A fast threshold multi-party privacy set intersection method

Abstract

This invention discloses a fast threshold-based multi-party privacy set intersection method, relating to the field of data security technology. Each participant utilizes a Bloom filter and a public key. pk The server encrypts its own private set; the participating party, acting as the server, performs homomorphic addition on the encrypted Bloom filters of all participating parties to obtain the frequency information of all elements in the private sets of all participating parties; the server homomorphically compares the frequency information with a preset threshold T to obtain the ciphertext form of the threshold intersection result; all participating parties, depending on whether they support the t-N threshold access structure, transfer the encryption key of the threshold intersection result from their public key. pk Change to public key tpk The receiving party uses a public key. tpk corresponding private key tsk The threshold intersection result after public key switching is decrypted, and the elements appearing in at least T participants' private sets are obtained based on the decryption result and its own encrypted Bloom filter. This invention can efficiently identify threshold intersections and support more participants without significantly affecting performance.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically relating to a fast threshold multi-party privacy set intersection method. Background Technology

[0002] Secure multi-party computation is a key technology for protecting user data. It allows multiple participants to perform secure computation on encrypted inputs and only reveals the final aggregate result, which is significant in supporting collaboration and innovation between individuals and institutions. Multiparty Private Set Intersection (MPSI) is a fundamental task in secure multi-party computation (MPC), allowing multiple untrusted participants to perform computations securely on encrypted inputs. Each holds a private collection Calculate the intersection together They can achieve this without revealing any additional information. However, because MPSI requires that the output strictly consist of elements that appear only in the set of all participants, they are not applicable in certain scenarios. For example, if a malicious participant inputs an empty set, these protocols cannot produce the correct intersection result.

[0003] Threshold Multiparty Private Set Intersection (TMPSI) is a variant of MPSI designed to address the aforementioned problem. TMPSI aims to return all elements in the set of participants that appear at least a threshold number. For example, it can be achieved through... Figure 1 To illustrate the functions of the MPSI and TMPSI protocols, the threshold for TMPSI is set to 2, and Party1, Party2, and Party3 represent three participating parties, as follows: Figure 1 As shown, the private sets of the three participants are {Black, Red, Blue}, {Black, Red, Pink}, and {Black, Green, White}, respectively. The MPSI method determines the intersection of these three sets as "Black", while the TMPSI method determines the intersection as "Black" and "Red". TMPSI provides a secure and privacy-preserving data sharing method, making it suitable for various application scenarios, such as preventing illegal activities through international cooperation, threshold voting, contact discovery, and network risk assessment.

[0004] Based on high-level construction, MPSI protocols can be divided into four main types: MPSI based on homomorphic encryption, MPSI based on unintentional linear computation, MPSI based on unintentional transmission, and MPSI based on obfuscated circuits. Kolesnikov et al. proposed a modular MPSI method that maintains security even with an arbitrary number of semi-honest participants. Their method relies on an unintentionally programmable pseudo-random function as a key component, allowing secure value sharing and computation without revealing sensitive data. Although this method performs well with large sets, the computational complexity increases significantly with the number of participants, as the protocol's performance is quadratic with the number of participants. Vos et al. efficiently implemented privacy AND and privacy OR operations using elliptic curves, proposing a new MPSI and Multi-party Private Set Union (MPSU) construction. This method improves performance to some extent, requiring only three rounds of communication.

[0005] Kissner and Song first proposed the concept of a threshold and designed corresponding threshold-privacy set union and intersection protocols. Their method performs homomorphic computation through multinomial factorization, with the required number of communication rounds linearly related to the number of participants. Miyaji and Nishida implemented TMPSI based on Bloom filters and additive homomorphic encryption schemes, but they did not provide related security analysis. Building on their work, Bay et al. further extended the protocol using the Secure Computation Protocol (SCP), implementing a TMPSI protocol based on the Paillier encryption system and providing necessary security analysis. However, Paillier's homomorphic addition cannot be batch-processed, resulting in low computational efficiency, while SCP has high communication overhead, with the number of communication rounds proportional to the number of participants. Furthermore, their scheme does not consider the impact of the false positive probability of Bloom filters on the protocol, thus exhibiting a high false positive probability.

[0006] In other words, current TMPSI work is mainly based on binary encoding. It encodes each participant's privacy set into a binary vector and then estimates the frequency of each element across all sets to implement the TMPSI protocol. The thresholding function, by comparing the frequency of each element with a threshold, can be implemented using a secure comparison protocol. However, existing work has some limitations. First, it requires traversing the entire binary vector and performing bit-by-bit comparisons in a homomorphic manner to identify intersections. Second, it does not optimize protocol parameters for the most accurate results, leading to a high false alarm probability. Furthermore, identifying elements with frequencies greater than the threshold requires a secure comparison protocol across all participants, resulting in a linear relationship between the number of communication rounds and the number of participants. In multi-party protocols, all participants need to synchronously execute a series of interactive operations, especially during the joint key generation and joint decryption phases. If any participant suddenly disconnects due to device failure or network instability, the entire protocol process will be interrupted, preventing further execution. If a participant suddenly disconnects, the protocol needs to be re-executed, which wastes computational resources and reduces operational efficiency. Therefore, in TMPSI schemes with many participants, higher fault tolerance is required to handle participant disconnections. One solution to directly improve protocol efficiency is to employ batching techniques from error-learning-based multi-party homomorphic encryption schemes, instead of comparing the entire set of binary vectors bit by bit. However, directly applying batching complicates the implementation of subsequent thresholding functions because error-learning-based homomorphic encryption schemes do not support division. Furthermore, due to the use of batching techniques, it is impossible to perform a separate secure comparison protocol for each frequency information. Summary of the Invention

[0007] To address the aforementioned problems in the existing technology, this invention provides a fast threshold multi-party privacy set intersection method.

[0008] The technical problem to be solved by this invention is achieved through the following technical solution:

[0009] This invention provides a fast method for finding the intersection of thresholded multi-party privacy sets, the method comprising:

[0010] Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt your own private collection to obtain your own encrypted Bloom filter;

[0011] The server among the multiple participants obtains the frequency information of all elements in the private set of the multiple participants by performing homomorphic addition on the encrypted Bloom filter of the multiple participants.

[0012] The server performs a homomorphic comparison between the frequency information of all elements in the private sets of the multiple participants and a preset threshold T to obtain the threshold intersection result in ciphertext form.

[0013] Depending on whether the multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is obtained from the public key. Switch to public key t represents the number of online participants, and N represents the total number of the multiple participants;

[0014] The participant acting as the receiver among the multiple participants uses the public key. corresponding private key The threshold intersection result after the public key switch is decrypted, and the elements appearing in the private sets of at least T participants are obtained based on the decryption result and its own cryptographic Bloom filter.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0016] 1) This invention designs a novel threshold function that compares the frequency of elements with a given threshold in batches using homomorphic ciphertext. This can efficiently identify threshold intersections in batch ciphertext vectors, support more participants, and not significantly affect performance. This provides a new approach to efficient homomorphic design principles.

[0017] 2) This invention supports a tN threshold access structure, which means that even if some participants go offline, this invention can still continue as long as at least t users are online, ensuring the integrity and correctness of threshold intersection identification.

[0018] 3) This invention excels in efficiency. Compared with existing solutions, the running time is greatly reduced, and the threshold intersection can be determined with only a constant number of communication rounds.

[0019] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0020] Figure 1 This is a functional diagram illustrating MPSI and TMPSI;

[0021] Figure 2 This is a flowchart illustrating the fast threshold multi-party privacy set intersection method provided in this embodiment of the invention;

[0022] Figure 3 This is a schematic diagram illustrating the initialization phase performed by three participating parties according to an embodiment of the present invention;

[0023] Figure 4This is a schematic diagram illustrating the principle of three participating parties generating their own encrypted Bloom filters based on their own private sets, and performing homomorphic addition on all encrypted Bloom filters, as provided in this embodiment of the invention.

[0024] Figure 5 This is a schematic diagram of the principle of a Bloom filter;

[0025] Figure 6 This is a schematic diagram illustrating the function of threshold calculation provided in an embodiment of the present invention;

[0026] Figure 7 This is a schematic diagram provided by an embodiment of the present invention, in which three participating parties switch encryption keys based on whether or not they support the tN threshold access structure, and determine the set of elements in plaintext form that appear in the private sets of at least T participating parties based on the threshold intersection results after key switching.

[0027] Figure 8a This is a schematic diagram comparing the operational efficiency of the present invention with other solutions when there are 25 participating parties, as provided in an embodiment of the present invention.

[0028] Figure 8b This is a schematic diagram comparing the operating efficiency of the present invention with other solutions when there are 35 participating parties, as provided in an embodiment of the present invention;

[0029] Figure 8c This is a schematic diagram comparing the operating efficiency of the present invention with other solutions when there are 45 participating parties, as provided in an embodiment of the present invention;

[0030] Figure 9a This is a schematic diagram comparing the communication volume of the present invention with other schemes when the parameter α=3, provided by an embodiment of the present invention;

[0031] Figure 9b This is a schematic diagram comparing the communication volume of the present invention with other schemes when parameter α=5, provided by an embodiment of the present invention;

[0032] Figure 10a This is a schematic diagram comparing the operating efficiency of the present invention with other solutions when the size of the private set of each participant is 256 and the preset threshold is set to the number of participants, according to an embodiment of the present invention.

[0033] Figure 10b This is a schematic diagram comparing the operating efficiency of the present invention with other solutions when the size of the private set of each participant is 1024 and the preset threshold is set to the number of participants, according to an embodiment of the present invention. Detailed Implementation

[0034] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0035] To address the problems in the background technology, this invention proposes a fast Threshold Numerous Participants Private Set Intersection (TNPP) scheme. The main idea is to determine elements whose frequencies exceed a threshold from batch-encrypted ciphertext by substituting the frequency information of all set elements into a carefully designed threshold function. Specifically, this invention first maps the elements in each participant's private set onto a Bloom filter, compresses the Bloom filter using batch processing, encrypts it, and then sends it to the server. The server uses homomorphic addition to calculate the frequency of all elements. Then, the calculated frequencies are substituted into the threshold function for homomorphic calculation to achieve threshold intersection identification. Furthermore, considering the occasional scenario where some users may suddenly disconnect, potentially causing protocol interruption, this invention utilizes a t-out-of-N threshold access structure to ensure the protocol can continue as long as at least t users are online, guaranteeing the integrity and correctness of threshold intersection identification. The performance of this invention is linearly related to the Bloom filter length, and threshold intersection can be determined in only one round of communication.

[0036] Figure 2 This is a flowchart illustrating the fast threshold multi-party privacy set intersection method provided in this embodiment of the invention. It is applied to scenarios where multiple parties need to find the intersection of their sets. These multiple parties include: a party acting as the server, a party acting as the receiver, and other parties, each with a private set. Figure 2 As shown, the method includes:

[0037] S101, Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt your own private set to obtain your own encrypted Bloom filter.

[0038] S102. The server among the multiple participants performs homomorphic addition on the cryptographic Bloom filters of the multiple participants to obtain the frequency information of all elements in the private set of the multiple participants.

[0039] S103. The server performs a homomorphic comparison between the frequency information of all elements in the private sets of multiple participants and a preset threshold T to obtain the threshold intersection result in ciphertext form.

[0040] S104. Depending on whether multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is transferred from the public key. Switch to public key t represents the number of online participants, and N represents the total number of participants.

[0041] Here, the English term for the tN threshold access structure is "t-out-of-N-threshold access-structure," and this access structure is existing technology, which will not be elaborated upon in this invention. It should be noted that whether multiple participating parties support the tN threshold access structure is agreed upon in advance by these participating parties.

[0042] S105. Among multiple participants, the participant acting as the receiver uses a public key. corresponding private key Decrypt the threshold intersection result after the public key switch. Based on the decryption result and its own cryptographic Bloom filter, obtain the elements that appear in the private sets of at least T participants. Where multiple participants are not calculating the intersection of their sets for the first time, the public key... and private key It is a public-private key pair generated by the receiver during the initialization phase when the intersection of the sets of multiple participants is calculated for the first time. The public key is... It is a public key generated by multiple participants during the initialization phase, based on whether each participant supports the tN threshold access structure, by combining their own private keys.

[0043] In other words, when multiple participants are finding the intersection of their sets for the Qth time, and Q is greater than or equal to 2, then the public key... and private key It is a public-private key pair generated by the receiver during the initialization phase when the intersection of the sets of multiple participants is calculated for the first time. The public key is... This refers to the public key generated by multiple participants during the initialization phase, based on whether each participant supports the tN threshold access structure, by combining their own private keys. When multiple participants are finding the intersection of their sets for the first time, the initialization phase must be executed first to obtain the public key. and private key Each participant's private key and public key .

[0044] It should be noted that this invention can be applied to scenarios such as threshold voting, contact discovery, and network risk assessment. Specifically, in the threshold voting scenario, each voter is a participant, and the vote counting party is also a participant. The vote counting party acts as both the receiver and the server. Each voter's private set is the candidate they voted for or the hash of their vote (e.g., {candidate A}), and the vote counting party's private set is the complete set of all possible candidates (e.g., {candidate A, candidate B, candidate C}). The final intersection is the intersection of the sets of the counting party and the voters, representing which candidate they voted for, without revealing other voting information. When the number of votes reaches the threshold, it can be proven that a candidate's support rate has exceeded the limit. In the contact discovery scenario (e.g., friend recommendations in chat software), both the client user and the server are participants, and the client user is the receiver. The client user's private set is their own address book (e.g., {phone number A, phone number B, email C}), and the server's private set is the set of all registered user accounts (e.g., {phone number B, phone number D, email E}). The final intersection result, for example, is {phone number B}, indicating that someone in the user's contacts is already using the application, and it can be recommended to add them as a friend. In a network risk assessment scenario, each organization is a participant, such as organization A and organization B. Organization A's private set is its list of suspected or monitored high-risk accounts / devices / Internet Protocol (IP) addresses, while organization B's private set is its own risk blacklist or customer list. The final intersection result is the same risk object (such as a phone number / IP appearing on multiple blacklists), thus allowing for more confident marking of risk objects as high-risk.

[0045] In some embodiments, the initialization phase includes the following steps:

[0046] S001. The receiver generates a public-private key pair and publishes the public key to the remaining participants. .

[0047] Specifically, the recipient uses the key generation algorithm in a multi-party homomorphic encryption algorithm to generate a public-private key pair. and announce .

[0048] S002. Multiple participants jointly generate a public key based on whether they support the tN threshold access structure. and relinearized key .

[0049] Here, when multiple participants do not support the tN threshold access structure, each participant generates its own private key. Subsequently, multiple participants used their own private keys Jointly generate public key and relinearized key Specifically, each participating party The private key is generated and stored using the key generation algorithm in multi-party homomorphic encryption. Afterwards, the participating parties utilized The public key is generated using the joint public key generation algorithm and the joint relinearization key generation algorithm in multi-party homomorphic encryption. and relinearized key .

[0050] Here, when multiple parties support the tN threshold access structure, each party generates its own private key, and each of at least t of the multiple parties generates its own additional key based on its own private key. At least t participants jointly generate a public key using their own additional keys. and relinearized key Specifically, each participating party The private key is generated and stored using the key generation algorithm in multi-party homomorphic encryption. Then, each of at least t participants draws from a predefined polynomial ring. Randomly select a polynomial As a common point, each of the at least t participants then generates its own additional key using the thresholding algorithm in the threshold multi-party homomorphic encryption algorithm, based on a randomly selected polynomial and its own private key. Then, these at least t participants utilized The public key is generated using the joint public key generation algorithm and the joint relinearization key generation algorithm in the threshold multi-party homomorphic encryption algorithm. and relinearized key .

[0051] For example, Figure 3 This is a schematic diagram illustrating the initialization phase performed by three participants: Participant 1, Participant 2, and Participant 3. , and These represent the private keys of participant 1, participant 2, and participant 3, respectively, and are shown outside the black dashed box. and These represent the public key and relinearization key jointly generated by the three participants using their private keys, assuming that none of the three participants support the tN threshold access structure. The black dashed box indicates... and These represent the cases where the three participants support the tN threshold access structure, and participants 1 and 2 use their own private keys to generate additional keys, and then use their additional keys to jointly generate a public key and a relinearization key.

[0052] In some embodiments, the above S101 is achieved through the following steps:

[0053] S1011. Each participant generates its own Bloom filter based on a hash function pre-negotiated by multiple participants.

[0054] S1012. Each participant uses its own Bloom filter to convert its private set into a binary vector, and according to the length d of its own Bloom filter and the preset homomorphic encryption parameter n, uses the packing algorithm in the multi-party homomorphic encryption algorithm to batch process the binary vector, and then uses the public key... The batch-processed binary vectors are encrypted using the encryption algorithm in the multi-party homomorphic encryption algorithm to obtain their own encrypted Bloom filter.

[0055] Specifically, each participant uses its own Bloom filter to convert a private set into a binary vector. Then, it calculates the batch processing count based on the length d of its own Bloom filter and the preset homomorphic encryption parameter n. , This indicates rounding up. Next, a binary vector is divided into... The segmented binary vector is processed in batches using a packing algorithm within a multi-party homomorphic encryption algorithm. After batch processing, the data is processed based on the user's public key. The batch-processed binary vectors are encrypted using an encryption algorithm from a multi-party homomorphic encryption algorithm to obtain a cryptographic Bloom filter. This cryptographic Bloom filter has the following characteristics: Paragraph. For example, Figure 4 This is a schematic diagram illustrating the principle that participants 1, 2, and 3 generate their own encrypted Bloom filters based on their private sets, and then perform homomorphic addition on all encrypted Bloom filters. (For example...) Figure 4 As shown, each participant converts its private set into a binary vector, which is then batch-processed and used with the public key. Encryption is performed to obtain encrypted Bloom filters (e.g., each encrypted Bloom filter has two segments, namely batch 1 and batch 2). Then, homomorphic addition is performed on the encrypted Bloom filters of the three participants to obtain the frequency information of all elements in the private sets of the three participants. This indicates an addition operation.

[0056] For example, Figure 5 This is a schematic diagram illustrating the principle of a Bloom filter. Figure 5 As shown, {black, red, blue} represents the private set of participant 1, and the binary vector containing 0s and 1s below {black, red, blue} represents the cryptographic Bloom filter of participant 1 generated based on the private set {black, red, blue}. {black, red, pink} represents the private set of participant 2, and the binary vector containing 0s and 1s below {black, red, pink} represents the cryptographic Bloom filter of participant 2 generated based on the private set {black, red, pink}. Figure 5 As shown, by calculating the Hadamard product between the cryptographic Bloom filters of participant 1 and participant 2, a new cryptographic Bloom filter can be obtained. This new cryptographic Bloom filter represents the intersection {black, red} of the private sets of participant 1 and participant 2, where... It represents the Hadamardi (or Hadama) stack.

[0057] Since the set is converted into a binary vector using a Bloom filter, this invention, after analyzing the impact of the false positive rate of the Bloom filter on the accuracy of the TMPSI protocol, also provides guidance on selecting appropriate Bloom filter parameters. Specifically, when the false positive probability of the Bloom filter is 0.1%, and the size of each participant's private set is represented as Set Size, NT=α, the selection of the Bloom filter length FL can refer to the following scheme:

[0058] When Set Size=64, and α is 1, 3, and 5 respectively, FL is 1261, 4495, and 7714 respectively;

[0059] When Set Size=128, and α is 1, 3, and 5 respectively, FL is 2521, 18057, and 30854 respectively;

[0060] When Set Size = 256, and α is 1, 3, and 5 respectively, FL is 5043, 18057, and 30854 respectively;

[0061] When Set Size=512, and α is 1, 3, and 5 respectively, FL is 10085, 36113, and 61709 respectively;

[0062] When Set Size = 1024 and α is 1, 3, and 5 respectively, FL is 20170, 72226, and 123418 respectively.

[0063] It should be noted that these options were proposed after analyzing the impact of the inherent false positive probability of Bloom filters on the correctness of the results obtained by this invention.

[0064] Specifically, the threshold intersection result is a polynomial to be calculated. Therefore, the above S103 is achieved through the following steps:

[0065] S1031, Server Setting Vector sum vector And set the polynomial to be found The initial values ​​of the coefficients of the first and second terms are -T and 1, respectively, where the vector Represents the polynomial to be found All coefficients, vector Representing vectors Intermediate variables.

[0066] S1032, The server, based on the vector ,vector Given the initial values ​​of the coefficients of the first and second terms, solve for the polynomial to be solved. The coefficients of each term.

[0067] Specifically, the server lets k represent the k-th iteration, and j represent the j-th iteration in the k-th iteration, with the initial value of j being 0. The vector... The initial value is 0, where k takes values ​​from 0 to NT-1; in the k-th iteration, let i = T+1 + k, then perform the j-th iteration in the k-th iteration, and in the j-th iteration, according to calculate And according to -i, and Generate updated , Represents the polynomial to be found The coefficient of the (j+1)th term, Represents the j-th intermediate variable. Let j be the (j+1)th intermediate variable. Then, let j = j+1 and continue with the j-th iteration in the k-th iteration until j = i - T+1, at which point the updated value is obtained. Then, let k = k+1, and then according to the updated... Continue the k-th iteration until k = NT, at which point the final vector is obtained. The final vector As the vector Where i is initially set to T+1. Specifically, , .

[0068] S1033, The server determines the first value L based on N and T, and based on N, T and... Determine the second value H.

[0069] Specifically, , Where N represents the total number of participants and T represents the preset threshold.

[0070] S1034, The server calculates the polynomial to be determined. The coefficients of each term in the middle H, frequency information of all elements in the private sets of multiple participants. Relinearized key The receiver's encrypted Bloom filter generates the polynomial to be calculated. .

[0071] Specifically, frequency information of all elements in the private sets of multiple participants. It is a whole, and the frequency information of all elements in the private set of multiple participants. Both the encrypted Bloom filter of the receiver and the encrypted Bloom filter have M segments, where, The server randomly generates [the data] during the j2nd iteration of the loop. random values , for the generated Batch processing of random values ​​yields a vector. That is, vector Represented as Next, a relinearized key is used. Calculate the frequency information of segment j2 respectively The 2nd to L-1th powers, and the frequency information of the j2nd segment. The L to (H-1)L powers, where j2 takes values ​​from 1 to M; based on the receiver's encrypted Bloom filter and vector... The polynomial to be determined is determined by the coefficients of each term in the polynomial, the powers of 2 to L-1 of the frequency information in the j2th segment, and the powers of L to (H-1)L of the frequency information in the j2th segment. The j2 part polynomial After executing M iterations, M partial polynomials are obtained. These M partial polynomials are combined sequentially in the order they were obtained to form the polynomial to be solved. .

[0072] Specifically, the polynomial to be found The j2 part polynomial The calculation formula is as follows:

[0073] ;

[0074] in, Represents the frequency information of segment j2 of Power of 1 express of Power of 1 This represents the encrypted Bloom filter of the recipient. express The j2th segment in Denotes the first polynomial to be found. The coefficient of the term.

[0075] For example, Figure 6 This is a schematic diagram illustrating the function of threshold calculation. For example... Figure 6 As shown, batch 1 and batch 2 on the left of the red dotted box represent the frequency information of all elements in the private sets of the three participants. After the frequency information is calculated by the preset threshold T of 2 represented by the red dotted box, batch 1 and batch 2 on the right of the red dotted box can be obtained, which are the threshold calculation results. In batch 1 and batch 2 on the right of the red dotted box, r represents a random number.

[0076] For example, the above S103 can be implemented by the following algorithm, which is as follows:

[0077] Input: , T;

[0078] Ouput: ;

[0079] 1 , ;

[0080] 2 for to do

[0081] 3 ;

[0082] 4for to do

[0083] 5 ;

[0084] 6 ;

[0085] 7 ;

[0086] 8 , ;

[0087] 9 for to do

[0088] 10 ;

[0089] 11 Use the Key to calculate;

[0090] and

[0091] ,

[0092] 12 ;

[0093] Ouput: ".

[0094] In the above algorithm, the numbers 1 to 12 represent the row numbers. Represents the polynomial to be found The initial value of the coefficient of the first term is set to -T, where T represents the preset threshold. Represents the polynomial to be found The initial value of the coefficient of the second term is set to 1. Representative vector The initial value is 0, where the vector It is a set. Indicates what will be obtained Assigned According to the algorithm described above, the vector can be obtained by following the steps in rows 1 to 7. That is, to obtain the polynomial to be found. Then, by determining the coefficients of each term, and following the algorithm steps in lines 8 to 12, the polynomial to be calculated can be obtained. The M-part polynomial can then be obtained. To maximize the efficiency of batch processing, this invention constructs an interpolation polynomial to accurately locate the positions in the binary vector corresponding to frequencies that meet the threshold condition, while adding noise to other positions to protect privacy. To optimize computation, this invention employs the Paterson-Stockmeyer algorithm, reducing the number of ciphertext-ciphertext homomorphic multiplications required during polynomial evaluation.

[0095] In some embodiments, the above-mentioned S104 is implemented through the following steps:

[0096] S1041. When multiple participants support the tN threshold access structure, the server sends the threshold intersection result to each of the at least t participants, and the at least t participants use their own additional keys. The joint public-key switching algorithm in threshold multi-party homomorphic encryption algorithms switches the encryption key of the threshold intersection result from the public key. Switch to public key .

[0097] S1042. When multiple participants do not support the tN threshold access structure, the server sends the threshold intersection result to each participant, and the multiple participants use their own private keys. The joint public-key switching algorithm in multi-party homomorphic encryption algorithms switches the encryption key from the public key to the threshold intersection result. Switch to public key .

[0098] In some embodiments, the above S105 is specifically implemented as follows: the receiver uses a private key. The threshold intersection result after the public key switch is decrypted to obtain the decryption result. Then, the decryption result is compared with its own cryptographic Bloom filter. In this way, the set of elements in plaintext form that appear in the private sets of at least T participants can be obtained.

[0099] For example, Figure 7 The three parties, depending on whether they support the tN threshold access structure, will extract the encryption key from the public key of the threshold intersection result. Switch to public key This diagram illustrates the set of elements in plaintext form that appear in the private sets of at least T participants, determined based on the threshold intersection result after the public key switch. (Example:) Figure 7 As shown, based on whether the three participants support the tN threshold access structure, it can be determined which participants will engage in key switching. After the key switching is completed, the threshold intersection result after the key change can be obtained (i.e., Batch 1 and Batch 2 on the left), then, using By decrypting the threshold intersection result after key swapping and comparing the decryption result with its own cryptographic Bloom filter, the element that appears in at least two participant sets (i.e., "Black" and "Red") can be obtained.

[0100] To further verify the effectiveness of the present invention, simulations were performed to compare the present invention with other solutions. The simulation comparison results are as follows: Figures 8a-8c , Figures 9a-9b , Figures 10a-10b . Figure 8a This is a schematic diagram comparing the operational efficiency of the present invention (hereinafter referred to as the TNPP protocol) with other solutions (i.e., the method proposed by Bay et al. mentioned in the background art, hereinafter referred to as the Bay protocol) when there are 25 participating parties. Figure 8b This is a schematic diagram comparing the operating efficiency of the present invention with that of the Bay protocol when there are 35 participants; Figure 8c This diagram illustrates a comparison of the operational efficiency of the present invention with that of the Bay protocol when there are 45 participants. Figures 8a-8c The horizontal axis represents the parameter α, and α = NT. Figures 8a-8c In this context, TNPP-64 / 128 / 256 represent the operational efficiency of the invention when the size of the private set of each participant is 64, 128, or 256, respectively; similarly, Figures 8a-8c In the Bay-64 / 128 clause, Bay-64 and Bay-128 represent the operational efficiency of the Bay protocol when the size of each participant's private set is 64 or 128, respectively. Figure 9a This is a diagram comparing the traffic of the TNPP protocol and the Bay protocol when the parameter α=3. Figure 9b This diagram illustrates the comparison of communication volume between the TNPP protocol and the Bay protocol when parameter α=5; where Bay-N25 / N45 represent the operational efficiency of the Bay protocol when the number of participants is 25 or 45, respectively. Figure 10a This is a schematic diagram comparing the operating efficiency of the present invention with that of the Bay protocol, Vos protocol, and Kolesnikov protocol (i.e., the methods proposed by Vos et al. and Kolesnikov et al. mentioned in the background art, respectively referred to as the Vos protocol and Kolesnikov protocol) when the size of the private set of each participant is 256 and the preset threshold T is set to the number of participants. Figure 10b This is a schematic diagram comparing the operating efficiency of the present invention with the Bay protocol, Vos protocol, and Kolesnikov protocol when the size of the private set of each participant is 1024 and the preset threshold T is set to the number of participants.

[0101] like Figures 8a-8c As shown, compared with the prior art, the present invention can support more participants without significantly affecting performance. Figures 9a-9b and Figures 10a-10b As shown, the present invention demonstrates outstanding efficiency, reducing the running time by three orders of magnitude compared to existing technologies, while requiring only a constant number of communication rounds.

[0102] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0103] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0104] In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. While different embodiments may describe certain measures, this does not mean that these measures cannot be combined to produce a good effect.

[0105] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A fast threshold-based multi-party privacy set intersection method, characterized in that, The method includes: Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt your own private collection to obtain your own encrypted Bloom filter; The server among the multiple participants obtains the frequency information of all elements in the private set of the multiple participants by performing homomorphic addition on the encrypted Bloom filter of the multiple participants. The server performs a homomorphic comparison between the frequency information of all elements in the private sets of the multiple participants and a preset threshold T to obtain the threshold intersection result in ciphertext form. Depending on whether the multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is obtained from the public key. Switch to public key t represents the number of online participants, and N represents the total number of the multiple participants; The participant acting as the receiver among the multiple participants uses the public key. corresponding private key Decrypt the threshold intersection result after the public key switch, and obtain the elements that appear in the private set of at least T participants based on the decryption result and its own cryptographic Bloom filter; The threshold intersection result is a polynomial to be calculated. The server performs a homomorphic comparison between the frequency information of all elements in the private sets of the multiple participants and a preset threshold T to obtain the ciphertext form of the threshold intersection result, including: The server setting vector sum vector And the initial values ​​of the coefficients of the first and second terms of the polynomial to be determined are set to -T and 1, respectively, where the vector Represents all the coefficients of the polynomial to be determined, a vector. Representing vectors Intermediate variables; The server defines k as the k-th iteration and j as the j-th iteration within the k-th iteration, with j initially set to 0. The vector... The initial value is 0, where the value of k ranges from 0 to NT-1; In the k-th iteration, let i = T+1 + k, then perform the j-th iteration in the k-th iteration. In the j-th iteration, according to... calculate And according to -i, and Generate updated , This represents the coefficient of the (j+1)th term of the polynomial to be determined. Represents the j-th intermediate variable. Let j be the (j+1)th intermediate variable. Then, let j = j+1 and continue with the j-th iteration in the k-th iteration until j = i - T+1, at which point the updated value is obtained. Then, let k = k+1, and then according to the updated... Continue the k-th iteration until k = NT, at which point the final vector is obtained. The final vector As the vector , where the initial value of i is T+1; The server determines a first value L based on N and T, and a second value H based on N, T, and L; The server randomly generates [the data] during the j2nd iteration of the loop. A random value, for the generated Batch processing of random values ​​yields a vector. In this context, the frequency information of all elements in the private sets of the multiple participating parties and the encrypted Bloom filter of the receiver both have M segments, where... , Indicates the length of the Bloom filter. These are the preset homomorphic encryption parameters. This indicates rounding up, and the value of j2 ranges from 1 to M; The server uses a re-linearized key. Calculate the powers of 2 to L-1 of the frequency information of the j2th segment, and the powers of L to (H-1)L of the frequency information of the j2th segment, respectively; The server uses the encrypted Bloom filter from the receiver and the vector. The coefficients of each term in the polynomial to be determined, the powers of 2 to L-1 of the frequency information of the j2-th segment, and the powers of L to (H-1)L of the frequency information of the j2-th segment are used to determine the j2-th part polynomial of the polynomial to be determined; the formula for calculating the j2-th part polynomial of the polynomial to be determined is as follows: , Denotes the polynomial of the j2th part. This represents the frequency information of the j2th segment. of Power of 1 express of Power of 1 This represents the j2nd segment in the receiver's encrypted Bloom filter. Denotes the first polynomial of the polynomial to be determined. The coefficient of the term; After executing M loops, the server obtains M partial polynomials, which constitute the polynomial to be determined.

2. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, When the multiple participants are not seeking the intersection of their sets for the first time, the public key... and the private key It is a public-private key pair generated by the receiver during the initialization phase when the multiple participants first find the intersection of their sets; the public key It is a public key generated by the multiple participants during the initialization phase, based on whether the multiple participants support the tN threshold access structure, by combining their own private keys; The initialization phase includes: The receiver generates a public-private key pair and publishes the public key to the remaining participants. ; The multiple participants jointly generate the public key based on whether they support the tN threshold access structure. and the relinearization key .

3. The fast threshold multi-party privacy set intersection method according to claim 2, characterized in that, The multiple participants jointly generate the public key based on whether they support the tN threshold access structure. and the relinearization key ,include: When the multiple participants do not support the tN threshold access structure, each participant generates its own private key, and the multiple participants jointly generate the public key using their own private keys. and the relinearization key ; When the plurality of participants support the tN threshold access structure, each participant generates its own private key, and each of at least t participants generates its own additional key based on its private key. The at least t participants then jointly generate the public key using their additional keys. and the relinearization key .

4. The fast threshold multi-party privacy set intersection method according to claim 3, characterized in that, Each of at least t of the plurality of participants generates its own additional key based on its own private key, including: Each of the at least t participants randomly selects a polynomial from a preset polynomial ring; Each of the at least t participants generates its own additional key using the thresholding algorithm in the threshold multi-party homomorphic encryption algorithm, based on a randomly selected polynomial and its own private key.

5. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, Each of the multiple participants utilizes a Bloom filter and a public key. Encrypt its own private collection to obtain its own encrypted Bloom filter, including: Each participant generates its own Bloom filter based on a hash function pre-negotiated by the multiple participants; Each participant uses its own Bloom filter to convert its private set into a binary vector, and then batch processes the binary vector using a packing algorithm in a multi-party homomorphic encryption algorithm, based on the length of its own Bloom filter and preset homomorphic encryption parameters, and then uses the public key. The batch-processed binary vectors are encrypted using the encryption algorithm in the multi-party homomorphic encryption algorithm to obtain their own encrypted Bloom filter.

6. The fast threshold multi-party privacy set intersection method according to claim 1, characterized in that, Depending on whether the multiple participants support the tN threshold access structure, the encryption key of the threshold intersection result is obtained from the public key. Switch to public key ,include: When the multiple participants support the tN threshold access structure, the server sends the threshold intersection result to each of the at least t participants. The at least t participants use their own additional keys and the joint public key switching algorithm in the threshold multi-party homomorphic encryption algorithm to change the encryption key of the threshold intersection result from the public key. Switch to the public key ; When the multiple participants do not support the tN threshold access structure, the server sends the threshold intersection result to each participant. The multiple participants use their own private keys and the joint public key switching algorithm in the multi-party homomorphic encryption algorithm to change the encryption key of the threshold intersection result from the public key. Switch to the public key .

Images