A privacy set intersection verification method, device, equipment and medium

Abstract

The application relates to the technical field of data processing, and in particular to a privacy set intersection verification method and device, equipment and a medium. A first privacy data set is decrypted by using a private key to obtain a first data set of other participants, a to-be-verified intersection and a non-intersection data set are determined according to the first data set and a second data set of the self, a parameter set is determined according to a first prime number and a second prime number generated when the private key is determined, and the first prime number, the second prime number, the parameter set, the first privacy data set, the non-intersection data set and a preset constraint condition are processed based on a zero-knowledge proof algorithm to obtain proof evidence of the non-intersection data set. The to-be-verified intersection and the proof evidence are sent to enable the other participants to verify the authenticity of the to-be-verified intersection, and the verifiability of the privacy set intersection is realized.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus, device and medium for verifying the intersection of privacy sets. Background Technology

[0002] Private set intersection (PSI) refers to the calculation of the intersection between a client-provided dataset and a server-provided dataset using a series of underlying cryptographic techniques, without revealing any data outside the intersection. It has wide applications in real-world scenarios such as blacklist sharing and marketing matching.

[0003] In related technologies, the design is based on the assumption that the participating parties are semi-trustworthy, but this assumption is not rigorous. In many cases, participating parties comply with the agreement because violating the agreement may be discovered or will harm their own interests. In the final step of the existing PSI technology, the client needs to share the result with the server. However, in this step, if the client intentionally sends an incomplete intersection (intentionally omitting one or more elements from the true intersection) to the server, the server will not be able to detect it.

[0004] Therefore, how to verify the authenticity of the intersection sent by other participants has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for verifying the intersection of privacy sets, in order to solve the problem in the prior art that the authenticity of the intersection sent by other participants cannot be verified.

[0006] Firstly, this application provides a method for verifying the intersection of privacy sets, the method comprising: If a first private data set is received from another participant, each element in the first private data set is decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. The parameter set is determined based on the first and second prime numbers generated when the private key is determined. The first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and the preset constraints are processed based on the zero-knowledge proof algorithm to obtain the proof evidence of the disjoint data set. The intersection to be verified and the proof evidence are sent to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0007] Further, the step of determining the parameter set based on the generation of the first prime number and the second prime number when determining the private key includes: Determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; The least common multiple of the first difference and the second difference is determined as the first parameter in the parameter set.

[0008] Furthermore, the method also includes: The product of the first prime number and the second prime number is determined as the second parameter in the parameter set.

[0009] Furthermore, the method also includes: The sum of the second parameter and the target value is determined as the third parameter in the parameter set.

[0010] Furthermore, the method also includes: The first parameter raised to the power of the third parameter is determined as the first value; Determine the first remainder when the first value is divided by the square of the second parameter, and determine the second value based on the first remainder and the second parameter; Determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

[0011] Furthermore, the preset constraints include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0012] Furthermore, the method also includes: Based on the second data set, a polynomial is constructed using interpolation, such that the solution of the polynomial being 0 is the second data set; The set of elements is encrypted using the public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the set of elements is composed of the coefficients of each term of the polynomial; The second privacy data set and the public key are sent to the other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the other participants' third data set.

[0013] Secondly, this application provides a privacy set intersection verification device, the device comprising: The decryption module is used to, if it receives a first private data set sent by another participant, decrypt each element in the first private data set using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant, and determine the intersection and non-intersection data sets to be verified based on the first data set and its own second data set. The determination module is used to determine the parameter set based on the first prime number and the second prime number generated when determining the private key; The proof module is used to process the first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and preset constraints based on a zero-knowledge proof algorithm to obtain proof evidence for the disjoint data set; and to send the intersection to be verified and the proof evidence to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0014] Furthermore, the determining module is specifically used to determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; and to determine the least common multiple of the first difference and the second difference as the first parameter in the parameter set.

[0015] Furthermore, the determining module is also used to determine the product of the first prime number and the second prime number as the second parameter in the parameter set.

[0016] Furthermore, the determining module is also used to determine the sum of the second parameter and the target value as the third parameter in the parameter set.

[0017] Furthermore, the determining module is also used to determine the first power of the third parameter as a first value; determine the first remainder when the first value is divided by the square of the second parameter, and determine the second value based on the first remainder and the second parameter; determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

[0018] Furthermore, the preset constraints include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0019] Furthermore, the device also includes: An encryption module is configured to construct a polynomial using interpolation based on the second data set, such that the solution of the polynomial being 0 is the second data set; encrypt the element set using a public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the element set is composed of the coefficients of each term of the polynomial; and send the second privacy data set and the public key to the other participants, so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the third data set of the other participants.

[0020] This application also provides an electronic device, which includes a processor, configured to execute a computer program stored in a memory to implement the steps of any of the privacy set intersection verification methods described above.

[0021] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the privacy set intersection verification methods described above.

[0022] This application also provides a computer program product, which includes computer program code that, when run on a computer, causes the computer to perform the steps of any of the privacy set intersection verification methods described above.

[0023] In this embodiment, upon receiving a first private data set from another participant, each element in the first private data set is decrypted using a private key determined by a homomorphic encryption algorithm to obtain the other participant's first data set. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. A parameter set is determined based on the first and second prime numbers generated when determining the private key. A zero-knowledge proof algorithm is used to process the first prime numbers, the second prime numbers, the parameter set, the first private data set, the non-intersection data set, and preset constraints to obtain proof of the non-intersection data set. The intersection to be verified and the proof are then sent to the other participant, enabling them to verify the authenticity of the intersection based on the zero-knowledge proof algorithm and the proof. After determining the intersection to be verified, to ensure the other participant accepts its authenticity, a zero-knowledge proof algorithm and the determined parameter set are used to determine proof that data in the non-intersection data set does not belong to the intersection to be verified. This allows the other participant to accept the authenticity of the intersection based on the proof, thus achieving the verifiability of the intersection of the private sets. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a privacy set intersection verification process provided in an embodiment of this application; Figure 2 A schematic diagram of a privacy set intersection verification device provided in this application embodiment; Figure 3 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art are within the scope of protection of this application.

[0027] This application provides a method, apparatus, device, and medium for verifying the intersection of privacy sets. The method, upon receiving a first privacy data set from another participant, decrypts each element in the first privacy data set using a private key determined by a homomorphic encryption algorithm to obtain the other participant's first data set. Based on the first data set and its own second data set, it determines the intersection and non-intersection data sets to be verified. It then determines a parameter set by generating a first prime number and a second prime number when determining the private key. Finally, it processes the first prime number, the second prime number, the parameter set, the first privacy data set, the non-intersection data set, and preset constraints using a zero-knowledge proof algorithm to obtain proof evidence for the non-intersection data set. The method then sends the intersection to be verified and the proof evidence to the other participant, enabling the other participant to verify the authenticity of the intersection based on the zero-knowledge proof algorithm and the proof evidence.

[0028] Figure 1 A flowchart illustrating a privacy set intersection verification process provided in this application embodiment is shown below. Figure 1 As shown, the process includes the following steps: S101: If a first privacy data set is received from another participant, each element in the first privacy data set is decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant, and the intersection and non-intersection data sets to be verified are determined based on the first data set and its own second data set.

[0029] The privacy set intersection verification method provided in this application is applied to electronic devices, such as servers and PCs.

[0030] Suppose that Bank A and Bank B each hold a customer list X and Y, respectively. X and Y are composed of customers' ID numbers. Bank A and Bank B want to obtain their shared customer list Z = X ∩ Y, but neither wants to disclose customer information outside the shared list to the other. In this case, it can be determined that both Bank A and Bank B are participants, and the PSI protocol can be executed to determine the shared customer list Z = X ∩ Y.

[0031] In the PSI protocol, in order to determine the intersection of data, a participant can encrypt its own data and send it to other participants. The other participants then encrypt the received encrypted data and their own data again to obtain a private data set, which they then send to the other participant (i.e., the aforementioned participant). The other participant decrypts the private data set to obtain the other participant's data and determines the intersection.

[0032] In this embodiment, for ease of description, the entire privacy set intersection verification method process will be described from the perspective of one of the aforementioned participating parties. For ease of description, in this embodiment, one of the aforementioned participating parties can be referred to as the client, and the other participating parties as the server. This application will describe the entire scheme from the client's perspective. It should be noted that those skilled in the art can define which participating party is the client and which is the server as needed.

[0033] In this embodiment of the application, a first privacy data set sent by other participants can be received in real time. The first privacy data set can be obtained by the other participants encrypting the received encrypted data and their own data again based on the public key determined by the homomorphic encryption algorithm.

[0034] In this embodiment, if a first private data set is received from another participant, each element in the first private data set can be decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the other participant's first data set. The homomorphic encryption algorithm can be the Paillier Cryptosystem (Paillier) algorithm. Of course, those skilled in the art can also use other algorithms as needed.

[0035] Since the first data set of the other participants has already been determined through decryption, in order to determine the intersection, in this embodiment of the application, the intersection and non-intersection data sets to be verified can be determined based on the first data set and its own second data set. The non-intersection data set can be understood as the set of data in the first data set excluding the data in the intersection to be verified.

[0036] S102: Determine the parameter set based on the first prime number and the second prime number generated when determining the private key.

[0037] When determining the private and public keys based on a homomorphic encryption algorithm, the algorithm generates a first prime number and a second prime number. In this embodiment, the parameter set can be determined based on the first and second prime numbers.

[0038] In this embodiment, p can be used to represent the first prime number and q to represent the second prime number, where p and q are distinct large prime numbers in the Paillier algorithm. How the Paillier algorithm generates p and q when generating the private key is existing technology, and this embodiment will not elaborate on this process.

[0039] In the embodiments of this application, the parameter set may include one or more parameters. For example, the product of the first prime number and the second prime number may be determined as a parameter in the parameter set, the sum of the first prime number and the second prime number may be determined as a parameter in the parameter set, and the least common multiple of the first prime number and the second prime number may be determined as a parameter in the parameter set.

[0040] S103: Based on the zero-knowledge proof algorithm, process the first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and the preset constraints to obtain proof evidence for the disjoint data set.

[0041] To obtain proof that data in a disjoint dataset does not belong to the intersection to be verified, this embodiment of the application uses a zero-knowledge proof (ZKP) algorithm to process the first prime number, the second prime number, the parameter set, the first privacy dataset, the disjoint dataset, and preset constraints to obtain proof of the disjoint dataset. The core purpose of zero-knowledge proof is to prove the truth of a proposition to the verifier without revealing any additional information, thereby achieving the dual goals of privacy protection and trusted verification.

[0042] S104: Send the intersection to be verified and the proof evidence to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0043] After obtaining the proof, the intersection to be verified and the proof can be sent to the other party so that the other party can verify the authenticity of the intersection based on the zero-knowledge proof algorithm and the proof.

[0044] In this embodiment, upon receiving a first private data set from another participant, each element in the first private data set is decrypted using a private key determined by a homomorphic encryption algorithm to obtain the other participant's first data set. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. A parameter set is determined based on the first and second prime numbers generated when determining the private key. A zero-knowledge proof algorithm is used to process the first prime numbers, the second prime numbers, the parameter set, the first private data set, the non-intersection data set, and preset constraints to obtain proof of the non-intersection data set. The intersection to be verified and the proof are then sent to the other participant, enabling them to verify the authenticity of the intersection based on the zero-knowledge proof algorithm and the proof. After determining the intersection to be verified, to ensure the other participant accepts its authenticity, a zero-knowledge proof algorithm and the determined parameter set are used to determine proof that data in the non-intersection data set does not belong to the intersection to be verified. This allows the other participant to accept the authenticity of the intersection based on the proof, thus achieving the verifiability of the intersection of the private sets.

[0045] To further improve the accuracy of privacy set intersection verification, based on the above embodiments, in this application embodiment, the step of determining the parameter set according to the generation of a first prime number and a second prime number when determining the private key includes: Determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; The least common multiple of the first difference and the second difference is determined as the first parameter in the parameter set.

[0046] In this embodiment of the application, when determining the parameter set based on the first prime number and the second prime number, a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value, can be determined. For example, the target value can be 1.

[0047] The least common multiple of the first and second differences is determined as the first parameter in the parameter set.

[0048] Specifically, the process of determining the first parameter can be expressed as follows:

[0049] in, The first parameter is represented by lcm(); lcm() is used to calculate the least common multiple. Denotes the first prime number; It represents the second prime number.

[0050] In one possible implementation, when determining the parameter set based on the first prime number and the second prime number, the product of the first prime number and the second prime number can be determined as the second parameter in the parameter set.

[0051] Specifically, the process of determining the second parameter can be expressed as follows:

[0052] in, Denotes the first prime number; Represents the second prime number; This indicates the second parameter.

[0053] In one possible implementation, when determining the parameter set based on the first prime number and the second prime number, the sum of the second parameter and the target value can be determined as the third parameter in the parameter set.

[0054] Specifically, the process of determining the third parameter can be expressed as follows: g=n+1 Where g represents the third parameter and n represents the second parameter.

[0055] In one possible implementation, when determining the parameter set based on the first prime number and the second prime number, the first power of the third parameter can be used as the first value. The first remainder when the first value is divided by the square of the second parameter is determined, and the second value is determined based on the first remainder and the second parameter. Finally, the remainder when the reciprocal of the second value is divided by the second parameter is determined, and this remainder is used as the fourth parameter in the parameter set.

[0056] Specifically, the process of determining the fourth parameter can be expressed as follows:

[0057] in, Indicates the fourth parameter; Indicates the third parameter; Indicates the first parameter; Then it represents the first value; L represents the second parameter; L() represents the preset formula. , where n is the second parameter; This indicates the second value.

[0058] To further improve the accuracy of privacy set intersection verification, based on the above embodiments, in this application embodiment, the preset constraint condition includes at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0059] In this embodiment, preset constraints can be configured. These preset constraints may include: for each data point in the disjoint data set, determining the corresponding encrypted data in the first privacy data set; determining the third value as a power of the first parameter of the encrypted data; determining the second remainder when the third value is divided by the square of the second parameter; determining the fourth value based on the second remainder and the second parameter; determining the third remainder when the fourth value is divided by the second parameter; and determining the product of the fourth parameter and the third remainder.

[0060] After identifying each data point in the disjoint dataset, we can then determine if each data point in the disjoint dataset is consistent with its corresponding product value. If so, the constraints are satisfied.

[0061] Specifically, this constraint can be expressed using the following formula:

[0062] in, This represents a specific data point within a disjoint dataset. Indicates the fourth parameter; This indicates the encrypted data corresponding to the data in the first privacy data set; Indicates the first parameter; This indicates the third value; Indicates the second parameter; Then it represents the second remainder; L() represents the preset formula. , where n is the second parameter; This indicates the fourth value; Then it represents the third remainder.

[0063] If every data point in the disjoint dataset satisfies the above equation, then the constraint conditions can be determined to be met.

[0064] In one possible implementation, the preset constraint may further include: for each data in the disjoint data set, substituting the data and the privacy coefficients in the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypting the polynomial ciphertext using the private key to obtain the polynomial plaintext corresponding to the data; if the product of the polynomial plaintexts corresponding to all data in the disjoint data set is not 0, then the constraint is determined to be satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set is composed of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set.

[0065] Specifically, this constraint can be expressed using the following formula:

[0066] in, Represents data in a disjoint dataset The corresponding polynomial plaintext; j represents the index. Assuming that the number of data in the disjoint data set is n, then the value of j can be 0, 1, 2, ..., n-1.

[0067] In this embodiment of the application, the data can be first... And the privacy coefficients from the second privacy dataset are substituted into the polynomial. This data can be obtained from [the source]. Corresponding polynomial ciphertext .in, This represents the number of polynomial coefficients, specifically the number of privacy coefficients included in the second privacy data set. After obtaining this polynomial ciphertext, the private key is used to process the polynomial ciphertext. Decryption will yield the polynomial plaintext. The product of the polynomial plaintexts corresponding to all data in all disjoint data sets is not zero, i.e., it satisfies the above formula. Then it can be determined that the constraints are met.

[0068] In one possible implementation, the preset constraint may further include: determining a set of parameters to be determined based on the first prime number and the second prime number received by the zero-knowledge proof algorithm; if the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint is determined to be met.

[0069] Specifically, this constraint can be expressed using the following formula:

[0070] In the above formula Corresponding to p in the above embodiments; Corresponding to q in the above embodiments; Corresponding to the embodiments described above ; Corresponding to the embodiments described above ; This corresponds to n in the above embodiments.

[0071] The data set consisting of the first prime number, the second prime number, and the parameters determined by the above formula, received by the zero-knowledge proof algorithm, can be called the parameter set to be determined. If the parameters in the parameter set to be determined are consistent with the parameters in the parameter set to be determined, then the constraint conditions are met.

[0072] It should be noted that the preset constraints include one or more of the above-mentioned conditions.

[0073] For example, the circuit can be predefined. If and only if In other words, the preset constraints include each of the above items.

[0074] To achieve intersection of privacy-preserving data, based on the above embodiments, the method in this application embodiment further includes: Based on the second data set, a polynomial is constructed using interpolation, such that the solution of the polynomial being 0 is the second data set; The set of elements is encrypted using the public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the set of elements is composed of the coefficients of each term of the polynomial; The second privacy data set and the public key are sent to the other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the other participants' third data set.

[0075] To achieve intersection of private data, when determining the intersection of data from different parties, a polynomial can be constructed using interpolation based on the second set of data. The solution where this polynomial equals 0 constitutes the second set of data. Each coefficient of this polynomial forms a set of elements. Subsequently, this set of elements can be encrypted using the public key determined by the homomorphic encryption algorithm to obtain the second private data set.

[0076] Suppose that the constructed polynomial is Then the set of elements can be represented as .

[0077] After obtaining the second privacy data set, the second privacy data set and the public key can be sent to other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and their own stored third data set.

[0078] The process of determining and verifying the intersection of privacy sets is explained in detail below.

[0079] The participants include: client (C) and server (S).

[0080] C's data set is The data set of S is Y .

[0081] C performs the following steps: (1) Generate the public-private key pair for the homomorphic encryption algorithm Paillier ( Secretly store the private key Publicly expose the public key to the server. .

[0082] (2) Obtain the polynomial using interpolation. This makes the equation The set of solutions is X.

[0083] (3) For sets For each element in the set, perform Paillier public-key encryption to obtain the set. .

[0084] (4) Send set E to S.

[0085] S performs the following steps: (1) For all y Based on the characteristics of the Paillier algorithm, calculate , where n are the parameters of the Paillier algorithm. The coefficients of the polynomial, i.e., the set Elements in; This represents the data within its own data set; This indicates that data is encrypted using a public key and a homomorphic encryption algorithm. Randomly select r, and calculate... The first privacy data set formed by the above calculation results is denoted as CT. ,in, This indicates the amount of data included in the first privacy data set.

[0086] (2) Send CT to C.

[0087] C performs the following steps: (1) For each element in CT ,implement That is, using the private key corresponding to the public key for each element. Decryption is performed.

[0088] (2) Determine the set Intersection with X That is, the intersection of X and Y.

[0089] If C sends the set to S Alternatively, if the set CT sent by S to C is inaccurate, it will inevitably affect the accuracy of the result, thus harming the sender's interests. Therefore, neither C nor S should engage in malicious behavior in the above steps.

[0090] In C During the process of sending to S, if C adds irrelevant elements to the result, S can easily detect it. However, if C sends a subset of the result to S, according to the current protocol, S cannot recognize it.

[0091] Therefore, C also needs to perform step (3) to determine the proof evidence based on the predefined constraint clauses and zero-knowledge proof algorithm.

[0092] Specifically, define the circuit. If and only if .in, The function L is defined as Here, n and g are both public parameters of the Pailliar algorithm. This means that every data point in the non-intersecting dataset satisfies this equation.

[0093] make .

[0094] calculate ,in, This represents the set of parameters based on the first prime number p and the second prime number q. Where n is the number of elements described in the above embodiments. , As described in the above embodiments , This indicates the data included in the first privacy data set. This represents all data in the first privacy data set. As described in the above embodiments , As described in the above embodiments , As described in the above embodiments , As described in the above embodiments , The non-intersecting data set described in the above embodiments, That is, data in non-intersecting datasets. For data Representation in the circuit. pp represents the public parameters of the zero-knowledge proof zkStark. Wherein, It is the core function in the zero-knowledge proof algorithm; pp represents the public parameters of the zero-knowledge proof zkStark. pp is short for Public Parameters, which is the set of parameters publicly disclosed in the protocol for generating and verifying proofs, and is usually determined by security parameters. This indicates preset constraints.

[0095] (4) Order C will Send to S.

[0096] S performs the following steps: Received Based on zero-knowledge proof algorithms and proof evidence, the intersection to be verified is validated. The authenticity of.

[0097] The privacy set intersection verification method provided in this application allows the S side to verify the correctness of the result compared to the original PSI protocol. Under this method, S can perform a verification operation after receiving the intersection sent by C, and promptly detect malicious behavior of C.

[0098] Based on the same inventive concept, embodiments of this application provide a privacy set intersection verification device. Figure 2 A schematic diagram of a privacy set intersection verification device provided in this application embodiment is shown below. Figure 2 The device includes: The decryption module 201 is used to, if it receives a first privacy data set sent by another participant, decrypt each element in the first privacy data set using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant, and determine the intersection and non-intersection data sets to be verified based on the first data set and its own second data set. The determining module 202 is used to determine the parameter set based on the first prime number and the second prime number generated when determining the private key; The proof module 203 is used to process the first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and preset constraints based on a zero-knowledge proof algorithm to obtain proof evidence for the disjoint data set; and to send the intersection to be verified and the proof evidence to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0099] In one possible implementation, the determining module 202 is specifically used to determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; and to determine the least common multiple of the first difference and the second difference as a first parameter in the parameter set.

[0100] In one possible implementation, the determining module 202 is further configured to determine the product of the first prime number and the second prime number as the second parameter in the parameter set.

[0101] In one possible implementation, the determining module 202 is further configured to determine the sum of the second parameter and the target value as the third parameter in the parameter set.

[0102] In one possible implementation, the determining module 202 is further configured to determine the first power of the third parameter as a first value; determine the first remainder when the first value is divided by the square of the second parameter, and determine a second value based on the first remainder and the second parameter; determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

[0103] In one possible implementation, the preset constraint conditions include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0104] In one possible implementation, the device further includes: The encryption module 204 is configured to construct a polynomial using interpolation based on the second data set, such that the solution of the polynomial being 0 is the second data set; encrypt the element set using a public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the element set is composed of the coefficients of each term of the polynomial; and send the second privacy data set and the public key to the other participants, so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the third data set of the other participants.

[0105] Based on the same inventive concept, embodiments of this application provide an electronic device that can implement the steps of the privacy set intersection verification method discussed above. Figure 3 This application provides a schematic diagram of an electronic device structure, such as... Figure 3 As shown, it includes: processor 301, communication interface 302, memory 303 and communication bus 304, wherein processor 301, communication interface 302 and memory 303 communicate with each other through communication bus 304; The memory 303 stores a computer program. When the program is executed by the processor 301, the processor 301 performs the following steps: If a first private data set is received from another participant, each element in the first private data set is decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. The parameter set is determined based on the first and second prime numbers generated when the private key is determined. The first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and the preset constraints are processed based on the zero-knowledge proof algorithm to obtain the proof evidence of the disjoint data set. The intersection to be verified and the proof evidence are sent to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0106] In one possible implementation, determining the parameter set based on generating the first and second prime numbers when determining the private key includes: Determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; The least common multiple of the first difference and the second difference is determined as the first parameter in the parameter set.

[0107] In one possible implementation, the method further includes: The product of the first prime number and the second prime number is determined as the second parameter in the parameter set.

[0108] In one possible implementation, the method further includes: The sum of the second parameter and the target value is determined as the third parameter in the parameter set.

[0109] In one possible implementation, the method further includes: The first parameter raised to the power of the third parameter is determined as the first value; Determine the first remainder when the first value is divided by the square of the second parameter, and determine the second value based on the first remainder and the second parameter; Determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

[0110] In one possible implementation, the preset constraint conditions include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0111] In one possible implementation, the method further includes: Based on the second data set, a polynomial is constructed using interpolation, such that the solution of the polynomial being 0 is the second data set; The set of elements is encrypted using the public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the set of elements is composed of the coefficients of each term of the polynomial; The second privacy data set and the public key are sent to the other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the other participants' third data set.

[0112] Since the principle of the above-mentioned electronic device in solving the problem is similar to that of the privacy set intersection verification method, the implementation of the above-mentioned electronic device can be found in the embodiments of the method, and repeated details will not be repeated.

[0113] The communication bus mentioned in the aforementioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. Communication interface 302 is used for communication between the aforementioned electronic device and other devices. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0114] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0115] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, it causes the processor to perform the following steps: If a first private data set is received from another participant, each element in the first private data set is decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. The parameter set is determined based on the first and second prime numbers generated when the private key is determined. The first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and the preset constraints are processed based on the zero-knowledge proof algorithm to obtain the proof evidence of the disjoint data set. The intersection to be verified and the proof evidence are sent to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence.

[0116] In one possible implementation, determining the parameter set based on generating the first and second prime numbers when determining the private key includes: Determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; The least common multiple of the first difference and the second difference is determined as the first parameter in the parameter set.

[0117] In one possible implementation, the method further includes: The product of the first prime number and the second prime number is determined as the second parameter in the parameter set.

[0118] In one possible implementation, the method further includes: The sum of the second parameter and the target value is determined as the third parameter in the parameter set.

[0119] In one possible implementation, the method further includes: The first parameter raised to the power of the third parameter is determined as the first value; Determine the first remainder when the first value is divided by the square of the second parameter, and determine the second value based on the first remainder and the second parameter; Determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

[0120] In one possible implementation, the preset constraint conditions include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or For each data point in the disjoint data set, substitute the data point and the privacy coefficients from the second privacy data set into a polynomial to obtain polynomial ciphertext; decrypt the polynomial ciphertext using the private key to obtain the corresponding polynomial plaintext; if the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not 0, then the constraint condition is satisfied; wherein, the second privacy data set is obtained by encrypting the element set based on the public key, and the element set consists of the coefficients of each term of the polynomial; the polynomial is constructed using interpolation based on the second data set, and the solution of the polynomial is the second data set; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

[0121] In one possible implementation, the method further includes: Based on the second data set, a polynomial is constructed using interpolation, such that the solution of the polynomial being 0 is the second data set; The set of elements is encrypted using the public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the set of elements is composed of the coefficients of each term of the polynomial; The second privacy data set and the public key are sent to the other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the other participants' third data set.

[0122] Since the principle of the computer-readable storage medium used to solve the problem is similar to that of the privacy set intersection verification method, the implementation of the computer-readable storage medium can be found in the implementation of the method, and the repeated parts will not be described again.

[0123] Based on the same inventive concept, this application also provides a computer program product, which includes computer program code that, when executed on a computer, causes the computer to perform any of the privacy set intersection verification methods discussed above. Since the principle of the above computer program product in solving the problem is similar to that of the data manipulation method, the implementation of the above computer program product can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0124] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0126] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of user-operated steps to be executed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0128] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for verifying the intersection of privacy sets, characterized in that, The method includes: If a first private data set is received from another participant, each element in the first private data set is decrypted using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant. Based on the first data set and its own second data set, the intersection and non-intersection data sets to be verified are determined. The parameter set is determined based on the first and second prime numbers generated when the private key is determined. The first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and the preset constraints are processed based on the zero-knowledge proof algorithm to obtain the proof evidence of the disjoint data set. The intersection to be verified and the proof evidence are sent to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence. The preset constraints include: For each data point in the disjoint data set, the data point and the privacy coefficients in the second privacy data set are substituted into a polynomial to obtain polynomial ciphertext. The polynomial ciphertext is then decrypted using the private key to obtain the polynomial plaintext corresponding to the data point. If the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not zero, then the constraint condition is satisfied. The second privacy data set is obtained by encrypting the element set using a public key, and the element set is composed of the coefficients of each term of the polynomial. The polynomial is constructed using interpolation based on the second data set, and the solution to the polynomial is the second data set.

2. The method according to claim 1, characterized in that, The step of generating a first prime number and a second prime number based on the private key, and determining the parameter set, includes: Determine a first difference between the first prime number and the target value, and a second difference between the second prime number and the target value; The least common multiple of the first difference and the second difference is determined as the first parameter in the parameter set.

3. The method according to claim 2, characterized in that, The method further includes: The product of the first prime number and the second prime number is determined as the second parameter in the parameter set.

4. The method according to claim 3, characterized in that, The method further includes: The sum of the second parameter and the target value is determined as the third parameter in the parameter set.

5. The method according to claim 4, characterized in that, The method further includes: The first parameter raised to the power of the third parameter is determined as the first value; Determine the first remainder when the first value is divided by the square of the second parameter, and determine the second value based on the first remainder and the second parameter; Determine the remainder when the reciprocal of the second value is divided by the second parameter, and determine the remainder as the fourth parameter in the parameter set.

6. The method according to claim 5, characterized in that, The preset constraints include at least one of the following: For each piece of data in the disjoint data set, determine the encrypted data corresponding to that data in the first privacy data set; determine the third value by raising the first parameter of the encrypted data to a power; determine the second remainder when the third value is divided by the square of the second parameter, and determine the fourth value based on the second remainder and the second parameter; determine the third remainder when the fourth value is divided by the second parameter, and determine the product of the fourth parameter and the third remainder; if each piece of data in the disjoint data set matches the corresponding product value, then the constraint condition is satisfied; or Based on the first and second prime numbers received by the zero-knowledge proof algorithm, a set of parameters to be determined is determined. If the parameters in the set of parameters to be determined are consistent with the parameters in the set of determined parameters, then the constraint condition is met.

7. The method according to claim 1, characterized in that, The method further includes: Based on the second data set, a polynomial is constructed using interpolation, such that the solution of the polynomial being 0 is the second data set; The set of elements is encrypted using the public key determined based on the homomorphic encryption algorithm to obtain a second privacy data set, wherein the set of elements is composed of the coefficients of each term of the polynomial; The second privacy data set and the public key are sent to the other participants so that the other participants can determine the first privacy data set based on the second privacy data set, the public key, and the other participants' third data set.

8. A privacy set intersection verification device, characterized in that, The device includes: The decryption module is used to, if it receives a first private data set sent by another participant, decrypt each element in the first private data set using a private key determined based on a homomorphic encryption algorithm to obtain the first data set of the other participant, and determine the intersection and non-intersection data sets to be verified based on the first data set and its own second data set. The determination module is used to determine the parameter set based on the first prime number and the second prime number generated when determining the private key; The proof module is used to process the first prime number, the second prime number, the parameter set, the first privacy data set, the disjoint data set, and preset constraints based on a zero-knowledge proof algorithm to obtain proof evidence for the disjoint data set; and to send the intersection to be verified and the proof evidence to the other participants so that the other participants can verify the authenticity of the intersection to be verified based on the zero-knowledge proof algorithm and the proof evidence. The preset constraints include: For each data point in the disjoint data set, the data point and the privacy coefficients in the second privacy data set are substituted into a polynomial to obtain polynomial ciphertext. The polynomial ciphertext is then decrypted using the private key to obtain the polynomial plaintext corresponding to the data point. If the product of the polynomial plaintexts corresponding to all data points in the disjoint data set is not zero, then the constraint condition is satisfied. The second privacy data set is obtained by encrypting the element set using a public key, and the element set is composed of the coefficients of each term of the polynomial. The polynomial is constructed using interpolation based on the second data set, and the solution to the polynomial is the second data set.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images