A cross-border user data alignment method and system based on privacy set intersection

Abstract

This invention relates to the field of data security and privacy computing technology, and discloses a method and system for aligning cross-border user data based on privacy set intersection. Key technical points include: obtaining one-time session security parameters and bound task identifiers based on long-term identity key pairs through out-of-band exchange, elliptic curve key exchange, and hierarchical key derivation; obtaining anonymized identifier sets, set polynomial commitments, and proof verification keys through standardized hash processing and a polynomial commitment scheme; generating audit verification data packets through an inadvertent transmission extension protocol, Cuckoo hash mapping, and zero-knowledge proofs; and obtaining cross-border user data alignment results through zero-knowledge proof verification, exact value matching intersection, and task identifier binding. This invention, based on polynomial commitment schemes, zero-knowledge proof verification, and task identifier binding technology, improves the accuracy, compliance, and long-term operational security of data alignment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security and privacy computing, in particular to a cross-border user data alignment method and system based on privacy set intersection. BACKGROUND

[0002] In the multi-agency cross-domain data collaboration scenario, joint marketing, anti-fraud joint defense, risk credit assessment and other businesses all need to accurately identify the records in different data sources pointing to the same natural person in order to carry out subsequent joint analysis. However, user identity identifiers are high-sensitivity data and are also the core business assets of each agency, and any participating party does not intend to directly deliver the complete user identifier list of the party to the other party in plaintext or restorable transformed form. The traditional centralized matching scheme relying on a trusted third party not only has the security risks of single-point trust dependence and data leakage, but also cannot achieve the security goals of data local retention and minimization of exposure.

[0003] The emergence of privacy set intersection technology provides a theoretical basis for solving the above-mentioned contradictions, which allows participating parties to share only the common elements in the intersection set while hiding their own unique information. However, when deploying such a protocol in a real cross-border business environment, it also needs to simultaneously address the multiple complex challenges of dynamic security parameter maintenance under the condition of no mutual trust among multiple parties, the lack of auditability of the correctness of the calculation process, and the compliance constraints of the intersection result being obtained and used outside the domain. Existing solutions focus on the security and efficiency optimization of a single calculation stage, and lack systematic design of exception tolerance and compliance embedded mechanisms throughout the entire process of task establishment, data preprocessing, privacy intersection calculation, result auditing and usage tracing. Therefore, the existing technology has deficiencies. SUMMARY

[0004] In view of the deficiencies of the existing technology, the purpose of the present application is to provide a cross-border user data alignment method and system based on privacy set intersection, which covers the entire process from task establishment to result tracing through distributed key derivation and compliance token binding mechanism, provides a complete integrity auditing foundation for lightweight privacy set intersection based on polynomial commitment and zero-knowledge verifiable circuits, and outputs alignment results with compliance labels according to exact value matching and task identifier binding, thereby realizing full-cycle abnormal resilience in a cross-border environment without mutual trust, solving the problems of un-auditable calculation process, possible violation of result usage, and difficulty in maintaining long-term security operation, and improving the security self-operation and maintenance capability, data alignment accuracy, compliance auditability and long-term operation resilience of the cross-border privacy set intersection scheme.

[0005] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a cross-border user data alignment method based on privacy set intersection, comprising:

[0007] Based on the long-term identity key pair, through out-of-band exchange, elliptic curve key exchange and hierarchical key derivation, a one-time session security parameter and a bound task identifier are obtained;

[0008] Based on the one-time session security parameter and the user original identifier, through standardized hash processing and polynomial commitment scheme, an anonymized identifier set, a set polynomial commitment and a proof verification key are obtained;

[0009] Based on the anonymized identifier set and the set polynomial commitment, through the oblivious transfer extension protocol, the Cuckoo hash mapping and the zero-knowledge proof generation, an audit verification data packet is obtained;

[0010] Based on the audit verification data packet and the pseudo-random function output value held by the second participant, through zero-knowledge proof verification, intersection of exact value matching and task identifier binding, a cross-border user data alignment result is obtained.

[0011] Further, the method for obtaining the one-time session security parameter and the bound task identifier comprises:

[0012] Based on the long-term identity key pair, the public key is exchanged through the secure out-of-band channel to obtain a bidirectional trust anchor;

[0013] Based on the digital signature of the compliance supervisor, through task token application and verification, a compliance token and a bound task identifier are obtained;

[0014] Based on the bidirectional trust anchor and the task identifier, through elliptic curve key exchange and hierarchical key derivation, a one-time session security parameter is obtained.

[0015] Further, the method for obtaining the one-time session security parameter based on the bidirectional trust anchor and the task identifier through elliptic curve key exchange and hierarchical key derivation comprises:

[0016] Based on the first participant's long-term private key in the bidirectional trust anchor and the second participant's long-term public key, through elliptic curve key exchange, a basic shared secret is obtained;

[0017] Based on the basic shared secret and the task identifier, through a key derivation algorithm, a one-time hash salt value and an oblivious pseudo-random function key seed are extracted and expanded;

[0018] Based on the oblivious pseudo-random function key seed, a one-time oblivious pseudo-random function key held by the second participant is derived by the second participant through a pseudo-random generator.

[0019] Further, the method for obtaining the anonymized identifier set, the set polynomial commitment and the proof verification key comprises:

[0020] Based on the one-time session security parameter and the user original identifier, an anonymous identifier set is obtained through a standardization rule and a cryptographic hash function;

[0021] Based on the anonymous identifier set of the first participant, a set polynomial commitment and a proof verification key are obtained through a polynomial construction and a succinct commitment scheme.

[0022] Further, the anonymous identifier set of the first participant is obtained through a polynomial construction and a succinct commitment scheme to obtain a set polynomial commitment and a proof verification key, comprising:

[0023] Based on the anonymous identifier set of the first participant, each element of the set is multiplied as the root of the polynomial to obtain a set polynomial;

[0024] Based on the set polynomial and the KZG public reference string, the set polynomial commitment is obtained through an exponential operation on an elliptic curve group;

[0025] Based on the set polynomial commitment, the private input and the constraint relationship required by the mapping circuit are combined, and the proof verification key containing the proof key and the verification key is precomputed through a non-interactive zero-knowledge proof system.

[0026] Further, the method for obtaining the audit verification data packet comprises:

[0027] Based on the anonymous identifier set of the first participant and the one-time session security parameter of the second participant, a pseudo-random function output value held by each party is obtained through an oblivious transfer extended protocol;

[0028] Based on the pseudo-random function output value held by the first participant, the set polynomial commitment and the proof verification key, an encrypted hash table, a failed element list and a mapping integrity proof are generated through Cuckoo hash mapping and zero-knowledge proof;

[0029] Based on the encrypted hash table, the failed element list, the mapping integrity proof and the set polynomial commitment, an audit verification data packet received by the second participant is transmitted through a cross-border encryption channel.

[0030] Further, the pseudo-random function output value held by the first participant, the set polynomial commitment and the proof verification key are obtained through Cuckoo hash mapping and zero-knowledge proof to generate an encrypted hash table, a failed element list and a mapping integrity proof, comprising:

[0031] Based on the pseudo-random function output value held by the first participant, the candidate bucket position is calculated through a pseudo-random hash function and the Cuckoo hash insertion algorithm is executed to obtain the encrypted hash table and the failed element list;

[0032] Based on the set polynomial commitment, the encrypted hash table and the failed element list, the generation input of the circuit satisfiability proof is obtained by expressing the whole process of the Cuckoo hash mapping as a constraint condition of the zero-knowledge satisfiability circuit.

[0033] Based on the generation input of the circuit satisfiability proof and the proof verification key, the mapping integrity proof is obtained by a non-interactive zero-knowledge proof generation algorithm.

[0034] Further, the cross-border user data alignment result obtaining method comprises:

[0035] Based on the audit verification data packet received by the second participant, the integrity audit pass confirmation is obtained by zero-knowledge proof verification and failure count threshold checking.

[0036] Based on the integrity audit pass confirmation, the pseudo-random function output value held by the second participant, the encrypted hash table and the failed element list, the complete private set intersection is obtained by exact value matching retrieval.

[0037] Based on the complete private set intersection and the bound task identifier, the cross-border user data alignment result is obtained by binding storage and local attribute association.

[0038] Further, the integrity audit pass confirmation is obtained by zero-knowledge proof verification and failure count threshold checking based on the audit verification data packet received by the second participant, comprising:

[0039] Based on the audit verification data packet received by the second participant, the mapping correctness verification result is obtained by running the zero-knowledge proof verification algorithm with the set polynomial commitment as the public input.

[0040] Based on the failed element list in the audit verification data packet, the failure count compliance judgment is obtained by comparing with the preset acceptable threshold.

[0041] Based on the fact that the failure count compliance judgment and the mapping correctness verification result are both passed, the integrity audit pass confirmation is obtained by the second participant confirming the audit.

[0042] In a second aspect, the present application provides a cross-border user data alignment system based on private set intersection, comprising:

[0043] Security base module: based on the long-term identity key pair, the one-time session security parameter and the bound task identifier are obtained by out-of-band exchange, elliptic curve key exchange and hierarchical key derivation.

[0044] Data commitment module: based on the one-time session security parameter and the user original identifier, the anonymous identifier set, the set polynomial commitment and the proof verification key are obtained by standardized hash processing and polynomial commitment scheme.

[0045] Mapping proof module: based on the anonymized identifier set and the set polynomial commitment, the audit verification data packet is obtained through the oblivious transfer extension protocol, the Cuckoo hash mapping and the zero-knowledge proof generation;

[0046] Audit intersection module: based on the audit verification data packet and the pseudo-random function output value held by the second participant, the cross-border user data alignment result is obtained through the zero-knowledge proof verification, the exact value matching intersection and the task identifier binding.

[0047] Compared with the prior art, the present application has the following beneficial effects:

[0048] The present application is based on the secure session foundation constructed by the long-term identity key pair, the elliptic curve key exchange and the hierarchical key derivation, the whole process of the task is covered through the distributed key evolution mechanism and the compliance token binding technology, the alignment result with the compliance label is output according to the audit verification data packet and the exact value matching search, the whole cycle abnormal toughness of the auditable calculation process, the traceable result use and the self-evolution of the security parameter under the cross-border no mutual trust condition is realized, the problems of the mapping integrity unverifiable, the intersection result lacking compliance control and the static shared parameter operation and maintenance difficulty in the prior art are solved, and the security self-operation and maintenance ability, the data alignment accuracy and the compliance traceability of the cross-border privacy set intersection scheme are improved. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 The step flow chart of the cross-border user data alignment method based on the privacy set intersection of the present application is shown in the figure.

[0050] Figure 2 The step flow chart of the step flow chart for obtaining the one-time session security parameter and the bound task identifier is shown in the figure.

[0051] Figure 3 The step flow chart for obtaining the anonymized identifier set, the set polynomial commitment and the proof verification key is shown in the figure.

[0052] Figure 4 The step flow chart for obtaining the audit verification data packet is shown in the figure.

[0053] Figure 5 The step flow chart for obtaining the cross-border user data alignment result is shown in the figure.

[0054] Figure 6 The structure schematic diagram of the cross-border user data alignment system based on the privacy set intersection of the present application is shown in the figure. DETAILED DESCRIPTION

[0055] The technical solutions of the present application will be described in detail below with reference to the drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solutions of the present application, but not limitations of the technical solutions of the present application.

[0056] Wherein the same parts are denoted by the same reference numerals. It should be noted that the words "front", "back", "left", "right", "up" and "down" used in the following description refer to the directions in the drawings, and the words "bottom" and "top", "inner" and "outer" refer to the directions towards or away from the geometric center of a particular part.

[0057] The term "and / or" in the following description is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " generally represents that the front and rear associated objects are in an "or" relationship.

[0058] Embodiment 1:

[0059] As shown in Figure 1 The present embodiment provides a cross-border user data alignment method based on intersection of privacy sets, comprising:

[0060] Based on the long-term identity key pair, through out-of-band exchange, elliptic curve key exchange and hierarchical key derivation, a one-time session security parameter and a bound task identifier are obtained;

[0061] Based on the one-time session security parameter and the user original identifier, through standardized hash processing and polynomial commitment scheme, an anonymized identifier set, a set polynomial commitment and a proof verification key are obtained;

[0062] Based on the anonymized identifier set and the set polynomial commitment, through the oblivious transfer extension protocol, the Cuckoo hash mapping and the zero-knowledge proof generation, an audit verification data packet is obtained;

[0063] Based on the audit verification data packet and the pseudo-random function output value held by the second participant, through zero-knowledge proof verification, exact value matching intersection and task identifier binding, a cross-border user data alignment result is obtained.

[0064] The long-term identity key pair is an asymmetric key pair generated locally by the first participant and the second participant based on an elliptic curve cryptosystem, and is composed of a private key and a public key in one-to-one correspondence. The private key is generated by a cryptographically secure random number generator in a finite field corresponding to the order of an elliptic curve group. The public key is obtained by scalar multiplication calculation of the private key and the generator of the elliptic curve group. The public key is used to build a two-way trust anchor for both parties. The first participant is an in-country user data holder, who has complete in-country user identity data and business attribute data, and performs set commitment generation, hash mapping construction, and audit proof generation. The second participant is an out-of-country data query party, who holds in-country user identity data in an out-of-country domain, and performs compliance token application, intersection calculation, and result alignment. Both parties complete the identification and data alignment of the common users under the premise of not disclosing the non-intersection user information of each other through a cryptology protocol. The out-of-band exchange is an operation of public key exchange between the two parties through an offline face-to-face key exchange, mutual recognition of digital certificates, and other security channels that are independent of the business data transmission link, which is used to ensure that the distribution process of the long-term public key is not eavesdropped or tampered with, and to protect the security of the trust root. The elliptic curve key exchange is a process in which the two parties use their own long-term private keys and the long-term public keys of the other party to calculate the same basic shared secret through the elliptic curve Diffie-Hellman key agreement algorithm, which is used to generate initial key material shared by both parties without transmitting sensitive keys. The layered key derivation is a process in which the two parties use the byte string of the basic shared secret as the initial key material, use the task identifier as the salt value, and perform extraction and expansion operations in sequence through the key derivation function based on HMAC (Hash-based Message Authentication Cod), to obtain multiple groups of session-specific key parameters in layers. Based on the same trust root, a one-time secure parameter is derived for a single task, which avoids the security risks caused by cross-task key reuse. The one-time session security parameter is a set of cryptology parameters that are only valid for the current alignment task, including a one-time hash salt value and an inadvertent pseudo-random function key seed, which are both obtained through layered key derivation. The one-time hash salt value is used for identifier anonymization processing. The inadvertent pseudo-random function key seed is derived by the second participant into an inadvertent pseudo-random function key through a pseudo-random generator. The first participant does not obtain the key to ensure the inadvertent nature of the protocol. The bound task identifier is a task unique identifier included in the compliance token issued by the compliance supervisor. The task identifier is extracted after the first participant verifies that the supervisor's digital signature, validity period, and business purpose of the token are all compliant, which is used to bind the keys, data, and results of the whole process and the current alignment task, and realizes compliance tracing in the task dimension.

[0065] The user original identifier is original data held by both parties for uniquely identifying the identity of the user, including but not limited to an email address, a mobile phone number, a user number, etc., and is a basic comparison object for data alignment. The standardized hash processing is a format normalization processing of the user original identifier according to a unified format rule, and is concatenated with a one-time hash salt value and input into a cryptographic hash function to obtain a fixed-length output, and then mapped to an elliptic curve group finite field operation, which is used to convert the original identifier into an anonymized identifier that cannot be reversed, thereby protecting the privacy of the user identity. The polynomial commitment scheme is a cryptographic commitment scheme based on the KZG polynomial commitment. The set elements are constructed as the roots of the polynomial, and the value of the polynomial at the secret evaluation point is committed on the elliptic curve group to obtain a constant-size commitment value, which is used to bind the identifier set of the first participant for integrity, so that the subsequent mapping process can be verified and the set content cannot be tampered with. The anonymized identifier set is a user identifier set obtained after the standardized hash processing. The first participant obtains the first participant anonymized identifier set, and the second participant obtains the second participant anonymized identifier set, which are used as input sets for subsequent privacy set intersection. The set polynomial commitment is a set polynomial constructed by the first participant by taking each element in the anonymized identifier set of the first participant as a root of the polynomial, and the polynomial commitment value calculated by using the public KZG public reference string is an elliptic curve group element with a constant size, which is used as a public input of zero-knowledge proof to bind all elements to be compared of the first participant. The proof verification key is a key pair generated by a non-interactive zero-knowledge proof system after the first participant defines the Cuckoo hash mapping logic and the set member constraint as an arithmetic circuit, including a proof key and a verification key. The proof key is used by the first participant to generate a mapping integrity proof, and the verification key can be provided to the second participant for proof checking.

[0066] The Oblivious Transfer Extension Protocol is a cryptographic protocol that generates a large number of Oblivious Transfer channels through pseudo-random extension based on a small number of basic Oblivious Transfer instances, and is used to support the execution of Oblivious Pseudo-Random Function, reduce the interaction overhead and computational complexity of the protocol under the premise of ensuring Obliviousness; the Cuckoo Hash Mapping is a hash mapping method that uses three pseudo-random hash functions to calculate three candidate bucket positions for each element, and stores the element in the single-capacity hash bucket through the iterative kick-out mechanism, the maximum number of kick-outs for a single insertion is a preset kick-out number threshold, which is usually 100, the total number of buckets is a multiple of the number of set elements, which is usually 1.27 times the number of set elements, and the elements that still cannot be successfully placed after exceeding the maximum number of kick-outs are recorded in the failed element list, this mapping method is used to map the high-dimensional identifier set to a compact hash table structure, and improve the query efficiency of subsequent intersection; the Zero-Knowledge Proof Generation is a process in which the first participant generates a mapping integrity proof through a non-interactive zero-knowledge proof algorithm, with the set polynomial commitment as the public input and the anonymized identifier set and the corresponding pseudo-random function output value as the private input, which is used to prove to the second participant that the construction process of the hash table and the failed list has no element omission or tampering without revealing the original set content; the Audit Verification Data Packet is a structured data set assembled by the first participant for cross-border transmission, including the encrypted hash table, the failed element list, the mapping integrity proof and the set polynomial commitment, and does not contain any original user identifier or information that can directly restore the identity, which is used to provide the second participant with all the verification and comparison data required for intersection, while meeting the compliance requirements of data minimization; the Pseudo-Random Function Output Value is a pseudo-random value calculated based on the Oblivious Pseudo-Random Function protocol, and the first participant synthesizes the output values corresponding to all elements of its own set through the Oblivious Transfer Extension Protocol interaction, and the second participant directly calculates the output values corresponding to all elements of its own set using the derived Oblivious Pseudo-Random Function key locally, which is used as a comparison medium for private set intersection to avoid direct transmission of identifiers.

[0067] The zero-knowledge proof verification is a process in which the second participant uses a verification key to run a non-interactive zero-knowledge proof verification algorithm on the mapping integrity proof, taking the set polynomial commitment as the public input, for checking whether the received hash table and the failure list are from the legal set promised by the first participant, and whether the mapping process is compliant and tamper-free; the exact value matching intersection is a process in which the second participant respectively compares the candidate bucket storage value of the encrypted hash table and the complete record value of the failure element list with the output value of the pseudo-random function held by the second participant, and if the comparison is successful, it is determined that the intersection of the common users is obtained, which is used to accurately obtain the user set common to both parties without revealing the non-intersection elements of both parties, and realizes the intersection result with zero false positive and zero false negative; the task identifier binding is an operation in which the second participant associates and stores the intersection set obtained with the task identifier of the task, which is used to add a compliant source label to the intersection result, and ensures that the subsequent data use can be traced back to the corresponding compliant token and business purpose; and the cross-border user data alignment result is the intersection user identifier set with the compliant source label, and the auditable user alignment view obtained by associating the self user portrait, transaction record and other business attributes based on the intersection in the local of both parties, the use range of which is strictly limited within the business purpose declared by the compliant token, and the whole-process audit log is retained.

[0068] The embodiment realizes non-interactive session key negotiation and compliant task deep binding through the technical means of long-term identity key anchor point and session key hierarchical derivation, improves the trust basis and key isolation security of cross-border data interaction; realizes the auditable nature of the whole process of hash table construction through the verifiable mapping mechanism combining KZG polynomial commitment and non-interactive zero-knowledge proof, and improves the integrity checking capability and tamper resistance of cross-border data transmission; realizes the privacy set intersection calculation with low interaction overhead through the efficient intersection architecture combining the oblivious pseudo-random function extended based on the oblivious transmission and the Cuckoo hash, and improves the execution efficiency and privacy protection strength of the privacy intersection in the large-scale user scenario; realizes the accurate intersection result with zero false negative through the double-path exact matching mechanism of main hash table intersection and failure list supplementary intersection, and improves the accuracy and reliability of cross-border user data alignment.

[0069] Further, the embodiment provides a step of obtaining a one-time session security parameter and a bound task identifier, including:

[0070] Based on the long-term identity key pair, the public keys are exchanged through a secure out-of-band channel to obtain a bidirectional trust anchor point;

[0071] Based on the digital signature of the compliance supervisor, the compliant token and the bound task identifier are obtained through task token application and verification;

[0072] Based on bidirectional trust anchors and task identifiers, one-time session security parameters are obtained through elliptic curve key exchange and hierarchical key derivation; specifically including:

[0073] Based on the long-term private key of the first participant and the long-term public key of the second participant in the two-way trust anchor, the basic shared secret is obtained through elliptic curve key exchange; based on the basic shared secret and the task identifier, a one-time hash salt value and an unintentional pseudo-random function key seed are obtained by extraction and expansion through a key derivation algorithm; based on the unintentional pseudo-random function key seed, the second participant derives the one-time unintentional pseudo-random function key held by the second participant alone through a pseudo-random generator.

[0074] The secure out-of-band channel is a secure interaction channel that is independent of the main cross-border business data transmission link. This includes, but is not limited to, face-to-face key exchange and digital certificate mutual recognition channels certified by authoritative institutions. It is used to complete the trusted distribution of long-term public keys in an environment free from network eavesdropping risks, ensuring the initial security of the root of trust. The public key exchange involves the first and second participants sending their generated long-term public keys to each other via the secure out-of-band channel and securely storing them. This is a prerequisite for building a two-way trust anchor. The two-way trust anchor is a set of trusted root key materials supporting subsequent key negotiations between the two parties across borders. This includes the first participant's long-term private key, the first participant's long-term public key, the second participant's long-term public key, and the second participant's long-term private key. The first participant locally stores its own long-term private key and the second participant's long-term public key, which are used to provide a unified trust foundation for the full cross-border alignment task. The first participant is the holder of domestic user data, possessing complete domestic user identity data and business attribute data, and is responsible for generating set commitments, constructing hash maps, and generating audit proofs. The second participant is the overseas data query party, holding user identity data within an overseas domain, and is responsible for applying for compliance tokens, calculating intersections, and aligning results. The first participant's long-term private key is a large integer generated locally by the first participant using a cryptographically secure random number generator, with a value range corresponding to the finite field multiplication group of the elliptic curve group order. The random elements within the first participant's public key are typically random numbers of 256 bits or more. These are privately stored locally by the first participant and never disclosed to the outside world. They serve as the core private credentials for the first participant's identity authentication and key negotiation. The first participant's long-term public key is an elliptic curve group element obtained by the first participant through scalar multiplication of the elliptic curve group generator and its own long-term private key. It can be publicly distributed and used by the other party to complete key negotiation and identity verification. The second participant's long-term public key is a public key element generated by the second participant based on the same elliptic curve parameters. It is distributed by the second participant to the first participant through an out-of-security channel and is used by the first participant to complete the basic shared secret calculation. The second participant's long-term private key is a privately generated random integer that corresponds one-to-one with the second participant's long-term public key. It is privately stored by the second participant and serves as the core credentials for the second participant's key negotiation and OPRF key derivation.

[0075] The compliance regulator is a third-party compliance agency recognized by both parties in the cross-border transaction and possessing regulatory qualifications. It is responsible for reviewing the business purpose and identity of the parties involved in the cross-border data exchange and issuing compliance certificates. The digital signature is an integrity and identity authentication mechanism based on asymmetric cryptography. It is obtained by the compliance regulator using its own private key to sign the plaintext of the token. The recipient can verify the signature validity through the regulator's public key, ensuring the non-forgeability and credible origin of the compliance token. The task token application and verification process involves the second participant submitting application materials to obtain the compliance token, and the first participant verifying the token's legality. This deeply binds a single cross-border alignment task with the compliance approval result, ensuring all data interactions are executed within the scope of compliant authorization. The compliance token is a structured certificate carrying task compliance information, including a unique task identifier, business purpose, second participant identity information, validity period, and the regulator's digital signature. It serves as the compliance access basis for cross-border data alignment tasks. The bound task identifier is a globally unique identifier string contained within the compliance token, extracted by the first participant after verifying token compliance. It is used to associate and bind the token with the key parameters, calculation process, and final result of the task throughout the entire process, achieving full-link traceability at the task level.

[0076] Elliptic curve key exchange (ECE) is a key generation method based on the Diffie-Hellman key exchange protocol. Both parties use their private keys and the other party's public keys to perform group operations to obtain the same shared secret, used to generate consistent initial key material without exchanging sensitive keys. The basic shared secret consists of the same elliptic curve group elements calculated by both parties through EEC, serving as the initial key material for subsequent session key derivation. It is calculated independently by both parties locally and is not transmitted over the network. Layered key derivation is the process of extracting multiple sets of functionally isolated session parameters from a single initial secret using key derivation functions. This is used to derive different, independent, one-time security parameters from the same basic shared secret, avoiding the security risks associated with cross-functional key reuse. The key derivation algorithm is HMAC-based Key Derivation, conforming to the RFC5869 standard. The Function, or HKDF algorithm, comprises two phases: extraction and expansion. It transforms a non-uniformly distributed initial secret into multiple cryptographically secure session keys. The one-time hash salt, derived from the HKDF expansion phase, is a hash salt parameter specific to the current task and used for anonymizing the user identifier, ensuring that hash results from different tasks are uncorrelated. The unintentional pseudo-random function key seed, derived from the HKDF expansion phase, is an intermediate seed parameter used to derive the OPRF key. It is provided only to the second participant for subsequent key generation; the first participant does not obtain the final key corresponding to this seed. The pseudo-random generator derivation involves using the key seed as input and expanding it through a cryptographically secure pseudo-random generator to generate a key of a specified length. This is used to generate unintentional pseudo-random function keys that meet the length requirements from the seed parameter. The one-time unintentional pseudo-random function key held by the second participant is a pseudo-random function key valid only for the second participant and obtained independently by the second participant based on the key seed using the pseudo-random generator. It is the core private parameter for executing the unintentional pseudo-random function protocol, and the first participant cannot know its specific value throughout the process.

[0077] Specifically, such as Figure 2 As shown, firstly, during the protocol initialization phase, the first and second participants each generate local long-term identity key pairs based on pre-agreed standard elliptic curve parameters; the order is selected as a large prime number. cyclic elliptic curve group Its generator is The first participant generates a random number generator with a length equal to or greater than the given number using a cryptographically secure random number generator. A random integer of the same bit length is used as the long-term private key of the first participant. ,satisfy That is, the first participant's long-term private key is a finite field multiplication group, and the first participant's long-term public key is calculated using elliptic curve scalar multiplication. Similarly, the second participant generates its own long-term private key. And calculate the long-term public key of the second participant. After the key pair is generated, both parties exchange public keys through an out-of-band secure channel. The first participant receives and securely stores the second participant's long-term public key. The second participant receives and securely stores the first participant's long-term public key. At this point, the first participant holds the key pair locally. The second participant holds the key pair locally. Together, these two elements form a two-way trust anchor. This initialization step only needs to be executed once, providing a unified trust foundation for all subsequent cross-border alignment tasks.

[0078] Then, when a cross-border user data alignment requirement arises, the second participant submits a statement of the business purpose of this task, its own identity verification materials, and an application for the scope of data use to the compliance regulator. The compliance regulator conducts a compliance review of the application materials, and upon approval, generates a unique task identifier. The token contains the plaintext of the business purpose field, the second participant identity field, and the validity period field, and is used with the private key of the compliance regulator. Digitally sign the plaintext of the token to obtain the signature value. Ultimately, the plaintext of the token and the signature value are combined to form a compliance token. The compliance token is then issued to the second participant; after obtaining the compliance token, the second participant sends it along with the alignment request to the first participant; upon receiving the request, the first participant first uses the pre-stored public key of the compliance regulator. Verify signature value The validity of the token is verified to ensure that it has not been tampered with and that its source is trustworthy. Then, the validity period of the token is verified to ensure that it is within the current time range and that the business purpose complies with internal compliance policies. Once all verifications are passed, the task identifier in the token is extracted and used as the unique identifier for binding the entire process of this task. If any verification fails, the first participating party immediately terminates the alignment task and records the exception log.

[0079] Ultimately, based on a two-way trust anchor and task identifier, both parties independently derive the one-time session security parameters locally, without any additional network interaction. First, they compute the underlying shared secret through elliptic curve key exchange: the first participant uses its own long-term private key. Long-term public key with the second participant Perform elliptic curve scalar multiplication to obtain the underlying shared secret. The second participant uses its own long-term private key. Long-term public key with the first participant Perform the calculation to obtain the basic shared secret on the second participating party's side. According to the mathematical properties of the elliptic curve Diffie-Hellman protocol, , ,therefore Both parties obtain a completely identical basic shared secret; then, based on the basic shared secret and the task identifier, they perform hierarchical key derivation using the HKDF algorithm. This algorithm follows the RFC5869 standard and consists of two stages: extraction and expansion. The extraction stage uses the basic shared secret... The byte string encoding is used as the input key material IKM, with the task identifier. The pseudo-random key is calculated using the salt value (salt). Its calculation formula is , This is the extraction phase operation function of the HKDF key derivation algorithm, used to convert non-uniformly distributed initial key material into a cryptographically secure pseudo-random master key; the expansion phase uses a pseudo-random key. As input, two independent sets of session parameters are derived hierarchically through different information tags (info), namely: , ,in, This is a function for the expansion stage of the HKDF key derivation algorithm, used to expand the pseudo-random master key into a function key of a specified length and purpose. This is a tag for deriving the key of an unintentional pseudo-random function, used for subsequently deriving the working key of the unintentional pseudo-random function. A label is derived from the hash salt value and used for anonymizing the hashing of user identifiers. For the unintentional pseudo-random function key seed, This is a one-time hash salt value. Then, only the second participant performs the key derivation operation; the first participant does not perform this step. The second participant uses an unintentional pseudo-random function key seed. As input, through a cryptographically secure pseudo-random generator Expand to obtain a one-time unintentional pseudo-random function key of a specified length. This key is held privately by only the second participant and is used for the subsequent execution of the unintentional pseudo-random function protocol. In this embodiment, parameters such as the elliptic curve bit length, the underlying hash function of HKDF, and the output length of the pseudo-random generator are merely examples. Those skilled in the art can set these parameters according to the actual security level and business scale; this embodiment does not impose any limitations on them.

[0080] This embodiment utilizes a technique of distributing long-term public keys through an out-of-security channel to construct bidirectional trust anchors, enabling offline trusted establishment of trust roots between cross-border parties and enhancing the security and resistance to network attacks in initial key distribution. Through a token verification mechanism using digital signatures from compliant regulators, it achieves compliant access control and task identifier binding for single tasks, improving the compliance and end-to-end traceability of cross-border data interaction. A non-interactive key generation mechanism combining elliptic curve Diffie-Hellman key negotiation and HKDF layered derivation enables the local synchronous generation of multiple sets of isolated security parameters for a single task, improving the efficiency of session key generation and key isolation security. An asymmetric key distribution mechanism using independently derived OPRF keys by a second participant achieves compliant binding of keys on the key side through unintentional pseudo-random functions, ensuring that entities without compliant tokens cannot participate in the intersection protocol, thus enhancing the overall security boundary and access control capabilities of the protocol.

[0081] Furthermore, this embodiment provides a step for obtaining a set of anonymized identifiers, a set polynomial commitment, and a proof verification key, including:

[0082] Based on one-time session security parameters and the user's original identifier, an anonymous identifier set is obtained through standardization rules and cryptographic hash functions;

[0083] Based on the anonymized identifier set of the first participant, a set of polynomial commitments and proof verification keys are obtained through polynomial construction and a concise commitment scheme; specifically including:

[0084] Based on the anonymized identifier set of the first participant, a set polynomial is constructed by multiplying each element as the root of a polynomial. Based on the set polynomial and the KZG common reference string, a set polynomial commitment is obtained through exponential operations on the elliptic curve group. Based on the set polynomial commitment, combined with the private inputs and constraints required by the mapping circuit, a proof verification key containing the proof key and the verification key is pre-computed through a non-interactive zero-knowledge proof system.

[0085] The standardization rules and cryptographic hash functions are a combination of format specifications and cryptographic primitives used in the preprocessing of user identifiers. The standardization rules are unified format normalization rules pre-agreed upon by both parties across borders, including but not limited to converting email addresses to all lowercase, removing special suffixes, removing country code prefixes and separators from mobile phone numbers, and removing invalid identifiers. The cryptographic hash function is a cryptographic hash algorithm with anti-image and anti-collision properties. After hashing the standardized identifiers with a one-time hash salt value, it maps them to the finite field corresponding to the elliptic curve group. This is used to convert the original identifiers that can directly identify the user's identity into anonymized field elements that cannot be reversed, thus protecting the user's original identity privacy while ensuring consistency in comparison. The anonymized identifier set is the set of field elements obtained by each party after completing the standardization and hashing of the original identifiers locally. The first participant obtains its own anonymized identifier set, and the second participant obtains its own anonymized identifier set. Both of these are input sets for the subsequent privacy set intersection protocol.

[0086] The first participant's anonymized identifier set is a finite-field element set obtained by processing the original identifiers of domestic users held by the first participant. It contains all user identifier elements of the first participant to be compared and serves as the basic input for constructing the set polynomial and generating commitments. The polynomial construction and concise commitment scheme are a combination of cryptographic schemes to achieve set integrity binding and verifiability. The polynomial construction is used to convert discrete set elements into a unified polynomial representation. The concise commitment scheme adopts the KZG polynomial commitment scheme to bind the polynomial with a constant size, so that the committing party can prove the integrity of the set content and the membership relationship without revealing the specific elements of the set. The set polynomial is the first polynomial constructed by multiplying each element in the first participant's anonymized identifier set. The degree of the polynomial is equal to the total number of elements in the set, and uniquely corresponds to a set of anonymized identifiers. The KZG public reference string is a global public parameter of the KZG polynomial commitment scheme, generated and published by a trusted third party during the initialization phase. It contains the elliptic curve group generators and the group elements corresponding to each power of the secret evaluation point. The maximum polynomial degree it supports is 1 to 2 times the expected maximum size of the set, usually 1.2 times the expected maximum size of the set. It is used to support the calculation of polynomial commitments and membership proofs, ensuring the security and verifiability of the commitment scheme. The exponentiation operation on the elliptic curve group is a multi-scalar multiplication operation performed based on the KZG public reference string. It maps the values ​​of the set polynomials at the secret evaluation points to elliptic curve group elements, and is used to compress high-dimensional set information into a commitment value of constant size.

[0087] The set polynomial commitment is a constant-size elliptic curve group element that binds the anonymized identifier set of the first participant. It is obtained by performing exponential operations on the elliptic curve group using the set polynomial and the KZG common reference string. It possesses binding and hiding properties, cannot be tampered with, and does not reveal the specific element information of the set. It serves as the public input for subsequent zero-knowledge proofs and the basis for set integrity verification. The private inputs and constraints required by the mapping circuit are the core components of the zero-knowledge proof arithmetic circuit. The private inputs include the anonymized identifier set of the first participant and the output value of the pseudo-random function subsequently obtained through an unintentional pseudo-random function protocol. The constraints are defined according to the KZG set membership proof rules, the candidate bucket calculation logic of the Cuckoo hash map, the iterative kick-out rules, and the insertion success and failure judgment rules, ensuring that the circuit can completely constrain the entire hash mapping process. Legality; The pre-computation of the non-interactive zero-knowledge proof system is the process of generating a proof key and a verification key through the trusted setup phase of the non-interactive zero-knowledge proof system for a defined arithmetic circuit. This pre-computation only needs to be performed once for the same circuit, and the generated key pair can be reused for proof generation and verification of circuits with the same structure, thereby improving the execution efficiency of subsequent proof generation and verification; the proof and verification keys are key pairs that support the generation and verification of zero-knowledge proofs, including a proof key and a verification key; the proof key is a privately generated key obtained by the pre-computation of the non-interactive zero-knowledge proof system, held by the first participant, and used to generate a legitimate zero-knowledge proof by combining the public and private inputs of the circuit; the verification key is a public verification key obtained by the pre-computation of the non-interactive zero-knowledge proof system, which can be provided to the second participant for validating the received zero-knowledge proof.

[0088] Specifically, such as Figure 3 As shown, the first and second participants first, locally, use a one-time hash salt value. The parties will perform standardization and hash mapping on their respective user original identifiers to generate their own anonymized identifier sets. They will pre-agree on unified standardization rules and perform corresponding normalization operations for different types of user original identifiers: for email identifiers, they will uniformly convert them to all lowercase, remove variable parts such as periods and plus signs from usernames, and eliminate invalid email addresses with illegal formats; for mobile phone number identifiers, they will uniformly remove country code prefixes, hyphens, spaces, and other separators, retaining only pure numbers and verifying the validity of the number of digits. After completing the standardization process, each party will assign each standardized identifier to a one-time hash salt value. Perform byte concatenation and input cryptographic hash function The operation is performed to obtain a fixed-length hash output value, and then the hash output is mapped to an elliptic curve group through modulo operation. Corresponding finite field Within, anonymized identifier elements are obtained; among them, the first participant holds a total of Valid original identifiers This corresponds to the generation of the anonymized identifier set for the first participant. , As the first participant Each anonymous identifier element is a field value obtained by hashing and moduloing the standardized original identifier. The total number of valid original identifiers held by the first participant, where the first participant is... The formula for calculating each element is: In the formula This indicates a byte concatenation operation. For modulo operation, Let be the order (prime number) of the elliptic curve group. ≤ The hash function can use the SHA-256 algorithm, with an output length of 256 bits; similarly, the second participant holds a total of Valid original identifiers This corresponds to the generation of a set of anonymized identifiers for the second participant. , No. The calculation method for each element is exactly the same as that of the first participant. ≤ , Anonymize the set of identifiers for a set The Middle An anonymous identifier element ensures that the same original identifier can be obtained with the exact same anonymous domain element locally on both parties.

[0089] Then, the first participant uses its own set of anonymized identifiers. The process sequentially executes set polynomial construction, KZG polynomial commitment computation, and zero-knowledge proof circuit pre-computation to obtain the set polynomial commitment and proof verification key; it then implements the construction of the set polynomial: [the process involves] converting the set... Each element in As the root of a univariate polynomial, the first set polynomial is constructed through a series of multiplication operations. Its expression is , Let be the independent variable of the set polynomial, taking values ​​in the finite field corresponding to the elliptic curve group. This represents a series multiplication operation, and the degree of the polynomial is... , The total number of elements in the set of anonymized identifiers of the first participant is also the degree of the polynomial; and only if the input value belongs to the set... When the polynomial takes the value 0, the set polynomial commitment is then calculated using the publicly available KZG reference string. ,in Secret evaluation points generated for a trusted third party. The maximum polynomial degree supported by a common reference string, satisfying The value range is typically 1 to 1.5 times the maximum expected size of the set. For example, when the expected maximum user size is 1 million, It can be set to 1.2 million; the set polynomial Expand into coefficient form ,in Let be the coefficients of each term in the set polynomial, where the coefficient of the highest degree term is . Corresponding to the properties of the first polynomial, The highest degree of the polynomial is equal to the total number of elements in the set. The set polynomial commitment is calculated by multiplying the polynomial coefficients with the group elements of the corresponding powers in the common reference string using weighted summation. Its calculation formula is ,in For set polynomials After unfolding, the first The coefficient of the second term, For set polynomials at secret evaluation points The value at that location, To make the first one in the public reference string Individual elements implement scalar multiplication; For set polynomials at secret evaluation points The value at the location The corresponding elliptic curve group element; this commitment is a single elliptic curve group element with a constant size, independent of the size of the set elements; further, a verifiable mapping arithmetic circuit is constructed and the proof verification key is pre-computed: the first participant defines the entire logic of the subsequent Cuckoo hash mapping as an arithmetic circuit, and the public input of the circuit is a set polynomial commitment. The private input is the set of anonymized identifiers of the first participant. With the set of pseudo-random function output values ​​to be obtained later The circuit incorporates three types of core constraints: the first is set membership constraints, which use KZG membership proof logic to constrain each private input. All meet That is, it belongs to the set polynomial commitment. The corresponding valid set; secondly, the mapping rule constraint, defining three pseudo-random hash functions. The constraints define the calculation method for the candidate bucket position corresponding to each element, the iterative kick-out logic, and the insertion result determination rules. Represented as, is the function mapping symbol, representing the mapping relationship from the domain to the range, and is the output range of the hash function. The corresponding integer range of bucket indices in the Cuckoo hash table. The first factor is the total number of buckets in the Cuckoo hash table; the second is the integrity constraint, where all elements in the constraint set have been mapped without omission or additional additions; after the circuit definition is completed, the first participant performs pre-computation through the trusted setup phase of the non-interactive zero-knowledge proof system to generate a proof verification key uniquely corresponding to the circuit, where the proof key is denoted as... The key is securely stored locally by the first participating party and used for subsequent generation of mapping integrity proof; the verification key is denoted as... This information can be provided to a second participant via a secure channel for subsequent proof verification. In this embodiment, parameters such as hash function selection, maximum number of common reference strings, and zero-knowledge proof system type are merely examples. Those skilled in the art can set these parameters according to actual security levels and business scale; this embodiment does not impose any limitations on them.

[0090] This embodiment achieves irreversible desensitization of user original identifiers through standardized rules combined with salted hashing anonymization, ensuring stable mapping of identical identifiers and preventing association between different identifiers, thus enhancing the protection of user identity privacy in cross-border data interaction. Through the constant-size set binding mechanism of KZG polynomial commitments, it achieves concise integrity commitments for large-scale user sets, significantly reducing the amount of commitment data and verification overhead in cross-border transmission, and improving the transmission efficiency and verifiability of the protocol. Through the arithmetic circuit encapsulation of full-process mapping constraints, it achieves formal verification of the Cuckoo hash mapping logic, ensuring that each step of the mapping process conforms to preset rules, improving the rigor and credibility of subsequent audit verification. Through a one-time pre-computation mechanism of non-interactive zero-knowledge proofs, it achieves pre-generation of proof keys, avoiding repeated setup operations for each task, and improving the execution efficiency and engineering feasibility of large-scale, high-frequency alignment tasks.

[0091] Furthermore, this embodiment provides a step for obtaining an audit verification data packet, including:

[0092] Based on the anonymized identifier set of the first participant and the one-time session security parameters of the second participant, the pseudo-random function output values ​​held by each party are obtained through the unintentional transmission extension protocol.

[0093] Based on the pseudo-random function output value, set polynomial commitment, and proof verification key held by the first participant, an encrypted hash table, a list of failed elements, and a proof of mapping integrity are generated through Cuckoo hash mapping and zero-knowledge proof; specifically including:

[0094] Based on the pseudo-random function output value held by the first participant, the candidate bucket position is calculated using a pseudo-random hash function and the Cuckoo hash insertion algorithm is executed to obtain an encrypted hash table and a list of failed elements. Based on the set polynomial commitment, the encrypted hash table, and the list of failed elements, the entire Cuckoo hash mapping process is expressed as the constraint condition of a zero-knowledge satisfiability circuit to obtain the generation input for the circuit satisfiability proof. Based on the generation input for the circuit satisfiability proof and the proof verification key, a mapping integrity proof is obtained through a non-interactive zero-knowledge proof generation algorithm.

[0095] Based on encrypted hash tables, lists of failed elements, mapping integrity proofs, and set polynomial commitments, audit verification data packets received by the second participant are transmitted through cross-border encrypted channels.

[0096] The first participant's anonymized identifier set is a finite-field element set obtained by the first participant based on its own domestic user original identifiers, processed by standardization rules and cryptographic hash functions. It includes the anonymized user identifier elements to be compared and serves as the sender's input set for the unintentional pseudo-random function protocol. The second participant's one-time session security parameters are a set of session-specific cryptographic parameters derived by the second participant based on bidirectional trust anchors and bound task identifiers. These parameters include at least the one-time unintentional pseudo-random function key held by the second participant, which is privately stored locally by the second participant and never disclosed. This serves as the receiver's core private input for the unintentional pseudo-random function protocol. The unintentional transmission extension protocol is based on a small number of basic unintentional transmission instances and extends through pseudo-randomization. This cryptographic protocol generates a large number of low-cost unintentional transmission channels. The number of executions of the basic unintentional transmission is a preset security parameter, usually set to 128 times. This is used to significantly reduce the interaction overhead and computational complexity of large-scale pseudo-random function calculations while ensuring the unintentional security attribute, thus supporting the efficient execution of the unintentional pseudo-random function protocol. The pseudo-random function output values ​​held by each party are sets of pseudo-random values ​​obtained by each party through the unintentional pseudo-random function protocol, each corresponding to an element of its own identifier set. The first party holds the first party's pseudo-random function output value set, and the second party holds the second party's pseudo-random function output value set. The output values ​​corresponding to the same identifier are completely identical, and it is impossible to deduce the original identifier information from the output value.

[0097] The pseudo-random function output value held by the first participant is a set of pseudo-random values ​​synthesized locally by the first participant after interaction through the unintentional transmission extension protocol. This set corresponds one-to-one with elements in the first participant's anonymized identifier set and serves as the direct input for constructing the hash map table. The pseudo-random hash function is a cryptographic hash mapping function with uniform distribution characteristics. Three independent function instances are set up to map the pseudo-random function output value to candidate bucket indices in the hash table. The candidate bucket position is the hash bucket index value calculated by the pseudo-random hash function. Each set element corresponds to three different candidate storage locations, providing options for Cuckoo hash insertion. Storage buckets; Cuckoo hash mapping is a hash storage scheme based on multiple candidate buckets and an iterative kick-out mechanism, used to compress and map large-scale set elements into a compact single-capacity hash table structure, improving the execution efficiency of subsequent intersection queries; Cuckoo hash insertion algorithm is the specific execution algorithm of Cuckoo hash mapping, which attempts to store elements into candidate buckets according to preset iterative kick-out rules, used to complete the actual storage mapping from set elements to hash table; Zero-knowledge proof is a cryptographic proof mechanism with zero-knowledge, completeness, and reliability attributes, used to prove the legality and completeness of the hash mapping process to the verifier without revealing the original set elements and intermediate mapping details.

[0098] The encrypted hash table is a single-capacity hash bucket array storing the output values ​​of successfully inserted pseudo-random functions. It contains only pseudo-random values ​​and no original identity information, serving as the core comparison carrier for cross-border transmission. The failed element list is an ordered set recording the output values ​​of pseudo-random functions that failed to be successfully inserted into the hash table even after exceeding the maximum number of kickouts. It is used to supplement subsequent intersection operations and eliminate the false negative problem caused by the inherent failure rate of Cuckoo hashing. The constraints of the zero-knowledge satisfiability circuit are arithmetic circuit constraint rules that formalize the logic of the entire Cuckoo hashing process. These include set membership constraints, candidate bucket calculation constraints, kickout logic constraints, and insertion result constraints, used to transform the mapping process into one that can be passed by a zero-knowledge proof system. The formal satisfiability problem of verification is addressed. The generation input for circuit satisfiability proof consists of all the input parameters required to generate zero-knowledge proof, including a set of multinomial commitments as public input and a set of anonymized identifiers and pseudo-random function output values ​​as private input. These are substituted into the proof generation algorithm to obtain a valid proof. The non-interactive zero-knowledge proof generation algorithm is a non-interactive proof generation algorithm based on a pre-computed proof key. It can generate independently verifiable proofs without online interaction from the verifier, and is used to efficiently generate mapping integrity proofs. The mapping integrity proof is a fixed-length proof string output by the non-interactive zero-knowledge proof generation algorithm, with a constant size, and its validity can be independently verified by a second participant using a verification key.

[0099] Cross-border encrypted channel transmission is a restricted cross-border data transmission channel based on transport layer encryption protocols. It adopts an end-to-end encryption mechanism to ensure that data packets transmitted across borders are not eavesdropped on, tampered with, or leaked, thus meeting the security and compliance requirements for cross-border data transmission. The audit verification data packet received by the second participant is a structured data set successfully received and parsed by the second participant. It includes an encrypted hash table, a list of failed elements, a mapping integrity proof, and a set multinomial commitment. It serves as the complete input basis for subsequent integrity audits and privacy set intersection.

[0100] Specifically, such as Figure 4 As shown, firstly, both parties execute an unintentional pseudo-random function protocol based on unintentional transmission extension to obtain their respective pseudo-random function output values. Before the protocol execution, the roles are pre-determined, with the second participant acting as the receiver of the unintentional pseudo-random function, and secretly holding the one-time unintentional pseudo-random function key held by the second participant. The first participant, as the sender, holds the first participant's set of anonymized identifiers. The unintentional pseudo-random function protocol is divided into two phases: basic unintentional transmission and extension. First, both parties execute... Sub-basic unintentional transmission instance, in which For security purposes, it is typically set to 128 bits, serving as the trust seed for subsequent expansion. During the expansion phase, the second participant uses a one-time, unintentional pseudo-random function key. Using the seed as input, a cryptographically secure pseudo-random number generator is used to generate a random number of lengths. The selected bit string serves as the receiver's selection input for the Unintentional Transmission Extension Protocol (UTP). The first participant, acting as the sender of the UTP, generates two sets of corresponding random mask parameters and completes the interaction. After the protocol execution is complete, the first participant selects each element... The two corresponding output shares are obtained, and the pseudo-random function output value corresponding to the element is calculated using the local share synthesis algorithm. ,in It is a standard pseudo-random function, which can be implemented using the AES-CMAC algorithm. The first participant can only obtain the output value throughout the entire process. Unable to obtain the key The specific value of the key ensures the unintentionality of the protocol; meanwhile, the second participant does not need additional interaction and can directly use the one-time unintentional pseudo-random function key locally. Anonymize your own set of identifiers Each element in The calculation is performed to obtain the pseudo-random function output value held by the second participant. Due to the key The task identifier is deeply associated with the compliance token, and entities that do not hold a legitimate compliance token cannot derive the correct key. Therefore, it is impossible to calculate a valid pseudo-random function output value to participate in the subsequent intersection process.

[0101] Then, based on the pseudo-random function output value it holds, the first participant sequentially executes the Cuckoo hash map construction and zero-knowledge proof generation to obtain the encrypted hash table, the list of failed elements, and the map integrity proof; first, the encrypted hash table and the list of failed elements are constructed: the hash table configuration parameters and the total number of hash buckets are determined. ,in The load factor is typically set to 1.27, and each hash bucket has a storage capacity of 1. A maximum kickout threshold is also set. The value is typically taken 100 times; three independent pseudo-random hash functions are defined. This is used to map each element to one of the three candidate bucket positions; then the Cuckoo hash insertion algorithm is executed, iterating through all the pseudo-random function output values. For the current element, try the first candidate bucket position in turn. If the corresponding bucket is empty, then directly... Store the element in the bucket; if the bucket is already occupied by another element, remove the existing element from the bucket and add the current element. Store the element in the bucket, then try the next candidate bucket position for the kicked-out element, repeating the above kick-out iteration process; if an element passes through... If no free bucket can be found after the next iteration, the element is added to the list of failed elements. And accumulate the failure count. After all elements have been traversed, an encrypted hash table storing the successfully inserted values ​​is obtained. And a list of failed elements that record failed insertion values. Then, the generating input for the circuit satisfaction proof is: a set of polynomial commitments. As a public input to the circuit, the set of anonymized identifiers of the first participant is used. and the corresponding set of pseudo-random function output values As the private input to the circuit, combined with the predefined constraints of the zero-knowledge satisfiability circuit, they together constitute the input for generating the circuit satisfiability proof. These constraints, defined during the proof verification key pre-computation stage, include three categories: set membership constraints, mapping rule constraints, and integrity constraints, respectively constraining the legality of element ownership, the compliance of the mapping process, and the integrity of element processing. Further, the mapping integrity proof is generated: the first participant calls the pre-computed proof key. Substituting the input for generating the circuit satisfaction proof into the non-interactive zero-knowledge proof generation algorithm, the output yields the mapping integrity proof. This proof can demonstrate the encrypted hash table to a second participant. List of failed elements All are committed by set polynomials The corresponding valid set is generated according to the established rules, and there is no case of element tampering, omission or extra addition.

[0102] Ultimately, the first participant encapsulates the data packet and transmits it via a cross-border encrypted channel. The second participant receives the data packet and obtains an audit verification data packet. The first participant first uses an encrypted hash table. List of failed elements Failure count Mapping integrity proof With set polynomial commitment The payload is structured and encapsulated according to a preset format to form the data to be transmitted. The payload to be transmitted contains only the output value of a pseudo-random function and cryptographic proof components, without any original user identifiers or hash identifiers that can directly reconstruct identity, thus conforming to the principle of data minimization. Subsequently, the first participant sends the payload to be transmitted from a domestic node to an overseas node of the second participant through a pre-established cross-border encrypted channel. The entire transmission process adopts an end-to-end encryption mechanism to ensure the confidentiality and integrity of data transmission. After the second participant successfully receives and decrypts the data packet, it extracts all the cryptographic components to obtain the audit verification data packet received by the second participant, which is used for subsequent integrity audit verification and privacy set intersection operation. In this embodiment, the parameters such as the basic unintentional transmission quantity, load factor, and maximum kickout count are only examples. Those skilled in the art can set them according to the actual set size and security level. This embodiment does not impose any restrictions on them.

[0103] This embodiment achieves bidirectional unintentionality between the key side and the computation side through an unintentional pseudo-random function protocol mechanism based on unintentional transmission extension, ensuring that neither party can obtain the other's original set information and key parameters, thus enhancing the privacy protection strength and protocol security boundary of the privacy intersection process. Through a storage mechanism combining Cuckoo hash compact mapping with failure list supplementation, it achieves low-space-overhead storage of large-scale sets while fully preserving the comparison capability of all elements, avoiding false negatives caused by the inherent failure rate of hashing, and improving the integrity of the intersection results and storage utilization efficiency. Through a zero-knowledge proof generation mechanism with full-process mapping constraints, it achieves formal auditability of the entire hash construction process, ensuring that cross-border transmitted data packets completely correspond to the promised legitimate set, thus improving the integrity verification capability and anti-tampering capability of cross-border data interaction. Through an encrypted cross-border transmission mechanism for de-identified content, it achieves minimization and de-identification of cross-border transmitted data, meeting data localization and cross-border data compliance requirements, and improving the compliance and transmission security of the cross-border user data alignment process.

[0104] Furthermore, this embodiment provides a step for obtaining cross-border user data alignment results, including:

[0105] Based on the audit verification data packet received by the second participant, integrity audit approval is obtained through zero-knowledge proof verification and failure count threshold check; specifically including:

[0106] Based on the audit verification data packet received by the second participant, and with set multinomial commitment as public input, the mapping correctness verification result is obtained by running a zero-knowledge proof verification algorithm; based on the list of failed elements in the audit verification data packet, the failure count compliance judgment is obtained by comparing it with a preset acceptable threshold; based on the fact that both the failure count compliance judgment and the mapping correctness verification result are passed, the integrity audit is confirmed by the second participant.

[0107] Based on integrity auditing, the intersection of the complete privacy set is obtained by verifying the pseudo-random function output value held by the second participant, the encrypted hash table, and the list of failed elements, and by searching through exact value matching.

[0108] Based on the intersection of complete privacy sets and the bound task identifiers, cross-border user data alignment results are obtained by binding storage and associating with local attributes.

[0109] The zero-knowledge proof verification is a cryptographic verification operation performed by the second participant based on a pre-stored verification key and public input to verify the validity of the received zero-knowledge proof. This verifies that the statement corresponding to the proof is true and valid, and that there is no forgery or tampering. The mapping correctness verification result is the output conclusion after the zero-knowledge proof verification, divided into two states: pass and fail. This indicates whether the hash mapping process conforms to preset rules and is consistent with the commitment set. The failure count threshold check is a verification operation that compares the total number of received failed elements with a preset acceptable threshold. This is used to eliminate the risk of an excessively high failure rate due to abnormalities in the hash mapping process. The preset acceptable threshold is a pre-agreed upper limit for the failure count, determined according to the set... The scale and theoretical failure rate setting of the hash algorithm are typically set to 0.5% of the total number of elements in the set. For example, when the set size is 1 million, the preset acceptable threshold can be set to 5000. The failure count compliance judgment is the output conclusion after checking the failure count threshold, which is divided into compliant and non-compliant states. It is used to characterize whether the failure scale of the hash mapping is within the theoretically reasonable range. The second participant confirmation audit is the second participant's comprehensive judgment operation on whether the audit passes based on the two verification results of the mapping correctness and the failure count. It is used to control the overall legality of cross-border received data packets. The integrity audit pass confirmation is the audit conclusion identifier generated after both verifications pass. It is a prerequisite for subsequent execution of privacy set intersection.

[0110] Exact value matching retrieval is an intersection method based on the output values ​​of a pseudo-random function. Matching is performed on both the main hash table and the list of failed elements, accurately identifying shared user identifiers without revealing non-intersecting elements. The complete privacy set intersection is the shared user set obtained by deduplicating and merging the user identifiers that successfully matched the two paths. It includes anonymized identifiers corresponding to all users jointly held by both parties, exhibiting zero false positives and zero false negatives. Binding storage and local attribute association involves associating the intersection result with task identifiers and associating user business attributes locally. This adds compliance source tags to the intersection result, achieving alignment and integration of business data. The cross-border user data alignment result is the collective term for the intersection user set with compliance source tags and the business view after local association by both parties. It includes intersection user identifiers with task identifiers and auditable user panorama data. Its use is strictly limited to the business purposes stated in the compliance token declaration, and a full-process operation log is retained.

[0111] Specifically, such as Figure 5 As shown, the second participant first performs integrity audit verification on the received audit verification data packet, and obtains confirmation that the integrity audit has passed; firstly, the validity of the set polynomial commitment format is verified: the second participant uses the publicly available KZG common reference string to check the set polynomial commitment. Is it an elliptic curve group? The system extracts valid elements, excluding commitment values ​​with abnormal formats or those that have been tampered with; then, it performs zero-knowledge proof verification: the second participant makes a commitment in the form of a set of polynomials. As public input, call the pre-stored verification key. Run a non-interactive zero-knowledge proof verification algorithm to prove the integrity of the mapping. The verification is performed. If it proves valid, the mapping correctness verification result is passed, and the encrypted hash table can be confirmed. List of failed elements All by The corresponding valid set is generated according to established rules, with no missing, altered, or additional elements. If proven invalid, the mapping correctness verification result is a failure, and the second participant immediately terminates the protocol and records the exception. Further, a failure count threshold check is performed: the second participant checks the list of failed elements... The failure count was obtained from the statistics. This is compared with the pre-agreed acceptable threshold agreed upon by both parties. If a comparison is made, If the failure count compliance judgment is deemed compliant, it indicates that the failure rate is within the theoretically reasonable range; if If the mapping process fails, it is deemed non-compliant and considered abnormal. Then, the audit results are comprehensively confirmed: if and only if the mapping correctness verification result is passed and the failure count compliance judgment is compliant, the second participant generates a completeness audit confirmation and is allowed to enter the subsequent intersection stage; if any one of the verifications fails, the audit is deemed to have failed and the task is terminated.

[0112] Then, after obtaining confirmation of integrity auditing, the second participant, based on its own pseudo-random function output value, retrieves the intersection of the complete privacy set through dual-path exact value matching; first, the intersection of the main hash tables is obtained: the second participant, based on its own set of anonymized identifiers... Each element in Using a locally held, one-time, unintentional pseudo-random function key Calculate the output value of the corresponding pseudo-random function. Then use three pseudo-random hash functions that are exactly the same as those used by the first participant. Calculate the positions of the three candidate buckets corresponding to the output value. , , ; sequentially query the encrypted hash table The values ​​stored in these three candidate buckets are such that if the value stored in any one of the buckets is the same as the value stored in the other bucket, then the value stored in the other bucket is the same as the value stored in the other bucket. If they are exactly equal, the user corresponding to that element is determined to be a user shared by both parties, and it is added to the intersection set of the main hash tables. Furthermore, the failure list is supplemented by intersection: the second participant iterates through all of its own pseudo-random function output values. Compare each output value with the list of failed elements. All record values ​​are traversed one by one for precise comparison. If an equal value is found, the user corresponding to that element is determined to be a user shared by both parties, and the user is added to the failure list to supplement the intersection set. This step covers elements that failed to be stored in the main hash table due to Cuckoo hash collisions, fundamentally eliminating false negatives in the intersection results; then, a complete intersection set union is performed: the second participant performs a set union operation on the intersection set of the main hash table and the intersection set of the failed list, obtaining the complete privacy set intersection. Because precise equivalence matching is used throughout the process and covers all elements of the set, the final intersection result has the characteristics of zero false positives and zero false negatives.

[0113] Finally, the second participant completes the compliant binding of the intersection results, and both parties perform attribute association locally to obtain the cross-border user data alignment results; first, the task identifier binding and storage are performed: the second participant will perform the intersection of the complete privacy set. Task identifier bound to this task The process involves associating and storing data, adding compliance source tags to each intersection element to form a set of intersection user identifiers with compliance markings. This ensures that any subsequent use can be traced back to the corresponding compliance token and business purpose. Then, local business attribute association is performed: the first and second participants each map their local set of intersection user identifiers with compliance source tags to their own user profiles, transaction records, behavioral tags, and other business attribute data, generating an aligned user panorama view from their respective perspectives. Furthermore, usage scope control and audit retention are implemented: both parties strictly limit the use of the aligned user panorama view to the business purpose declared in the compliance token, prohibiting out-of-scope use and secondary dissemination. Simultaneously, a full-process operation audit log is retained, recording information such as task identifier, operating entity, operation time, and data usage scope, ultimately forming an auditable and traceable cross-border user data alignment result. The acceptable threshold ratio and number of matching paths preset in this embodiment are merely examples; those skilled in the art can set them according to the actual set size and business needs. This embodiment does not impose any limitations on these parameters.

[0114] This embodiment employs a dual-dimensional audit verification mechanism combining zero-knowledge proof verification and failure rate control to ensure both the integrity and legality of cross-border received data packets. This guarantees that transmitted data fully corresponds to the promised legal set and is free from abnormal tampering, enhancing the audit rigor and risk control capabilities of cross-border data interaction. A dual-path precise intersection mechanism, combining rapid matching of the main hash table with supplementary comparison of the failure list, achieves precise intersection calculations with zero false positives and zero false negatives. This retains the efficient query advantages of Cuckoo hashing while completely compensating for the result loss caused by the inherent failure rate of hashing, improving the accuracy and reliability of privacy set intersection results. A compliance traceability mechanism with end-to-end task identifier binding achieves deep association between intersection results and compliance approval documents, ensuring full traceability and auditability of data usage and enhancing the compliance control capabilities of the cross-border data alignment process. A result output mechanism based on localized attribute association and usage scope constraints achieves panoramic alignment of user data without the original data leaving the domain. This satisfies both business alignment needs and data localization compliance requirements, improving the integrity assurance, alignment accuracy, and compliance traceability of the cross-border data alignment method during the result audit stage.

[0115] Example 2:

[0116] like Figure 6 As shown, this embodiment provides a cross-border user data alignment system based on privacy set intersection, including:

[0117] Security Infrastructure Module: Based on long-term identity key pairs, one-time session security parameters and bound task identifiers are obtained through out-of-band exchange, elliptic curve key exchange, and hierarchical key derivation.

[0118] Data commitment module: Based on one-time session security parameters and the user's original identifier, it obtains an anonymized identifier set, set multinomial commitment, and proof verification key through standardized hash processing and a multinomial commitment scheme;

[0119] Mapping proof module: Based on the set of anonymized identifiers and set multinomial commitments, it generates audit verification data packets through the inadvertent transmission extension protocol, Cuckoo hash mapping and zero-knowledge proof;

[0120] Audit Intersection Module: Based on the audit verification data packet and the pseudo-random function output value held by the second participant, the cross-border user data alignment result is obtained through zero-knowledge proof verification, exact value matching intersection, and task identifier binding.

[0121] The security foundation module, data commitment module, and mapping proof module are all deployed on the domestic server of the first participant, while the security foundation module and audit intersection module are deployed on the overseas server of the second participant. The domestic and overseas servers establish an end-to-end secure communication connection through a cross-border encrypted channel. The servers receive raw data transmitted from the acquisition device and perform cryptographic calculations, compliance verification, and business alignment processing. The security foundation module, in collaboration between the domestic and overseas servers, completes the construction of trust anchors, compliance access verification, and session key derivation: During the initialization phase, it generates and out-of-band interacts with long-term identity key pairs between the two parties, constructing a bidirectional trust anchor; during the task initiation phase, it applies for and verifies compliance tokens, extracts the bound task identifier, and uses it throughout the entire process; during the session preparation phase, it generates mutually isolated one-time session security parameters for each task through elliptic curve Diffie-Hellman key negotiation and HKDF layered key derivation, providing a unified secure input and compliance binding basis for all subsequent cryptographic calculations. The data commitment module, deployed on a domestic server, receives a one-time hash salt value output by the security foundation module. It performs standardization and salting hashing on the original identifier of the local user, generating an irreversible set of anonymized identifiers. Based on this set, it constructs a set polynomial, calculates a constant-size set polynomial commitment using the KZG common reference string, and pre-defines a mapping constraint circuit to pre-compute the zero-knowledge proof key, providing a commitment foundation and key support for the verifiability of subsequent hash mappings. The mapping proof module, also deployed on a domestic server, uses the anonymized identifier set and proof verification key output by the data commitment module. It collaborates with the overseas security foundation module to execute an unintentional pseudo-random function protocol based on unintentional transmission extension, obtaining the pseudo-random function output value from the first participating party. Subsequently, it executes the Cuckoo hash insertion algorithm to construct an encrypted hash table and a list of failed elements, and calls the pre-computed proof key to generate a zero-knowledge proof of mapping integrity. Finally, the above components are encapsulated into an audit verification data packet, sent to the overseas server via a cross-border encrypted channel. The transmitted content only contains pseudo-random values ​​and cryptographic proofs, without carrying any original information that can reconstruct the identity. The audit intersection module is deployed on an overseas server. After receiving the audit verification data packet, it first uses a set multinomial commitment as public input and combines it with the verification key to complete the verification of the mapping integrity proof. At the same time, it checks the failure count threshold to confirm that there are no abnormalities in the hash mapping process. After the double verification is passed, it enters the intersection stage. Then, based on the pseudo-random function output value of the second participant side calculated locally, it performs exact equal-value matching on the encrypted hash table and the list of failed elements respectively, and merges them to obtain the intersection of the complete privacy set with zero false positives and zero false negatives. Finally, the intersection result is associated and bound with the task identifier and associated with local business attribute data to form an auditable and traceable cross-border user data alignment result.

[0122] In summary, this invention, through the deep integration of cryptographic privacy computing technology and compliance management mechanisms, constructs a secure, auditable, and traceable cross-border user data alignment system across the entire chain. On the one hand, it achieves accurate user matching without the original data leaving the domain, without disclosing the identity information and business data of non-intersecting users throughout the process, thus possessing strong privacy protection capabilities. On the other hand, it establishes an integrity verification mechanism for cross-border data transmission through multinomial commitments and zero-knowledge proofs, and achieves full-chain traceability for compliance by combining full-process task identifier binding, effectively adapting to the regulatory requirements for cross-border data interaction. At the same time, it adopts an efficient architecture combining unintentional transmission extension and Cuckoo hashing, realizing task-level isolation and non-interactive autonomous updating of security parameters, complete verification of the integrity of the mapping process and complete elimination of silent data discarding, cryptographic auditability of accurate intersection results, and full lifecycle compliance traceability of cross-border user data alignment results. Under the premise of meeting cross-border data compliance requirements, it improves the secure autonomous operation and maintenance capabilities, data alignment accuracy, compliance auditability, and long-term operational resilience of the privacy set intersection scheme in a trustless environment.

[0123] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A cross-border user data alignment method based on intersection of privacy sets, characterized in that, include: Based on long-term identity key pairs, one-time session security parameters and bound task identifiers are obtained through out-of-band exchange, elliptic curve key exchange, and hierarchical key derivation. Based on the one-time session security parameters and the user's original identifier, an anonymized identifier set, a set of polynomial commitments, and a proof verification key are obtained through standardized hash processing and a multinomial commitment scheme. Based on the set of anonymous identifiers and set multinomial commitments, audit verification data packets are generated through the inadvertent transmission extension protocol, Cuckoo hash mapping and zero-knowledge proofs. Based on the audit verification data packet and the pseudo-random function output value held by the second participant, the cross-border user data alignment result is obtained through zero-knowledge proof verification, exact value matching intersection, and task identifier binding.

2. The cross-border user data alignment method based on privacy set intersection as described in claim 1, characterized in that, The method for obtaining the one-time session security parameters and the bound task identifier includes: Based on long-term identity key pairs, a two-way trust anchor is obtained by exchanging public keys through an out-of-security channel. Based on the digital signature of the compliance regulator, a compliance token and a bound task identifier are obtained through task token application and verification; Based on the bidirectional trust anchor and task identifier, one-time session security parameters are obtained through elliptic curve key exchange and hierarchical key derivation.

3. The cross-border user data alignment method based on privacy set intersection as described in claim 2, characterized in that, Based on the aforementioned bidirectional trust anchor and task identifier, one-time session security parameters are obtained through elliptic curve key exchange and hierarchical key derivation, including: Based on the long-term private key of the first participant and the long-term public key of the second participant in the two-way trust anchor, the basic shared secret is obtained through elliptic curve key exchange. Based on the aforementioned shared secret and task identifier, a one-time hash salt value and an unintentional pseudo-random function key seed are obtained by extracting and expanding the key derivation algorithm. Based on the unintentional pseudo-random function key seed, the second participant independently derives the one-time unintentional pseudo-random function key held by the second participant through a pseudo-random generator.

4. The cross-border user data alignment method based on privacy set intersection as described in claim 1, characterized in that, The method for obtaining the anonymized identifier set, set polynomial commitment, and proof verification key includes: Based on the one-time session security parameters and the user's original identifier, an anonymized identifier set is obtained through standardization rules and cryptographic hash functions; Based on the anonymized identifier set of the first participant, a set of polynomial commitments and proof verification keys are obtained through polynomial construction and a concise commitment scheme.

5. The cross-border user data alignment method based on privacy set intersection as described in claim 4, characterized in that, Based on the anonymized identifier set of the first participant, a set of polynomial commitments and proof verification keys are obtained through polynomial construction and a concise commitment scheme, including: Based on the set of anonymous identifiers of the first participant, a set polynomial is constructed by multiplying each of its elements as the roots of a polynomial. Based on the set polynomial and the KZG common reference string, the set polynomial commitment is obtained through exponential operations on the elliptic curve group. Based on the set of polynomial commitments, and combined with the private inputs and constraints required by the mapping circuit, a proof verification key containing a proof key and a verification key is pre-computed through a non-interactive zero-knowledge proof system.

6. The cross-border user data alignment method based on privacy set intersection as described in claim 1, characterized in that, The method for obtaining the audit verification data packet includes: Based on the anonymized identifier set of the first participant and the one-time session security parameters of the second participant, the pseudo-random function output values ​​held by each party are obtained through the unintentional transmission extension protocol. Based on the pseudo-random function output value, set polynomial commitment, and proof verification key held by the first participant, an encrypted hash table, a list of failed elements, and a proof of mapping integrity are generated through Cuckoo hash mapping and zero-knowledge proof. Based on encrypted hash tables, lists of failed elements, mapping integrity proofs, and set polynomial commitments, audit verification data packets received by the second participant are transmitted through cross-border encrypted channels.

7. The cross-border user data alignment method based on privacy set intersection as described in claim 6, characterized in that, Based on the pseudo-random function output value, set polynomial commitment, and proof verification key held by the first participant, an encrypted hash table, a list of failed elements, and a proof of mapping integrity are generated through Cuckoo hash mapping and zero-knowledge proof, including: Based on the pseudo-random function output value held by the first participant, the candidate bucket position is calculated by the pseudo-random hash function and the Cuckoo hash insertion algorithm is executed to obtain the encrypted hash table and the list of failed elements. Based on set polynomial commitments, cryptographic hash tables, and lists of failed elements, the circuit satisfiability proof is generated by expressing the entire Cuckoo hash mapping process as constraints of a zero-knowledge satisfiability circuit. The generation input and proof verification key based on circuit satisfaction proof are used to obtain the mapping integrity proof through a non-interactive zero-knowledge proof generation algorithm.

8. The cross-border user data alignment method based on privacy set intersection as described in claim 1, characterized in that, The method for obtaining the cross-border user data alignment results includes: Based on the audit verification data packet received by the second participant, the integrity audit is confirmed through zero-knowledge proof verification and failure count threshold check. Based on integrity auditing, the intersection of the complete privacy set is obtained by verifying the pseudo-random function output value held by the second participant, the encrypted hash table, and the list of failed elements, and by searching through exact value matching. Based on the intersection of complete privacy sets and the bound task identifiers, cross-border user data alignment results are obtained by binding storage and associating with local attributes.

9. The cross-border user data alignment method based on privacy set intersection as described in claim 8, characterized in that, Based on the audit verification data packet received by the second participant, integrity audit pass confirmation is obtained through zero-knowledge proof verification and failure count threshold check, including: Based on the audit verification data packet received by the second participant, and with set multinomial commitment as public input, the mapping correctness verification result is obtained by running a zero-knowledge proof verification algorithm; Based on the list of failed elements in the audit verification data packet, the failure count compliance judgment is obtained by comparing it with a preset acceptable threshold; Based on the fact that both the failure count compliance judgment and the mapping correctness verification results were passed, the integrity audit was confirmed as passed by the second participating party.

10. A cross-border user data alignment system based on privacy set intersection, used to implement the cross-border user data alignment method based on privacy set intersection as described in any one of claims 1-9, characterized in that, The system includes: The security infrastructure module, based on long-term identity key pairs, obtains one-time session security parameters and bound task identifiers through out-of-band exchange, elliptic curve key exchange, and hierarchical key derivation. The data commitment module, based on the one-time session security parameters and the user's original identifier, obtains an anonymized identifier set, a set of polynomial commitments, and a proof verification key through standardized hash processing and a polynomial commitment scheme; The mapping proof module, based on the set of anonymous identifiers and set multinomial commitments, generates audit verification data packets through the inadvertent transmission extension protocol, Cuckoo hash mapping, and zero-knowledge proofs. The audit intersection module, based on the audit verification data packet and the pseudo-random function output value held by the second participant, obtains the cross-border user data alignment result through zero-knowledge proof verification, exact value matching intersection, and task identifier binding.

Images