Privacy preserving set intersection method supporting authentication input

Abstract

This application discloses a privacy set intersection method supporting authenticated input, relating to the field of data security technology, and applicable to servers, clients, and trusted third-party authentication authorities, where the server's dataset is significantly larger than the client's. The method includes: generating a first parameter set and a second parameter set through the third-party authentication authority; generating and publishing a signature public key; generating a signature private key and executing a signature algorithm to obtain a signature set, which is then sent to the server; generating a short digest message on the server and sending it to the client; encrypting the second dataset on the client to generate a ciphertext set, which is then sent to the server; and filtering the first dataset on the server to obtain a target dataset and solving for the intersection of the ciphertext sets to obtain the intersection elements between the server and the client. The privacy set intersection method provided by this invention combines the simplicity of authentication input and imbalanced dataset intersection, while also supporting delayed signatures, tag information linkage, and efficient update features.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically to a method for finding the intersection of privacy sets that supports authenticated inputs. Background Technology

[0002] Private set intersection (PSI) is an important branch of secure multi-party computation, allowing participants to compute the intersection of private sets without revealing additional information, and is widely used in privacy-related scenarios. However, most existing PSI protocols do not constrain the receiver's input, allowing malicious receivers to steal privacy by constructing specific sets. Furthermore, while PSI with authenticated input can restrict receiver input, it suffers from issues such as the inability to support delayed signatures and the lack of concise receiver messages.

[0003] In addition, although the simplified PSI protocol can adapt to the interaction scenario between large dataset servers and resource-constrained clients to a certain extent, the existing simplified PSI scheme with authentication input and labels has the drawback of difficulty in updating the receiver's database, making it difficult to adapt to the actual needs of the receiver to frequently update data.

[0004] Against this backdrop, the present invention proposes a scheme that supports the intersection of authenticated input and labeled, updatable, concise private sets, in order to at least partially solve the aforementioned technical problems. Summary of the Invention

[0005] The purpose of this application is to provide a privacy set intersection method that supports authenticated inputs, which can overcome the limitations of existing solutions, combine the simplicity of intersection of authenticated inputs and imbalanced datasets, and support delayed signatures, tag information linkage, and efficient update features.

[0006] To achieve the above objectives, this application provides a privacy set intersection method supporting authenticated input, applicable to a server, a client, and a trusted third-party authentication authority. The server includes a first dataset, and the client includes a second dataset. The first dataset is significantly larger than the second dataset. The privacy set intersection method includes: generating a first parameter set and a second parameter set using the third-party authentication authority based on a preset parameter generation algorithm, a bilinear mapping relationship, and random numbers; generating a signing private key and a signing public key using a preset key generation algorithm; publicly disclosing the signing public key; executing a signing algorithm on the legitimate data recognized by the third-party authentication authority based on the signing private key to obtain a signature set; and sending the signature set and the first parameter set to the server. The server sends the second parameter set to the client; the server generates a short digest based on a preset information generation algorithm and the first dataset, and sends it to the client; the client encrypts the second dataset based on the short digest, a preset encryption algorithm, and the second parameter set to generate a ciphertext set, which is then sent to the server; the server filters the first dataset to obtain a target dataset based on a signature verification algorithm corresponding to the signature algorithm, the signature public key, and the signature set, and calculates the intersection of the ciphertext set in the target dataset using a decryption algorithm corresponding to the encryption algorithm to obtain the intersection elements of the first dataset and the second dataset.

[0007] Through the above technical solution, the advantages of this invention are as follows: Compared with the prior art, it can overcome the limitations of the existing solution, and on the basis of ensuring the legality of input data, realizing the linkage acquisition of intersection and label, and maintaining the simple communication characteristics, it adds the ability to efficiently update local data of the receiver, while effectively reducing the computational complexity of the unbalanced receiver. Without sacrificing the privacy computing security and core functionality, it greatly improves the practicality and execution efficiency of the solution, and can be widely used in various scenarios such as data sharing, privacy protection query, and cross-institutional data collaboration.

[0008] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0009] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 A flowchart illustrating a method for finding the intersection of privacy sets that support authenticated inputs according to an embodiment of this application is shown. Figure 2A flowchart illustrating the technical route of the privacy set intersection method according to embodiments of this application in practical applications is shown. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0011] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0012] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0013] To provide a more comprehensive overview of this invention, a brief introduction to the technical terms and prior art involved in the invention will be given first: Private set intersection is a specific type of secure multi-party computation problem that allows participants to compute the intersection of their respective private sets without revealing any additional information. Privacy-sharing (PSI) protocols are crucial for privacy protection in various scenarios, such as contact tracing during the pandemic, privacy-preserving contact discovery, online advertising effectiveness evaluation, and gene sequence matching. Researchers have conducted extensive work on this topic, developing numerous PSI protocols. However, most existing PSI protocols allow the receiver to arbitrarily choose the input set. Malicious receivers could potentially construct specific sets to execute the protocol and steal the other party's privacy, reducing the protocol's practicality.

[0014] For example, a company proposed a privacy-protected content moderation system, planning to integrate it into its cloud storage service. The core objective of this system was to detect the presence of Child Sexual Abuse Material (CSAM) on the server without decrypting all user-uploaded images. To achieve this, they designed a PSI protocol, disclosing image information only if the image exists in the company's CSAM image database. Although the company initially planned to roll out the protocol via a software update, it was immediately met with widespread criticism. The crux of the problem is that the protocol lacks any constraints to prevent the company from using arbitrary inputs to the image database. Specifically, the company (or any server running the protocol) could easily bypass the CSAM image database and embed politically motivated images to achieve its censorship goals.

[0015] PSI protocols with authenticated inputs can restrict the receiver's input through authentication, meaning the receiver can only effectively execute the PSI protocol and obtain the intersection by using legitimate data certified by an authoritative third-party organization, thus effectively solving the aforementioned problems. However, the applicant found that most existing PSI protocols with authenticated inputs have the following drawbacks: 1) They cannot implement "delayed signatures," meaning the protocol requires the input to be authenticated at the initial stage of the protocol, which cannot support scenarios of "submitting to the database first and then supplementing authentication" (such as adding suspicious addresses and then obtaining official sanctions signatures in anonymous electronic cash monitoring lists), which limits the flexibility of practical applications; 2) The size of the receiver's message grows linearly with its data scale, lacking simplicity.

[0016] Specifically, concise cryptography is an emerging paradigm that typically requires only two rounds of messages to achieve cryptographic tasks with asymptotically optimal communication complexity. In this scenario, the receiver may have a large input, but the size of its protocol messages depends only on security parameters and is independent of its own input size. That is, the second round of messages sent by the sender may grow with the size of the sender's input, but should be independent of the size of the receiver's input. Concise PSI protocols are particularly suitable for scenarios where servers with large datasets need to compute the intersection with resource-constrained clients' small datasets, and multi-round interactions are not supported. Therefore, concise PSI has received widespread attention and research in recent years. For example, Bartusek et al. implemented a concise PSI scheme with authenticated input and labels, but this scheme suffers from the problem of difficulty in updating the receiver's database. This is because the receiver needs to generate a witness value for each element, and the witness value for each element is not a function of that element, but is constructed from the remaining elements after removing that element. When one element changes, the witness value needs to be recalculated for all elements in the database. Since the receiver's dataset is large, this makes updating the data extremely difficult and unsuitable for real-world scenarios where the receiver needs to frequently update the database.

[0017] To address the aforementioned issues and overcome the shortcomings of existing technologies, this invention provides a scheme for finding the intersection of authenticated input and labeled, updatable, concise private sets. This scheme simultaneously features authenticated input, "delayed signature," conciseness, and efficient updating, overcoming the limitations of existing privacy set intersection schemes, such as the inability to guarantee the legality of input data, the inability to link the intersection result with label information, low data update efficiency, high communication and computational complexity, and insufficient practicality. This invention balances privacy security, functional completeness, and execution efficiency, and is particularly suitable for privacy intersection needs in imbalanced data scenarios.

[0018] First, this application provides a privacy set intersection method 100 that supports authenticated input. This method can be applied to servers, clients, and trusted third-party authentication authorities. The server acts as the receiver, including a large first dataset, while the client acts as the sender, including a smaller second dataset. The first dataset is significantly larger than the second dataset, adapting to imbalanced data scenarios (such as scenarios where the server is a large database and the client is a personal terminal or small data node). It should be noted that "significantly larger" here can be flexibly set as a factor based on the actual application scenario, for example, 10 times, 20 times or more, or even 50 times or 100 times or more depending on the data scale requirements. This invention does not impose specific limitations in this regard, as long as the core characteristic of an imbalanced scenario—"the client set size is significantly smaller than the server set size"—is met, ensuring the versatility and flexibility of the solution.

[0019] Before executing each step of this invention, the following parameter settings and definitions are required to provide a foundation for the smooth execution of the subsequent intersection process and ensure the consistency and security of the calculations in each step. Specifically, this includes: 1. Setting bilinear mappings. , They are pairwise distinct cyclic groups, and both are of order large prime. , These are the generators of the two groups, respectively. The introduction of this bilinear mapping provides a mathematical foundation for subsequent signature verification, ciphertext encryption and decryption, ensuring the cryptographic security of the scheme.

[0020] 2. This is a key generation algorithm for a digital signature scheme. For safety parameters, The signature algorithm for this signature scheme is... Here is the verification algorithm for this signature scheme, where For signing private key, To verify the public key, This is a signature of x. By explicitly defining the signature-related algorithms and parameters, the legitimacy of the input data is authenticated, preventing illegal data from participating in the computation.

[0021] 3. For parameter generation algorithms, These are safety parameters. This algorithm is used to generate various public and private parameters required for the execution of the scheme, providing parameter support for the execution of subsequent steps.

[0022] 4. The algorithm for generating the first message for the receiver is as follows: The initialization parameters required by the receiver. The dataset for the recipient; Here is the ciphertext generation algorithm of the sender, where The initialization parameters required by the sender. For the sender's plaintext data, for The tag information is defined. By specifying two types of generation algorithms, the efficient generation of receiver digest information and sender ciphertext is achieved, ensuring the orderly conduct of communication and computation.

[0023] 5. Here is the decryption algorithm for the receiver, where Execute for sender The generated secret information For third-party certification authorities to perform signature algorithms on data they deem legitimate The resulting set of signatures; It is a random oracle hash function used to map data of arbitrary length to a hash value of fixed length, thereby improving data processing efficiency and security and avoiding security risks caused by hash collisions.

[0024] like Figure 1 As shown in the flowchart, the intersection method 100 may include the following steps S110-S140: Step S110: Through a third-party certification authority, a first parameter set and a second parameter set are generated based on a preset parameter generation algorithm, a bilinear mapping relationship, and random numbers. A signature private key and a signature public key are generated based on a preset key generation algorithm. The signature public key is made public. The legitimate data recognized by the third-party certification authority is used to execute a signature algorithm based on the signature private key to obtain a signature set. The signature set and the first parameter set are sent to the server, and the second parameter set is sent to the client.

[0025] Wherein, the first dataset is set as (where n is the size of the first dataset), the first parameter set is It should be noted that n here is the upper limit of the number of elements that the receiver can construct for the short summary information, which can be related to the first dataset. The size of the dataset can be the same or different; here, it is set to be the same as the size of the first dataset. The second parameter set is... ={s} (where s is a random number), the information generation algorithm is: .

[0026] Specifically, in step S110, the following steps can be used to generate a signing private key and a signing public key to ensure the security and standardization of key generation: Step S111: Execute the key generation algorithm through a third-party certification authority. Generate a signing private key and verify public key .in, For parameter generation algorithms, For security parameters, a third-party certification authority, acting as a trusted entity, executes the key generation algorithm. Generate a signing private key and verify public key .

[0027] Step S112, randomly select a private key Calculate the corresponding verification public key Among them, Z p It is a set containing all integers from 0 to p-1. This step ensures the correspondence between the public and private keys by calculating the group elements based on a bilinear mapping, providing a foundation for subsequent signature verification.

[0028] Additionally, a third-party parameter generation algorithm trusted by the sender is executed. That is, select a random number. Generate parameters for the receiver. and sender parameters ={s}, and send them to the receiver and sender respectively.

[0029] Next, the third-party certification authority performs a signature algorithm on each piece of data x that it deems legitimate. To generate the corresponding signature Finally, a signature set is formed by combining the signatures corresponding to all valid data. Send it to the recipient to ensure that the recipient can only use certified and legitimate data to participate in the intersection calculation.

[0030] In one embodiment, the privacy set intersection method can employ the BLS signature scheme to perform the signature algorithm. and signature verification algorithm Where x is legal data certified by a third-party certification body, For signing private key, To verify the public key, It is the signature of x.

[0031] Specifically, the signature algorithm can be executed through the following steps. : Step S113: Verify the legality of the data through a third-party certification authority. Calculate signature ,in, For random oracle hash functions, satisfying This step maps the original data into group elements using a hash function before signing, which ensures the security of the signature while improving the efficiency of the signature calculation.

[0032] Step S114, the set of all signatures As a signature set, it facilitates the recipient to perform batch verification of the data's legality.

[0033] Additionally, in step S110, the signature verification algorithm can also be executed through the following steps. : Step S115, via the server, for the signature set Each signature in and each element in the first dataset Calculate whether the following equation is true: ,in ; Step S116: If the equation holds true, then it means... yes The signature is given, so output 1; Step S117: If the equation is not true, output 0.

[0034] That is, the receiver calculates If the equation is true, output 1, indicating that... yes The signature is entered; otherwise, 0 is output. Specifically, for the database... Each data in ( ), and signature set Each signature The receiver executes the signature verification algorithm. This will result in an element that is 1. Store in a collection Among them Represents a set cardinality, verification algorithm Output 1 indicates Output the signature of x, otherwise output 0.

[0035] Step S120: The server generates a short summary message based on a preset information generation algorithm and the first dataset, and sends it to the client.

[0036] In this step, the receiver executes... A short summary is generated and then sent to the sender. The generation of this short summary aims to reduce the communication overhead for the receiver, achieving the core characteristic of "simplicity" and avoiding the communication pressure caused by the receiver directly sending large datasets. The short summary includes a short summary... .

[0037] The following steps can be used to generate a brief summary information.

[0038] Step S121, according to Newton's identity, using the first dataset Construct polynomials: That is, using sets Construct a polynomial.

[0039] Step S122, using Calculate the accumulator ; Step S123, select a random number Calculate short summary information .

[0040] Step S124, upon receiving the brief summary information on the client side... Then, verification Is it not equal to ; Step S125, in Not equal to as well as Step S126, in equal In this case, verification fails and the agreement is terminated.

[0041] Furthermore, if the recipient wants to update its local dataset X by adding new elements, deleting old elements, or modifying existing elements, it only needs to directly modify dataset X and re-execute the step of generating the short summary information, i.e., recalculate the short summary. This eliminates the need to regenerate witness values ​​for each element as required by existing protocols, significantly improving data update efficiency.

[0042] Specifically, the privacy set intersection method 100 may also include a step of updating the summary information of the updated receiver dataset to ensure that the updated data can participate in the intersection calculation in a timely manner, specifically including: Step S127: If the first dataset is updated, a new short summary is generated based on the preset information generation algorithm, the first parameter set, and the updated first dataset, and then sent to the client.

[0043] The data update process includes adding new elements, deleting old elements, or modifying existing elements in the first dataset. When adding a new element, the receiver adds the new element to dataset X and requests a signature for that element from a third-party certification authority. The third-party certification authority must sign the new element and add the new signature to the signature set Σ. This step is independent of the step of regenerating new short digest information; that is, a signature is not required before the protocol can be executed. When deleting an old element, the element and its corresponding signature are directly removed from dataset X. When modifying an existing element, the operations of deleting old elements and adding new elements described above are performed.

[0044] You can refer to steps S121-S124 and regenerate the new short summary information through the following steps: 1) Use the updated first dataset Construct a new polynomial ; 2) Use Calculate the new accumulator ; 3) Select a new random number Calculate new summary information .

[0045] The benefits of this step are as follows: it empowers the recipient with efficient capabilities to update the local dataset without requiring a complete re-execution of parameter initialization, signature generation, and distribution processes, or the calculation of witness values ​​for each element. Only the polynomial, accumulator, and digest information need to be recalculated, significantly reducing the computational overhead of data updates and enhancing the practicality and scalability of the solution. Simultaneously, the updated digest information accurately reflects the latest state of the dataset, ensuring the accuracy of subsequent intersection calculation results and adapting to the dynamic changes in datasets required in practical applications (such as daily updates to large databases and dynamic maintenance of data nodes). Furthermore, the data update process maintains data legitimacy authentication, ensuring that the updated data still requires signature from a third-party authentication authority to effectively derive intersection elements, thus not compromising the security of the solution.

[0046] Step S130: The second dataset is encrypted by the client based on the brief summary information, the preset encryption algorithm and the second parameter set, generating a ciphertext set and sending it to the server.

[0047] The second dataset is set as follows: ,in It is plaintext data in the second dataset and its value is non-zero. yes The attached tags, whose information can be set according to actual application needs, such as data category, data priority, data source, etc.; the encryption algorithm is... .

[0048] Specifically, the encryption algorithm can be executed through the following steps. To ensure the security and decryptability of encrypted text: Step S131, for as well as Select 4 random numbers ; Step S132, calculate As a collection of ciphertexts, in , , , , , .

[0049] If the sender verifies the short digest information, it continues to execute the protocol. Each element in Execute ciphertext generation algorithm Obtain the ciphertext ; All the ciphertext Send to the recipient.

[0050] As can be seen, this encryption process uses bilinear mapping-related group element calculations to encrypt plaintext data and tag information, ensuring that only the receiver can decrypt and obtain the relevant information, thus protecting the sender's privacy.

[0051] The beneficial effects of this step are as follows: By encrypting the sender's plaintext data and its tag information, the sender's data privacy is effectively protected, preventing the sender's data from being stolen or tampered with during transmission. Simultaneously, the ciphertext structure is rationally designed, containing both encrypted data information and associated tag information, providing a foundation for the receiver to synchronously obtain the intersection elements and tag information. Furthermore, the encryption process involves only simple group element exponentiation and bilinear pairing operations, resulting in low computational overhead. The number of ciphertexts sent by the sender is only linearly related to its own data size, making it suitable for scenarios with small-scale sender data without adding excessive computational and communication burdens. The introduction of random numbers further enhances the security of the ciphertext, reduces the risk of ciphertext being cracked, and ensures the security of privacy-preserving computation.

[0052] Step S140: The server filters the first dataset based on the signature verification algorithm, signature public key and signature set corresponding to the signature algorithm to obtain the target dataset. Based on the decryption algorithm corresponding to the encryption algorithm, the intersection of the ciphertext set in the target dataset is solved to obtain the intersection elements of the first dataset and the second dataset.

[0053] Among them, for data sets Each data in ( ),as well as Each ciphertext in ( The receiver executes the decryption algorithm. To determine If the elements are intersecting, the sender's tag information on the intersecting elements can also be calculated. .

[0054] In order to decrypt the ciphertext set and output the intersection, in one embodiment, step S140 may include the following steps S141-S144: Step S141, for the elements in the target dataset Calculate whether the following equation is true: = ,in This equation is used to verify whether the data element sent by the sender and the data element whose signature has been obtained by the receiver are intersecting elements.

[0055] Step S142: If the equation does not hold true, it means that the data elements being compared are non-intersecting elements.

[0056] Step S143: If the equation holds true, it means that the compared data elements are intersection elements. This verification step uses the characteristics of bilinear mapping to accurately determine the intersection elements by utilizing the receiver's digest information and the sender's ciphertext information, without requiring both parties to disclose the original data.

[0057] Step S144, execute. This process yields the tag information of the intersection elements. This step decrypts the tag information from the ciphertext, enabling the simultaneous acquisition of intersection elements and tag information without additional communication.

[0058] visible, The specific execution process is calculation Is it equal to If they are not equal, the process ends; if they are equal, then... Since these are valid intersection elements, the process will continue. Obtain the label information of the intersection elements.

[0059] The benefits of this step are as follows: it achieves accurate calculation of the intersection of privacy sets, while simultaneously acquiring the label information corresponding to the intersection elements, enriching the function of privacy intersection calculation and meeting the needs of practical applications for additional information on intersection elements; the decryption process uses double equality verification to ensure the accuracy of intersection elements and labels; the decryption calculation only involves bilinear mapping calculation and simple logarithmic calculation, with low overhead and consistently high computational efficiency; the entire decryption process does not require additional participation from the sender, enabling intersection calculation and label acquisition to be completed in one round of communication, which aligns with the core characteristic of the scheme's simplicity, while ensuring the privacy and security of data for both parties and avoiding the leakage of original data.

[0060] In summary, this invention aims to propose a privacy set intersection method that supports authenticated input. It achieves the legality authentication of input data through a third-party authentication authority, and realizes the linkage acquisition of intersection elements and label information, efficient data updating, and simple communication interaction through optimized algorithm design. This addresses the shortcomings of existing technologies and improves the security, functionality, efficiency, and practicality of privacy set intersection schemes.

[0061] Compared with existing technologies, its advantages are: 1. Input data authentication function: Through the signature verification of the third-party certification authority and the recipient's signature, it ensures that the recipient can only use certified legal data to participate in the calculation, prevents illegal data and tampered data from entering the process, and protects the security of privacy computing and the accuracy of the calculation results; 2. Enables simultaneous acquisition of intersection and tags: While acquiring the intersection elements, the receiver can simultaneously extract the tag information attached to the intersection elements from the sender, without the need for additional communication interaction. This enriches the functional dimensions of the solution and meets the needs of practical applications. 3. Supports efficient data updates: The recipient can directly add, delete, and modify the local dataset. The update can be completed simply by regenerating a short summary, which greatly reduces the update overhead and is suitable for dynamic dataset scenarios. 4. Simple and efficient communication: The entire intersection process can be completed in just one round of communication. The communication volume of the receiver is constant and independent of its own data size. The communication volume of the sender is linearly related to its own data size, which greatly reduces the communication overhead in large-scale data scenarios and improves the scalability of the solution. 5. Low computational complexity: By optimizing the algorithm design, the computational complexity of the receiver is reduced, while the computational overhead of the sender is also low, which improves the execution efficiency of the solution and facilitates practical deployment and application. 6. High privacy and security: By combining cryptographic technologies such as bilinear mapping, digital signatures, random oracle hash functions, and encryption algorithms, the original data of both parties is not leaked, ensuring the security and fairness of the protocol.

[0062] Therefore, the purpose of this invention is to provide a method for intersecting authenticated inputs with labeled, updatable, concise private sets. Due to its conciseness, this method is suitable for scenarios where there is a large set receiver and a small set sender with limited resources, and multi-round interactions are not supported. Authenticated inputs effectively prevent the receiver from maliciously selecting input data, ensuring the legality of the input data. Furthermore, it supports efficient updates of the receiver's large-scale data, enhancing its practicality. Additionally, it allows the sender to attach label information to its data, expanding the application scenarios of this solution.

[0063] In addition, to better illustrate the essential features of the present invention, specific numerical values ​​will be substituted below to further illustrate the present invention by way of examples. However, it should be emphasized that the implementation of the present invention is not limited thereto.

[0064] You can refer to Figure 2 This diagram illustrates the execution logic of the privacy set intersection method supporting authenticated input of the present invention in a specific application example, mainly including the following execution steps: Step 1: Set up bilinear mapping , They are pairwise distinct cyclic groups, and both are of order large prime. , These are the generators of the two groups, respectively. This is a key generation algorithm for a digital signature scheme. For safety parameters, The signature algorithm for this signature scheme is... Here is the verification algorithm for this signature scheme, where For signing private key, To verify the public key, It is the signature of x. For parameter generation algorithms, For safety parameters. The algorithm for generating the first message for the receiver is as follows: The initialization parameters required by the receiver. The dataset for the recipient; Here is the ciphertext generation algorithm of the sender, where The initialization parameters required by the sender. For the sender's plaintext data, for Tag information. Here is the decryption algorithm for the receiver, where Execute for sender The generated secret information For third-party certification authorities to perform signature algorithms on data they deem legitimate The resulting set of signatures; This is a random oracle hash function.

[0065] In practical applications, large prime order It can be set to 256-bit or higher. For safety parameters, safety parameters It can be set to 1024 or higher to achieve the required security strength.

[0066] Step 2: The third-party certification authority executes the key generation algorithm. Generate a signing private key and verify public key Publish verification public key Next, the third-party certification authority performs a signature algorithm on each piece of data x that it deems legitimate. Generate the corresponding signature Finally, the signature set Send to the recipient.

[0067] Optionally, the signature scheme is the BLS signature scheme, specifically as follows: A third-party certification authority performs the key generation process. Randomly select private key Among them, Z p It is a set containing all integers from 0 to p-1; calculate and verify the public key. Publish verification public key Then, a third-party certification body verifies the legality of the data. ,calculate signature Among them, collision-resistant hash function satisfy: Finally, all signatures are combined into a set. Send to the recipient.

[0068] Step 3: A third party trusted by the sender executes the parameter generation algorithm. That is, select a random number. Generate parameters for the receiver. and sender parameters ={s}, and send them to the receiver and sender respectively.

[0069] Step 4: Assume the recipient's data set The receiver executes Generate a short summary Then Send to the sender.

[0070] Specifically, the receiver uses sets according to Newton's identities. Construct a polynomial ,use Calculate the accumulator Then select a random number. Calculate a short summary .

[0071] Step 5: Assume the sender has a dataset. ,in It is the sender's plaintext data and its value is not 0. yes The attached label; sender inspection Is it not equal to If equal to If the sender throws an exception and terminates the protocol execution, otherwise the sender continues to execute the protocol. Each element in Execute ciphertext generation algorithm Obtain the ciphertext ; All the ciphertext Send to the recipient.

[0072] Specifically, for the required encrypted plaintext data: as well as Attached label information ,in , The sender selects 4 random numbers. ,calculate ,in , , , , , .

[0073] Step Six: For the database Each data in ( ), and signature set Each signature The receiver executes the signature verification algorithm. This will result in an element that is 1. Store in a collection Among them Represents a set cardinality, verification algorithm Output 1 indicates Output the signature of x, otherwise output 0.

[0074] Specifically, for the data that needs to be verified: For the signature set published by the third-party certification authority Each signature ,in The receiver calculates If the equation holds true, then it means yes The signature.

[0075] Step 7: For the data set Each data in ( ),as well as Each ciphertext in ( The receiver executes the decryption algorithm. To determine If the elements are intersecting, the sender's tag information on the intersecting elements can also be calculated. Otherwise, you will get ⊥.

[0076] Specifically, for elements whose signatures have been obtained and whose intersection needs to be determined... For all ciphertext sent by the sender The receiver calculates sequentially. Is it equal to If they are not equal, the process ends; if they are equal, then... For valid intersection elements, proceed with the following steps. Obtain the label information of the intersection elements, where .

[0077] Step 8: If the recipient wants to perform an update operation.

[0078] Specifically, the receiver uses the updated set. Construct a new polynomial ,use Calculate the new accumulator Then select a new random number. Calculate a new short summary Then Send to the sender.

[0079] In summary, this invention discloses a scheme for intersection of authenticated input and labeled, updatable, concise, and privacy-preserving sets. In this scheme, the receiver (server) can only obtain the intersection result using data authenticated by a third-party certification authority, effectively ensuring the legality of the input data and reducing the risk of privacy leakage and computational distortion. Simultaneously, in addition to obtaining the intersection elements with the sender (client), the receiver can also synchronously obtain the label information attached to the sender's intersection elements, achieving linked acquisition of the intersection result and label information. Complete intersection-related information can be obtained without additional communication interaction, enriching the functional dimensions of privacy-preserving intersection and meeting the needs of practical applications for additional information on intersection elements.

[0080] Furthermore, this solution supports efficient data update operations for both the receiver and the sender, and possesses excellent and concise communication characteristics: communication interaction can be completed in just one round, and the communication volume is completely independent of the data scale of the large data set (the receiver). The communication volume of the receiver remains constant and is not affected by the growth of its own data volume, while the communication volume of the sender is only linearly related to its own data scale. This effectively reduces the communication overhead in large-scale data scenarios and improves the scalability of the solution.

[0081] Compared to existing solutions that support authenticated input and simple privacy set intersection with labels, the core improvement of this solution lies in giving the recipient the ability to efficiently update their local data. It does not require generating a witness value associated with the entire database for each element; data addition, deletion, and modification can be completed simply by updating the generation of short summary information. At the same time, the optimized algorithm design effectively reduces the computational complexity of the recipient. While ensuring the security and functionality of privacy computation, it further improves the practicality and execution efficiency of the solution.

[0082] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

[0083] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0084] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for finding the intersection of privacy sets that support authenticated inputs, applicable to server-side, client-side, and trusted third-party authentication authorities, characterized in that, The server includes a first dataset, and the client includes a second dataset. The first dataset is much larger than the second dataset. The method for finding the intersection of the privacy sets includes: The third-party certification authority generates a first parameter set and a second parameter set based on a preset parameter generation algorithm, a bilinear mapping relationship, and random numbers. It also generates a signature private key and a signature public key based on a preset key generation algorithm. The signature public key is made public. The legitimate data recognized by the third-party certification authority is used to execute a signature algorithm based on the signature private key to obtain a signature set. The signature set and the first parameter set are sent to the server, and the second parameter set is sent to the client. The server generates a short summary based on a preset information generation algorithm and the first dataset, and sends it to the client. The client encrypts the second dataset based on the short summary information, the preset encryption algorithm, and the second parameter set, generating a ciphertext set which is then sent to the server. The server filters the first dataset to obtain a target dataset based on the signature verification algorithm corresponding to the signature algorithm, the signature public key, and the signature set. It then solves the intersection of the ciphertext set in the target dataset based on the decryption algorithm corresponding to the encryption algorithm to obtain the intersection elements of the first dataset and the second dataset.

2. The privacy set intersection method according to claim 1, characterized in that, The bilinear mapping relationship is wherein, are two different cyclic groups, are the generators of the two groups, respectively, The first data set is , the first parameter set is , the second parameter set is = {s}, and the information generation algorithm is .

3. The method for finding intersections of privacy sets according to claim 2, characterized in that, The short summary information is generated by the following steps According to Newton's identity, using the first data set Constructing a polynomial: ; Using Computing the accumulator ; Select random number Calculate the short summary information .

4. The privacy set intersection method according to claim 3, characterized in that, The method for finding the intersection of privacy sets also includes: The client receives the short summary information. Then, verification Is it not equal to ; exist Not equal to as well as exist equal In this case, verification fails and the agreement is terminated.

5. The method for finding the intersection of privacy sets according to claim 2, characterized in that, The method for finding the intersection of privacy sets also includes: If the first dataset is updated, a new short summary is generated based on a preset information generation algorithm, the first parameter set, and the updated first dataset, and then sent to the client.

6. The method for finding the intersection of privacy sets according to claim 5, characterized in that, The data update includes: adding new elements, deleting old elements, or modifying existing elements in the first dataset. When a new element needs to be added, a signature for that element is requested from the aforementioned third-party certification authority. Regenerate new, shorter summary information using the following steps: Using the updated first dataset Construct a new polynomial ; use Calculate the new accumulator ; Select a new random number Calculate new summary information .

7. The method for finding intersections of privacy sets according to claim 2, characterized in that, The key generation algorithm is as follows: ,in For parameter generation algorithms, For safety parameters, The privacy set intersection method uses the BLS signature scheme to execute the signature algorithm. and the signature verification algorithm Where x is the legitimate data recognized by the third-party certification authority, For signing private key, To verify the public key, It is the signature of x. Generate a signing private key and a signing public key using the following steps: Performed through the aforementioned third-party certification body Generate a signing private key and verify public key ; Randomly select private key Calculate the corresponding verification public key Among them, Z p It is a set containing all integers from 0 to p-1.

8. The method for finding the intersection of privacy sets according to claim 7, characterized in that, The signature algorithm is executed through the following steps. : The legitimate data is verified through the aforementioned third-party certification authority. Calculate signature ,in, For random oracle hash functions, satisfying ; The set of all signatures , as the signature set, The signature verification algorithm is executed through the following steps. : Through the server, for the signature set Each signature and each element in the first dataset Calculate whether the following equation is true: ,in ; If the equation holds true, then it means yes The signature is given, so output 1; If the equation is not true, output 0.

9. The method for finding the intersection of privacy sets according to claim 2, characterized in that, The second dataset is ,in It is plaintext data in the second dataset and has a non-zero value. yes The attached label, the encryption algorithm is , The encryption algorithm is executed through the following steps. : for as well as Select 4 random numbers ; calculate , as the set of ciphertexts, wherein , , , , , .

10. The method for finding the intersection of privacy sets according to claim 9, characterized in that, The decryption algorithm is as follows: The step of finding the intersection of the ciphertext set in the target dataset based on the decryption algorithm includes: For the elements in the target dataset that have already been signed Calculate whether the following equation is true: ,in ; If the equation is not true, the agreement shall be terminated. If the equation holds, it means The elements representing the intersection of the first dataset and the second dataset; implement The label information of the intersection elements is obtained.

Images