectively, FL is 5043, 18057, 30854 respectively; When Set Size=512, and α is 1, 3, 5 respectively, FL is 10085, 36113, 61709 respectively; When Set Size=1024, and α is 1, 3, 5 respectively, FL is 20170, 72226, 123418 respectively.

[0035] It should be noted that these selection schemes are proposed by the present application after analyzing the influence of the inherent false positive probability of the Bloom filter on the correctness of the results obtained by the present application.

[0036] Specifically, the threshold intersection result is a polynomial to be solved Therefore, the above S103 is achieved through the following steps: S1031, Server Setting Vector sum vector And set the polynomial to be calculated. The initial values ​​of the coefficients of the first and second terms are -T and 1, respectively, where the vector Represents the polynomial to be found All coefficients, vector Representing vectors Intermediate variables.

[0037] S1032, The server, based on the vector ,vector Given the initial values ​​of the coefficients of the first and second terms, solve for the polynomial to be solved. The coefficients of each term.

[0038] Specifically, the server lets k represent the k-th iteration, and j represent the j-th iteration in the k-th iteration, with the initial value of j being 0. The vector... The initial value is 0, where k takes values ​​from 0 to NT-1; in the k-th iteration, let i = T+1 + k, then perform the j-th iteration in the k-th iteration, and in the j-th iteration, according to calculate And according to -i, and Generate updated , Represents the polynomial to be found The coefficient of the (j+1)th term, Represents the j-th intermediate variable. Let j be the (j+1)th intermediate variable. Then, let j = j+1 and continue with the j-th iteration in the k-th iteration until j = i - T+1, at which point the updated value is obtained. Then, let k = k+1, and then according to the updated... Continue the k-th iteration until k = NT, at which point the final vector is obtained. The final vector As the vector Where i is initially set to T+1. Specifically, , .

[0039] S1033, The server determines the first value L based on N and T, and based on N, T and... Determine the second value H.

[0040] Specifically, , wherein N represents the total number of participants, and T represents a preset threshold.

[0041] S1034, the server calculates the j2th part polynomial of the polynomial to be solved according to the encrypted Bloom filter of the receiver, the vector, the coefficients of each term in the polynomial to be solved, the 2th to (L-1)th power of the j2th frequency information, and the Lth to (H-1)Lth power of the j2th frequency information. , H, the frequency information of all elements in the private set of the plurality of participants , the relinearization key , the encrypted Bloom filter of the receiver .

[0042] Specifically, the frequency information of all elements in the private set of the plurality of participants is an entirety, and the frequency information of all elements in the private set of the plurality of participants and the encrypted Bloom filter of the receiver each have M segments, wherein . The server, at the j2th cycle, randomly generates random values , batches the generated random values, and obtains a vector , that is, the vector is expressed as ; then, the relinearization key is used to respectively calculate the 2th to (L-1)th power of the j2th frequency information and the Lth to (H-1)Lth power of the j2th frequency information , wherein j2 is 1 to M; according to the encrypted Bloom filter of the receiver, the vector , the coefficients of each term in the polynomial to be solved, the 2th to (L-1)th power of the j2th frequency information, and the Lth to (H-1)Lth power of the j2th frequency information, the j2th part polynomial of the polynomial to be solved is determined; after M cycles are performed, M part polynomials are obtained, and the M part polynomials are combined in the order obtained to constitute the polynomial to be solved .

[0043] Specifically, the calculation formula of the j2th part polynomial of the polynomial to be solved is as follows: ; wherein represents the th power of the j2th frequency information , and represents the th power of , and ​an encrypted Bloom filter representing the receiver, represents the j2th segment in represents the coefficient of the jth term of the polynomial to be solved.

[0044] An exemplary Figure 6 is a schematic diagram of the threshold calculation function. As Figure 6 shown, the batches 1 and 2 on the left of the red dashed box represent the frequency information of all elements in the private sets of the three participants, and after the threshold calculation of the pre-set threshold T of 2 represented by the red dashed box, the batches 1 and 2 on the right of the red dashed box, i.e. the threshold calculation result, can be obtained, wherein r in the batches 1 and 2 on the right of the red dashed box represents a random number.

[0045] An exemplary S103 can be implemented by the following algorithm, which is as follows: “Input: , , T; Ouput: ; 1 , ; 2 for to do; 3 ; 4for to do; 5 ; 6 ; 7 ; 8 , ; 9 for to do; 10 ; 11Use the Key to calculate; and , 12 ; Ouput: ”。

[0046] ​In the above algorithm, the numbers 1 to 12 represent the row numbers, represents the first term of the polynomial to be solved , the initial value of the coefficient of the first term is set to -T, T represents a preset threshold value, represents the second term of the polynomial to be solved , the initial value of the coefficient of the second term is set to 1, represents the initial value of the vector , wherein the vector is a set, represents that the obtained is assigned to . According to the above algorithm, according to the algorithm steps of the first row to the seventh row, the vector can be obtained, that is, the coefficients of each term of the polynomial to be solved are obtained, then according to the algorithm steps of the eighth row to the twelfth row, the M partial polynomials of the polynomial to be solved can be obtained, so that can be obtained. In order to maximize the effect of batch processing, the present application constructs an interpolation polynomial to accurately locate the position corresponding to the frequency satisfying the threshold condition in the binary vector, and adds noise to other positions to protect privacy. In order to optimize the calculation, the present application adopts Paterson-Stockmeyer algorithm, which reduces the number of ciphertext-ciphertext homomorphic multiplications required in the polynomial evaluation process.

[0047] In some embodiments, the above S104 is implemented by the following steps: S1041, when the plurality of participants support the t-N threshold access structure, the server sends the threshold intersection result to each of the at least t participants, and the at least t participants switch the encryption key of the threshold intersection result from the public key to the public key using the joint public key switching algorithm in the threshold multi-party homomorphic encryption algorithm and their own additional key .

[0048] S1042, when the plurality of participants do not support the t-N threshold access structure, the server sends the threshold intersection result to each participant, and the plurality of participants switch the encryption key of the threshold intersection result from the public key to the public key using the joint public key switching algorithm in the multi-party homomorphic encryption algorithm and their own private key .

[0049] In some embodiments, the above S105 is specifically implemented as: the receiver adopts the private key The threshold intersection result after the public key switching is decrypted to obtain a decryption result, and then the decryption result is compared with the encrypted Bloom filter of the self, so that the element set at least present in the private set of the T participants in plaintext form can be obtained.

[0050] Exemplary, Figure 7 is a schematic diagram of switching the encryption key of the threshold intersection result from the public key to the public key according to whether the t-N threshold access structure is supported by the three participants, and determining the set of elements at least present in the private set of the T participants in plaintext form according to the threshold intersection result after the public key switching. As shown in Figure 7 , according to whether the t-N threshold access structure is supported by the three participants, it can be determined which participants participate in the key switching, and after the key switching is completed, the threshold intersection result after the key replacement (i.e. Batch 1 and Batch 2 on the left) can be obtained, then the threshold intersection result after the key replacement is decrypted, and by comparing the decryption result with the encrypted Bloom filter of the self, the elements at least present in the two participant sets (i.e. “Black” and “Red”) can be obtained.

[0051] In order to further verify the effectiveness of the present application, the present application and other schemes are simulated and compared, and the simulation and comparison results are respectively as follows Figure 8a~Figure 8c , Figure 9a~Figure 9b , Figure 10a~Figure 10b . Figure 8a is a comparison diagram of the running efficiency of the present application (referred to as TNPP protocol) and other schemes (i.e. the method proposed by Bay et al. mentioned in the background art, referred to as Bay protocol) in the case of 25 participants; Figure 8b is a comparison diagram of the running efficiency of the present application and the Bay protocol in the case of 35 participants; Figure 8c is a comparison diagram of the running efficiency of the present application and the Bay protocol in the case of 45 participants, Figure 8a~Figure 8c the horizontal axis of each of which represents the parameter α, and α=N-T. Figure 8a~Figure 8c TNPP-64 / 128 / 256 in represent the running efficiency of the present application in the case that the size of the private set of each participant is 64 or 128 or 256, respectively; similarly, Figure 8a~Figure 8c Bay-64 / 128 in represent the running efficiency of the Bay protocol in the case that the size of the private set of each participant is 64 or 128, respectively. Figure 9a is a comparison diagram of the communication amount of the TNPP protocol and the Bay protocol in the case of α=3; Figure 9bis a schematic diagram of the communication volume of the TNPP protocol compared with the Bay protocol in the case of the parameter α = 5; wherein Bay-N25 / N45 respectively represent the running efficiency of the Bay protocol in the case of the number of participants being 25 or 45. Figure 10a is a schematic diagram of the running efficiency of the present application when the preset threshold T is set to the number of participants in the case of the size of the private set of each participant being 256 compared with the Bay protocol, the Vos protocol and the Kolesnikov protocol (i.e. the methods proposed by Vos et al. and Kolesnikov et al. mentioned in the background art, which are referred to as the Vos protocol and the Kolesnikov protocol respectively). Figure 10b is a schematic diagram of the running efficiency of the present application when the preset threshold T is set to the number of participants in the case of the size of the private set of each participant being 1024 compared with the Bay protocol, the Vos protocol and the Kolesnikov protocol.

[0052] As shown in Figure 8a~Figure 8c , compared with the prior art, the present application can support more participants without significantly affecting the performance. As shown in Figure 9a~Figure 9b and Figure 10a~Figure 10b , the present application performs outstandingly in efficiency, and compared with the prior art, the running time is reduced by three orders of magnitude, and only a constant number of communication rounds are required.

[0053] It should be noted that the terms "first", "second" are only used for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can include one or more features explicitly or implicitly. In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0054] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the description of the present application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in the present application.

[0055] In the description, the word "comprising" does not exclude other components or steps, and "one" or "a" does not exclude a plurality. Some measures are described in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0056] The above description is further detailed in connection with specific preferred embodiments of the present application, and it is not to be construed that the specific implementation of the present application is limited to these descriptions. For those skilled in the art to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or substitutions can be made, and all of them should be considered as falling within the protection scope of the present application.

Claims

1. A fast threshold-based multi-party privacy set intersection method, characterized in that, The method includes: Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt your own private collection to obtain your own encrypted Bloom filter; The server among the multiple participants obtains the frequency information of all elements in the private set of the multiple participants by performing homomorphic addition on the encrypted Bloom filter of the multiple participants. The server performs a homomorphic comparison between the frequency information of all elements in the private sets of the multiple participants and a preset threshold T to obtain the threshold intersection result in ciphertext form. Depending on whether the multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is obtained from the public key. Switch to public key t represents the number of online participants, and N represents the total number of the multiple participants; The participant acting as the receiver among the multiple participants uses the public key. corresponding private key The threshold intersection result after the public key switch is decrypted, and the elements appearing in the private sets of at least T participants are obtained based on the decryption result and its own cryptographic Bloom filter.

2. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, When the multiple participants are not seeking the intersection of their sets for the first time, the public key... and the private key It is a public-private key pair generated by the receiver during the initialization phase when the multiple participants first find the intersection of their sets; the public key It is a public key generated by the multiple participants during the initialization phase, based on whether the multiple participants support the tN threshold access structure, by combining their own private keys; The initialization phase includes: The receiver generates a public-private key pair and publishes the public key to the remaining participants. ; The multiple participants jointly generate the public key based on whether they support the tN threshold access structure. and relinearized key .

3. The fast threshold multi-party privacy set intersection method according to claim 2, characterized in that, The multiple participants jointly generate the public key based on whether they support the tN threshold access structure. and relinearized key ,include: When the multiple participants do not support the tN threshold access structure, each participant generates its own private key, and the multiple participants jointly generate the public key using their own private keys. and the relinearization key ; When the plurality of participants support the tN threshold access structure, each participant generates its own private key, and each of at least t participants generates its own additional key based on its private key. The at least t participants then jointly generate the public key using their additional keys. and the relinearization key .

4. The fast threshold multi-party privacy set intersection method according to claim 3, characterized in that, Each of at least t of the plurality of participants generates its own additional key based on its own private key, including: Each of the at least t participants randomly selects a polynomial from a preset polynomial ring; Each of the at least t participants generates its own additional key using the thresholding algorithm in the threshold multi-party homomorphic encryption algorithm, based on a randomly selected polynomial and its own private key.

5. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt its own private collection to obtain its own encrypted Bloom filter, including: Each participant generates its own Bloom filter based on a hash function pre-negotiated by the multiple participants; Each participant uses its own Bloom filter to convert its private set into a binary vector, and then batch processes the binary vector using a packing algorithm in a multi-party homomorphic encryption algorithm, based on the length of its own Bloom filter and preset homomorphic encryption parameters, and then uses the public key. The batch-processed binary vectors are encrypted using the encryption algorithm in the multi-party homomorphic encryption algorithm to obtain their own encrypted Bloom filter.

6. The fast threshold multi-party privacy set intersection method according to claim 2, characterized in that, The threshold intersection result is a polynomial to be calculated. The server performs a homomorphic comparison between the frequency information of all elements in the private sets of the multiple participants and a preset threshold T to obtain the ciphertext form of the threshold intersection result, including: The server setting vector sum vector And the initial values ​​of the coefficients of the first and second terms of the polynomial to be determined are set to -T and 1, respectively, where the vector Represents all the coefficients of the polynomial to be determined, a vector. Representing vectors Intermediate variables; The server is based on the vector The vector The initial values ​​of the coefficients of the first and second terms are used to solve for the coefficients of each term in the polynomial to be determined. The server determines a first value L based on N and T, and a second value H based on N, T, and L; The server uses the coefficients of each term in the polynomial to be calculated, L, H, the frequency information of all elements in the private sets of the multiple participants, and the relinearization key. The receiver's encrypted Bloom filter generates the polynomial to be determined.

7. The fast threshold multi-party privacy set intersection method according to claim 6, characterized in that, The server is based on the vector The vector The initial values ​​of the coefficients of the first and second terms are used to solve for the coefficients of each term in the polynomial to be determined, including: Let k denote the k-th iteration, and j denote the j-th iteration in the k-th iteration, with the initial value of j being 0. (The vector...) The initial value is 0, where the value of k ranges from 0 to NT-1; In the k-th iteration, let i = T+1 + k, then perform the j-th iteration in the k-th iteration. In the j-th iteration, according to... calculate And according to -i, and Generate updated , This represents the coefficient of the (j+1)th term of the polynomial to be determined. Represents the j-th intermediate variable. Let j be the (j+1)th intermediate variable. Then, let j = j+1 and continue with the j-th iteration in the k-th iteration until j = i - T+1, at which point the updated value is obtained. Then, let k = k+1, and then according to the updated... Continue the k-th iteration until k = NT, at which point the final vector is obtained. The final vector As the vector , where the initial value of i is T+1.

8. The fast threshold multi-party privacy set intersection method according to claim 6, characterized in that, The frequency information of all elements in the private sets of the multiple participating parties and the encrypted Bloom filter of the receiver both have M segments, where, , Indicates the length of the Bloom filter. These are the preset homomorphic encryption parameters. This indicates rounding up; the process involves using the coefficients of each term in the polynomial to be calculated, L, H, the frequency information of all elements in the private sets of the multiple participating parties, and the relinearization key. The receiver's encrypted Bloom filter generates the polynomial to be determined, including: In the j2nd iteration, generate randomly A random value, for the generated Batch processing of random values ​​yields a vector. Where j2 takes values ​​from 1 to M; Using the relinearization key Calculate the powers of 2 to L-1 of the frequency information of the j2th segment, and the powers of L to (H-1)L of the frequency information of the j2th segment, respectively; According to the receiver's encrypted Bloom filter, the vector The coefficients of each term in the polynomial to be determined, the powers of 2 to L-1 of the frequency information of the j2th segment, and the powers of L to (H-1)L of the frequency information of the j2th segment are used to determine the j2nd part polynomial of the polynomial to be determined. After executing M iterations, an M-part polynomial is obtained, which constitutes the polynomial to be determined.

9. The fast threshold multi-party privacy set intersection method according to claim 8, characterized in that, The formula for calculating the j2-th part of the polynomial to be determined is as follows: ； in, Denotes the polynomial of the j2th part. This represents the frequency information of the j2th segment. of Power of 1 express of Power of 1 This represents the j2nd segment in the receiver's encrypted Bloom filter. Denotes the first polynomial of the polynomial to be determined. The coefficient of the term.

10. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, Depending on whether the multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is obtained from the public key. Switch to public key ,include: When the multiple participants support the tN threshold access structure, the server sends the threshold intersection result to each of the at least t participants. The at least t participants use their own additional keys and the joint public key switching algorithm in the threshold multi-party homomorphic encryption algorithm to change the encryption key of the threshold intersection result from the public key. Switch to the public key ; When the multiple participants do not support the tN threshold access structure, the server sends the threshold intersection result to each participant. The multiple participants use their own private keys and the joint public key switching algorithm in the multi-party homomorphic encryption algorithm to change the encryption key of the threshold intersection result from the public key. Switch to the public key .

Images