Privacy set intersection method and system supporting load interval screening

Abstract

The invention discloses a privacy set intersection method and system supporting load interval screening, and the method comprises the steps: determining a Bloom filter and a hash function, generating a homomorphic encryption key pair by a first participant, setting a threshold parameter and a load interval by a second participant, and generating a symmetric encryption key, a master secret and a random number; the first participant obtains a ciphertext and sends the ciphertext to the second participant, the second participant generates a homomorphic ciphertext, and the second participant encrypts elements, a load value and a load interval boundary value of the homomorphic ciphertext and sends the elements, the load value and the load interval boundary value to the first participant together in combination with a threshold parameter; the master secret is recovered through threshold judgment; the first participant decrypts and screens out the intersection element ciphertext meeting the load interval, and sends the intersection element ciphertext to the second participant; and outputting the intersection element meeting the load interval condition through decryption. According to the invention, intersection calculation of load values in a specific range is realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for finding intersections of privacy sets that supports load range filtering. Background Technology

[0002] With the development of the digital age, various industries have placed higher demands on the secure sharing and collaborative analysis of sensitive data. Against this backdrop, Private Set Intersection (PSI), as a fundamental cryptographic primitive in secure multi-party computation, is playing an increasingly important role in practical scenarios and is widely used in areas such as advertising conversion rates, financial risk control, and medical data sharing.

[0003] The core objective of the PSI protocol is to enable participating parties to securely compute the intersection of sets while protecting their respective privacy information. The protocol only reveals the intersection information and does not disclose non-intersection elements or any additional information, thereby achieving the collaborative release of data value while ensuring data privacy.

[0004] Significant progress has been made in both theoretical research and engineering practice of existing PSI protocols, including various technical paths such as Diffie-Hellman, blind transport, and homomorphic encryption, enabling efficient completion of two-party or multi-party intersection computation tasks under semi-honest or malicious models. While traditional PSI protocols have demonstrated good security and efficiency in protecting data privacy, their functionality is relatively limited. In practical applications, the elements of the participating parties' sets often carry payload information, such as the frequency of user actions, purchase amounts, and risk scores. This information reflects the additional attributes of the set elements. In such scenarios, participants are more concerned with intersection elements that conform to relevant attributes. For example, in a precision marketing scenario, merchant A collaborates with payment platform B to conduct a coupon distribution business. Merchant A has a large number of potential customers, such as registered members or long-term followers, while payment platform B has users' online spending amounts or spending activity. Payment platform B wants to collaborate with merchant A to identify users who are both potential customers of the merchant and whose spending amounts fall within a certain range (e.g., [500, 1000]), so as to issue specific amounts of merchant coupons to users within this specific spending range, thereby effectively improving activity conversion rates and product sales. Traditional PSI protocols can only identify the overlapping customers between the two parties, but cannot determine whether these customers meet the condition of a certain consumption range.

[0005] The study found that existing research has proposed protocols such as Threshold Privacy Set Intersection (Threshold PSI), Label Privacy Set Intersection (Label PSI), and Privacy Set Intersection with Payload Summation (PSI-Sum), achieving some progress in the functionality of PSI protocols. However, these protocols still struggle to perform fine-grained conditional filtering of payload information (such as range selection, attribute matching, etc.), limiting their application value in practical business applications. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a privacy set intersection method and system that supports load range filtering, enabling the calculation of intersections that satisfy a specific range of load values.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a privacy set intersection method that supports load interval filtering, comprising: The first and second participants jointly negotiate and determine the Bloom filter and hash function; the first participant generates a homomorphic encryption key pair, and the second participant sets the threshold parameters and load range, and generates a symmetric encryption key, a master secret, and a random number. The first participant inserts all its elements into a Bloom filter and encrypts them to obtain ciphertext, which is then sent to the second participant. The second participant generates homomorphic ciphertext based on the ciphertext, and sequentially reveals and encrypts its load value and load interval boundary value to obtain the corresponding ciphertext. The load value ciphertext is then encrypted a second time, and the elements in the second participant are encrypted and combined with the threshold parameter before being sent to the first participant. The first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first and second participants jointly call the ideal function to recover the master secret. The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set by revealing the order of the intersection element payload values. The first participant then selects the intersection element ciphertext that satisfies the payload range and sends it to the second participant. The second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

[0008] As a further technical solution, the hash function maps to ;in, The size of the Bloom filter; the first participant generates a Paillier homomorphic encryption key pair, denoted as... ;in, For public key, The private key retained by the first participant.

[0009] As a further technical solution, the second participant generates homomorphic ciphertext by performing homomorphic operations on the ciphertext. Specifically, after receiving the ciphertext, the second participant first divides the master secret into... The second participant calculates the insertion position of each element in the Bloom filter. Using the calculated insertion position and a random number, the second participant performs a homomorphic operation on the received ciphertext to generate... A homomorphic ciphertext.

[0010] As a further technical solution, the second participant sequentially reveals and encrypts the load value and load interval boundary value associated with its element, respectively obtaining the load value ciphertext and boundary value ciphertext. The second participant then uses the master secret as the key to perform secondary encryption on the load value ciphertext and uses a symmetric key to encrypt each element in the second participant, obtaining the element ciphertext.

[0011] As a further technical solution, homomorphic ciphertext, The symmetric encryption element ciphertext is encapsulated into a triple, the triple is shuffled, and the shuffled triple, boundary value ciphertext, and threshold parameter are sent together to the first participant.

[0012] As a further technical solution, after receiving the triplet, the first participant decrypts the homomorphic ciphertext and obtains a tag set based on the decryption result. Specifically, if the decryption result is 0, the index corresponding to the triplet is added to the initial intersection set, and 1 is stored in the tag set; otherwise, only 0 is added to the tag set.

[0013] As a further technical solution, the first and second participants jointly invoke the ideal function to recover the master secret. The specific method is as follows: First, the ideal function is executed, where the first participant inputs a set of tags, and the second participant inputs the secret shares obtained after splitting the master secret, and assigns an invalid value to each secret share; then, if the tag set is 1, a valid share is obtained, and if the tag set is 0, an invalid value is obtained; finally, the master secret is recovered based on all the valid shares.

[0014] Secondly, this invention provides a privacy set intersection system that supports load interval filtering, comprising the following modules: The initialization module is configured as follows: the first and second participants jointly negotiate and determine the Bloom filter and hash function; the first participant generates a homomorphic encryption key pair, and the second participant sets the threshold parameter and load range, and generates a symmetric encryption key, a master secret and a random number. The encryption module is configured as follows: the first participant inserts all its elements into a Bloom filter and encrypts them to obtain ciphertext, which is then sent to the second participant; the second participant generates homomorphic ciphertext based on the ciphertext, and sequentially reveals and encrypts its load value and load interval boundary value to obtain the corresponding ciphertext, and performs secondary encryption on the load value ciphertext, and then encrypts the elements in the second participant and combines them with the threshold parameter, and sends them together to the first participant; The threshold determination module is configured as follows: the first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first participant and the second participant jointly call the ideal function to recover the master secret. The filtering module is configured as follows: The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set in the order of the intersection element payload values. The first participant filters out the intersection element ciphertext that satisfies the payload range and sends it to the second participant. The decryption module is configured such that the second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

[0015] One or more technical solutions of the present invention have the following beneficial effects: (1) To address the technical problem that existing PSI protocols cannot perform fine-grained range filtering of load information (such as consumption amount and risk score) associated with set elements, this method innovatively introduces Sequential Reveal Encryption (ORE) technology to achieve range comparison of load values ​​in ciphertext state, thereby efficiently filtering out intersection elements that meet the load range while protecting privacy. Furthermore, this invention supports participants to customize load range and threshold parameters, effectively improving the applicability of the PSI protocol in complex collaborative scenarios.

[0016] (2) While some improved PSI protocols (such as LabelPSI) can carry additional information about elements, they are prone to leaking the payload association information of non-intersecting elements during the interaction process. This invention, however, constructs a full-link privacy protection system through multi-layer encryption and threshold determination mechanisms. On the one hand, Paillier homomorphic encryption is applied only to the Bloom filter bits, without directly exposing the original set elements; the payload ciphertext, element ciphertext, and homomorphic ciphertext are encapsulated into triples and shuffled to further hide the correspondence between elements and payloads, avoiding the leakage of payload information of non-intersecting elements. On the other hand, this invention introduces an intersection cardinality threshold determination mechanism, where the intersection size... When the intersection size is too small, the protocol terminates directly without any output, effectively preventing the additional exposure of privacy information (such as the load characteristics of a small number of intersection elements) due to the execution of subsequent processes. Compared with existing solutions without threshold mechanisms, the privacy protection dimensions are more comprehensive. Attached Figure Description

[0017] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0018] Figure 1 This is a flowchart of a privacy set intersection method that supports load interval filtering according to the present invention; Figure 2 This is a diagram showing the communication overhead of the protocol in this invention. Detailed Implementation

[0019] Example 1 This embodiment provides a privacy set intersection method that supports load range filtering, such as... Figure 1 As shown, the specific steps of the method are as follows: S1 Initialization: First Participant Second Participant The Bloom filter and hash function are determined through joint consultation; and the first participant... Generate homomorphic encryption key pairs and publish the public key, second participant Set threshold parameters and load range, and generate symmetric encryption key, master secret, and master secret. The random numbers and their order reveal the parameters required for encryption.

[0020] In step S1, the first participant Second Participant A size is determined through joint consultation. Bloom filters BF and k hash functions And map the hash function to .

[0021] First Participant Input set , for The first participant generates a Paillier homomorphic encryption key pair from the elements in the code. ,in For the published public key, The private key retained by the first participant; the second participant Input set ,in, Represents element The associated load value, the second participant Set threshold parameters With load range , This represents the boundary value of the load interval. Second participant. generate random numbers The Lord's Secret Symmetric encryption key .

[0022] S2 Encryption: First Participant Insert all its elements into a Bloom filter and encrypt them to obtain ciphertext, then send it to the second participant. Second Participant Generate homomorphic ciphertext from the ciphertext, and the second participant... The load value and load range boundary values ​​are sequentially revealed and encrypted to obtain the corresponding ciphertext. The load value ciphertext is then encrypted a second time, and then the second participant... After encrypting the elements, they are combined with a threshold parameter and sent to the first participant. .

[0023] In step S2, the first participant use k A hash function will set The elements in the table are inserted into the Bloom filter, the positions corresponding to the hash values ​​are set to 1 in the Bloom filter, and each bit of the Bloom filter is encrypted using the public key to obtain the ciphertext set. And send the encrypted set to the second participant. .

[0024] Second Participant After receiving the ciphertext, first send the master secret. Split into The shares are split to obtain secret shares. And calculate the insertion position of each element in the second participant in the Bloom filter, then the second participant Using the calculated insertion position and a random number, a homomorphic operation is performed on the received ciphertext set to generate... A homomorphic ciphertext.

[0025] Meanwhile, the second participant The load value and load range boundary value associated with its elements ( The encryption is performed sequentially to obtain the payload ciphertext and boundary value ciphertext, and the second participant uses the master secret. The payload ciphertext is encrypted a second time using the key, and each element in the second participant is encrypted using the symmetric key to obtain the element ciphertext.

[0026] The aforementioned Order-Revealing Encryption (ORE) is an improvement on order-preserving encryption, allowing direct comparison of ciphertext values ​​to reveal the order of the plaintext. Unlike order-preserving encryption, ORE does not require the ciphertext values ​​to monotonically correspond to the plaintext order. The solution includes the following three algorithms: (1) : based on safety parameters Input, output key .

[0027] (2) : with encryption key and messages As input, the encryption algorithm will send the message Encrypt to ciphertext And output it.

[0028] (3) : with two ciphertexts and The algorithm takes the input as input and outputs the comparison result. .if , indicating ciphertext The corresponding plaintext is greater than the ciphertext. The corresponding plaintext; if , indicating ciphertext The corresponding plaintext is smaller than the ciphertext. The corresponding plaintext. express The corresponding plaintext is equal.

[0029] Finally, the homomorphic ciphertext, The ciphertext of the symmetric encryption element is encapsulated as a triple, which has the following form: Shuffle n triples and send the shuffled triples, boundary value ciphertext, and threshold parameters to the first participant.

[0030] S3 Threshold Determination: The first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first and second participants jointly call the ideal function to recover the master secret.

[0031] In step S3, the first participant After receiving the triple, first use the private key pair Decrypt a homomorphic ciphertext, check if the decryption result is 0, and obtain a tag set based on the decryption result. Specifically: if the decryption result is 0, then add the index corresponding to the triple to the initial intersection set. And store 1 into the tag set. Conversely, only 0 is added to the tag set. Then, Calculate the initial intersection set size The number of intersections is compared with a threshold parameter: if the number of intersections is less than the threshold parameter, the protocol terminates; otherwise, and Common call Subideal functional To restore the Lord's secret.

[0032] The first and second participants jointly invoke the ideal function to recover the master secret. In this embodiment, the ideal function is represented as follows: This function involves two parties: the sender and the receiver. and the recipient During the execution process, A selection bit needs to be entered. ,and Two messages need to be entered. and After the execution is completed, Able to obtain the message selected ,and There will be no output, and nothing can be known. Specific input The specific method is as follows: First, the ideal function is executed, where the first participant... Input tag set Second Participant Input the secret shares obtained by splitting the master secret, and assign an invalid value to each secret share, as follows: Then, if the set of tags If the value is 1, then an effective share is obtained. If the set of tags If the value is 0, then an invalid value is obtained; ensure Only the corresponding valid share can be obtained, and finally the master secret is recovered based on all the valid shares.

[0033] S4 Filtering: The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set by revealing the order of the load values ​​of the intersection elements. The first participant filters out the ciphertext of the intersection elements that satisfy the load range and sends it to the second participant.

[0034] In step S4, the first participant The master secret recovered in step S3 is used to perform the first level of decryption on the payload ciphertext, and the order of the intersection element payload values ​​reveals the encrypted ciphertext set. Subsequently, the first participant... The call sequence reveals the encryption comparison algorithm, filtering out those that meet the load range. The ciphertext of the intersection elements of [] is added to the set. I and set I Send to the second participant .

[0035] S5 Decryption: The second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

[0036] In step S5, the second participant Using a set of symmetric key pairs I Decrypt the intersection elements and output the intersection elements that satisfy the load interval condition.

[0037] To verify the feasibility of this embodiment, the following experiment was conducted: The experiment was conducted on a hardware platform equipped with 32GB of memory and an Intel Core i7 3.60 GHz processor with 8 physical cores. In the Bloom filter section, the false positive rate was set to... In the OT protocol phase, the experiment utilized the 2-to-1 OT protocol provided by the LibOTe library. For sets with sizes of... , , , and The protocol runtime and set size are respectively , , , and The protocol communication overhead was tested and analyzed. All experimental results are the average time cost of 10 protocol runs. The specific protocol run times are shown in Table 1, and the trend of protocol communication overhead is shown in Table 2. Figure 2 As shown in the figure. Overall, this protocol operates efficiently in small to medium-sized aggregate scenarios and has good practicality.

[0038] Table 1 Protocol runtime (unit: seconds)

[0039] Example 2 This embodiment provides a privacy set intersection system that supports load range filtering, including the following modules: The initialization module is configured as follows: the first and second participants jointly negotiate and determine the Bloom filter and hash function; the first participant generates a homomorphic encryption key pair, and the second participant sets the threshold parameter and load range, and generates a symmetric encryption key, a master secret and a random number. The encryption module is configured as follows: the first participant inserts all its elements into a Bloom filter and encrypts them to obtain ciphertext, which is then sent to the second participant; the second participant generates homomorphic ciphertext based on the ciphertext, and sequentially reveals and encrypts its load value and load interval boundary value to obtain the corresponding ciphertext, and performs secondary encryption on the load value ciphertext, and then encrypts the elements in the second participant and combines them with the threshold parameter, and sends them together to the first participant; The threshold determination module is configured as follows: the first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first participant and the second participant jointly call the ideal function to recover the master secret. The filtering module is configured as follows: The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set in the order of the intersection element payload values. The first participant filters out the intersection element ciphertext that satisfies the payload range and sends it to the second participant. The decryption module is configured such that the second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

[0040] Various modifications and variations of this invention will be apparent to those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for finding intersections of privacy sets that supports load interval filtering, characterized in that, include: The first and second participants jointly negotiate and determine the Bloom filter and hash function; the first participant generates a homomorphic encryption key pair, and the second participant sets the threshold parameters and load range, and generates a symmetric encryption key, a master secret, and a random number. The first participant inserts all its elements into a Bloom filter and encrypts them to obtain ciphertext, which is then sent to the second participant. The second participant generates homomorphic ciphertext based on the ciphertext, and the second participant sequentially reveals and encrypts its payload value and payload interval boundary value to obtain the corresponding ciphertext. The payload value ciphertext is then encrypted a second time, and the elements in the second participant are then encrypted and combined with the threshold parameter before being sent to the first participant. The first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first and second participants jointly call the ideal function to recover the master secret. The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set by revealing the order of the intersection element payload values. The first participant then selects the intersection element ciphertext that satisfies the payload range and sends it to the second participant. The second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

2. The privacy set intersection method supporting load interval filtering as described in claim 1, characterized in that, The hash function is mapped to ;in, The size of the Bloom filter; the first participant generates a Paillier homomorphic encryption key pair, denoted as... ;in, For public key, The private key retained by the first participant.

3. The privacy set intersection method supporting load interval filtering as described in claim 1, characterized in that, The second participant performs homomorphic operations on the ciphertext to generate homomorphic ciphertext. Specifically, after receiving the ciphertext, the second participant first divides the master secret into... The second participant calculates the insertion position of each element in the Bloom filter. Using the calculated insertion position and a random number, the second participant performs a homomorphic operation on the received ciphertext to generate... A homomorphic ciphertext.

4. The privacy set intersection method supporting load interval filtering as described in claim 1, characterized in that, The second participant sequentially reveals and encrypts the load value and load interval boundary value associated with its element, obtaining the load value ciphertext and boundary value ciphertext respectively. The second participant then uses the master secret as the key to perform secondary encryption on the load value ciphertext and uses a symmetric key to encrypt each element in the second participant, obtaining the element ciphertext.

5. The privacy set intersection method supporting load interval filtering as described in claim 4, characterized in that, Homomorphic ciphertext, The symmetric encryption element ciphertext is encapsulated into a triple, the triple is shuffled, and the shuffled triple, boundary value ciphertext, and threshold parameter are sent together to the first participant.

6. The privacy set intersection method supporting load interval filtering as described in claim 5, characterized in that, After receiving the triplet, the first participant decrypts the homomorphic ciphertext and obtains a tag set based on the decryption result. Specifically, if the decryption result is 0, the index corresponding to the triplet is added to the initial intersection set, and 1 is stored in the tag set; otherwise, only 0 is added to the tag set.

7. The privacy set intersection method supporting load interval filtering as described in claim 1, characterized in that, The first and second participants jointly invoke the ideal function to recover the master secret. The specific method is as follows: First, the ideal function is executed, where the first participant inputs a set of tags, and the second participant inputs the secret shares obtained after splitting the master secret, and assigns an invalid value to each secret share; then, if the tag set is 1, a valid share is obtained, and if the tag set is 0, an invalid value is obtained; finally, the master secret is recovered based on all the valid shares.

8. A privacy set intersection system supporting load interval filtering, characterized in that, Includes the following modules: The initialization module is configured as follows: the first and second participants jointly negotiate and determine the Bloom filter and hash function; the first participant generates a homomorphic encryption key pair, and the second participant sets the threshold parameter and load range, and generates a symmetric encryption key, a master secret and a random number. The encryption module is configured such that: the first participant inserts all its elements into a Bloom filter and encrypts them to obtain ciphertext, which is then sent to the second participant; The second participant generates homomorphic ciphertext based on the ciphertext, and the second participant sequentially reveals and encrypts its payload value and payload interval boundary value to obtain the corresponding ciphertext. The payload value ciphertext is then encrypted a second time, and the elements in the second participant are then encrypted and combined with the threshold parameter before being sent to the first participant. The threshold determination module is configured as follows: the first participant decrypts the homomorphic ciphertext and obtains an initial intersection set based on the decryption result. If the size of the initial intersection set is less than the threshold parameter, the process terminates; if it is greater than the threshold parameter, the first participant and the second participant jointly call the ideal function to recover the master secret. The filtering module is configured as follows: The first participant uses the recovered master secret to decrypt and obtains the encrypted ciphertext set in the order of the intersection element payload values. The first participant filters out the intersection element ciphertext that satisfies the payload range and sends it to the second participant. The decryption module is configured such that the second participant uses a symmetric key to decrypt the ciphertext of the intersection elements and outputs the intersection elements that satisfy the load interval condition.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the privacy set intersection method that supports load range filtering as described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the privacy set intersection method that supports load range filtering as described in any one of claims 1-7.

Images