Security comparison method and system and storage medium

Abstract

The invention relates to the technical field of data privacy protection, in particular to a security comparison method and system and a storage medium. According to the method, an auxiliary party is introduced to realize addition sharing of two parties, the original sequence of data is disrupted, and a security comparison result is disclosed, so that data grouping is realized at low cost, and security comparison is optimized by fully utilizing the point that the result can be disclosed. According to the method, the highest bit solving is converted into the lowest bit solving in combination with modulus parity, so that the communication calculation overhead is further reduced, and the communication rounds are reduced.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a secure comparison method, system, and storage medium. Background Technology

[0002] In joint statistical analysis of multi-source data, it is necessary to sort the encrypted data involved.

[0003] Secure sorting refers to the collaborative sorting of data by multiple parties under end-to-end encryption, without revealing data values, relative sizes, or original positions. Except for the result, which can be obtained by designated participants, no other private data can be disclosed. Secure sorting is widely used for privacy protection in data processing, such as secure graph analysis, secure joint statistical analysis, and secure decision tree training. Secure multi-party computation allows multiple computational parties to collaboratively compute a function without disclosing input and intermediate data.

[0004] As shown in Table 1, Figure 5 As shown, existing secure quicksort algorithms based on secure multi-party computation [Reference: Secure Graph Analysis at Scale (ACM CCS 2021)] require two secure shuffle algorithms and one quicksort network. Assume... For data scale, The bit length of a single key. Given the total bit length of each row of data, the communication cost complexity of the secure shuffle algorithm is O(n). The communication round complexity is The expected execution depth of the quicksort network is Each round Each security comparison requires [number] times. communications and The communication cost is significant. Therefore, when the data volume is large, the communication overhead, especially the runtime caused by high communication rounds, can be quite long.

[0005] Table 1: Secure Quicksort in Secure Graph Analysis at Scale Summary of the Invention

[0006] To overcome the shortcomings of existing secure sorting algorithms in terms of high communication overhead when dealing with large-scale data, this invention proposes a secure comparison method that reduces the communication overhead of secure comparison.

[0007] This invention proposes a secure comparison method for secret-shared sorting between participants P0 and P1, where participants P0 and P1 respectively hold data x and y, and the secret-shared value of x modulo M is denoted as [x]. M The secret shared value of y modulo M is denoted as [y]. M M=2 k k is a positive integer; The method includes the following steps: The auxiliary party P2 selects a random integer r, where 1 ≤ r ≤ N, and N = 2. k -1; Auxiliary side P2 calculates r <1> [r] N and {[r ] q } i∈[k] ,[k]={1,2,…,k};r <1> and r Let [r] represent the 1st and 1st bits of r, respectively. N Represents the secret shared value of r modulo N, [r ] q Indicates r A secret shared value with modulus q; q is the smallest prime number greater than k; The support player P2 will r <1> [r] N and {[r ] q } i∈[k] The corresponding secret shares are sent to participants P0 and P1 respectively to assist them in calculating the difference. and will Convert to ; Participants , calculate ; Participants , calculate and exchange The secret share to reconstruct ; As a transitional term, express A secret shared value with a modulus of N; by , , , The overflow detection protocol is invoked as input, and the result is obtained. ; Participants , calculate ; =1, then it means Conversely, it means ; For the first bit of r, for The first bit, Indicates XOR.

[0008] Preferably, participants P0 and P1 invoke the secret sharing conversion protocol to... Convert to .

[0009] Preferably, the invocation steps of the secret sharing conversion protocol include: S41, Participating Parties , Calculating secret shares ,in Let c be a random number modulo M, where c is an integer random number generated by the auxiliary party P2, and 1 ≤ c ≤ N; the auxiliary party P2 calculates the secret shared value for the random number c. and as well as And send the corresponding secret shares to each. , ; and These represent the secret shared values ​​with modulo M and N, respectively. express exist array on, This represents the secret shared value where the modulus of the i-th bit of c is q; S42, , exchange After obtaining the secret share, add the secret shares together to reconstruct the structure. ; S43, with , , , The overflow detection protocol is invoked as input, and the result is obtained. ; S44 , calculate .

[0010] Preferred, allowing participating parties , hold , , , ,in + , , greater than The smallest prime number; , Results obtained using an overflow detection protocol The method is as follows: St1, Order Traversal ,calculate: ; ; ; ; in, and These are the i-th bits of h and s, respectively; and Transitional terms and A secret shared value with modulus q; for A secret shared value with modulus q; St2, Generate a set of random values ​​using PRF. and a length of Random mapping ,in , ={1,2,……,q-1}; St3, Calculation And send their own secret share to ; St4、 Reconstruct all If it exists Then set Otherwise set 0; Towards , send .

[0011] Preferred participants , exchange The secret share to reconstruct The method is as follows: Participants , exchange The secret share is made public , ; if overflow ,but .

[0012] The present invention proposes a secure comparison system, comprising a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor executes the computer program to implement the secure comparison method.

[0013] The present invention proposes a storage medium storing a computer program, which, when executed, is used to implement the aforementioned secure comparison method.

[0014] The present invention provides a computer program, which, when executed, is used to implement the aforementioned secure comparison method.

[0015] The advantages of this invention are: (1) This invention introduces an auxiliary party to achieve shared addition between the two parties. This invention shuffles the original order of the data and publishes the result of the secure comparison, thereby achieving data grouping at low cost. It fully utilizes the public nature of the result to optimize the secure comparison. This invention combines modulo parity to transform the calculation of the highest bit into the calculation of the lowest bit, further reducing communication computation overhead and reducing the number of communication rounds from... Down to .

[0016] (2) Compared with the traditional three-party security system for copying secret sharing, the communication computation complexity of the present invention to achieve secure shuffling is the same, but the present invention is easier to construct a dedicated protocol for secure comparison.

[0017] (3) Compared to the implementation method in the reference paper, this invention utilizes the publicly available comparison results and the adjustable system model to design a dedicated secure comparison protocol for secure quicksort. The communication rounds of the dedicated secure comparison protocol proposed in this invention for secure quicksort are as follows: The security comparison in the referenced paper requires... This communication, without incurring additional communication costs or security assumptions, represents a significant improvement in efficiency. In this way, the number of communication rounds and the running time can be reduced by about half. Attached Figure Description

[0018] Figure 1 This is a flowchart of a secure comparison method proposed in this invention; Figure 2 for Figure 1 Flowchart of the secret sharing protocol; Figure 3 for Figure 1 Overflow detection protocol flowchart; Figure 4 This is a schematic diagram of the safety comparison method proposed in this invention; Figure 5 This is a schematic diagram of the existing secure quicksort process. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] like Figure 1 As shown, a secure comparison method for secret-sharing ordering between participants P0 and P1 includes the following steps: S1. Let participant P0 and participant P1 hold data x and y respectively, and denote the secret shared value of x with modulus M as [x]. M The secret shared value of y modulo M is denoted as [y]. M M=2 k k is a positive integer; S2. Set up an auxiliary party P2. P2 selects a random integer r, where 1 ≤ r ≤ N, and N = 2. k -1; Auxiliary side P2 calculates r <1> [r] N and {[r ] q } i∈[k] ,[k]={1,2,…,k};r <1> Represents the first bit (i.e., the least significant bit) of r, [r] N Represents the secret shared value of r modulo N, [r ] q Let r represent the secret shared value whose modulus is q for the i-th bit; q is the smallest prime number greater than k.

[0021] S3, Assistant P2 will r <1> [r] N and {[r ] q } i∈[k] The corresponding secret shares are sent to participants P0 and P1 respectively, to assist participants P0 and P1 in calculating the difference. .

[0022] S4, invoke the secret sharing conversion protocol to Convert to ; for and The difference. If we take Turn to And calculate ,So ,Right now highest position and The least significant bit is the same. This is because: ; Where e is a transition term, This represents a secret shared value whose modulus is N.

[0023] Let be the bit value of the k-th (most significant) bit of d. The value of the first (least least significant) bit of e; like ,but .at this time It must be an odd number; otherwise 0, then It must be even. Assume for Holding The secret share, for Holding If the secret share is determined, then the following equation holds:

[0024] Indicates XOR; express Returns 1 if the condition is met, otherwise returns 0. in , They are respectively , hold, Difficult to calculate. To solve this problem, this invention utilizes an auxiliary method P2 to generate randomness. Assume... for The generated random numbers, and calculate And distribute secret shares to , .after , Can be calculated And made public . As a transitional term, express A secret shared value with a modulus of N; ; if overflow ,but ;at this time: ; That is, if overflow ,So , All less than .beg It can be transformed into: ; That is, to find Reduced to the point of seeking ,in It is possible , Open to the public The bit decomposition can be derived from The preprocessing stage is completed, and the corresponding secret shares are converted and distributed to... , ,beg This can be accomplished through a single overflow detection protocol.

[0025] like Figure 2 As shown, step S4 involves calling the secret sharing conversion protocol using the following steps S41-S44.

[0026] S41 , Calculating secret shares ,in The secret shared value is a random number c modulo M, where c is an integer random number generated by the auxiliary party P2, 1 ≤ c ≤ N; the auxiliary party P2 also calculates the secret shared value for the random number c. and as well as And send the corresponding secret shares to each. , ; This represents a secret shared value whose c modulus is M. This represents the secret shared value whose c modulus is N, and express exist array on, This represents the secret shared value where the modulus of the i-th bit of c is q; S42, , exchange After obtaining the secret share, add the secret shares together to reconstruct the structure. ; The secret share calculated by P0 is denoted as z0, and the secret share calculated by P1 is denoted as z1; , Reconstruct z as z0 + z1; S43, with , , , The overflow detection protocol is invoked as input, and the result is obtained. That is, when ,but ,on the contrary 0; S44 , calculate .

[0027] S5 , calculate ; S6 , calculate and exchange The secret share to reconstruct ; , exchange The secret share is equivalent to the public share. , ; if overflow ,but ,Right now .

[0028] S7, with , , , The overflow detection protocol is invoked as input, and the result is obtained. ; S8 , calculate ; =1, then it means Conversely, it means ; For the first bit of r, for The first bit, Indicates XOR.

[0029] This implementation requires the use of an overflow detection protocol for both secure comparison and secret sharing.

[0030] make , hold , , , ,in + , , greater than The smallest prime number, , Results obtained using an overflow detection protocol .

[0031] like Figure 3 As shown, let , Perform the overflow detection protocol as follows and obtain the results. : St1, Order Traversal ,calculate: ; ; ; ; in, and These are the i-th bits of h and s, respectively; and They are respectively and A secret shared value with modulus q; for A secret shared value with modulus q; and This is a transitional term.

[0032] St2, generate a set of random values ​​using PRF (random number generation function). and a length of Random mapping ,in , ={1,2,……,q-1}; St3, Calculation And send their own secret share to ; St4、 Reconstruct all If it exists Then set Otherwise set 0; Towards , send .

[0033] from The calculation formula shows that the current position and Not equal, ;otherwise . Its function is to identify, starting from the highest bit, if and If they are equal, then Always 1; if and Then there is It is 0, and then Since the accumulated term will be greater than or equal to 1; if and ,but At least 2. (The question is incomplete and requires further context.) back , Using PRF to generate randomness Blinding Then send it in shuffled order. , Decryption If it exists If so, it indicates that an overflow exists.

[0034] In the security comparison protocol, { , , , }={ , , , }, = ; In a secret sharing protocol, { , , , }={ , , , }, = .

[0035] Of course, those skilled in the art will recognize that the present invention is not limited to the details of the exemplary embodiments described above, but also includes the same or similar structures that can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0036] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

[0037] The technologies, shapes, and structures not described in detail in this invention are all known technologies.

Claims

1. A secure comparison method for secret-shared sorting between participants P0 and P1, where participants P0 and P1 hold data x and y respectively, and the secret-shared value of x modulo M is denoted as [x]. M The secret shared value of y modulo M is denoted as [y]. M M=2 k k is a positive integer; Its features are, The method includes the following steps: The auxiliary party P2 selects a random integer r, where 1 ≤ r ≤ N, and N = 2. k -1; Auxiliary side P2 calculates r <1> [r] N and {[r ] q } i∈[k] ,[k]={1,2,…,k};r <1> and r Let [r] represent the 1st and 1st bits of r, respectively. N Represents the secret shared value of r modulo N, [r ] q Indicates r A secret shared value with modulus q; q is the smallest prime number greater than k; The support player P2 will r <1> [r] N and {[r ] q } i∈[k] The corresponding secret shares are sent to participants P0 and P1 respectively to assist them in calculating the difference. and will Convert to ; Participants , calculate ; Participants , calculate and exchange The secret share to reconstruct ; As a transitional term, express A secret shared value with a modulus of N; by , , , The overflow detection protocol is invoked as input, and the result is obtained. ; Participants , calculate ; =1, then it means Conversely, it means ; For the first bit of r, for The first bit, Indicates XOR.

2. The security comparison method as described in claim 1, characterized in that, Participants P0 and P1 invoke the secret sharing conversion protocol to Convert to .

3. The security comparison method as described in claim 2, characterized in that, The steps for invoking the secret sharing conversion protocol include: S41, Participating Parties , Calculating secret shares ,in Let c be a random number modulo M, where c is an integer random number generated by the auxiliary party P2, and 1 ≤ c ≤ N; the auxiliary party P2 calculates the secret shared value for the random number c. and as well as And send the corresponding secret shares to each. , ; and These represent the secret shared values ​​with modulo M and N, respectively. express exist array on, Let c represent the secret shared value whose modulus is q for the i-th bit. S42, , exchange After obtaining the secret share, add the secret shares together to reconstruct the structure. ; S43, with , , , The overflow detection protocol is invoked as input, and the result is obtained. ; S44 , calculate .

4. The security comparison method as described in claim 1 or 3, characterized in that, Let the participants , hold , , , ,in + , , greater than The smallest prime number; , Results obtained using an overflow detection protocol The method is as follows: St1, Order Traversal ,calculate: in, and These are the i-th bits of h and s, respectively; and Transitional terms and A secret shared value with modulus q; for A secret shared value with modulus q; St2, Generate a set of random values ​​using PRF. and a length of Random mapping ,in , ={1,2,……,q-1}; St3, Calculation And send their own secret share to ; St4、 Reconstruct all If it exists Then set Otherwise set 0; Towards , send .

5. The security comparison method as described in claim 2, characterized in that, Participants , exchange The secret share to reconstruct The method is as follows: Participants , exchange The secret share is made public , ; if overflow ,but .

6. A security comparison system, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, the processor is connected to the memory, and the processor is used to execute the computer program to implement the secure comparison method as described in any one of claims 1-5.

7. A storage medium, characterized in that, The device contains a computer program that, when executed, implements the secure comparison method as described in any one of claims 1-5.

8. A computer program, characterized in that, When the computer program is executed, it is used to implement the secure comparison method as described in any one of claims 1-5.

Images