Methods, systems, media, and computer programs for secure computation and communication.

Abstract

Methods and systems for secure computation and communication are provided. The method includes transforming the identification information of a first dataset using a first transformation scheme, and transforming the attributes of the first dataset using a second transformation scheme. The method also includes dispatching the transformed first dataset, receiving a second dataset, transforming the identification information of the received second dataset, dispatching the transformed identification information of the received second dataset, and receiving a set of identification information. The method further includes generating a first intersection of the received set of identification information and the transformed received second dataset, generating a first share based on the first intersection, receiving a second share, and constructing a result based on the first share and the second share.

Description

Technical Field

[0001] [Cross - Reference to Related Applications] This application claims priority to U.S. Application No. 18 / 297,339, filed on April 7, 2023, with the title "SECURE COMPUTATION AND COMMUNICATION", the disclosure of which is hereby incorporated by reference in its entirety.

[0002] The embodiments described herein generally relate to secure and private computing and communication. More specifically, the embodiments described herein relate to secure inner - joins of data from multiple data owners, as well as secure computing and communication.

Background Art

[0003] Inner - joining records of datasets from multiple data owners can be a prerequisite for subsequent operations in many applications, including the collection of aggregated statistics, the training of distributed machine - learning models, etc. For example, if one party owns the feature data or attribute data of elements and another party owns the labels or identification information of these elements, a secure inner - join that does not expose the common part is required before performing distributed training or federated training in a machine - learning application.

[0004] Existing secure matching schemes for computing can achieve secure identity matching without exposing the common part of two parties' datasets or databases, and after the members or user identification information in the datasets are matched, a secure sharing of the two - party data can be generated for subsequent multi - party calculations.

Summary of the Invention

Problems to be Solved by the Invention

[0005] It should be understood that existing schemes have relatively high communication and computational complexity, and that there is a need to design optimized schemes for privacy matching and computation of large amounts of data. The features in the embodiments disclosed herein can help solve the problem of privacy matching of two-party or multi-party data in two-party or multi-party secure computation and generate secure sharing of data relating to the common parts of datasets from two or more parties. The features in the embodiments described herein can provide confidential and secret protocols based on various algorithms, such as computational complexity assumptions (e.g., deterministic Diffie-Hellman assumption) and additive homomorphic encryption algorithms, and can effectively reduce communication and computational complexity compared to existing schemes.

[0006] In a semi-honest security model, it should be understood that all parties honestly adhere to confidential coupling computation and computing protocols, but are attempting to extract more information from the input datasets of other parties. The features in the embodiments described herein can provide security with respect to semi-honest and computationally finite adversaries. [Means for solving the problem]

[0007] In one exemplary embodiment, a method for secure computation and communication is provided. The method includes: transforming the identification information of a first dataset using a first transformation scheme; transforming the attributes of the first dataset using a second transformation scheme; dispatching the transformed first dataset; receiving a second dataset; transforming the identification information of the received second dataset; dispatching the transformed identification information of the received second dataset; receiving a set of identification information; generating a first intersection of the received set of identification information and the transformed received second dataset; generating a first share based on the first intersection; receiving a second share; and constructing a first result based on the first share and the second share.

[0008] In another exemplary embodiment, a secure computation and communication system is provided. The system comprises a memory for storing a first dataset and a processor. The processor transforms the identification information of the first dataset using a first transformation scheme, transforms the attributes of the first dataset using a second transformation scheme, dispatches the transformed first dataset, receives a second dataset, transforms the identification information of the received second dataset, dispatches the transformed identification information of the received second dataset, receives a set of identification information, generates a first intersection of the received set of identification information and the transformed received second dataset, generates a first share based on the first intersection, receives a second share, and constructs a first result based on the first share and the second share.

[0009] In yet another embodiment, a non-temporary computer-readable medium storing computer-executable instructions is provided. When the instructions are executed, one or more processors are caused to perform operations including: converting the identification information of a first dataset; converting the attributes of the first dataset; dispatching the converted first dataset; receiving a second dataset; converting the identification information of the received second dataset; dispatching the converted identification information of the received second dataset; receiving a set of identification information; generating a first intersection of the received set of identification information and the converted received second dataset; generating a first share based on the first intersection; receiving a second share; and constructing a first result based on the first share and the second share. [Brief explanation of the drawing]

[0010] The accompanying drawings illustrate various embodiments of the systems and methods of the Disclosure, and embodiments of various other aspects of the Disclosure. Those skilled in the art will understand that the illustrated element boundaries in the drawings (e.g., boxes, groups of boxes, or other shapes) represent examples of boundaries. In some examples, one element may be designed as multiple elements, or multiple elements may be designed as one element. In some examples, an element shown as an internal component of one element may be realized as an external component of another element, and vice versa. The following description is non-limiting and non-exclusive, with reference to the drawings. Components in the drawings are not necessarily to scale, and the emphasis is on illustrating the principle. Since various changes and modifications may become apparent to those skilled in the art from the following detailed description, embodiments are described only as illustrations in the following detailed description.

[0011] [Figure 1] This is a schematic diagram showing an exemplary secure computation and communication system arranged according to at least some embodiments described herein.

[0012] [Figure 2] This is a flowchart illustrating an exemplary internal coupling process flow for confidential and secure computation and communication according to at least some embodiments described herein.

[0013] [Figure 3] This is a flowchart illustrating an exemplary secret sharing processing flow for confidential and secure computation and communication according to at least some embodiments described herein.

[0014] [Figure 4] This is a schematic diagram illustrating an exemplary packing optimization scheme for confidential and secure computation and communications, according to at least some embodiments described herein.

[0015] [Figure 5A] This figure shows the first portion of a schematic diagram illustrating an example of the processing flow in Figure 2, according to at least some embodiments described herein.

[0016] [Figure 5B] This figure shows a second portion of the schematic diagram illustrating an example of the processing flow in Figure 2, according to at least some embodiments described herein.

[0017] [Figure 5C] This figure shows a third portion of the schematic diagram illustrating an example of the processing flow shown in Figure 3, according to at least some embodiments described herein.

[0018] [Figure 5D] This figure shows a fourth portion of the schematic diagram illustrating an example of the processing flow shown in Figure 3, according to at least some embodiments described herein.

[0019] [Figure 6]It is a schematic configuration diagram of an exemplary computer system applicable to realizing an electronic device arranged according to at least some embodiments described in this specification.

Embodiments for Carrying out the Invention

[0020] In the following detailed description, specific embodiments of the present disclosure will be described herein with reference to the accompanying drawings that form a part of the description. In this description and the drawings, unless otherwise specified in the context, like reference numerals represent elements that can perform the same, similar, or equivalent functions. Further, unless otherwise noted, in the description of each successive drawing, one or more features of the previous drawing may be referred to in order to provide a clearer context and a more substantial description of the current exemplary embodiment. Nevertheless, the exemplary embodiments described in the detailed description, the drawings, and the claims are not intended to be limiting. Other embodiments may be utilized and other changes may be made without departing from the spirit or scope of the subject matter presented herein. It is readily understood that the aspects of the present disclosure generally described herein and shown in the drawings may be arranged, substituted, combined, separated, and designed in a variety of different configurations. All of these are explicitly contemplated herein.

[0021] It should be understood that the disclosed embodiments are merely examples of the disclosure and may be embodied in various forms. To avoid obscuring the present disclosure with unnecessary details, well-known functions or structures will not be described in detail. Therefore, the specific structures and function details disclosed herein should not be construed as limiting, but rather as representative bases for teaching those skilled in the art how to use the present disclosure in substantially any suitable detailed structure for various purposes.

[0022] Furthermore, in this specification, functional blocks may also be described in the form of functional block components and various processing steps. It is understood that such functional blocks can be realized by any number of hardware and / or software components configured to perform a specified function.

[0023] The scope of the disclosure should be determined by the appended claims and their legal equivalents, not by the examples set forth herein. For example, the steps described in the claims of a method may be performed in any order, and are not limited to the order shown in the claims. Furthermore, unless specifically stated herein as “material” or “essential,” there are no elements essential to the implementation of the disclosure.

[0024] As used herein, “dataset” is a technical term and may refer to an organized collection of electronically stored and accessed data. In one embodiment, a dataset may refer to a database, a data table, a portion of a database or data table, etc. It is understood that a dataset corresponds to one or more database tables, where each column of a database table represents a specific variable or field, and each row of a database table corresponds to a specific record in a dataset. A dataset may list the values ​​of each variable and / or the values ​​of each record in the dataset. A dataset may also refer to a collection of related data and the way in which the related data is organized. In exemplary embodiments, each record in a dataset may include one or more predefined or predetermined identifying information (e.g., membership identifying information such as username, email address, telephone number, etc., user identifying information), and / or fields or elements such as one or more attributes, features, or values ​​associated with one or more identifying information. It is understood that any user identifying information and / or user data described herein are authorized, approved, and / or authenticated by the user for use in the embodiments described herein and appropriate legal equivalents understood by those skilled in the art.

[0025] The term "inner join" as used here is a technical term and may refer specifically to an operation or function that involves joining records from datasets when there are matching values ​​in a common field of the datasets. For example, an inner join can be performed on the "Departments" dataset and the "Employees" dataset to determine all employees in each department. It should be understood that the resulting dataset of an inner join operation (i.e., the "common part") may contain mutually relevant information from both datasets. On the other hand, an outer join may result in a dataset that contains information unrelated to the other dataset. A secret inner join refers to an inner join operation of two or more parties' datasets that does not expose data in the common part of the two or more parties' datasets.

[0026] The term "hash" as used here may refer to an operation or function that transforms or converts an input (a key such as a number or string) into an output (another number, another string, etc.). It's important to understand that hashing is a technical term and can be used in cybersecurity applications to access data in short, nearly constant intervals each time it's retrieved.

[0027] As used herein, “federated,” “distributed,” or “collaborative” learning or training are technical terms referring to machine learning techniques that train algorithms across multiple decentralized edge devices or servers that store local data samples without exchanging data samples between these devices or servers. Federated learning or training is in contrast to traditional centralized machine learning techniques where all local datasets are uploaded to a single server, and to more classical distributed approaches which often assume that local data samples are identically distributed. Federated learning or training enables multiple actors to build a common, robust machine learning model without sharing data among the actors, thereby addressing critical issues such as data privacy, data security, data access rights, and access to heterogeneous data.

[0028] The terms "MPC" or "Multi-Party Computation" used here are technical terms and may refer to a field of cryptography aimed at creating schemes for parties to collaboratively compute a function on a shared input while keeping each input private. Unlike traditional cryptographic tasks where encryption guarantees the security and integrity of communications or storage, MPC encryption may protect the privacy of the participants themselves, especially when adversaries are outside the participants' systems (e.g., eavesdroppers on the sender and / or receiver).

[0029] The terms "ECC" or "elliptic curve cryptography" used here are technical terms and may refer to public-key cryptography based on the algebraic structure of elliptic curves over a finite field. ECC is understood to offer equivalent security with smaller keys compared to non-EC cryptography. It is also understood that "EC" or "elliptic curves" can be applied to key agreement, digital signatures, pseudorandom number generators, and / or other tasks. Elliptic curves can be used indirectly for encryption by combining key agreement between parties with symmetric encryption schemes. Elliptic curves can also be used in integer factorization algorithms based on elliptic curves, which are applied to cryptography.

[0030] As used herein, the “Definitive Diffie-Hellman Assumption” or “DDH Assumption” is a technical term referring to a computational complexity assumption about a particular problem involving discrete logarithms in cyclic groups. It should be understood that the DDH assumption may be used as the basis for proving the security of many cryptographic protocols.

[0031] The terms "Elliptic Curve Diffie-Hellman" or "ECDH" used here are technical terms and may refer to a key agreement protocol or corresponding algorithm that enables two or more parties, each possessing an elliptic curve public-key and private-key pair, to establish a shared secret over an unsecured channel. The shared secret can be used directly as a key or to derive another key. This key, or any derived key, can then be used to encrypt or encode subsequent communications using symmetric-key cryptography. Furthermore, ECDH may also refer to a variant of the Diffie-Hellman protocol that uses elliptic curve cryptography.

[0032] As used herein, “homomorphic” encryption is a technical term referring to a form of encryption that allows a user to perform calculations on encrypted data without first decrypting the encrypted data. It should be understood that the resulting homomorphic encryption calculations remain encrypted and, when decrypted, yield the same output as if the calculations had been performed on unencrypted data. It should also be understood that homomorphic encryption can be used for privacy-preserving outsourced storage and computation, potentially allowing data to be encrypted and outsourced to a commercial cloud environment for processing in an encrypted state. Furthermore, it should be understood that additive homomorphic encryption or cryptographic systems may refer to a form of encryption or cryptographic system that can compute the encryption of m1+m2 given only the public key and the encryption of messages m1 and m2. For example, the Paillier cryptosystem, a probabilistic asymmetric algorithm of public-key cryptography, is an additive homomorphic encryption system.

[0033] The terms "secret sharing" or "secret partitioning" used here are technical terms and may refer to an encryption operation or algorithm that generates a secret, divides that secret into multiple shares, distributes those shares among multiple parties, and allows the secret to be reconstructed only when the parties combine their respective shares. Secret sharing may refer to an operation or algorithm that distributes a secret within a group, so that no individual possesses any understandable information about the secret, but allows it to be reconstructed when a sufficient number of individuals combine their "shares." It should also be understood that insecure secret sharing, an attacker may be able to obtain more information from each share, while secure secret sharing is "all or nothing," where "all" may mean the required number of shares.

[0034] As used herein, “shuffle,” “shuffling,” “rearrange,” or “sort” are technical terms referring to an action or algorithm for rearranging and / or randomly rearranging the order of records (elements, rows, etc.) in, for example, arrays, datasets, databases, data tables, etc.

[0035] As used herein, “semi-honest” attacker is a technical term referring to a party that may attempt to corrupt another party but adheres to the established protocol. It should be understood that a “semi-honest” party may honestly execute the current protocol but could be a corrupted party that attempts to learn messages received from another one or more parties for purposes beyond what the protocol intends, for example.

[0036] Figure 1 is a schematic diagram showing an exemplary secure computation and communication system 100 arranged according to at least some embodiments described herein.

[0037] System 100 may include terminal devices 110, 120, 130, and 140, a network 160, and a server 150. It should be understood that Figure 1 shows only an exemplary number of terminal devices, networks, and servers. The embodiments described herein are not limited to the number of terminal devices, networks, and / or servers described herein. That is, the number of terminal devices, networks, and / or servers described herein are provided for illustrative purposes only and are not limiting.

[0038] According to at least some embodiments, terminal devices 110, 120, 130, and 140 may be various electronic devices. These various electronic devices include, but are not limited to, mobile devices such as smartphones, tablet computers, e-readers, laptop computers, desktop computers, and / or other suitable electronic devices.

[0039] According to at least some embodiments, network 160 is a medium used to provide communication links between terminal devices 110, 120, 130, 140 and server 150. Network 160 can be the Internet, a local area network (LAN), a wide area network (WAN), a local interconnection network (LIN), a cloud, etc. Network 160 is implemented by various types of connections such as wired communication links, wireless communication links, and fiber optic cables.

[0040] According to at least some embodiments, server 150 may be a server that provides various services to users using one or more of the terminal devices 110, 120, 130, and 140. Server 150 may be implemented by a distributed server cluster including multiple servers, or by a single server.

[0041] Users may interact with the server 150 via the network 160 using one or more of the terminal devices 110, 120, 130, and 140. Various applications, such as social media applications and online shopping services, or their localized interfaces, may be installed on the terminal devices 110, 120, 130, and 140.

[0042] It should be understood that software applications or services in accordance with the embodiments described herein and / or services provided by the service provider may be executed by server 150 and / or terminal devices 110, 120, 130, and 140 (which may be referred to herein as user devices). Therefore, the devices for the software applications and / or services may be located within server 150 and / or terminal devices 110, 120, 130, and 140.

[0043] It is also understood that if the service is not run remotely, system 100 may not include network 160 and may only include terminal devices 110, 120, 130, and 140 and / or server 150.

[0044] Furthermore, it is understood that each of the terminal devices 110, 120, 130, 140 and / or server 150 may include one or more processors, memory, and a storage device for storing one or more programs. Each of the terminal devices 110, 120, 130, 140 and / or server 150 may also include an Ethernet connector, a wireless fidelity receptacle, and the like. When one or more programs are executed by one or more processors, they can cause one or more processors to perform the methods described in any embodiment described herein. It is also understood that, according to the embodiments described herein, a computer-readable non-volatile medium is provided. A computer program is stored on the computer-readable medium. When the computer program is executed by a processor, it is used to perform the methods described in any embodiment described herein.

[0045] Figure 2 is a flowchart illustrating an exemplary internal coupling processing flow 200 for confidential and secure computation and communication according to at least some embodiments described herein. Figure 5A is a diagram showing a first portion 500 of a schematic diagram illustrating an example of the processing flow 200 of Figure 2 according to at least some embodiments described herein. Figure 5B is a diagram showing a second portion 501 of a schematic diagram illustrating an example of the processing flow 200 of Figure 2 according to at least some embodiments described herein.

[0046] It should be understood that the processing flow 200 disclosed herein may be performed by one or more processors (for example, the processors of one or more of the terminal devices 110, 120, 130, and 140 in Figure 1, the processor of the server 150 in Figure 1, the central processing unit 605 in Figure 6, and / or any other suitable processor) unless otherwise specified.

[0047] It is also understood that the processing flow 200 may include one or more operations, actions, or functions, as indicated in one or more of blocks 210, 220, 230, and 240. These various operations, functions, or actions may correspond, for example, to processor-executable software, program code, or program instructions that cause the execution of a function. Although shown as separate blocks, obvious modifications may be made, for example, the order of two or more blocks may be changed, more blocks may be added, various blocks may be split into additional blocks, combined into fewer blocks, or deleted, depending on the desired implementation. It is also understood that operations such as initialization may be performed before the processing flow 200. For example, system parameters and / or application parameters may be initialized. The processing flow 200 may begin with block 210.

[0048] In block 210 (Shuffling and Transforming Datasets), the processor may provide a dataset for party A (e.g., 505A in Figure 5A) and / or provide a dataset for party B (e.g., 505B in Figure 5A). In one exemplary embodiment, the size of dataset 505A or 505B may include tens of thousands or hundreds of thousands of elements (or records, rows, etc.). It should be understood that the size of a dataset may refer to the number of elements (or records, rows, etc.) in the dataset. It should be understood that the size of dataset 505A may be significantly larger than the size of dataset 505B.

[0049] In one exemplary embodiment, dataset 505A includes multiple records (rows), each record including member or membership or user identification information (ID) and a time (T1) indicating, for example, the time (e.g., start time or timestamp) when the user clicked a link on Party A's platform. Dataset 505B includes multiple records (rows), each record including member or membership or user identification information (ID) and a time (T2) indicating, for example, the time (e.g., start time or timestamp) when the user navigated to Party B's website and a value indicating the user's value for Party B. In one exemplary embodiment, the time (or timestamp) is expressed in units of "minutes". It should be understood that the format, content and / or arrangement of datasets 505A and / or 505B are for illustrative purposes only and are not intended to be limiting. For example, each dataset 505A or 505B may have one or more IDs (columns) and / or one or more features or attributes (columns) associated with such one or more IDs.

[0050] In one exemplary embodiment, Party A and / or Party B may want to find out, for example, (1) the number of users who click, for example, a link on Party A's platform, navigate to Party B's website and have a valuable interaction; (2) the number of users who click, for example, a link on Party A's platform, navigate to Party B's website within a certain period (e.g., 70 minutes) after clicking the link on Party A's platform and have a valuable interaction; and / or (3) the total number of all users who click, for example, a link on Party A's platform, navigate to Party B's website within a certain period (e.g., 70 minutes) after clicking the link on Party A's platform and have a valuable interaction.

[0051] It should be understood that Party A and / or Party B may not want to expose to other parties the data in dataset 505A and / or dataset 505B, and / or the data in the common portion of dataset 505A and dataset 505B.

[0052] In block 210, the processor of each device may also shuffle dataset 505A (for example, by randomly rearranging it) to obtain or generate dataset 510A for party A, and / or shuffle dataset 505B to obtain or generate dataset 510B for party B.

[0053] The processor may also transform the ID (column) of dataset 510A using a transformation scheme for party A. It should be understood that the function or operation of “transforming” one or more columns (or rows) of the dataset, such as one or more identification fields / columns (or records / rows), may also mean processing the dataset or part thereof (e.g., encrypting, decrypting, encoding, decrypting, manipulating, compressing, decompressing, transforming, etc.). “Transformation scheme” refers to an algorithm, protocol, or function that performs processing of the dataset or part thereof (e.g., encrypting, decrypting, encoding, decrypting, manipulating, compressing, decompressing, transforming, etc.). In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decrypt, manipulate, compress, decompress, transform, etc.) the ID of dataset 510A using, for example, party A’s key, based on an ECDH algorithm or protocol (represented by function D0(.)).

[0054] The processor may also transform the IDs of dataset 510B using a transformation scheme for party B. In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decode, manipulate, compress, decompress, transform, etc.) the IDs of dataset 510B using, for example, party B's key, based on an ECDH algorithm or protocol (represented by function D1(.)).

[0055] The processor may further transform T1 (column) of dataset 510A using a transformation scheme for party A. In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decode, manipulate, compress, decompress, transform, etc.) T1 of dataset 510A using, for example, party A's key, based on an additive homomorphic encryption algorithm or protocol (represented by the function H0(.)).

[0056] The processor may also transform T2 (column) and Values ​​(column) of dataset 510B using a transformation scheme for Party B. In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decode, manipulate, compress, decompress, transform, etc.) T2 and Values ​​of dataset 510B using, for example, Party B's key, based on an additive homomorphic encryption algorithm or protocol (represented by function H1(.)).

[0057] In block 210, the sequence of dataset transformation and dataset shuffling may be switched or modified for party A and / or party B without affecting the purpose of the resulting dataset. For example, the processor may transform dataset 505A to obtain or generate dataset 510A for party A, and then shuffle dataset 510A. The processor may also transform dataset 505B to obtain or generate dataset 510B for party B, and then shuffle dataset 510B. Processing may proceed from block 210 to block 220.

[0058] In block 220 (dataset exchange, shuffling, and transformation), the processor of each device may exchange dataset 510A and dataset 510B between party A and party B. For party A, the processor may dispatch or transmit dataset 510A to party B and receive or acquire dataset 510B from party B as dataset 515A (see Figure 5A). For party B, the processor may dispatch or transmit dataset 510B to party A and receive or acquire dataset 510A from party A as dataset 515B (see Figure 5A). Since datasets 510A and 510B have already been transformed (e.g., encoded), the corresponding receiving party should understand that it does not know the data in the received dataset.

[0059] The processor may also shuffle dataset 515A for party A to obtain or generate dataset 520A, and / or shuffle dataset 515B for party B to obtain or generate dataset 520B.

[0060] The processor may further transform the IDs of dataset 520A using a transformation scheme for party A. In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decrypt, manipulate, compress, decompress, convert, etc.) the IDs of dataset 520A using party A's key based on an ECDH algorithm or protocol (represented by function D0(.)). The processor may further transform the IDs of dataset 520B using a transformation scheme for party B. In one exemplary embodiment, the processor may encrypt (or decrypt, encode, decrypt, manipulate, compress, decompress, convert, etc.) the IDs of dataset 520B using party B's key based on an ECDH algorithm or protocol (represented by function D1(.)). It should be understood that the results of functions D1(D2(p)) and D2(D1(p)) may be the same for the same parameter "p".

[0061] In block 220, the sequence of transforming the dataset IDs and shuffling the datasets may be switched or modified for party A and / or party B, without affecting the purpose of the resulting datasets. For example, the processor may transform dataset 515A to obtain or generate dataset 520A for party A, and then shuffle dataset 520A. The processor may also transform dataset 515B to obtain or generate dataset 520B for party B, and then shuffle dataset 520B. Processing may proceed from block 220 to block 230.

[0062] In block 230 (exchange and matching), the processor of each device may, for party A, extract the ID of dataset 520A and obtain or generate dataset 525A, and / or, for party B, extract the ID of dataset 520B and obtain or generate dataset 525B. The processor of each device may also exchange dataset 525A and dataset 525B between party A and party B. For party A, the processor may dispatch or transmit dataset 525A to party B and receive or obtain dataset 525B from party B. For party B, the processor may dispatch or transmit dataset 525B to party A and receive or obtain dataset 525A from party A.

[0063] The processor may also perform a search for matching (or an inner join operation, etc.) between dataset 520A and dataset 330A to obtain or generate a common part (dataset 530A in Figure 5B) for party A. It should be understood that the above operations include adding or appending the record (or row) from dataset 520A containing the matched identifier in dataset 525B to dataset 530A for each identifier in dataset 525B that matches the identifier in dataset 520A.

[0064] The processor may also perform a search for matching (or an inner join operation, etc.) between dataset 520B and dataset 525A to obtain or generate a common part (dataset 530B in Figure 5B) for party B. It should be understood that the above operation involves adding or appending the record (or row) from dataset 520B containing the matched identifier in dataset 525A to dataset 530B for each identifier in dataset 525A that matches the identifier in dataset 520B.

[0065] It should be understood that for Party A, the data in the common section 530A is also transformed (e.g., encoded) by Party B (via D1(.) and H1(.)), so Party A does not know the actual data in the common section 530A. For Party B, the data in the common section 530B is also transformed (e.g., encoded) by Party A (via D0(.) and H0(.)), so Party B does not know the actual data in the common section 530B. In other words, the matching or inner join operation performed as described above is a confidential matching or inner join operation. The processor performs confidential identity matching without exposing the common section of the datasets of these two parties. Processing may proceed from block 230 to block 240.

[0066] In block 240 (share generation), for each attribute or feature in dataset 530A for party A (e.g., an element that is not the identifier of an ID field / column), the processor may generate a corresponding mask (see description in Figure 4 for details), and may obtain or generate dataset 535A by masking each attribute or feature in dataset 530A with its corresponding mask using a masking scheme (see description in Figure 4 for details). In one exemplary embodiment, each mask is a random number or random plaintext. In one exemplary embodiment, the masking scheme is a homomorphic operation or computation (e.g., addition, subtraction, etc.) in an additive homomorphic encryption algorithm or protocol. For example, as shown in Figure 5B, the processor may homomorphically calculate the T2 data H1(50-share0_of_50) in dataset 535A by masking the T2 data H1(50) in dataset 530A with the mask "share0_of_50" and subtracting the mask "share0_of_50" from H1(50), where the mask "share0_of_50" is generated for and corresponds to the T2 time "50".

[0067] The processor may also extract the ID column and all masks generated for all attributes or features (i.e., elements that are not IDs) from dataset 530A to obtain dataset 540A for party A (see Figure 5C).

[0068] Similarly, for each attribute or feature in dataset 530B about party B (e.g., an element that is not an identifier in an ID field / column), the processor may generate a corresponding mask and use a masking scheme to mask each attribute or feature in dataset 530B with its corresponding mask to obtain or generate dataset 535B. In one exemplary embodiment, each mask is a random number or random plaintext. In one exemplary embodiment, the masking scheme is a homomorphic operation or computation (e.g., addition, subtraction, etc.) in an additive homomorphic encryption algorithm or protocol. For example, as shown in Figure 5B, the processor may homomorphically calculate the T1 data H0(30-share1_of_30) in dataset 535B by masking the T1 data H0(30) in dataset 530B with the mask "share1_of_30" and subtracting the mask "share1_of_30" from H0(30), where the mask "share1_of_30" is generated for and corresponds to the T1 time "30".

[0069] The processor may also extract the ID column and all masks generated for all attributes or features (i.e., elements that are not IDs) from dataset 530B to obtain dataset 540B for party B (see Figure 5C).

[0070] Figure 3 is a flowchart illustrating an exemplary secret sharing processing flow 300 for secure and confidential computation and communication according to at least some embodiments described herein. Figure 5C is a diagram showing a third portion 502 of a schematic diagram illustrating an example of the processing flow 300 of Figure 3 according to at least some embodiments described herein. Figure 5D is a diagram showing a fourth portion 503 of a schematic diagram illustrating an example of the processing flow 300 of Figure 3 according to at least some embodiments described herein.

[0071] It should be understood that the processing flow 300 disclosed herein may be performed by one or more processors (for example, the processors of one or more of the terminal devices 110, 120, 130, and 140 in Figure 1, the processor of the server 150 in Figure 1, the central processor unit 605 in Figure 6, and / or any other suitable processor) unless otherwise specified.

[0072] Furthermore, the processing flow 300 may include one or more operations, actions, or functions, as indicated by one or more of blocks 310, 320, 330, and 340. These various operations, actions, or functions may correspond, for example, to software, program code, or program instructions executable by the processor that cause these functions to be performed. Although shown as discrete blocks, obvious modifications may be made, for example, two or more of the blocks may be rearranged, more blocks may be added, and various blocks may be divided into additional blocks, combined into fewer blocks, or removed, depending on the desired implementation. It should be understood that operations, including initialization, may be performed before the processing flow 300. For example, system parameters and / or application parameters may be initialized from the result of block 240 in Figure 2. The processing flow 300 may start in block 310.

[0073] In block 310 (share exchange), the processor of each device may exchange data set 535A and data set 535B with party A and party B. For party A, the processor may dispatch or transmit data set 535A to party B and receive or acquire data set 535B from party B as data set 545A (see Figure 5C). For party B, the processor may dispatch or transmit data set 535B to party A and receive or acquire data set 535A from party A as data set 545B (see Figure 5C). Processing may proceed from block 310 to block 320.

[0074] In block 320 (share construction), the processor may construct a secret share (dataset 550A) for party A by transforming the attributes or features of dataset 545A (e.g., elements that are not T1-IDs) using a transformation scheme for party A, and combining dataset 540A with the transformed attributes or features of dataset 545A (e.g., elements that are not T1-IDs) (e.g., by performing a union operation, etc.). In one exemplary embodiment, the processor may decrypt (or encrypt, encode, decrypt, manipulate, compress, decompress, transform, etc.) the attributes or features of dataset 545A (e.g., elements that are not T1-IDs) using the key of party A based on an additive homomorphic encryption algorithm or protocol.

[0075] The processor may construct a secret share (dataset 550B) for party B by transforming the attributes or features of dataset 545B (e.g., elements other than T2 and value-ID) using a transformation scheme for party B, and combining dataset 540B with the transformed attributes or features of dataset 545B (e.g., elements other than T2 and value-ID) (e.g., by performing a union operation, etc.). In one exemplary embodiment, the processor may decrypt (or encrypt, encode, decrypt, manipulate, compress, decompress, transform, etc.) the attributes or features of dataset 545B (e.g., elements other than T2 and value-ID) using the key of party B based on an additive homomorphic encryption algorithm or protocol. Processing may proceed from block 320 to block 330.

[0076] In block 330 (Execution of Secret MPC), the processor of each device may perform a secret multiparty computation (see description below) on Party A's secret share, and / or perform a secret multiparty computation (see description below) on Party B's secret share.

[0077] In one exemplary embodiment, the processor may obtain or generate dataset 555A for party A by subtracting T1 from T2 for dataset 550A, and / or obtain or generate dataset 555B for party B by subtracting T1 from T2 for dataset 550B.

[0078] In one exemplary embodiment, the processor may determine whether T2 is greater than 0 and less than a predetermined value for dataset 555A, and then obtain or generate dataset 560A for party A. If T2 is greater than 0 and less than the predetermined value, the processor may set the T2 value in dataset 560A to a secret share of 1, which is a random number for party A (representing "true"). If T2 is less than or equal to 0, or greater than or equal to the predetermined value, the processor may set the T2 value in dataset 560A to a secret share of 0, which is a random number for party A (representing "false").

[0079] In one exemplary embodiment, the processor may determine whether T2 is greater than 0 and less than a predetermined value for dataset 555B, and then obtain or generate dataset 560B for party B. If T2 is greater than 0 and less than the predetermined value, the processor may set the T2 value in dataset 560B to a secret share of 1, which is a random number for party B (representing "true"). If T2 is less than or equal to 0, or greater than or equal to the predetermined value, the processor may set the T2 value in dataset 560B to a secret share of 0, which is a random number for party B (representing "false").

[0080] In one exemplary embodiment, the processor may also multiply the corresponding T2 and value of dataset 560A and store or save the result in the value field of dataset 565A to generate dataset 565A for party A. The processor may also multiply the corresponding T2 and value of dataset 560B and store or save the result in the value field of dataset 565B to generate dataset 565B for party B. It should be understood that multiplying a secret share of 1 by any value V can result in the same value V. Multiplying a secret share of 0 by any value V can result in a secret share of 0.

[0081] In one exemplary embodiment, the processor may further sum the values ​​of dataset 565A and store the result in the value field of dataset 570A to generate dataset 570A for party A. The processor may further sum the values ​​of dataset 565B and store the result in the value field of dataset 570B to generate dataset 570B for party B. It should be understood that adding any value V to a secret share of 0 may result in the same value V.

[0082] At this point, it should be understood that Party A possesses a dataset 570A (Secret Share) that represents the total number of users who clicked, for example, a link on Party A's platform, and then, within a certain period (e.g., 70 minutes) after clicking that link, navigated to Party B's website and engaged in a valuable interaction. It should also be understood that, because the Secret Share is a random value, Party A does not know the data within dataset 570A.

[0083] At this point, it should be understood that Party B has a dataset 570B (Secret Share) that represents the total number of users who clicked, for example, a link on Party A's platform, and then, within a certain period (e.g., 70 minutes) after clicking the link on Party A's platform, navigated to Party B's website and performed a valuable interaction. It should also be understood that, because the Secret Share is a random value, Party B does not know the data in dataset 570B. Processing may proceed from block 330 to block 340.

[0084] In block 340 (Result Construction), the processor of each device may exchange dataset 570A and dataset 570B between Party A and Party B. For Party A, the processor may dispatch or send dataset 570A to Party B and receive or acquire dataset 570B from Party B. The processor may also construct a result ("121") by, for example, adding the data in dataset 570A to the data in the received dataset 570B. That is, the sum of all users who clicked, for example, a link on Party A's platform, and then navigated to Party B's website within a certain period (e.g., 70 minutes) after clicking the link on Party A's platform and performed a valuable interaction is "121".

[0085] With respect to Party B, the processor may dispatch or send dataset 570B to Party A and receive or acquire dataset 570A from Party A. The processor may also construct the result ("121") by, for example, adding the data in dataset 570B to the data in the received dataset 570A. That is, the sum of all users who clicked, for example, a link on Party A's platform, and then navigated to Party B's website within a certain period (e.g., 70 minutes) after clicking the link on Party A's platform and performed a valuable interaction is "121", which is the same result as determined by Party A.

[0086] It should be understood that other results can be constructed or determined by combining secret shares (550A and 550B), secret shares (555A and 555B), secret shares (560A and 560B), secret shares (565A and 565B), etc. For example, the values ​​in the T2 column of dataset 555A and / or 555B may be constructed or determined by combining the T2 values ​​of secret shares 555A and 555B, and the constructed or determined results may be used to determine the corresponding T2 values ​​in dataset 560A and / or 560B. It should also be understood that other results can be further constructed or determined by performing other MPC calculations on secret shares to obtain the secret shares of party A and party B, and by combining the secret shares of both party A and party B.

[0087] Figure 4 is a schematic diagram showing an exemplary packing optimization scheme 400 for confidential and secure computation and communications according to at least some embodiments described herein.

[0088] As described above, in block 240 (share generation) of Figure 2, for each attribute or feature (an element other than an ID) in dataset 530A or 540B (see Figure 5B), the processor may generate a corresponding mask, and use a masking scheme to mask each attribute or feature in dataset 530A or 530B with its corresponding mask to obtain or generate dataset 535A or 535B. In one exemplary embodiment, each mask is a random number or random plaintext. The processor may also extract the ID column and all the masks generated for all attributes or features from dataset 530A or 530B to obtain dataset 540A or 540B.

[0089] In an exemplary embodiment without packing optimization, given an attribute or feature A0 in a record, the processor may generate its corresponding mask R0. The mask R0 may be a random number or random plaintext. Masking A0 with R0 may mean adding (or subtracting, etc.) R0 to (or from) A0 such that the result may be a random number or random plaintext (because the value to which a random number is added or subtracted may result in a random number). In one exemplary embodiment, for the T2 value (A0 = "50") in Figures 5B and 5C, its corresponding mask (R0) is represented as share0_of_50. For a ciphertext with a size of 6144 bits and a plaintext space of size 3072 bits, without packing optimization, each value A0 (e.g., having a size of 64 bits, etc.) may occupy 3072 bits of space during the process.

[0090] In Figure 4, record 410 (for example, in dataset 530A or 530B in Figure 5B) includes one or more IDs and one or more attributes or features (i.e., elements that are not IDs) A0, A1…AN. In one exemplary embodiment, the value of each attribute or feature has a size L. In one exemplary embodiment, L is 64 bits (i.e., 0 to 2 64(A value within the range of ). For each attribute or feature A0, A1…AN, the processor may generate a corresponding mask R0, R1…RN. Each mask R0, R1…RN is (for example, 2 L A random number or random plaintext (larger than ) which may have a size of L+D bits, where L is the size of A0, A1…AN and D is a statistical security parameter (e.g., 40 bits).

[0091] Each attribute or feature A0, A1…AN may be expanded from L bits to 1+L+D bits (for example, by adding leading zeros) and stored in slots 420_1, 420_2, ..., 420_N, respectively. Each slot has a size of 1+L+D bits and an additional bit (compared to the size of the masks R0, R1…RN) to accommodate overflows when adding or subtracting the corresponding masks R0, R1…RN to or from A0, A1…AN.

[0092] In one exemplary embodiment, the processor may pack (or combine, concatenate, etc.) two or more attributes or features A0, A1…AN into two or more corresponding slots 420_1, 420_2,…420_N, as long as the total size is less than the size of the plaintext space. For example, packing two attributes or features A0 and A1 into corresponding slots 420_1 and 420_2 may result in a packed attribute or packed feature having a size of 1+L+D+1+L+D bits, where the left / first 1+L+D bits are for A0 in slot 420_1 and the right / second 1+L+D bits are for A1 in slot 420_2.

[0093] In one exemplary embodiment, the processor may also pack two or more masks R0, R1…RN by expanding each mask R0, R1…RN from L+D bits to 1+L+D bits (e.g., by adding leading zeros), as long as the total size is less than the size of the plaintext space. For example, packing two masks R0 and R1 may result in a packed mask having a size of 1+L+D+1+L+D bits, where the left / first 1+L+D bits are for mask R0 and the right / second 1+L+D bits are for mask R1.

[0094] Packing optimization may be used to obtain the results of packing two or more masks R0, R1…RN as packed masks for packed attributes or packed features A0, A1…AN (i.e., the results from packing two or more attributes or features A0, A1…AN). The processor may use a masking scheme (e.g., addition, subtraction, etc.) to mask each packed attribute or packed feature with its corresponding packed mask.

[0095] It should be understood that the packing optimizations described above help reduce the number of transformations, such as encryption and decryption, by packing multiple messages (for example, multiple attributes or features associated with each user or member identifier) ​​together into a single ciphertext. The packing optimizations described above can also help reduce communication complexity.

[0096] Figure 6 is a schematic diagram of an exemplary computer system 600 applicable to realizing an electronic device (e.g., one of the servers or terminal devices shown in Figure 1), arranged according to at least some embodiments described herein. It should be understood that the computer system shown in Figure 6 is provided for illustrative purposes only and does not limit the functions and applications of the embodiments described herein.

[0097] As shown in the figure, the computer system 600 may include a central processing unit (CPU) 605. The CPU 605 may perform various operations and processes based on programs stored in read-only memory (ROM) 610 or programs loaded from storage device 640 into random access memory (RAM) 615. The RAM 615 may also store various data and programs required for the operation of the system 600. The CPU 605, ROM 610, and RAM 615 may be connected to each other via a bus 620. An input / output (I / O) interface 625 may also be connected to the bus 620.

[0098] The components connected to the I / O interface 625 may further include an input device 630, such as a keyboard, mouse, digital pen, or drawing pad; an output device 635, such as a display like a liquid crystal display (LCD) or a speaker; a storage device 640, such as a hard disk; and a communication device 645, such as a network interface card like a LAN card or a modem. The communication device 645 may perform communication processing via a network, such as the Internet, WAN, LAN, LINE, or cloud. In one embodiment, a driver 650 may also be connected to the I / O interface 625. A removable medium 655, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, may be mounted to the driver 650 as needed so that a computer program read from the removable medium 655 may be installed in the storage device 640.

[0099] It should be understood that the processes described with reference to the flowcharts in Figures 2 and 3 and / or the processes described in other figures may be implemented as a computer software program or in hardware. The computer program product may include a computer program stored on a computer-readable non-volatile medium. The computer program includes program code for performing the methods shown in the flowcharts and / or GUI. In this embodiment, the computer program may be downloaded and installed from a network via the communication device 645, or it may be installed from a removable medium 655. When the computer program is executed by the central processing unit (CPU) 605, it can perform the functions defined in the methods of the embodiments disclosed herein.

[0100] Tests and / or analyses, compared to existing algorithms, protocols, or systems, demonstrate that the features of the embodiments disclosed herein can improve efficiency, reduce the number of transformation operations or steps (e.g., homomorphic encryption, decryption, addition, etc.), and reduce communication and computational complexity.

[0101] It should be understood that the disclosed and other solutions, examples, embodiments, modules, and functional operations described herein may be implemented within digital electronic circuits, or within computer software, firmware, or hardware, including the structures disclosed herein and their structural equivalents, or within one or more combinations thereof. The disclosed embodiments and other embodiments may be implemented as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer-readable medium, to be executed by or to control the operation of a data processing device. The computer-readable medium may be a machine-readable storage device, a machine-readable storage board, a memory device, a composition of a material that affects machine-readable propagating signals, or one or more combinations thereof. "Data processing device" includes all equipment, devices, and machines for processing data, including, for example, a programmable processor, a computer, or multiple processors or computers. In addition to hardware, the device may include code that generates the execution environment of the computer program being discussed, such as processor firmware, a protocol stack, a database management system, an operating system, or code that constitutes one or more combinations thereof.

[0102] Computer programs (also referred to as programs, software, software applications, scripts, or code) may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, as standalone programs or as modules, components, subroutines, or other units suitable for use in a computing environment. Computer programs do not necessarily correspond to files in a file system. A program may be stored in part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program, or in a group of collaborative files (e.g., a file containing one or more modules, subprograms, or parts of code). Computer programs may be deployed to run on one computer, located in one site, or distributed across multiple sites and interconnected by a communication network.

[0103] The processing and logic flows described herein can perform their functions by manipulating input data and generating outputs, which are executed by one or more programmable processors running one or more computer programs. The processing and logic flows may also be executed by dedicated logic circuits, such as field-programmable gate arrays and application-specific integrated circuits, and devices may also be implemented as such.

[0104] Processors suitable for executing computer programs include, for example, both general-purpose microprocessors and dedicated microprocessors, and any one or more processors of any type of digital computer. Generally, a processor receives instructions and data from read-only memory or random-access memory or both. Essential elements of a computer are a processor for executing instructions and one or more storage devices for storing instructions and data. Generally, a computer also includes or is operablely coupled to one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks or optical disks, to receive or transfer data or both. However, a computer is not required to have such devices. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including, for example, erasable programmable read-only memory, electrically erasable programmable read-only memory and semiconductor memory devices such as flash memory devices, magnetic disks such as internal hard disks or removable disks, magneto-optical disks and compact disk read-only memory and digital video disk read-only memory disks. The processor and memory may be complemented by dedicated logic circuits, or they may be incorporated within dedicated logic circuits.

[0105] It should be understood that different features, variations, and multiple different embodiments are illustrated and described in various details. In this application, what is described with respect to a particular embodiment is done for illustrative purposes only and is not intended to limit or suggest that what has been devised is only one specific embodiment or particular embodiment. It should be understood that this disclosure is not limited to any single specific embodiment or enumerated variation. A person skilled in the art will conceive of many modifications, variations, and other embodiments which are intended and actually covered by this disclosure. The scope of this disclosure is actually intended to be determined by the appropriate legal interpretation and structure of the disclosure, including equivalents, as a person skilled in the art will understand by relying on the complete disclosure available at the time of filing.

[0106] Pattern:

[0107] It will be understood that any one of the embodiments may be combined.

[0108] Appearance 1, A method for secure computation and communication, the method comprising: transforming the identification information of a first dataset using a first transformation scheme; transforming the attributes of the first dataset using a second transformation scheme; dispatching the transformed first dataset; receiving a second dataset; transforming the identification information of the received second dataset; dispatching the transformed identification information of the received second dataset; receiving a set of identification information; generating a first intersection of the received set of identification information and the transformed received second dataset; generating a first share based on the first intersection; receiving a second share; and constructing a first result based on the first share and the second share.

[0109] Appearance 2, A method according to Embodiment 1, further comprising shuffling the transformed first dataset before dispatching the transformed first dataset, and shuffling the transformed second dataset before dispatching the identification information of the transformed second dataset.

[0110] Appearance 3, A method according to embodiment 1 or embodiment 2, further comprising manipulating the first share before constructing the first result.

[0111] Appearance 4, A method according to any one of embodiments 1 to 3, wherein generating the first share based on the first intersection includes: masking the attributes of the first intersection using a masking scheme; dispatching the masked attributes of the first intersection; generating a first portion of the first share using the masking scheme; receiving a second portion of the first share; transforming the second portion of the first share using a second transformation scheme; and generating the first share based on the first portion of the first share and the second portion of the first share.

[0112] Appearance 5, A method according to embodiment 4, wherein the first common part record includes identification information and two or more attribute fields, the method further includes expanding each of the two or more attribute fields to a predetermined size, concatenating the expanded two or more attribute fields, and masking the concatenated two or more attribute fields using the masking scheme.

[0113] Appearance 6, The method according to embodiment 5, wherein masking of two or more concatenated attribute fields includes adding a random value to each of the two or more extended attribute fields.

[0114] Appearance 7, A method according to any one of embodiments 1 to 6, further comprising determining a random exponent for the first transformation scheme.

[0115] Appearance 8, A method according to embodiment 7, wherein transforming the identification information of the first dataset using the first transformation scheme includes mapping the identification information of the first dataset to an elliptic curve and applying a power to the mapped identification information using the random exponent.

[0116] Appearance 9, A method according to any one of embodiments 1 to 8, further comprising generating a public key for the second transformation scheme.

[0117] Appearance 10, A method according to embodiment 9, wherein transforming the attributes of the first dataset using the second transformation scheme includes transforming the attributes of the first dataset using the public key.

[0118] Embodiment 11, A method according to any one of embodiments 1 to 10, further comprising: transforming the identification information of the second dataset using the first transformation scheme; transforming the attributes of the second dataset using the second transformation scheme; dispatching the transformed second dataset; receiving the dispatched first dataset; transforming the identification information of the received first dataset; dispatching the transformed identification information of the received first dataset; receiving the dispatched identification information of the transformed received second dataset; generating a second intersection of the received dispatched identification information and the transformed received first dataset; generating the second share based on the second intersection; receiving the first share; and constructing a second result based on the first share and the second share.

[0119] Appearance 12, The method according to embodiment 11, wherein the first result is the same as the second result.

[0120] Embodiment 13, A method according to embodiment 11 or embodiment 12, wherein the identification information of the first common part is matched with the identification information of the second common part.

[0121] Appearance 14, A method according to any one of embodiments 11 to 13, further comprising shuffling the transformed second dataset before dispatching the transformed second dataset, and shuffling the transformed received first dataset before dispatching the identification information of the transformed received first dataset.

[0122] Appearance 15, A secure computing and communication system, A memory for storing a first dataset, and a processor that transforms the identification information of the first dataset using a first transformation scheme, transforms the attributes of the first dataset using a second transformation scheme, dispatches the transformed first dataset, receives a second dataset, transforms the identification information of the received second dataset, dispatches the transformed identification information of the received second dataset, receives a set of identification information, generates a first intersection of the received set of identification information and the transformed received second dataset, generates a first share based on the first intersection, receives a second share, and constructs a first result based on the first share and the second share. Processor and A system equipped with these features.

[0123] Appearance 16, A system according to embodiment 15, The processor further shuffles the transformed first dataset before dispatching the transformed first dataset, and shuffles the transformed received second dataset before dispatching the identification information of the transformed received second dataset.

[0124] Appearance 17, A system according to embodiment 16, The processor further manipulates the first share before constructing the first result.

[0125] Appearance 18, A non-temporary computer-readable medium storing computer-executable instructions, wherein when an instruction is executed, it causes one or more processors to perform operations including: converting the identification information of a first dataset; converting the attributes of the first dataset; dispatching the converted first dataset; receiving a second dataset; converting the identification information of the received second dataset; dispatching the converted identification information of the received second dataset; receiving a set of identification information; generating a first intersection of the received set of identification information and the converted received second dataset; generating a first share based on the first intersection; receiving a second share; and constructing a first result based on the first share and the second share.

[0126] Appearance 19, A computer-readable medium according to embodiment 18, wherein the operation further includes shuffling the converted first dataset before dispatching the converted first dataset, and shuffling the converted received second dataset before dispatching the identification information of the converted received second dataset.

[0127] Appearance 20, A computer-readable medium according to embodiment 19, wherein the operation further includes manipulating the first share before constructing the first result.

[0128] The terms used herein are intended to describe, and not limit, specific embodiments. The terms “one,” “one,” and “the” include the plural form unless expressly indicated. The terms “includes” and / or “equipment,” as used herein, specify the presence of the described features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, and / or components.

[0129] It should be understood that, with respect to the above description, modifications may be made to details, particularly the materials used, shapes, sizes, and arrangements of components, without departing from the scope of this disclosure. The embodiments described herein and described herein are illustrative only, and the true scope and essence of this disclosure are given by the following claims.

Claims

1. A method for secure computation and communication, The identification information of the first dataset is transformed using the first transformation scheme, The attributes of the first dataset are transformed using a second transformation scheme, Dispatching the first dataset after transformation, Receiving the second dataset, The process involves transforming the identification information of the received second dataset, Dispatching identification information from the second received dataset after conversion, Receiving a set of identification information, To generate a first intersection set between the received set of identification information and the second received dataset after the transformation, To generate a first share based on the first intersection, Receiving a second share, Based on the first share and the second share, the first result is constructed, A method that includes this.

2. Before dispatching the first dataset after the transformation, the first dataset after the transformation is shuffled. Before dispatching the identification information of the second received dataset after the transformation, the second received dataset after the transformation is shuffled. The method according to claim 1, further comprising:

3. Before constructing the first result, manipulate the first share, The method according to claim 1, further comprising:

4. Generating the first share based on the first intersection is, Using a masking scheme to mask the attributes of the first intersection set, Dispatching the masked attributes of the first intersection set, Using the masking scheme described above, generate a first portion of the first share, Receiving the second portion of the first share, Converting the second portion of the first share using the second conversion scheme, The first share is generated based on the first portion of the first share and the second portion of the first share, The method according to claim 1, including the method described in claim 1.

5. The first common part record includes identification information and two or more attribute fields, and the method is Expanding each of the two or more attribute fields to a predetermined size, Linking two or more extended attribute fields, Using the aforementioned masking scheme, mask two or more linked attribute fields, The method according to claim 4, further comprising:

6. The masking of the two or more linked attribute fields includes adding a random value to each of the two or more extended attribute fields. The method according to claim 5.

7. To determine the random exponent for the first transformation scheme, The method according to claim 1, further comprising:

8. Transforming the identification information of the first dataset using the first transformation scheme is: Mapping the identification information of the first dataset onto an elliptic curve, This includes applying a power to the mapped identification information using the aforementioned random exponent. The method according to claim 7.

9. To generate a public key for the second transformation scheme, The method according to claim 1, further comprising:

10. Transforming the attributes of the first dataset using the second transformation scheme is: This includes transforming the attributes of the first dataset using the public key. The method according to claim 9.

11. The identification information of the second dataset is transformed using the first transformation scheme, Transforming the attributes of the second dataset using the second transformation scheme, Dispatching the second dataset after transformation, Receiving the dispatched first dataset, The process involves transforming the identification information of the first received dataset, Dispatching the identification information of the first received dataset after conversion, Receiving dispatched identification information of the second received dataset after transformation, To generate a second intersection between the received dispatched identification information and the transformed received first dataset, To generate the second share based on the second common part, Receiving the first share, Based on the first share and the second share, a second result is constructed, The method according to claim 1, further comprising:

12. The first result is the same as the second result. The method according to claim 11.

13. The identification information of the first common part matches the identification information of the second common part. The method according to claim 11.

14. Before dispatching the second received dataset after the transformation, the second received dataset after the transformation is shuffled. Before dispatching the identification information of the first dataset received after the transformation, the first dataset received after the transformation is shuffled. The method according to claim 11, further comprising:

15. A secure computing and communication system, Memory for storing the first dataset, It is a processor, The identification information of the first dataset is transformed using the first transformation scheme. The attributes of the first dataset are transformed using a second transformation scheme. Dispatch the transformed first dataset, Upon receiving the second dataset, The identification information of the received second dataset is transformed, Dispatch the identification information of the second received dataset after conversion. Upon receiving one set of identification information, A first intersection is generated between the received set of identification information and the second received dataset after the transformation. Based on the first intersection, a first share is generated, Received the second share, Based on the first share and the second share, the first result is constructed. Processor and A system equipped with these features.

16. The aforementioned processor further, Before dispatching the first dataset after the transformation, the first dataset after the transformation is shuffled. Before dispatching the identification information of the received second dataset after the transformation, the received second dataset after the transformation is shuffled. The system according to claim 15.

17. The aforementioned processor further, Before constructing the first result, manipulate the first share, The system according to claim 16.

18. A non-temporary computer-readable medium storing computer-executable instructions, wherein when the instructions are executed, one or more processors are configured to: The first dataset's identification information is transformed, The attributes of the first dataset described above are transformed, Dispatching the first dataset after transformation, Receiving the second dataset, The process involves transforming the identification information of the received second dataset, Dispatching identification information from the second received dataset after conversion, Receiving a set of identification information, To generate a first intersection set between the received set of identification information and the second received dataset after the transformation, To generate a first share based on the first intersection, Receiving a second share, Based on the first share and the second share, the first result is constructed, Perform an operation that includes this. Computer-readable media.

19. The aforementioned operation is, Before dispatching the first dataset after the transformation, the first dataset after the transformation is shuffled. The process further includes shuffling the received second dataset after transformation before dispatching the identification information of the received second dataset after transformation. The computer-readable medium according to claim 18.

20. The aforementioned operation is, This further includes manipulating the first share before constructing the first result. The computer-readable medium according to claim 19.

Images