Threshold privacy set intersection method and apparatus and readable storage medium thereof

Abstract

The application provides a threshold privacy set intersection method and device and a readable storage medium thereof, and belongs to the technical field of privacy calculation and secure multi-party computation. In view of the problems of low batch selection efficiency, large calculation and communication cost of the existing scheme in large-scale two-party balanced set matching, the application encodes a plurality of selection indexes of a receiving party into roots of blind polynomials on a finite field, realizes batch selection expression and key generation through polynomial coefficient transmission, and completes polynomial batch inadvertent transmission expansion; the algebraic association relationship established in the inadvertent transmission expansion stage is reused as the key material of an inadvertent pseudo-random function, pseudo-random labels of local calculation elements are obtained by both parties, and light batch inadvertent pseudo-random function mapping is completed; finally, the size of the intersection set is safely calculated in the label space, and whether to output the accurate intersection set is determined according to the comparison result of the size and the threshold. The application is mainly used for digital advertising audience evaluation, joint marketing and anti-fraud risk control.

Description

Technical Field

[0001] This invention relates to the fields of privacy computing and secure multi-party computation, and in particular to a threshold privacy set intersection method, apparatus and readable storage medium based on k-out-of-n unintentional transmission extension. Background Technology

[0002] Private Set Intersection (PSI) is a fundamental protocol in the field of secure multi-party computation, allowing two or more participants to compute the intersection of their sets without disclosing their respective non-intersecting data. With the development of the digital economy and the flow of data elements, PSI technology can achieve set matching without directly exposing user or device identifiers, making it valuable in scenarios such as digital advertising, joint marketing, and cross-platform audience assessment.

[0003] To avoid overexposure of low-value information caused by outputting an exact intersection when the intersection size is too small, the Threshold Private Set Intersection (TPSI) technique was proposed. This technique outputs an exact intersection only when the intersection size reaches a preset threshold; otherwise, the protocol is terminated without revealing any valid intersection information. The development of TPSI technology has evolved from a heavy cryptographic scheme to a lightweight and efficient one.

[0004] Early TPSI schemes primarily relied on homomorphic encryption methods. For example, Ghosh and Simkin proposed a TPSI protocol based on threshold fully homomorphic encryption in 2019, introducing an inadvertent linear function evaluation with a communication complexity of O(t). Badrinarayana et al. proposed a TPSI protocol based on threshold addition homomorphic encryption in 2021, with a communication complexity of O(t). 2 In 2021, Zhang et al. designed a scheme based on a confusion Bloom filter and (t,n) threshold secret sharing, which reduced public key operations. Although the above scheme theoretically verified the feasibility of TPSI, the computational latency and communication burden are high when dealing with large-scale sets due to the large overhead of homomorphic encryption and threshold public key operations.

[0005] As research has deepened, TPSI technology has gradually shifted towards efficient construction based on lightweight primitives such as Oblivious Transfer Extension (OTE), Oblivious Pseudorandom Function (OPRF), and Oblivious Key-Value Store (OKVS). Among these, OTE-based schemes have become an important technical route. Basic OT typically relies on public-key cryptography operations. Ishai et al. proposed the OTE technique in 2003, which generates a large number of OT instances by combining a small number of basic OT instances with efficient symmetric cryptographic operations. Kolesnikov and Kumaresan proposed the KK13 protocol in 2013, extending OT to a more efficient 1-out-of-n form. Subsequently, in 2023, Liu et al. used the KKRT / SpOT-light OTE method to construct OPRF to implement threshold PSI; in 2024, Zhao et al. proposed a two-party TPSI framework based on a 1-out-of-2 OT extension; and in 2025, Karakoc et al. used OTE combined with OPRF and Cuckoo Hash techniques to implement threshold PSI. These OTE-based schemes have reduced the computational and communication overhead of TPSI to some extent, but there is still room for improvement in terms of batch selection efficiency and protocol structure simplicity.

[0006] Therefore, there is an urgent need for a threshold privacy set intersection method, apparatus, and readable storage medium based on k-out-of-n unintentional transmission extension, in order to solve the problems existing in the prior art. Summary of the Invention

[0007] This invention provides a threshold privacy set intersection method, apparatus, and readable storage medium. It addresses the problems of existing threshold privacy set intersection schemes, which require repeated execution of a large number of independent unintended transmission extension instances when handling large-scale batch k-out-of-n selections, and rely heavily on complex cryptographic operations during the data mapping stage, resulting in significant computational latency and communication overhead in large-scale set matching scenarios.

[0008] The core technology of this invention is to achieve batch unintentional transmission extension by encoding the receiver's batch selection index into the roots of a blinded polynomial over a finite field and transmitting the coefficients of a single polynomial. The algebraic correlation established in this extension stage is directly reused to construct a lightweight unintentional pseudo-random function. Combined with a layered secure cardinality calculation mechanism, the precise intersection output triggered by the threshold condition is completed.

[0009] In a first aspect, the present invention provides a method for finding the intersection of threshold privacy sets, the method comprising the following steps:

[0010] The sender and receiver perform system initialization, determining security parameters, protocol parameters, and threshold parameters; The receiver and sender each perform hash mapping on the original set elements they hold, and the receiver constructs the corresponding bucket selection set for each hash bucket based on the mapping result. The receiver encodes the selected set in the bucket as the root of the blinded polynomial and sends the coefficients of the blinded polynomial to the sender. The sender generates an encryption key based on the polynomial evaluation result and encrypts the candidate message before sending it to the receiver. The receiver generates the corresponding decryption key based on the base key held locally to decrypt the message at the corresponding position in the selected set in the bucket, thus completing the polynomial batch unintentional transmission extension. The sender and receiver reuse the algebraic association established during the unintentional transmission extension stage as the unintentional pseudo-random function key material, calculate the pseudo-random tags corresponding to the elements of their respective sets, obtain their respective tag sets, and complete the lightweight batch unintentional pseudo-random function mapping. The sender and receiver input their respective tag sets into the privacy set to calculate the intersection cardinality sub-protocol, calculate the intersection size, compare the intersection size with the threshold parameter, and decide whether to output the exact intersection to the receiver based on the comparison result.

[0011] Furthermore, the steps of hash mapping the original set elements held by each entity and constructing the corresponding bucket selection set include: The receiver uses the first hash function to map each element in its target user set to the corresponding bucket number and the index position within the bucket. For each hash bucket, the receiver collects all in-bucket index positions mapped to that bucket to construct an in-bucket selection set, and ensures that the number of elements in the in-bucket selection set does not exceed the set maximum number of selections; The sender uses a first hash function to map each element in its active user set to determine the mapping position of the subsequent calculation of the unintentional pseudo-random function label.

[0012] Furthermore, if the number of elements mapped in any hash bucket is less than the set maximum selection number, the receiver adds a random padding index to the selection set within the corresponding bucket to make up to the maximum selection number.

[0013] Furthermore, the blinding polynomial is constructed by XORing the random blinding value with the product term. The product term is the result of multiplying the product of the candidate position and the differences between each element in the bucket selection set with the random blinding polynomial. It satisfies the following: when the input position belongs to the bucket selection set, the product is zero, making the product term zero, so that the decryption key generated by the receiver is consistent with the encryption key of the sender; when the input position does not belong to the bucket selection set, the polynomial evaluation result is randomly blinded, so that the corresponding key is unpredictable.

[0014] Furthermore, the steps of lightweight batch inadvertent pseudorandom function mapping include: The sender combines its global key, row vector set, and polynomial set into an implicit key material of an unintentional pseudo-random function; For any element in the sender set, the sender calculates the sender's pseudo-random label locally using the second hash function based on the implicit key material and the bucket number and bucket index position calculated by the first hash function. For any element in the receiver set, the receiver obtains the receiver's pseudo-random tag locally using the second hash function, based on the base key held during the unintentional transmission extension phase and the bucket number and bucket index position calculated by the first hash function.

[0015] Furthermore, the steps for deciding whether to output the exact intersection to the receiver based on the comparison results include: If the intersection size is less than the threshold parameter, the sender and receiver will terminate the protocol directly and will not output any valid intersection information. If the intersection size is greater than or equal to the threshold parameter, the precise intersection recovery phase is triggered, in which the sender and receiver work together to recover the precise intersection.

[0016] Furthermore, the precise intersection recovery phase includes: The sender randomly shuffles its own set of sender tags and sends the shuffled set of tags to the receiver. The receiver compares its local set of receiver tags with the received shuffled set of tags to obtain a set of matching tags; The receiver recovers the exact intersection from the set of matching tags based on the correspondence between the original elements and pseudo-random tags stored locally.

[0017] Secondly, the present invention provides a threshold privacy set intersection apparatus, comprising: The initialization module is used by the sender and receiver to perform system initialization and determine security parameters, protocol parameters, and threshold parameters. The mapping module is used by the receiver and sender to perform hash mapping on the original set elements they each hold. The receiver constructs the corresponding bucket selection set for each hash bucket based on the mapping result. The unintentional transmission extension module is used by the receiver to encode the selection set in the bucket into the root of the blind polynomial and send the coefficient of the blind polynomial to the sender. The sender generates an encryption key based on the polynomial evaluation result and encrypts the candidate message before sending it to the receiver. The receiver generates the corresponding decryption key based on the basic key held locally to decrypt the message at the corresponding position in the selection set in the bucket. The pseudo-random function mapping module is used by the sender and receiver to reuse the algebraic association relationship established in the unintentional transmission extension stage as the unintentional pseudo-random function key material, and calculate the pseudo-random tags corresponding to the elements of their respective sets to obtain their respective tag sets. The output module is used by the sender and receiver to input their respective tag sets into the privacy set to calculate the intersection cardinality sub-protocol, calculate the intersection size, compare the intersection size with the threshold parameter, and decide whether to output the exact intersection to the receiver based on the comparison result.

[0018] Thirdly, the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the above-described threshold privacy set intersection method.

[0019] Fourthly, the present invention provides a readable storage medium storing a computer program, the computer program including program code for controlling a process to execute the process, the process including the intersection method based on the aforementioned threshold privacy set.

[0020] The main contributions and innovations of this invention are as follows: 1. Reduced communication and computation overhead: This invention encodes the multiple selection indices of the receiver into the roots of a blinded polynomial. By sending polynomial coefficients instead of sending selection information one by one, it avoids repeatedly executing multiple independent unintended transmission extension instances, so that the communication and computation overhead no longer increases linearly with the number of selections, and significantly improves the efficiency in large-scale set matching scenarios.

[0021] 2. Achieving a balance between correct decryption and selective hiding: The blind polynomial designed in this invention can cancel out algebraic terms to generate a consistent key at selected positions, while exhibiting randomization at unselected positions. This ensures that the receiver can correctly decrypt the message at the selected position while hiding the selection index, thus enhancing security.

[0022] 3. Improved protocol lightweighting: This invention reuses the algebraic association established during the unintentional transmission extension phase as the key material for the unintentional pseudo-random function. Both parties calculate the pseudo-random tag locally, avoiding expensive public-key cryptographic operations such as blind signatures and elliptic curves in traditional schemes, and significantly reducing computational costs.

[0023] 4. Improve protocol scalability and modularity: This invention adopts a three-layer architecture of "polynomial batch unintentional transmission extension layer - lightweight batch unintentional pseudo-random function mapping layer - threshold-triggered output layer", which decouples the set mapping, intersection counting and threshold output processes, and makes the boundaries of each functional module clear, which is convenient for independent implementation, replacement and expansion.

[0024] 5. Ensuring data minimization: This invention only triggers precise intersection output when the intersection size reaches a preset threshold; otherwise, the protocol is terminated directly. This avoids the excessive exposure of low-value intersection information and meets the needs of privacy-preserving data collaboration scenarios.

[0025] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0026] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of the threshold privacy set intersection method according to an embodiment of the present invention; Figure 2 This is a flowchart of data mapping and selection set generation according to an embodiment of the present invention; Figure 3 This is a timing diagram of polynomial batch k-out-of-n unintentional transmission extended interaction according to an embodiment of the present invention; Figure 4 This is a lightweight batch unintentional pseudo-random function mapping logic diagram according to an embodiment of the present invention; Figure 5 This is a flowchart of the safe intersection cardinality calculation and threshold trigger output according to an embodiment of the present invention; Figure 6 This is a block diagram of the device logic structure according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0028] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0029] This invention is primarily applied to two-party balanced set matching scenarios in large-scale privacy-preserving data collaboration systems, aiming to address the problem of excessive communication and computational overhead in existing solutions during large-scale batch selection. The core idea of ​​this invention is to encode the receiver's batch selection index as the roots of a blinded polynomial over a finite field, achieve batch inadvertent transmission extension through single-order polynomial coefficient transmission, reuse its algebraic correlation to construct a lightweight inadvertent pseudo-random function, and finally achieve threshold-triggered precise intersection output through a hierarchical architecture.

[0030] Example 1 like Figure 1 As shown in the figure, the present invention provides a threshold privacy set intersection method based on k-out-of-n unintentional transmission extension, the execution subject of which includes two parties: sender S and receiver R. The sender S holds a set of active users. The receiver R holds the target user set. Both sets have a size of N. The overall process of this method includes the following steps: Step 1: System Initialization Both parties collaborate to perform system initialization in order to determine the basic parameters required for subsequent cryptographic operations.

[0031] Step 1.1: Both parties determine the safety parameter λ, and select a finite field accordingly. In this embodiment, λ = 128 is chosen, and a finite field is selected. The addition operation on this finite field is a bitwise XOR, and the multiplication operation is implemented using irreducible polynomial modulo reduction.

[0032] Step 1.2: Both parties determine the three hash functions required for the protocol, specifically: Key-derived hash function Used to generate message encryption keys during the Unintentional Transport Extension (OTE) phase, where For the key output length, take =256; First hash function This hash function is used to map the elements of the original set to bucket numbers and bucket index positions. It can be implemented using a cryptographic hash function (such as SHA-256) in conjunction with modulo operations. Second hash function It is used to generate pseudo-random labels for the Unintentional Pseudo-Random Function (OPRF).

[0033] Step 1.3: Both parties determine the protocol parameters, including the number of hash buckets m, the number of index positions that can be accommodated in each bucket n, and the maximum number of elements that the receiver can select in each batch k. In this embodiment, m = 1000, n = 2000, and k = 20.

[0034] The specific values ​​of the above parameters need to be adjusted according to the set size N and security requirements. For a set of size N, the parameter selection must satisfy the following: by choosing appropriate m and n, the number of elements mapped in each bucket is likely not to exceed k. When the number of elements mapped in a bucket exceeds k, the overflow probability can be reduced by increasing the number of buckets m or adjusting the mapping parameters of the first hash function H1. In this embodiment, when m = 1000 and N = 10... 6 At that time, according to the Poisson distribution estimate, the expected number of elements mapped in each bucket is approximately N / m = 1000. Assuming that the number of elements in each bucket follows a Poisson distribution, the bucket capacity n = 2000 can accommodate all elements with a high probability (the overflow probability is negligible).

[0035] Step 1.4: Both parties determine a threshold parameter τ pre-set based on specific business needs. In this embodiment, τ = 500. For example, in a digital advertising audience overlap assessment scenario, the advertiser and media platform agree that the protocol will only allow the output of the exact intersection to the receiver when the number of common users reaches τ, in order to satisfy the data minimization principle.

[0036] Step 2: Data Mapping and Selection Set Generation like Figure 2 As shown, this step discretizes the elements of the original set and constructs an input representation for batch selection.

[0037] Step 2.1: Receiver R uses the first hash function For each element in the target user set X, perform a hash mapping to calculate the bucket number j and the index a within the bucket for each element. The mathematical mapping relationship is expressed as follows:

[0038] Where j ∈ [m] represents the bucket number, and a ∈ [0, n-1] represents the index position within the bucket.

[0039] Step 2.2: For the j-th hash bucket, receiver R collects all bucket index positions mapped to that bucket and constructs the corresponding bucket selection set. ,satisfy:

[0040] During construction, receiver R ensures that each selection set contains no more than the maximum number of elements specified. To mitigate the risk of privacy breaches due to the number of choices, if the actual number of mapped elements in a hash bucket is less than k, i.e. Then the receiver R selects a set from the corresponding bucket. A randomized index is added to ensure that the selection set of each batch has a consistent selection size k in appearance.

[0041] Step 2.3: The sender S also uses the first hash function. Perform a hash mapping on each element in the set of active users Y:

[0042] The sender S stores the mapping result locally as the basis for calculating the mapping position of the corresponding OPRF tag in step four.

[0043] Step 3: Polynomial Batch k-out-of-n Unintentional Transfer Extension like Figure 3 As shown, this step is one of the core steps of this invention, used to establish an algebraic association between the sender S and the receiver R, enabling the receiver R to perform efficient batch selection while hiding the selection index. The entire OTE protocol includes seven sub-stages: global key selection, receiver random value selection, basic OT execution and row vector establishment, receiver polynomial encoding, polynomial coefficient transmission, sender evaluation encryption, and receiver decryption.

[0044] Step 3.1: The sender S randomly selects a global key s over a finite field, satisfying:

[0045] The global key s is held only by the sender S and is not sent to the receiver R.

[0046] Step 3.2: For each batch j ∈ [m], the receiver R randomly selects a blinding factor over a finite field. and base key ,satisfy:

[0047] And calculate the auxiliary key locally:

[0048] in, For random blinding values, Basic key, This is an auxiliary value used for input construction in the basic OT phase.

[0049] Step 3.3: Both parties perform λ basic unintentional transfers (OT). In each basic OT, the receiver R acts as the selector and the sender S acts as the sender. The basic OT can be implemented using the Chou-Orlandi OT protocol or other equivalent OT protocols. After the basic OT is completed, a matrix transpose operation is performed so that the sender S obtains the row vector. And the key materials held by both parties satisfy the following algebraic association relationship:

[0050] Among them, the global key s is held only by the sender S, and the basic key This relationship is held solely by the receiver R. It forms the algebraic basis for ensuring the consistency of subsequent encryption and decryption keys. After completing the λth-order basic OT, the column vectors are converted to row vectors via matrix transpose, allowing the sender S to obtain the row vectors corresponding to m batches. .

[0051] Step 3.4: For each batch j, the receiver R selects from the buckets constructed above. Constructing blind polynomials The receiver R first randomly selects a blinding polynomial over a finite field. , The degree can be taken as k, that is... It is a k-th degree random polynomial. Subsequently, the receiver R will blind the polynomial. The construction is in the form of an XOR of a randomized blinded value and a product term, and its expression is:

[0052] This blinded polynomial has the following algebraic properties: When the input position belongs to the selection set (i.e.) ), because there exists a certain satisfy There must exist in the product terms. =0, which causes the entire product term to be zero. In this case, the polynomial evaluation result is equal to the randomized blinded value:

[0053] When the input position does not belong to the selection set (i.e.) The product terms are not zero because of the randomized blinded polynomial. The randomness of polynomial evaluation results Completely randomized and blinded, exhibiting unpredictable pseudo-random finite field elements, can be represented as: ,in In order to be in Random elements that are uniformly distributed on the surface.

[0054] Step 3.5: The receiver R will blind the polynomial The coefficients of the polynomial are packaged and sent to the sender S. The degree is Therefore, the number of coefficients that need to be transmitted in each batch is indivual Elements. Since the sender S only receives the polynomial coefficients and does not know the polynomial roots, it cannot deduce the actual selection set of the receiver R. Because of blinding polynomials The location information of the root is fully hidden, thus ensuring the privacy of the selection.

[0055] Step 3.6: For each batch j and each candidate index a ∈ [0, n-1], the sender S locally evaluates the received polynomial to obtain the following: And combined with the row vectors it holds Using the global key s, the corresponding encryption key is generated using the first hash function H:

[0056] Step 3.7: The sender S uses the encryption key Messages for this location XOR encryption yields the ciphertext:

[0057] Among them, candidate messages The construction method is as follows: the sender S assigns the elements in its own set Y according to the first hash function. The mapping result is placed at the corresponding (j, a) position, and random placeholder values ​​are filled for positions without element mapping. After the sender S completes the encryption of all batches and all candidate positions, the ciphertext set is... Send to the recipient R.

[0058] Step 3.8: Receiver R selects its own index. Directly utilize the local base key Generate the corresponding decryption key:

[0059] Because when index hour, The key core algebra terms on the sender S side satisfy:

[0060] Therefore, algebraic cancellation occurs at the selected position, making the encryption key generated by the sender S exactly the same as the decryption key generated by the receiver R, i.e.:

[0061] Step 3.9: Receiver R uses the decryption key to decrypt the message:

[0062] Receiver R successfully recovered the message corresponding to the selected location. For the unselected location... ,because Randomly blinded Manifestation with The receiver R cannot construct a matching algebraic term locally for irrelevant random values, and therefore cannot obtain the correct decryption key, thus ensuring the unknowability of unselected messages.

[0063] Step 4: Lightweight Batch Unintentional Pseudorandom Function Mapping like Figure 4 As shown, this step maps the original set elements of both parties to a unified pseudo-random label space. Unlike traditional OPRF construction, this invention directly reuses the algebraic association relationship established in step three as the implicit key material for the unintentional pseudo-random function, avoiding the introduction of additional public key operations such as blind signatures and elliptic curves.

[0064] Step 4.1: The sender S transfers its global key s and row vector set to S. and polynomial sets Combining implicit key materials into unintentional pseudo-random functions:

[0065] Step 4.2: For any element y in the sender's set Y, sender S first uses the first hash function. The corresponding bucket number j and bucket index a are calculated:

[0066] Subsequently, the sender S bases its data on the row vectors in the implicit key material. Polynomial evaluation results And the global key s, using the second hash function The sender pseudo-random (OPRF) tag is calculated directly locally:

[0067] Here, "∥" represents a string concatenation operation. After the sender S completes the calculations for all elements in set Y, it obtains the sender's tag set. .

[0068] Step 4.3: For any element x in the receiver set X, receiver R also first uses the first hash function. Get the bucket number j and the bucket index a:

[0069] Since the receiver R already possesses the basic key in step three... Therefore, there is no need to interact with the sender S anymore; the second hash function can be used directly. The receiver's pseudo-random tag is calculated locally and independently. :

[0070] After receiver R completes the computation on all elements in set X, it obtains the receiver's tag set. .

[0071] Step 4.4: When an element belongs to both sets simultaneously, i.e., x = y, the first hash function is used. The certainty is known That is, its bucket number is completely consistent with the bucket index. Meanwhile, based on the algebraic cancellation relationship of the selected position described in step three, we have... This ensures that the pseudo-random labels calculated locally by both parties are completely identical, i.e.:

[0072] When x ≠ y, due to the second hash function Due to the unidirectional and random nature of the tags, they exhibit unpredictable random values, and the receiver R cannot recover the non-intersecting element information of the sender S from them. Ultimately, the sender S obtains the tag set. The receiver R obtains the tag set. .

[0073] Step 5: Calculate the cardinality of the safe intersection and trigger the output with a threshold like Figure 5 As shown, this step achieves threshold control output without revealing non-intersecting elements through a hierarchical judgment mechanism.

[0074] Step 5.1: Both parties will share their respective sets of pseudo-random tags. and Input a preset privacy set and find the intersection cardinality calculation sub-protocol In the process, calculate the size of the intersection of the tag sets. This sub-protocol can be implemented using a Bloom filter-based Private Set Intersection Cardinality (PSI-CA) scheme, an Oblivious Key-Value Store (OKVS)-based private cardinality calculation scheme, or other equivalent secure cardinality calculation schemes. As analyzed in step four, the condition is met if and only if x = y. Therefore, the cardinality of the intersection satisfies:

[0075] Step 5.2: Both parties compare the calculated intersection size c with the threshold parameter τ, and decide whether to output the exact intersection based on the comparison result. If c < τ, it means that the overlap of the samples between the two parties has not reached the preset business threshold. The two parties directly terminate the protocol and output ⊥. The sender S will never send any information to restore the exact intersection, ensuring that low-value intersection information is not leaked, which is in line with the principle of data minimization. If c ≥ τ, it means that the intersection size meets the standard, and the protocol is triggered to enter the precise intersection recovery phase.

[0076] Step 5.3: In the exact intersection recovery phase, sender S first checks its own set of tags. Perform a shuffle operation to eliminate the positional association between the tags and the original elements, and then set the shuffled tags together. Send to the recipient R.

[0077] Step 5.4: Receiver R will transfer the set of tags it holds locally. With the received set of randomly permuted tags Perform comparisons to securely extract the set of matching tags. ,satisfy:

[0078] Step 5.5: Since the receiver R locally stored the mapping relationship between the original elements and the receiver's pseudo-random labels in step four... Therefore, by filtering out the original elements of the matching label set I whose pseudo-random labels belong to the original elements, the receiver R can accurately recover the final exact intersection:

[0079] Therefore, the final output of the entire protocol can be expressed as: When c < τ, the output is ⊥; When c≥τ, the receiver R obtains the exact intersection X∩Y.

[0080] To better illustrate the invention, the following are specific numerical examples: Set safety parameters =128, finite field The size of both groups is N=10 6 The number of hash buckets is selected as m=1000, the number of index positions in each bucket is n=2000, the maximum number of selections per batch is k=20, and the threshold parameter is τ=500.

[0081] In step two, receiver R pairs 10 6 Each element is subjected to the first hash function. Mapping, where each element is mapped to a bucket number. [0,999] and bucket index position [0, 1999]. For the selected set, receiver R ensures that each... It can contain a maximum of k=20 indices; if there are fewer than k indices, it will be padded with random numbers.

[0082] In step three, both parties perform 128 basic OT operations to establish row vectors. In each batch, the receiver R constructs a polynomial. The coefficients are then sent to the sender S. The sender S evaluates the 2000 candidate positions in each batch, encrypts them to generate ciphertext, and sends it to the receiver R.

[0083] In step four, both parties calculate their own OPRF tags, and the sender S and receiver R each obtain a tag containing 10... 6 A collection of tags and .

[0084] In step five, both parties calculate the intersection cardinality c and compare it with τ=500. If c≥500, the sender S sends the randomly shuffled tag set to the receiver R, and the receiver R recovers the exact intersection by comparison; if c<500, both parties terminate the protocol.

[0085] Example 2 Based on the above method flow, embodiments of the present invention also provide a threshold privacy set intersection device based on k-out-of-n unintentional transmission extension, such as... Figure 6 As shown, the device includes: The initialization module is used by the sender and receiver to perform system initialization and determine security parameters, protocol parameters, and threshold parameters. The mapping module is used for the receiver and the sender to perform hash mapping on the original set elements they hold respectively. The receiver constructs a corresponding selection set within each hash bucket according to the mapping result, and fills in the maximum selection number by randomly filling the index when there are insufficient elements in the bucket. An unintentional transmission extension module is used for the receiver to encode multiple selection indices in the bucket selection set into roots of a blinded polynomial over a finite field, send the coefficients of the blinded polynomial to the sender, the sender to generate an encryption key based on the polynomial evaluation result and encrypt the candidate message before sending it to the receiver, and the receiver to generate a decryption key consistent with the sender using algebraic cancellation of the selected position to decrypt the message at the corresponding position in the bucket selection set; The pseudo-random function mapping module is used by the sender and the receiver to reuse the algebraic association relationship established in the unintentional transmission extension stage as unintentional pseudo-random function key material, and each party independently calculates the pseudo-random tags corresponding to the elements of their respective sets to obtain their respective tag sets. The output module is used to input the respective tag sets into the privacy set to calculate the intersection cardinality calculation sub-protocol to obtain the intersection size, and compare the intersection size with the threshold parameter. If the intersection size is less than the threshold parameter, the protocol is terminated. If the intersection size is greater than or equal to the threshold parameter, the precise intersection is output to the receiver by randomly shuffling and comparing the tag sets.

[0086] Example 3 This embodiment also provides an electronic device, see reference. Figure 7 It includes a memory 404 and a processor 402, wherein the memory 404 stores a computer program and the processor 402 is configured to run the computer program to perform the steps in any of the above method embodiments.

[0087] Specifically, the processor 402 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement embodiments of the present invention.

[0088] Memory 404 may include a mass storage device for data or instructions. For example, and not limitingly, memory 404 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 404 may include removable or non-removable (or fixed) media. Where appropriate, memory 404 may be internal or external to a data processing device. In a particular embodiment, memory 404 is non-volatile memory. In a particular embodiment, memory 404 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0089] The memory 404 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 402.

[0090] The processor 402 reads and executes computer program instructions stored in the memory 404 to implement any of the threshold privacy set intersection methods in the above embodiments.

[0091] Optionally, the electronic device may further include a transmission device 406 and an input / output device 408, wherein the transmission device 406 is connected to the processor 402, and the input / output device 408 is connected to the processor 402.

[0092] The transmission device 406 can be used to receive or send data via a network. Specific examples of the network described above may include wired or wireless networks provided by the communication provider of the electronic device. In one example, the transmission device includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 406 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0093] Input / output device 408 is used to input or output information.

[0094] Example 4 This embodiment also provides a readable storage medium storing a computer program, the computer program including program code for controlling a process to execute the process, the process including a method for finding intersections of a threshold privacy set according to Embodiment 1.

[0095] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0096] Generally, various embodiments can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the invention can be implemented in hardware, while others can be implemented by firmware or software executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the invention may be shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, by way of non-limiting example, these blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0097] Embodiments of the present invention can be implemented by computer software, which may be executable by a data processor of a mobile device, such as a processor entity, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products) including software routines, applets, and / or macros can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product may include one or more computer-executable components configured to perform the embodiments when the program is run. The one or more computer-executable components may be at least one piece of software code or a portion thereof. Additionally, it should be noted in this respect that, as Figure 1 Any box in the logical flow can represent a program step, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. Software can be stored on physical media such as memory chips or blocks of storage implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as DVDs and their data variants, CDs, etc. The physical medium is a non-transient medium.

[0098] Those skilled in the art should understand that the technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The above embodiments are merely illustrative of several implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims.

Claims

1. A threshold-privacy set intersection method, characterized in that, Includes the following steps: The sender and receiver perform system initialization, determining security parameters, protocol parameters, and threshold parameters; The receiver and the sender respectively perform hash mapping on the original set elements they hold, and the receiver constructs a corresponding bucket selection set for each hash bucket based on the mapping result; The receiver encodes the selection set within the bucket into the root of a blinded polynomial and sends the coefficients of the blinded polynomial to the sender. The sender generates an encryption key based on the polynomial evaluation result and encrypts the candidate message before sending it to the receiver. The receiver generates a corresponding decryption key based on the local base key to decrypt the message at the corresponding position of the selection set within the bucket, thus completing the polynomial batch unintentional transmission extension. The sender and the receiver reuse the algebraic association established in the unintentional transmission extension stage as the unintentional pseudo-random function key material, calculate the pseudo-random tags corresponding to the elements of their respective sets, obtain their respective tag sets, and complete the lightweight batch unintentional pseudo-random function mapping. The sender and the receiver input their respective tag sets into the privacy set intersection cardinality calculation sub-protocol to calculate the intersection size, and compare the intersection size with the threshold parameter. Based on the comparison result, they decide whether to output the exact intersection to the receiver.

2. The threshold privacy set intersection method as described in claim 1, characterized in that, The steps of hashing the original set elements held by each entity and constructing the corresponding bucket-selected set include: The receiver uses a first hash function to map each element in its target user set to the corresponding bucket number and the index position within the bucket. For each hash bucket, the receiver collects all in-bucket index positions mapped to that bucket to construct the in-bucket selection set, and ensures that the number of elements in the in-bucket selection set does not exceed the set maximum number of selections; The sender uses the first hash function to map each element in its active user set to determine the mapping position of the subsequent calculation of the unintentional pseudo-random function label.

3. The threshold privacy set intersection method as described in claim 2, characterized in that, If the number of elements mapped in any of the hash buckets is less than the set maximum selection number, the receiver adds a random padding index to the selection set within the corresponding bucket to make up to the maximum selection number.

4. The threshold privacy set intersection method as described in claim 1, characterized in that, The blinding polynomial is constructed by XORing the random blinding value with a product term. The product term is the result of multiplying the product of the candidate position and the differences between each element in the bucket selection set with the random blinding polynomial; and satisfies: When the input position belongs to the bucket selection set, the product is zero, making the product term zero, so that the decryption key generated by the receiver is consistent with the encryption key of the sender; When the input position does not belong to the bucket selection set, the polynomial evaluation result is randomly blinded to make the corresponding key unpredictable.

5. The threshold privacy set intersection method as described in claim 1, characterized in that, The steps of the lightweight batch unintentional pseudo-random function mapping include: The sender combines its global key, row vector set, and polynomial set into an implicit key material of an unintentional pseudo-random function. For any element in the sender set, the sender calculates the sender pseudo-random label locally using the second hash function based on the implicit key material and the bucket number and bucket index position calculated by the first hash function. For any element in the set of receivers, the receiver, based on the base key held during the unintentional transmission extension phase and the bucket number and bucket index position calculated by the first hash function, locally calculates the receiver's pseudo-random tag using the second hash function.

6. The threshold privacy set intersection method as described in claim 1, characterized in that, The steps for determining whether to output the exact intersection to the receiver based on the comparison results include: If the intersection size is less than the threshold parameter, the sender and the receiver directly terminate the protocol and do not output valid intersection information. If the size of the intersection is greater than or equal to the threshold parameter, the precise intersection recovery phase is triggered, in which the sender and the receiver work together to recover the precise intersection.

7. The threshold privacy set intersection method as described in claim 6, characterized in that, The precise intersection recovery phase includes: The sender randomly shuffles its own set of sender tags and sends the shuffled set of tags to the receiver. The receiver compares its local receiver tag set with the received shuffled tag set to obtain a matching tag set; The receiver recovers the exact intersection from the set of matching tags based on the correspondence between the original elements and pseudo-random tags stored locally.

8. A threshold privacy set intersection device, characterized in that, include: The initialization module is used by the sender and receiver to perform system initialization and determine security parameters, protocol parameters, and threshold parameters. The mapping module is used for the receiver and the sender to perform hash mapping on the original set elements they hold respectively, and the receiver constructs a corresponding bucket selection set for each hash bucket according to the mapping result; An unintentional transmission extension module is used for the receiver to encode the selection set within the bucket into the root of a blinded polynomial and send the coefficients of the blinded polynomial to the sender. The sender generates an encryption key based on the polynomial evaluation result and encrypts the candidate message before sending it to the receiver. The receiver generates a corresponding decryption key based on the local base key to decrypt the message at the corresponding position of the selection set within the bucket. The pseudo-random function mapping module is used by the sender and the receiver to reuse the algebraic association relationship established in the unintentional transmission extension stage as unintentional pseudo-random function key material, and calculate the pseudo-random tags corresponding to the elements of their respective sets to obtain their respective tag sets. The output module is used for the sender and the receiver to input their respective tag sets into the privacy set to calculate the intersection cardinality sub-protocol, calculate the intersection size, compare the intersection size with the threshold parameter, and decide whether to output the exact intersection to the receiver based on the comparison result.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the threshold privacy set intersection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program code for controlling a process to execute the process, the process including the threshold privacy set intersection method according to any one of claims 1 to 7.

Images