Privacy protection data sharing method and system based on cloud platform

Abstract

The application discloses a privacy protection data sharing method and system based on a cloud platform and belongs to the technical field of privacy data processing. In view of the problem that the prior art cannot simultaneously realize preprocessing state cross-session reuse, intersection member relationship hiding and non-redundant security output in the scene that a same large-scale database needs to serve multiple independent sessions under unbalanced data set scale, the application establishes a cross-session reusable basic shared state by performing cloud replacement on large-scale features through a cloud platform, independently generates a lightweight session seed and a seed correction amount refresh share for each session, and only outputs secret shares of real intersection records, so that each session does not need to repeatedly process a complete database, the computation amount of each session is only related to the intersection scale, and non-redundant privacy protection data sharing is completed under the premise of protecting original data and intersection member relationship.

Description

Technical Field

[0001] This invention relates to the field of privacy data processing technology, and in particular to a privacy-preserving data sharing method and system based on a cloud platform. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In practical applications of vertical privacy-preserving machine learning, taking joint modeling between credit data service agencies and multiple banks as an example, credit agencies hold massive amounts of credit feature data of users, while each bank only holds a small amount of identity information and default labels of loan applicants. Both parties need to complete the matching of overlapping users and feature-label alignment without disclosing the original data.

[0004] However, existing methods for finding intersections based on privacy sets have significant drawbacks in terms of privacy protection: some solutions directly output intersection member identifiers or local intersection locations to the data holders, allowing participants to know which users in each other's databases belong to the intersection. This intersection membership relationship itself constitutes a privacy leak in sensitive scenarios such as finance and healthcare (e.g., exposing users' credit application records or medical treatment behavior); another type of solution attempts to hide intersection information by adding obfuscated data or generating redundant shares to non-intersection records, but this increases the sample size and communication overhead for subsequent model training, and the intersection location information implicit in the redundant data can still be recovered by malicious participants through differential analysis or output distribution inference; in addition, existing protocols need to re-perform a secret-state retrieval or polynomial operation on the complete database of the credit reporting agency in each new business session (e.g., initiated by different banks or a new batch initiated by the same bank), which not only brings high computational costs, but also increases the risk of privacy inference attacks due to repeated exposure of query patterns.

[0005] Therefore, in typical scenarios where credit reporting agencies and multiple banks jointly model data with an imbalanced dataset and the same large-scale database needs to serve multiple independent sessions, existing technologies still struggle to simultaneously hide the intersection membership relationships and reuse the preprocessed state across sessions. This results in the need to repeatedly process the entire database for each session, creating an efficiency bottleneck due to the repeated transmission and computation of high-dimensional features. Furthermore, because the output results implicitly contain intersection location information or query pattern associations from multiple sessions, malicious actors can use the differences in outputs from multiple rounds to infer the distribution of intersection members, potentially leading to the mass leakage of sensitive relationships such as user credit records and medical behavior. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a privacy-preserving data sharing method and system based on a cloud platform. By establishing a basic shared state that can be reused across sessions through a single cloud preprocessing step, each session can be independently and lightweightly refreshed. While hiding the intersection membership relationship, it outputs a non-redundant secret share, enabling both parties to complete secure data sharing and joint modeling without disclosing the original data and intersection location information.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solution: In a first aspect, the present invention provides a privacy-preserving data sharing method based on a cloud platform, comprising: Receive the stable blinding identifier and feature ciphertext from the first data holder, and the candidate blinding identifier from the second data holder; A basic seed is generated based on the ciphertext features, and the ciphertext features are masked. The masked ciphertext features, the stable blinding identifier, and the basic seed are synchronously replaced in the cloud, and the replaced stable blinding identifier, basic seed, and index structure are saved. The replaced masked ciphertext features are returned to the first data holder to establish a basic shared state. The index structure is queried based on the candidate blinding identifier to obtain matching index pairs and arrange the output order in a unified manner. Based on the matching index, generate a session seed and seed correction amount for the corresponding base seed; The session seed and seed correction amount are sent to the first data holder and the second data holder so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

[0008] Furthermore, the stable blinding identifier is generated by the first data holder based on the data version-level blinding factor and the entity identifier; The first data holder also constructs a Bloom filter based on the stable blinding identifier, which is used by the second data holder to perform candidate filtering on local query identifiers.

[0009] Furthermore, the basic seed corresponds one-to-one with the feature ciphertext, and the mask is a basic mask generated from the basic seed using a seed expansion function; The index structure is a key-value index with a stable blind identifier as the key and a cloud-based replacement index and a basic seed as the values.

[0010] Furthermore, the seed expansion function is an approximately homomorphic pseudo-random generation function; For any two seeds ,satisfy ,in, The error is bounded and .

[0011] Furthermore, the candidate blinding identifiers are obtained by the second data holder through the following methods: The local query identifier is blinded using the session blinding factor to generate a first-level blinding identifier and sent to the first data holder; The first data holder performs a second layer of blinding on the first layer of blinding identifier using a data version-level blinding factor; the ciphertext of the label is randomly masked and re-randomized, and the query tuple is synchronously permuted before being sent to the second data holder; The second data holder uses the inverse of the session blinding factor to deblind the data, and then uses a Bloom filter to perform a member query to filter and obtain candidate blinding identifiers.

[0012] Further, the query of the index structure specifically involves: performing an exact equality comparison between the candidate blinding identifier and the stored stable blinding identifier, and forming a matching index pair only when they are completely equal; The matching index pair includes a cloud-based replacement index and a query replacement index.

[0013] Furthermore, the unified output order is specifically achieved by performing a random permutation on the matching index pair set, so that the permuted cloud replacement index sequence and the query replacement index sequence correspond one-to-one according to the same output position.

[0014] Furthermore, the basic shared state is reused by multiple independent sessions within the same data version, and the session seed and seed correction amount of each session are generated independently, without depending on the output state of the previous session. The session seed is a new seed that is independently sampled for the current session, and the seed correction amount is the difference between the base seed and the session seed.

[0015] Furthermore, the data dimensions of the session seed and seed correction amount are fixed and do not change with the increase of feature dimensions.

[0016] A second aspect of the present invention provides a privacy-preserving data sharing system based on a cloud platform, comprising: The primary data holder generates stable blinded identifiers and feature ciphertext, which are then sent to the cloud platform. The second data holder is used to generate candidate blinding identifiers and send them to the cloud platform; The cloud platform is used to receive the stable blinding identifier and the feature ciphertext, generate a basic seed based on the feature ciphertext and mask the feature ciphertext; perform cloud-synchronized replacement on the masked feature ciphertext, the stable blinding identifier and the basic seed, and save the replaced stable blinding identifier, basic seed and index structure; and return the replaced masked feature ciphertext to the first data holder to establish a basic shared state. The cloud platform is also used to receive the candidate blinding identifier, query the index structure based on the candidate blinding identifier, obtain matching index pairs and arrange the output order in a unified manner; generate session seeds and seed correction amounts according to the basic seeds corresponding to the matching index pairs and send them to the first data holder and the second data holder, so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

[0017] Compared with the prior art, the beneficial effects of the present invention are: Taking joint modeling between credit reporting agencies and multiple banks as an example, this invention utilizes a mechanism of one-time preprocessing and multi-session reuse. This allows credit reporting agencies to perform only one high-overhead cloud preprocessing operation on a massive credit feature database. Subsequent independent sessions initiated by any institution, such as Bank A or Bank B, can directly reuse this basic state. Each session generates lightweight updates only for a small number of overlapping users. During this process, both parties only obtain their respective secret shares, protecting the original data and the relationships between overlapping members from leakage. It also reduces the computational load of each session from being related to the scale of the massive database to being related only to the scale of a small number of overlapping users. Furthermore, it avoids redundant data from non-overlapping areas entering subsequent modeling, improving the efficiency and security of privacy-preserving data sharing in multi-institution, multi-batch scenarios. This invention is applicable to vertical privacy-preserving joint modeling scenarios where large-scale data holders, such as credit reporting agencies and multiple banks, medical data service centers and multiple insurance institutions, and internet platforms and multiple financial institutions, need to continuously serve multiple small-scale data holders and their multiple business batches within the same data version cycle. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 This is a flowchart of the method according to Embodiment 1 of the present invention; Figure 2 This is a schematic diagram illustrating the interaction between a large-scale data holder, a cloud platform, and a small-scale data holder in the current session, as described in this invention. Detailed Implementation

[0020] The following detailed description is exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0021] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0022] In this embodiment of the invention, the data collection and processing strictly adhere to the requirements of relevant laws and regulations, obtaining informed consent or separate consent from the data subject, and conducting subsequent data use and processing within the scope authorized by laws and regulations and the data subject. All data acquisition in this embodiment is based on compliance with laws and regulations and user consent, representing the lawful application of the data.

[0023] Example 1 Taking joint modeling between credit reporting agencies and multiple banks as an example, existing technologies have the following key shortcomings in handling secure data alignment before joint modeling: First, in terms of protecting the relationship between members of the intersection, existing privacy set intersection methods output the intersection identifier or local intersection location to the participants, enabling them to know which users in the other party's database belong to the intersection, directly exposing sensitive information such as the user's credit record or business relationship with the institution; Second, existing methods cannot achieve cross-session reuse of preprocessed states. Whenever Bank A initiates a new business batch or Bank B initiates an independent session, it is necessary to re-perform a complete encrypted retrieval, polynomial operations, and other complex operations on the massive credit feature database of the credit reporting agency. This not only brings high computational and communication costs, but also increases the risk of privacy inference attacks due to the repeated exposure of query patterns.

[0024] To address the aforementioned issues, this invention employs a preprocessing and multi-session reuse architecture. Credit reporting agencies and cloud platforms perform a cloud-based replacement and secret sharing preprocessing on the current data version, establishing a basic shared state that can be reused across sessions. Subsequent independent sessions initiated by each bank generate only lightweight session seeds and seed corrections for their respective small number of real overlapping users, eliminating the need to repeatedly process the entire database. Simultaneously, only the secret shares held by each party are output. Throughout the process, neither party can know the relationship between overlapping members or the location of the other party's original data, achieving efficient and non-redundant secure data sharing while protecting the privacy of the overlapping data.

[0025] In a typical embodiment of the present invention, such as Figure 1 As shown, a privacy-preserving data sharing method based on a cloud platform is disclosed, including: Receive the stable blinding identifier and feature ciphertext from the first data holder, and the candidate blinding identifier from the second data holder; A basic seed is generated based on the ciphertext features, and the ciphertext features are masked. The masked ciphertext features, the stable blinding identifier, and the basic seed are synchronously replaced in the cloud, and the replaced stable blinding identifier, basic seed, and index structure are saved. The replaced masked ciphertext features are returned to the first data holder to establish a basic shared state. The index structure is queried based on the candidate blinding identifier to obtain matching index pairs and arrange the output order in a unified manner. Based on the matching index, generate a session seed and seed correction amount for the corresponding base seed; The session seed and seed correction amount are sent to the first data holder and the second data holder so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

[0026] This invention enables the establishment of a reusable basic shared state through a single preprocessing step, allowing any number of independent sessions to complete the secret sharing of intersection data in a lightweight, non-redundant, and error-free manner. It amortizes high-overhead operations from the session level to the version level, while ensuring that the entity plaintext and intersection location information are not leaked throughout the process.

[0027] The following detailed description of the above-mentioned cloud platform-based privacy-preserving data sharing method, with reference to specific implementation methods, is provided below.

[0028] This invention is applicable to scenarios where a large-scale data service organization needs to provide privacy-protected data collaboration services to multiple small-scale business organizations within the same data version cycle.

[0029] Taking credit data service agencies as an example, these agencies are large-scale data holders. The system maintains a long-term database containing numerous user entity identifiers and high-dimensional credit features. These features include basic indicators and derived statistics categorized as account status, credit limit, borrowing behavior, repayment behavior, delinquency risk, debt level, and credit inquiries. This credit feature database can form a relatively stable data version on a daily, weekly, monthly, or other periodic basis. (Cloud platform) and Perform a data version-level basic shared preprocessing for this data version.

[0030] Small-scale data holders such as Bank A, Bank B, and credit platform C possess only a limited amount of entity identifiers and tag data related to their own businesses. They initiate independent data collaboration sessions for different business batches, such as loan applicants, credit card customers, or credit grantees. These small institutions do not share raw data or session states with each other, but they can all reuse the basic shared state pre-established by the credit data service agency and the cloud platform for the same data version. This achieves a highly efficient, privacy-preserving data collaboration mechanism that allows for one-time preprocessing and multiple session reuse.

[0031] For example, during the validity period of this data version, Bank A can initiate the first data collaboration session for recent loan applicants and their default tags; Bank B can initiate a second independent session for credit card customers and their repayment tags; credit platform C can initiate a third session for its local credit customers; and Bank A can also initiate subsequent sessions after new business batches arrive. In each of these sessions, the small-scale data holders each hold their own entity identifier, task-related tags, session keys, and random numbers. Different institutions do not need to share original data or session states. The only data shared by each institution is... and A stable blinded identifier, Bloom filter, base seed, precise index structure, and basic feature sharing status are established for the same version of the credit feature database. Therefore, credit data service agencies do not need to re-perform feature encryption, cloud secret replacement, and basic secret sharing on the complete credit feature database for each bank (Bank A), bank B, credit platform C, or subsequent business batches of bank A. Each small-scale institution also does not need to process all the identifier materials proportional to the size of the complete credit database, but only its local records and candidate records filtered by the Bloom filter.

[0032] The cloud platform independently performs exact matching on the candidate blinding identifiers for each session, and generates new session seeds and seed corrections only for the true intersection of those sessions. Ultimately, The smaller data holders in the current session obtain secret shares of in-order features and secret shares of labels corresponding to the customers whose data intersects with the actual data in this session. Each institution can use its obtained shares for training its own secure logistic regression, secure gradient boosting tree, or other privacy-preserving models, without obtaining the labels, session outputs, or business records of other smaller institutions. This multi-institution, multi-batch service model allows the high-overhead data version-level preprocessing to be amortized by all subsequent independent sessions within a data version cycle. It is particularly suitable for scenarios such as credit reporting services, medical data services, insurance risk analysis, and advertising conversion modeling where the large-scale feature database is relatively stable and multiple smaller business institutions or business batches continuously arrive.

[0033] This invention uses an additive homomorphic encryption scheme: ,in, These are the key generation algorithm, encryption algorithm, and decryption algorithm, respectively; for: Define the homomorphic subtraction between ciphertext and plaintext: , For public key, , and These are plaintext, ciphertext, and plaintext mask, respectively. Represents the homomorphic subtraction between ciphertext and plaintext; defines ciphertext rerandomization: ,in, The new random number used for rerandomization This is a ciphertext re-randomization algorithm; For public keys; It is encrypted; This is a homomorphic addition of ciphertext; To use random numbers The generated plaintext ciphertext; high-dimensional features can be encrypted using a homomorphic encryption scheme that supports plaintext-ciphertext addition and vector batch processing. A high-dimensional feature vector can be packaged into one or more homomorphic ciphertexts; when multiple ciphertexts are used, the multiple ciphertexts are used as ciphertext blocks of the same feature record for synchronous arrangement and synchronous retrieval. Tags can be encrypted using an additive homomorphic encryption scheme.

[0034] This implementation adopts a semi-honest security model, in which each participant strictly follows the protocol specifications to perform calculations, but may attempt to infer the private data of other participants based on intermediate messages obtained during the protocol execution process; there is no collusion between the cloud platform and any data holder, and the communication channels between all participants have confidentiality protection and integrity verification mechanisms.

[0035] like Figure 2 As shown, this invention is demonstrated in large-scale data holders. cloud platform With the current session's small-scale data holder The main processes and interactions between them are completed through steps S1 to S10, which achieve secure data alignment and secret sharing of intersection data. Specifically, steps S1 to S3 mainly establish the basic shared state bound to the large-scale database version; steps S4 to S7 complete blind querying, candidate filtering, and precise entity matching for the current session; steps S8 to S9 refresh only the true intersection records and generate the same-order features and tag secret shares; step S10 is used to support the reuse of subsequent independent sessions and data version updates.

[0036] Within a large-scale database version, large-scale data holders Heyun Platform Keep it fixed. The current small-scale data holder in a data collaboration session is denoted as... For any two sessions and , and It can correspond to different business batches of the same actual organization, or it can correspond to different actual organizations. Holding large-scale data sets ,in, For entity identification, For the corresponding high-dimensional feature vector, This represents the dimension of the feature vector. Small-scale data holders in each session Holding a small-scale dataset ,in, For entity identification, For the corresponding label vector, This represents the label dimension in binary classification or single-objective regression tasks. For ease of description and without loss of generality, the following will be referred to as The technical solution will be explained using an example; The relevant operations can be extended accordingly for each component of the label vector. Encode the modulus for features and labels, and share the modulus for addition secrets. The dataset size typically satisfies: ,in, For large-scale datasets, The size of the small dataset for the current session.

[0037] Step S1: Initialization. By setting unified public parameters and seed expansion functions, different participants can collaborate on computation within the same security framework, providing support for all subsequent cryptographic operations and cross-session reuse.

[0038] In this embodiment, the system first determines the security parameters. Determine the common parameters; specifically, choose a prime number as the order. Cyclic group Define hash to group mapping This is used to map entity identifiers to group elements; an additive homomorphic encryption algorithm is selected. It is used to perform ciphertext field operations on feature data and tag data; and to set the encoding and secret sharing modulus. Seed Modulus and seed dimension And define the seed expansion function. This is used to expand the seed into a mask vector of the same length as the feature; it also configures the bit array length, number of hash functions, and target false positive rate of the Bloom filter, and stipulates the entity identifier normalization rules, feature fixed-point encoding rules, and label encoding rules. (Large-scale data holders) Generate data version identifiers for the currently relatively stable large-scale high-dimensional feature database. Within the same data version, The entity identifier set and high-dimensional features remain unchanged, thus enabling the data version-level preprocessing results to be reused by multiple subsequent sessions, avoiding redundant processing of the stable database.

[0039] Step S2: Generate stable blinding identifiers and Bloom filters. Stable blinding identifiers are generated using data version-level blinding factors and synchronous random permutations, enabling entity identifiers for large-scale data parties to maintain irreversibility while possessing cross-session stability. Combined with Bloom filters, local lightweight candidate screening is achieved for small-scale parties.

[0040] Large-scale data holders establish Bloom filters for stable blinded identifier sets: Let the number of stable blinding markers be... The target false alarm rate is The length of the Bloom filter bit array is: The number of hash functions is: Bloom filters are used only to filter candidate queries, not to determine the final intersection. All false positive candidates are verified by the cloud platform using a precise blinded identifier index.

[0041] In this embodiment, the stable blinding identifier is generated by the first data holder based on the data version-level blinding factor and entity identifier: large-scale data holder Randomly select data version-level blinding factor and generate local random permutations. ,in, To obtain from the symmetric group A uniformly randomly selected permutation , For the set The symmetry group formed by all permutations above; according to Perform synchronous random permutations on entity identifiers and high-dimensional features, renumber them according to the permutation order, and calculate stable blinding identifiers for each record. , express Is it using a hash function? Entity identification Map to elements of the group, and then sum Perform scalar multiplication, where, Represents the cyclic group Upper group elements scalar multiplication, Indicates entity identifier; The stable blinding identifier sequence was calculated. .

[0042] First Data Holder Furthermore, a Bloom filter was constructed based on the stable set of blinded identifiers. This Bloom filter is associated with the data version identifier of current large-scale databases. Binding; each small-scale data holder participating in subsequent sessions can obtain and cache the Bloom filter corresponding to the data version. If the data version remains unchanged, different business batches within the same organization or independent sessions (second data holders) within different organizations can use this Bloom filter to filter candidates for local query identifiers.

[0043] Step S3: Establish a reusable shared state for basic features. Large-scale feature data is secretly shared between the cloud platform and the large-scale party in the form of basic seeds and basic feature shares. This data can be directly reused in any subsequent session without reprocessing the entire database.

[0044] Step S301: Encrypt high-dimensional features. Specifically, First, generate a characteristic homomorphic encryption key pair: ; Calculate the ciphertext of the features The corresponding stable blinding identifier and feature ciphertext will be used. Send to cloud platform .

[0045] Step S302: Generate a basic seed based on the feature ciphertext and mask the feature ciphertext. Specifically, Independently sample the base seed for each large-scale record. The basic seed corresponds one-to-one with the feature ciphertext, and the mask is generated by using the seed expansion function to generate the basic mask. Homomorphic subtraction and rerandomization are performed in the ciphertext field. ,in, This represents a homomorphic subtraction between ciphertext and plaintext.

[0046] The seed expansion function is an approximately homomorphic pseudo-random generation function. The system selects an integer modulus. Secretly shared module Seed dimension and feature dimensions ,in: The system generates a common matrix based on a common random source: Define the seed expansion function: Among them, the common matrix Scaling factor used to expand a low-dimensional random seed into a high-dimensional vector. Used to complete the process from the seed modulus space To the secret shared modular space The mapping such that the output mask vector satisfies .

[0047] For any two seeds ,satisfy ,in, This represents the quantization error vector introduced by the scaling and integer rounding operations in the seed spread function, and , representing the error vector introduced by scaling and integer rounding, satisfying That is, the absolute value of the error generated by each feature dimension does not exceed 1. Each session directly generates a session seed and a seed correction value from the basic seed, and the bounded error does not accumulate with the number of sessions.

[0048] In specific deployments, parameters can be selected using lattice cryptography security estimation tools based on the target security level, seed dimension, modulus, common matrix dimension, and the number of samples available to the adversary.

[0049] Step S303: Perform cloud-synchronized random permutation on the masked feature ciphertext, stable blinding identifier, and basic seed, and save the permuted stable blinding identifier, basic seed, and index structure. Specifically, Generate cloud-based secret substitution Synchronous random permutation is performed on the stable blinded identifier, masked feature ciphertext, and basic seed. ,in: This is a stable, blinded identifier sequence after cloud-based replacement; The mask feature ciphertext sequence after cloud-based permutation; This is the base seed sequence corresponding to the above-mentioned record positions. For the cloud-permuted [number]th... One record, location This is called a cloud-based replacement index. Simultaneously, a precise index structure is established, using stable blinded identifiers as keys and corresponding cloud-based replacement indexes and basic seeds as values. The precise index structure is used to query the corresponding cloud-based replacement index and basic seed based on the stable blinding identifier; and to save...

[0050] Step S304: Generate basic feature shares. Specifically, the permuted masked feature ciphertext is returned to the first data holder, i.e. The mask feature ciphertext sequence after cloud replacement Send to . Decrypting each message in the order it was received yields... And save the basic feature share sequence according to the cloud replacement index. .

[0051] At this point, the basic feature share sequence Basic seed sequence Stable blinding identifier sequence and Bloom filters Together, these constitute the basic shared state that can be reused across sessions under the current data version. For each cloud-based replacement index... , and Hold separately and ,in, Replace location in the cloud The corresponding base seed; both parties establish a corresponding relationship through cloud-based index replacement.

[0052] The candidate blinding identifier is obtained by the second data holder through steps S4-S6: A first-level blinding identifier is generated by blinding the local query identifier with a session blinding factor and sent to the first data holder. The first data holder performs a second-level blinding on the first-level blinding identifier with a data version-level blinding factor, performs random masking and re-randomization on the label ciphertext, performs synchronous permutation on the query tuple, and then sends it to the second data holder. The second data holder uses the inverse of the session blinding factor to deblind the identifier, and then uses a Bloom filter to perform member queries to filter and obtain candidate blinding identifiers.

[0053] Step S4: Generate a session request. Small-scale parties use independent session blinding factors to blind their local query identifiers, ensuring that their entity identifiers remain private during transmission to large-scale parties. Furthermore, the blinding factors for each session are independent of each other, preventing cross-session association.

[0054] In this embodiment, the first When a session is initiated, the current small-scale data holder First, randomly select the conversation blinding factor. and generate local random permutations. ; according to Perform a synchronous random permutation on the entity identifiers and labels, and renumber them according to the permutation order. Then, Generate tag homomorphic encryption key pairs This is used to encrypt the transmission of tag data. For each record, Calculate the first level of blinding identifier And encrypt the tag to obtain Finally, the first layer of blinding identifier is combined with the ciphertext of the tag. and tag homomorphic encryption public key Send together to Through the above operations, The original entity identifier and tag are transmitted to The process is presented in either blinded or encrypted form. Unable to obtain The original plaintext data.

[0055] Step S5: Perform the second layer of blinding and label masking. Double blinding is achieved by utilizing the commutativity of group scalar multiplication, so that the small-scale side can be directly compared with the stable blinded label of the large-scale side after deblinding. At the same time, the label is transmitted in the form of ciphertext mask, so the large-scale side processes the label but cannot know the plaintext.

[0056] In this embodiment, the first data holder Received After sending the first layer of blinding identifier and the ciphertext of the tag, for each first layer of blinding identifier... First data holder Using data version-level blinding factor Perform a second layer of blinding on the first layer of blinding identifier, and calculate the second layer of blinding identifier. From the commutativity of group scalar multiplication, we can obtain .

[0057] at the same time, Perform random masking and rerandomization on the ciphertext of the tags: sample a random mask independently for each tag. , Subtract the random mask from the ciphertext and perform ciphertext rerandomization to obtain the masked label ciphertext. . Generate query tuples (a query tuple refers to an information unit composed of the second-level blinding identifier, mask label ciphertext, and label random mask under the same query permutation index, used by small-scale data holders to perform candidate screening and subsequent secret share generation) random permutation and the second blinding identifier sequence , mask label ciphertext sequence and label random mask sequence Perform a synchronous random permutation. After the permutation, re-record the data according to the new order. The position after replacement Defined as a query replacement index.

[0058] Save the random mask sequence of the label and will Send to If the current session's small-scale data holder The Bloom filter corresponding to the current data version has been cached in a previous session or during session initialization. In this case, the session only needs to confirm the corresponding data version identifier, and there is no need to obtain it again. If For organizations participating in the current data version for the first time, or whose local cached version is different. If the current data version is inconsistent, the Bloom filter and its parameters corresponding to the current data version should be obtained and cached first.

[0059] Step S6: Blinded Identifier Filtering. Small-scale parties use Bloom filters to reduce candidates locally, sending only a small number of candidate identifiers to the cloud platform. The communication volume is determined by the local query scale and is independent of the large-scale database scale, reducing communication and computing overhead.

[0060] In this embodiment, the second data holder Received The second blinding identifier sequence sent , mask label ciphertext sequence and Bloom filters Then, for each query, replace the index. Second data holder Using conversation blinding factor Inverse element removal of the session blinding factor in the second blinding identifier: Calculate the query identifier after deblinding: ,make and The stable blinding identifiers are located in the same precise discrimination domain.

[0061] Then, Bloom filters are used to perform membership queries to filter and obtain candidate blinded identifiers: Bloom membership queries are performed on each deblinded identifier. Construct candidate set ,in, To query the replacement index, Assign corresponding candidate blinding identifiers and set the candidate set. Send to .

[0062] Bloom filters are used only for candidate reduction; all false positive candidates are eliminated by... Subsequent precise equality comparisons are performed using a precise index structure to exclude such cases.

[0063] Step S7: Perform exact matching. The cloud platform compares candidate identifiers one by one through the exact index structure, completely eliminating false positives from the Bloom filter, and ensuring that the final output contains only true intersection records, with no non-intersection redundancy.

[0064] Received Candidate set to be sent Then, for each candidate blinding identifier , Query exact index structure Candidate blinding identifiers With preserved stable blinding mark Perform an exact equality comparison, forming a matching index pair only if they are completely equal: if they exist Then the cloud index will be replaced. and query replacement index Form matching index pairs This yields the exact matching set. .

[0065] Records that entered the candidate set only due to false positives from the Bloom filter but do not have a stable blinding identifier for complete equality are not added to the exact matching set. Let... The actual intersection size of the current session, i.e. For the first The actual intersection size of each session.

[0066] Subsequently Generate random permutations And perform a random permutation on the set of matching index pairs: This yields a cloud-based permutation index sequence arranged in a uniform output order. and query replacement index sequence The two index sequences are arranged according to the same output position. One-to-one correspondence. For any output position Cloud-based index replacement The referenced feature record and query replacement index The pointed-to tag records belong to the same intersection entity. When the candidate set is empty, the cloud platform directly outputs an empty matching set. When the candidate set is not empty but the exact matching set is empty, let... The cloud platform provides data to two data holders. and Send an empty output message. Both parties output empty feature share sequences and label share sequences. The session ends normally.

[0067] Step S8: Refresh the intersection feature secret share. Session seeds and seed corrections are generated only for intersection records that match exactly. No share update material is generated for non-intersection records, achieving a zero-redundancy session-level lightweight refresh.

[0068] After the exact match is completed, For each output position Based on cloud-based replacement index Obtain the corresponding basic seed Independently sample new session seeds And calculate the seed correction amount: Both have fixed data dimensions, with the seed dimension being [missing information]. , and feature dimension Irrelevant, among which, This indicates the first number returned by the cloud platform. Each alignment result corresponds to the matching data index after cloud replacement; This indicates that the index is generated during the preprocessing stage. The corresponding basic seed generated; Indicates the first In the first collaborative session Each output index corresponds to a new session seed; This represents the adjustment between the base seed and the session seed; all seed operations are performed modulo 1. It takes place in space.

[0069] cloud platform According to the unified output order send and to send The amount of data transmitted does not change. Increase; among which, sent to of Used to select the corresponding basic feature share; Used to select the corresponding random mask for the label; Used to refresh the base feature share to the first feature secret share of the current session, and sent to of Used to select the corresponding mask label ciphertext. Used to generate the second characteristic secret share for the current session. Only for exact matches Each record generates a session seed and seed correction amount, but does not perform session-level feature share refresh on non-intersecting records.

[0070] Step S9: Generate in-order features and label secret shares. Both parties obtain the secret shares of features and labels respectively under a unified output order. The feature shares are combined to restore the bounded error and the label shares are restored to their exact form. The output order is randomly arranged to protect the intersection position information.

[0071] Step S901: Small-scale data holders generate shares.

[0072] Received Sent Then, for each output position , Calculate the second feature share based on the session seed. And replace the index according to the query. From the label share sequence Obtaining ciphertext And decrypt to obtain the second tag share .

[0073] Step S902: Large-scale data holders generate shares.

[0074] Received Sent Then, for each output position , Based on cloud-based replacement index From the basic feature share sequence Obtain the corresponding Calculate the first characteristic share And replace the index based on the query. From the random mask sequence of labels China achieved the first label share .

[0075] Step S903: Output secret shared data.

[0076] and Output in a uniform order and For each output position There exists an error vector. , making ,and The label share satisfies: .because For matching index pairs The entire process was randomized, and the output position was determined. The feature secret share and the label secret share correspond to the same intersection entity; the final output only contains the true intersection records confirmed by exact matching, and does not contain Bloom filter false alarms or other non-intersection redundant records.

[0077] Step S10: Multi-session reuse and data version update. The preprocessing results are reused an unlimited number of times by all subsequent sessions within the same data version. Each session generates parameters independently and does not depend on the output of the previous session. Errors do not accumulate and sessions do not interfere with each other. When the data version changes, it is uniformly invalidated and re-established.

[0078] The basic shared state is reused by multiple independent sessions within the same data version. Each session generates its own session seed and seed correction, which do not depend on the output state of the previous session.

[0079] No. After each session ends, each participant deletes the session-level secret state and intermediate results that are no longer used in the session. The session-level state includes at least: session blinding factor, local permutation of the current small-scale data holder, label homomorphic encryption key pair, label random mask, ciphertext rerandomization random number, query tuple permutation, candidate set, exact match set, match result arrangement, session seed and seed correction amount.

[0080] Assuming the current large-scale database version remains valid. Continue to preserve the data version-level blinding factor, Bloom filter, and basic feature share sequence bound to this data version; Continue to preserve the stable blinded identifier sequence, basic seed sequence, and precise index structure after cloud replacement. The above states constitute a data version-level basic shared state that can be reused by multiple subsequent independent sessions.

[0081] No. The first session can be generated by the second... A single small-scale data holder can initiate a new business batch, or another small-scale data holder can initiate it for its local entity identifier and tag data. The new current small-scale data holder is denoted as... . No need to acquire or inherit the first In each session Any input, session key, random number, intermediate result, or output share.

[0082] Each new session independently generates a session blinding factor, local query permutation, label homomorphic encryption key pair, label random mask, ciphertext rerandomization random number, query tuple permutation, matching result permutation, and session seed. The output order and secret share of different sessions are independent of each other. Each session directly generates its session seed and seed correction amount based on the data version-level base seed, without using the feature share of the previous session as input. Therefore, regardless of whether multiple sessions are initiated by the same small-scale data holder or different small-scale data holders, the bounded error generated by the seed expansion function will not accumulate with the number of sessions.

[0083] when When a large-scale dataset undergoes entity insertion, deletion, entity identifier modification, high-dimensional feature update, or other changes that render the current data version invalid, the system terminates the current data version, regenerates the data version identifier, data version-level blinding factor, Bloom filter, cloud secret permutation, basic seed, precise index structure, and basic feature share, and re-executes steps S2 to S3. Each small-scale data holder participating in subsequent sessions of the new data version should obtain and use the Bloom filter and data version identifier corresponding to the new version.

[0084] As can be seen, this invention has the following technical advantages: First, it supports the reuse of data version-level preprocessing results across sessions. It places the encryption of large-scale high-dimensional features, basic seed masking, ciphertext re-randomization, cloud-based secret permutation, and basic feature share generation in the preprocessing stage. With the large-scale dataset remaining unchanged, multiple subsequent sessions can reuse the basic shared state without reprocessing the entire database in each session. Second, it generates non-redundant, in-order intersection data secret shares. Through the cloud platform, it performs stable blinded identifier precise matching and uniformly randomizes the matching index pairs. The final output contains only true intersection records, which can be directly used as input for subsequent privacy-preserving calculations. Third, it reduces the processing burden on small-scale data holders. Small-scale holders do not need to receive the complete encrypted identifier set from large-scale holders. Instead, they use a reusable Bloom filter for local candidate screening, sending only candidate blinded identifiers to the cloud platform. The online computational load is mainly determined by the local query scale and the false positive candidate scale. Fourth, it supports session-level feature secret share updates. The cloud platform regenerates the session seed and calculates the seed correction in each session. Each session directly generates new feature shares from the basic shared state, without using the output of the previous session as input. Therefore, the bounded error generated by the approximate seed homomorphic expansion will not accumulate with the number of sessions. Fifth, it reduces the risk of exposing the correspondence between entity plaintext and original location. The protocol only uses cloud-based permutation indexes and query permutation indexes to locate records, and does not directly output the other party's entity plaintext identifier or original database location to any participant. Sixth, it reduces the network transmission volume during high-dimensional feature share refresh. The cloud platform transmits a fixed-dimensional session seed and seed correction between itself and the parties, rather than a complete mask vector of the same length as the high-dimensional feature. For low-dimensional feature scenarios, the system can flexibly select seed routing or explicit share routing methods according to the feature dimension, modulus, and serialization format.

[0085] Example 2 In a typical embodiment of the present invention, a cloud-based privacy-preserving data sharing system is provided, comprising: The primary data holder generates stable blinded identifiers and feature ciphertext, which are then sent to the cloud platform. The second data holder is used to generate candidate blinding identifiers and send them to the cloud platform; The cloud platform is used to receive the stable blinding identifier and the feature ciphertext, generate a basic seed based on the feature ciphertext and mask the feature ciphertext; perform cloud-synchronized replacement on the masked feature ciphertext, the stable blinding identifier and the basic seed, and save the replaced stable blinding identifier, basic seed and index structure; and return the replaced masked feature ciphertext to the first data holder to establish a basic shared state. The cloud platform is also used to receive the candidate blinding identifier, query the index structure based on the candidate blinding identifier, obtain matching index pairs and arrange the output order in a unified manner; generate session seeds and seed correction amounts according to the basic seeds corresponding to the matching index pairs and send them to the first data holder and the second data holder, so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

[0086] The steps and methods involved in Example 2 correspond to those in Example 1. For specific implementation details, please refer to the relevant description section of Example 1.

[0087] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0088] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0089] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A privacy-preserving data sharing method based on a cloud platform, characterized in that: include: Receive the stable blinding identifier and feature ciphertext from the first data holder, and the candidate blinding identifier from the second data holder; A basic seed is generated based on the ciphertext features, and the ciphertext features are masked. The masked ciphertext features, the stable blinding identifier, and the basic seed are synchronously replaced in the cloud, and the replaced stable blinding identifier, basic seed, and index structure are saved. The replaced masked ciphertext features are returned to the first data holder to establish a basic shared state. The index structure is queried based on the candidate blinding identifier to obtain matching index pairs and arrange the output order in a unified manner. Based on the matching index, generate a session seed and seed correction amount for the corresponding base seed; The session seed and seed correction amount are sent to the first data holder and the second data holder so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

2. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The stable blinding identifier is generated by the first data holder based on the data version-level blinding factor and the entity identifier; The first data holder also constructs a Bloom filter based on the stable blinding identifier, which is used by the second data holder to perform candidate filtering on local query identifiers.

3. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The basic seed corresponds one-to-one with the feature ciphertext, and the mask is a basic mask generated from the basic seed using a seed expansion function; The index structure is a key-value index with a stable blind identifier as the key and a cloud-based replacement index and a basic seed as the values.

4. The privacy-preserving data sharing method based on a cloud platform as described in claim 3, characterized in that, The seed expansion function is an approximately homomorphic pseudo-random generation function; For any two seeds ,satisfy ,in, The error is bounded and .

5. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, Candidate blinding identifiers are obtained by the second data holder through the following methods: The local query identifier is blinded using the session blinding factor to generate a first-level blinding identifier and sent to the first data holder; The first data holder performs a second layer of blinding on the first layer of blinding identifier using a data version-level blinding factor; the ciphertext of the label is randomly masked and re-randomized, and the query tuple is synchronously permuted before being sent to the second data holder; The second data holder uses the inverse of the session blinding factor to deblind the data, and then uses a Bloom filter to perform a member query to filter and obtain candidate blinding identifiers.

6. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The query of the index structure specifically involves: performing an exact equality comparison between the candidate blinding identifier and the stored stable blinding identifier, and forming a matching index pair only when they are completely equal; The matching index pair includes a cloud-based replacement index and a query replacement index.

7. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The unified output order is specifically achieved by performing a random permutation on the matching index pair set, so that the permuted cloud replacement index sequence and the query replacement index sequence correspond one-to-one according to the same output position.

8. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The basic shared state is reused by multiple independent sessions within the same data version. The session seed and seed correction amount of each session are generated independently and do not depend on the output state of the previous session. The session seed is a new seed that is independently sampled for the current session, and the seed correction amount is the difference between the base seed and the session seed.

9. The privacy-preserving data sharing method based on a cloud platform as described in claim 1, characterized in that, The data dimensions of the session seed and seed correction are fixed and do not change with the increase of feature dimensions.

10. A privacy-preserving data sharing system based on a cloud platform, characterized in that: include: The primary data holder generates stable blinded identifiers and feature ciphertext, which are then sent to the cloud platform. The second data holder is used to generate candidate blinding identifiers and send them to the cloud platform; The cloud platform is used to receive the stable blinding identifier and the feature ciphertext, generate a basic seed based on the feature ciphertext and mask the feature ciphertext; perform cloud-synchronized replacement on the masked feature ciphertext, the stable blinding identifier and the basic seed, and save the replaced stable blinding identifier, basic seed and index structure; and return the replaced masked feature ciphertext to the first data holder to establish a basic shared state. The cloud platform is also used to receive the candidate blinding identifier, query the index structure based on the candidate blinding identifier, obtain matching index pairs and arrange the output order in a unified manner; generate session seeds and seed correction amounts according to the basic seeds corresponding to the matching index pairs and send them to the first data holder and the second data holder, so that both parties can generate feature shares and label shares of the intersection entity in a unified order for privacy-preserving data sharing.

Images