CN114239019A

CN114239019A - Method, device and system for determining number of shared data for protecting privacy data

Info

Publication number: CN114239019A
Application number: CN202111547508.XA
Authority: CN
Inventors: 李漓春; 尹栋
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2021-12-16
Filing date: 2021-12-16
Publication date: 2022-03-25

Abstract

The embodiment of the specification provides a method, a device and a system for determining the number of shared data for protecting private data, which are realized by adopting secure multiparty calculation, and the method comprises the following steps: the first party maps the private data set to a bloom filter to obtain a first array of m bits; homomorphic encryption is carried out on each element in the first array, and a first ciphertext array obtained through encryption is sent to a second party; the second party determines k target positions of any private data in the bloom filter, and extracts the encryption elements of the k target positions in the first ciphertext array to obtain k encryption values; performing homomorphic function operation on the k encrypted values to obtain corresponding result ciphertext; homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; sending each result ciphertext to the first party; the first party decrypts each result ciphertext to determine the number of data shared by both parties. The safety can be improved.

Description

Method, device and system for determining number of shared data for protecting privacy data

Technical Field

One or more embodiments of the present description relate to the field of computers, and more particularly, to a method, apparatus, and system for determining a number of shared data for protecting private data.

Background

At present, in many scenes, the determination of the number of data shared by two parties is involved, and the data of the parties belongs to private data and cannot be transmitted outside. For example, each of the two parties has a set, and the size of the intersection needs to be determined without exposing the sets. The number of the common data can be used for judging scenes such as the matching degree of the data of the two parties and the number of the common clients, so that the two parties can continuously carry out cooperation and provide evaluation. And also can be used for association analysis, such as the association analysis of low-income families and lost schools by the social security organization and the education department. Since there is a need to protect private data, it needs to be implemented using secure multiparty computing.

In the prior art, in the process of determining the number of the shared data, some information of the private data is revealed, so that the other party can estimate a possible value of the private data.

Accordingly, it is desirable to have an improved scheme capable of enhancing security in determining the number of shared data protecting private data.

Disclosure of Invention

One or more embodiments of the present specification describe a method, an apparatus, and a system for determining the number of shared data for protecting privacy data, which can improve security in determining the number of shared data for protecting privacy data.

In a first aspect, a method for determining the number of shared data for protecting private data is provided, the method comprising:

the first party maps the first privacy data set to the bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter;

the first party performs homomorphic encryption on each element in the first array and sends a first ciphertext array obtained by encryption to the second party;

the second party determines k target positions of any private data in a second private data set in the second party in the bloom filter, and extracts encryption elements of the k target positions in the first ciphertext array to obtain k encryption values;

the second party performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result;

the second party sends result ciphertexts corresponding to the privacy data in the second privacy data set to the first party;

and the first party decrypts the result ciphertexts and determines the number of data shared by the two parties according to the statistical result of the preset value in each decrypted result.

In one possible embodiment, the first party maps the first set of private data it has to an m-bit bloom filter, comprising:

the first party respectively calculates k hash values for any private data in the first private data set through k hash functions, wherein each hash value corresponds to one position in a bloom filter; the bloom filter comprises m elements, and the initial values of the elements are all 0;

and setting the value of the element of k positions corresponding to any privacy data in the bloom filter as 1 to obtain a first array of m bits.

In one possible embodiment, the homomorphic encryption by the first party for each element in the first array includes:

the first party carries out homomorphic encryption supporting addition homomorphism aiming at each element in the first array;

the second party performs homomorphic function operation on the k encrypted values, including:

the second party performs homomorphic summation on the k encrypted values to obtain a first ciphertext convergence result;

the second party homomorphically subtracts k from the first ciphertext aggregation result to obtain a second ciphertext aggregation result;

and the second party multiplies the second ciphertext aggregation result by a random number in a homomorphic manner to obtain a result ciphertext corresponding to any privacy data.

the first party takes each element in the first array as a reduction number and 1 as a reduced number respectively, and obtains a processing value corresponding to each element through subtraction operation;

the first party carries out homomorphic encryption supporting the addition homomorphic aiming at each processing value;

the second party performs homomorphic summation on the k encrypted values to obtain a third ciphertext convergence result;

and the second party multiplies the third ciphertext aggregation result by a random number in a homomorphic manner to obtain a result ciphertext corresponding to any privacy data.

In a possible implementation manner, when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; and when at least one of the element values of the k target positions is 0, the value of the decryption result is a random value.

In one possible embodiment, the predetermined value is 0.

In a second aspect, a method for determining the number of shared data for protecting private data is provided, the method comprising:

the second party acquires a first ciphertext array from the first party; the first ciphertext array is obtained by mapping a first privacy data set of the first party to a bloom filter with m bits by the first party to obtain a first array with m bits, and homomorphically encrypting each element in the first array, wherein single privacy data corresponds to k positions in the bloom filter;

the second party sends result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; so that the first party decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in the decryption results.

In a possible embodiment, the second party performs homomorphic function operations on the k encrypted values, including:

In a third aspect, there is provided a system for determining the number of shared data for protecting private data, the system comprising:

the first party is used for mapping the first privacy data set to the bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter; homomorphic encryption is carried out on each element in the first array, and a first ciphertext array obtained through encryption is sent to a second party;

the second party is used for determining k target positions of any private data in a second private data set in the second party in the bloom filter, extracting encryption elements of the k target positions in the first ciphertext array and obtaining k encryption values; performing homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one of the private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; sending result ciphertexts corresponding to the privacy data in the second privacy data set to the first party;

and the first party is also used for decrypting each result ciphertext and determining the number of data shared by the two parties according to the statistical result of the preset value in each decrypted result.

In a fourth aspect, there is provided an apparatus for determining a number of shared data for protecting private data, the apparatus being provided to a second party, including:

an obtaining unit, configured to obtain a first ciphertext array from a first party; the first ciphertext array is obtained by mapping a first privacy data set of the first party to a bloom filter with m bits by the first party to obtain a first array with m bits, and homomorphically encrypting each element in the first array, wherein single privacy data corresponds to k positions in the bloom filter;

the extracting unit is used for determining k target positions of any private data in the second private data set in the bloom filter, and extracting the encryption elements of the k target positions in the first ciphertext array acquired by the acquiring unit to obtain k encrypted values;

the operation unit is used for carrying out homomorphic function operation on the k encrypted values obtained by the extraction unit to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result;

a sending unit, configured to send result ciphertexts corresponding to the respective privacy data in the second privacy data set obtained by the operation unit to the first party; so that the first party decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in the decryption results.

In a fifth aspect, there is provided a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first or second aspect.

In a sixth aspect, there is provided a computing device comprising a memory having stored therein executable code, and a processor that when executing the executable code, implements the method of the first or second aspect.

According to the method, the device and the system provided by the embodiment of the specification, firstly, a first party maps a first privacy data set which the first party has to a bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter; then the first party performs homomorphic encryption on each element in the first array and sends a first ciphertext array obtained by encryption to the second party; then the second party determines k target positions of any private data in a second private data set in the second party in the bloom filter, and extracts encryption elements of the k target positions in the first ciphertext array to obtain k encryption values; performing homomorphic function operation on the k encrypted values by a second party to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; the second party sends result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; and finally, the first party decrypts the result ciphertexts, and determines the number of the data shared by the two parties according to the statistical result of the preset value in each decrypted result. As can be seen from the above, in the embodiments of the present specification, in a manner of collecting bloom filter element values and then masking the bloom filter element values with a random number, a decryption result may be either a predetermined value or a random value, thereby avoiding leakage of additional information, and improving security in determining the number of shared data that protects private data.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1 is a schematic diagram illustrating an implementation scenario of an embodiment disclosed herein;

FIG. 2 illustrates an interaction diagram of a method for determining a number of shared data for protecting private data, according to one embodiment;

FIG. 3 illustrates a mapping diagram of a bloom filter according to one embodiment;

FIG. 4 shows an interaction diagram of a method for determining a number of shared data for protecting private data according to another embodiment;

FIG. 5 shows an interaction diagram of a method for determining a number of shared data for protecting private data according to another embodiment;

fig. 6 shows a schematic block diagram of a common data number determination apparatus for protecting privacy data according to one embodiment;

fig. 7 shows a schematic block diagram of a common data number determination system for protecting private data according to one embodiment.

Detailed Description

The scheme provided by the specification is described below with reference to the accompanying drawings.

Fig. 1 is a schematic view of an implementation scenario of an embodiment disclosed in this specification. The implementation scenario involves a determination of a number of shared data of the protected private data for determining a number of shared data between a first set of private data possessed by a first party and a second set of private data possessed by a second party. As shown in fig. 1, a scenario in which two parties determine the number of data in common involves a party a and a party B, or referred to as a first party and a second party, or referred to as a party a and a party B. The various participants may be implemented as any computing, processing capable device, platform, server, or cluster of devices. The two parties jointly determine the number of the shared data under the condition of protecting the data privacy.

The A side holds a set X of n1 private data, X { X1, X2. }, the B side holds a set Y of n2 private data, Y1, y2.. }, and the size of the intersection of X and Y is obtained on the premise that the respective sets are not exposed, so that the number of shared data is jointly determined. For example, if the set X is { twilight, small red, small steel }, and the set Y is { twilight, small red, small cloud, small blue }, the size of the intersection of the two is 2.

The embodiment of the specification realizes the determination of the number of the shared data for protecting the privacy data through the secure multi-party calculation. The scheme is applied to two parties, each party has a private set as an input and is respectively represented as X and Y, the two parties want to calculate the size of the intersection X ^ Y of the sets of the two parties together, and private data contained in the sets of the two parties are not disclosed, or private data outside the intersection of any party are not disclosed.

It will be appreciated that the private data may be any data that is not convenient to disclose, and may be, but is not limited to, data representing personal information of the user, or trade secrets or the like.

The secure multi-party computation is also called multi-party secure computation, namely, a plurality of parties compute the result of a function together without revealing the input data of each party of the function, and the computed result is disclosed to one or more parties.

The embodiment of the specification provides a corresponding solution for improving the security in the determination of the number of shared data for protecting the private data.

Fig. 2 shows an interaction diagram of a method for determining the number of shared data for protecting private data according to an embodiment, which may be based on the implementation scenario shown in fig. 1. As shown in fig. 2, the method for determining the number of shared data for protecting privacy data in this embodiment includes the steps of: step 21, the first party maps the first private data set to the bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter; step 22, the first party performs homomorphic encryption on each element in the first array and sends the first ciphertext array obtained by encryption to the second party; step 23, the second party determines k target positions of any private data in the second private data set in the bloom filter, and extracts the encryption elements of the k target positions in the first ciphertext array to obtain k encryption values; step 24, the second party performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; step 25, the second party sends the result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; and step 26, the first party decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in each decrypted result. Specific execution modes of the above steps are described below.

Firstly, in step 21, a first party maps a first privacy data set of the first party to a bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter. It will be appreciated that a bloom filter is used to represent the entire collection, not just one item of data in the collection.

In one example, the first party maps the first set of privacy data that it has to a bloom filter of m bits, comprising:

It is to be understood that the k hash functions are usually different, and accordingly, the k positions obtained by the k hash functions are different for any private data.

FIG. 3 illustrates a mapping diagram of a bloom filter according to one embodiment. Referring to fig. 3, the private data 1 represents any private data in the first private data set, k has a value of 3, the k hash functions are hash function 1, hash function 2 and hash function 3, respectively, the bloom filter is an array including m elements, the initial values of the elements are all 0, and the data in the set can be sequentially mapped to the bloom filter in the same mapping manner. Taking the private data 1 as an example, the obtained 3 positions are position 0, position 6 and position 12 respectively through the hash function 1, the hash function 2 and the hash function 3, and the element values of the 3 positions are set to 1, which is to say, for the mapping process of the private data 1, other private data in the set can be mapped to the bloom filter in the same way, the bloom filter after mapping can represent the whole set, and whether the data exists in the set is judged by whether the element value of one data corresponding to the corresponding position of the bloom filter is 1.

Then, in step 22, the first party performs homomorphic encryption on each element in the first array, and sends the encrypted first ciphertext array to the second party. It can be understood that the first party may directly perform homomorphic encryption on each element in the first array, or perform preset processing on each element in the first array first, and then perform homomorphic encryption on the obtained processing value.

Homomorphic encryption: compared with the common encryption, the homomorphic encryption has the property of homomorphism, namely, the data in the encryption state can be calculated. For example, the homomorphic encrypted ciphertext E (a) of a and the homomorphic encrypted ciphertext E (b) of b are subjected to a certain operation to obtain the ciphertext E (a + b) of a + b, and a, b or a + b is not leaked in the operation process, and a decrypted key is not required to be used.

In one example, the first party homomorphically encrypts each element in a first array, including:

and the first party carries out homomorphic encryption supporting addition homomorphism on each element in the first array.

In this example, a homomorphic addition operation may be subsequently performed on the ciphertext obtained by homomorphic encryption to implement aggregation of the element values.

and the first party carries out homomorphic encryption supporting the addition homomorphic aiming at each processing value.

In this example, when the element value is 1, the processing value is 0; when the element value is 0, the processing value is 1. And subsequently, homomorphic addition operation can be carried out on the ciphertext obtained by homomorphic encryption, and the convergence of the element values is indirectly realized by converging the processing values.

Next, in step 23, the second party determines k target positions of any private data in the second private data set that the second party has in the bloom filter, and extracts the encryption elements of the k target positions in the first ciphertext array to obtain k encrypted values. It will be appreciated that the second party may determine the k target locations in the same mapping as the first party.

In one example, the second party calculates k hash values for any private data in the second set of private data by k hash functions, respectively, each hash value corresponding to one location in the bloom filter, thereby obtaining k target locations.

It can be understood that the second party does not reset the element values of the corresponding positions in the bloom filter after obtaining the k target positions, but only extracts the encrypted elements of the k target positions in the first ciphertext array to obtain k encrypted values.

In step 24, the second party performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one of the private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result. It will be appreciated that by means of random number masking, leakage of additional information can be avoided.

In this embodiment of the present specification, the specific operation content of the homomorphic function operation is further related to the meaning represented by the encrypted value, that is, the first party directly performs homomorphic encryption supporting the addition homomorphic encryption on each element in the first array to obtain the encrypted value, or performs preset processing on each element in the first array, and then performs homomorphic encryption supporting the addition homomorphic encryption on the processed value to obtain the encrypted value. The preset processing mode is not unique, the preset processing performed by the first party belongs to the operation aiming at the plaintext, the homomorphic function operation performed by the second party belongs to the operation aiming at the ciphertext, the preset processing and the homomorphic function operation both achieve a total operation target, one part of the total operation can be realized through the plaintext operation, the other part of the total operation can be realized through the ciphertext operation, and the split mode of the total operation has multiple possibilities.

In one example, the first party performs homomorphic encryption that supports additive homomorphism for each element in a first array;

In one example, the first party takes each element in the first array as a subtrahend and 1 as a subtrahend, and obtains a processing value corresponding to each element through subtraction; the first party carries out homomorphic encryption supporting the addition homomorphic aiming at each processing value;

In step 25, the second party sends the result ciphertexts corresponding to the privacy data in the second privacy data set to the first party. It is to be understood that each private data in the second set of private data corresponds to one result ciphertext, and the number of result ciphertexts is the same as the number of private data included in the second set of private data.

For example, the second privacy data set includes privacy data 1, privacy data 2, and privacy data 3, the privacy data 1 corresponds to the result ciphertext 1, the privacy data 2 corresponds to the result ciphertext 2, the privacy data 3 corresponds to the result ciphertext 3, and the second party sends the result ciphertext 1, the result ciphertext 2, and the result ciphertext 3 to the first party.

Finally, in step 26, the first party decrypts the resulting ciphertexts, and determines the number of data shared by both parties based on the statistical result of the predetermined values in the decrypted results. It can be understood that, for data common to both parties, the element values of the aforementioned k target positions are all 1, and the corresponding decryption result is a predetermined value.

In one example, when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; and when at least one of the element values of the k target positions is 0, the value of the decryption result is a random value.

In one example, the predetermined value is 0.

It will be appreciated that in the multiplication operation, the result of multiplying 0 by the random number is still 0, and the result of multiplying a non-0 integer by the random number is a random value.

According to the method provided by the embodiment of the specification, firstly, a first party maps a first privacy data set of the first party to a bloom filter with m bits to obtain a first array with m bits; wherein a single item of private data corresponds to k locations in the bloom filter; then the first party performs homomorphic encryption on each element in the first array and sends a first ciphertext array obtained by encryption to the second party; then the second party determines k target positions of any private data in a second private data set in the second party in the bloom filter, and extracts encryption elements of the k target positions in the first ciphertext array to obtain k encryption values; performing homomorphic function operation on the k encrypted values by a second party to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; the second party sends result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; and finally, the first party decrypts the result ciphertexts, and determines the number of the data shared by the two parties according to the statistical result of the preset value in each decrypted result. As can be seen from the above, in the embodiments of the present specification, in a manner of collecting bloom filter element values and then masking the bloom filter element values with a random number, a decryption result may be either a predetermined value or a random value, thereby avoiding leakage of additional information, and improving security in determining the number of shared data that protects private data.

Fig. 4 shows an interaction diagram of a method for determining the number of shared data for protecting private data according to another embodiment, which is described by taking the example that a first party directly performs homomorphic encryption on each element in a first array, and the method employs a specific homomorphic function operation to implement aggregation of element values and random number masking with respect to the embodiment shown in fig. 2. As shown in fig. 4, the method for determining the number of shared data for protecting privacy data in this embodiment includes the steps of: step 41, the first party encodes its set as a bloom filter; step 42, the first party sends the bloom filter to the second party after homomorphic encryption; step 43, the second party takes out corresponding k encrypted elements from the bloom filter encrypted by the first party for each element of the set; step 44, after the homomorphic summation is carried out on the k encrypted elements by the second party, subtracting k from the homomorphic summation, and finally multiplying the homomorphic summation by a random number to obtain a result ciphertext corresponding to the element; step 45, the second party sends the result ciphertext corresponding to each element to the first party; and step 46, the first party decrypts all the received result ciphertexts to obtain each decryption result, and counts the number of the decryption results which are 0 as the size of the intersection. Specific execution modes of the above steps are described below.

First, at step 41, the first party encodes its set as a bloom filter. It will be appreciated that the bloom filter is the first array described above.

Wherein, the encoding process may include: and calculating k hash values for each element of the set, and setting the element of the bloom filter corresponding to the hash value as 1. The bloom filter is an array, initially with all elements 0.

The first party then sends its bloom filter homomorphically encrypted to the second party at step 42. It is understood that the homomorphic encryption is performed directly without any processing of the elements of the bloom filter.

Specifically, homomorphic encryption supporting the addition homomorphic is adopted.

Next, at step 43, the second party takes for each element of its set the corresponding k encrypted elements from the bloom filter encrypted by the first party. It will be appreciated that each element may correspond to fetching k encrypted elements.

For example, the second party calculates k hash values for each element of its set, and takes out the corresponding k encrypted elements from the bloom filter encrypted by the first party according to the k hash values.

And in step 44, the second party homomorphically sums the k encrypted elements, homomorphically subtracts k, and finally homomorphically multiplies a random number to obtain a result ciphertext corresponding to the elements. It will be appreciated that the second party operation involves a homomorphic addition operation, a homomorphic subtraction operation and a homomorphic multiplication operation.

Wherein, the support of the addition homomorphic operation means the support of the multiplication homomorphic operation of the ciphertext and the plaintext.

In step 45, the second party sends the result ciphertexts corresponding to the elements to the first party. It can be understood that the above-mentioned result ciphertext is subjected to aggregation of element values, and the aggregation result is subjected to random number masking.

Finally, in step 46, the first party decrypts all the result ciphertexts it receives to obtain each decryption result, and counts the number of decryption results as 0 as the size of intersection. It will be appreciated that the size of the intersection is the number of data that is common to both parties.

Fig. 5 is an interaction diagram illustrating a mutual data number determining method for protecting privacy data according to another embodiment, where the embodiment takes as an example that a first party performs preset processing on each element in a first array, and then performs homomorphic encryption on an obtained processed value, and the method employs a specific homomorphic function operation to implement aggregation of element values and random number masking with respect to the embodiment shown in fig. 2. As shown in fig. 5, the method for determining the number of shared data for protecting privacy data in this embodiment includes the steps of: step 51, the first party encodes its set as a bloom filter; step 52, the first party subtracts each element of the bloom filter from 1, and sends the processed bloom filter to the second party after homomorphic encryption; step 53, the second party takes out corresponding k encrypted elements from the encrypted bloom filter of the first party for each element of the set; step 54, after the homomorphic summation is carried out on the k encryption elements by the second party, the homomorphic summation is carried out on the k encryption elements, and random numbers are multiplied to obtain result ciphertexts corresponding to the elements; step 55, the second party sends the result ciphertexts corresponding to the elements to the first party; and step 56, the first party decrypts all the received result ciphertexts to obtain each decryption result, and counts the number of the decryption results which are 0 as the size of the intersection. Specific execution modes of the above steps are described below.

First, at step 51, the first party encodes its set as a bloom filter. It will be appreciated that the bloom filter is the first array described above.

Then, in step 52, the first party subtracts 1 from each element of its bloom filter, homomorphically encrypts the processed bloom filter, and sends the encrypted bloom filter to the second party. It can be understood that, after the first party performs the preset processing on each element in the bloom filter, the first party performs homomorphic encryption on the obtained processing value.

In the treated bloom filter, the element value 1 is 0 and 0 is 1, compared with the original bloom filter.

In particular, homomorphic encryption supporting the addition homomorphism is adopted.

Next, at step 53, the second party takes for each element of its set the corresponding k encrypted elements from the bloom filter encrypted by the first party. It will be appreciated that each element may correspond to fetching k encrypted elements.

And in step 54, the second party homomorphically sums the k encrypted elements and homomorphically multiplies the k encrypted elements by the random number to obtain a result ciphertext corresponding to the elements. It will be appreciated that the second party operation involves a homomorphic addition operation and a homomorphic multiplication operation.

In step 55, the second party sends the resulting ciphertexts corresponding to the elements to the first party. It can be understood that the above-mentioned result ciphertext is subjected to aggregation of element values, and the aggregation result is subjected to random number masking.

Finally, in step 56, the first party decrypts all the received result ciphertexts to obtain each decryption result, and counts the number of the decryption results as 0 as the size of the intersection. It will be appreciated that the size of the intersection is the number of data that is common to both parties.

According to an embodiment of another aspect, there is also provided a shared data number determination apparatus for protecting private data, the apparatus being provided for a second party, and the apparatus being configured to perform actions performed by the second party in the method provided by the embodiments of the present specification. Fig. 6 shows a schematic block diagram of a common data number determination apparatus for protecting privacy data according to one embodiment. As shown in fig. 6, the apparatus 600 includes:

an obtaining unit 61, configured to obtain a first ciphertext array from a first party; the first ciphertext array is obtained by mapping a first privacy data set of the first party to a bloom filter with m bits by the first party to obtain a first array with m bits, and homomorphically encrypting each element in the first array, wherein single privacy data corresponds to k positions in the bloom filter;

an extracting unit 62, configured to determine k target positions of any piece of private data in the second private data set in the bloom filter, and extract encryption elements of the k target positions in the first ciphertext array obtained by the obtaining unit 61, so as to obtain k encrypted values;

an operation unit 63, configured to perform homomorphic function operation on the k encrypted values obtained by the extraction unit 62 to obtain a result ciphertext corresponding to any one of the private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result;

a sending unit 64, configured to send result ciphertexts corresponding to the respective private data in the second private data set obtained by the operation unit 63 to the first party; so that the first party decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in the decryption results.

Optionally, as an embodiment, the operation unit 63 includes:

the first summation subunit is used for carrying out homomorphic summation on the k encrypted values to obtain a first ciphertext convergence result;

the subtraction subunit is configured to homomorphically subtract k from the first ciphertext aggregation result obtained by the first summing subunit to obtain a second ciphertext aggregation result;

and the first multiplier subunit is used for homomorphically multiplying the second ciphertext aggregation result obtained by the subtraction subunit by a random number to obtain a result ciphertext corresponding to any one piece of privacy data.

Optionally, as an embodiment, the operation unit 63 includes:

the second summation subunit is used for carrying out homomorphic summation on the k encrypted values to obtain a third ciphertext convergence result;

and the second multiplying subunit is used for homomorphically multiplying the third ciphertext aggregation result obtained by the second summing subunit by a random number to obtain a result ciphertext corresponding to any one privacy data.

With the apparatus provided in this specification, first, the obtaining unit 61 of the second party obtains the first ciphertext array from the first party; then, the extracting unit 62 determines k target positions of any private data in the second private data set in the bloom filter, and extracts the encryption elements of the k target positions in the first ciphertext array obtained by the obtaining unit 61 to obtain k encrypted values; then, the operation unit 63 performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one of the private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; finally, the sending unit 64 sends the result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; so that the first party decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in the decryption results. As can be seen from the above, in the embodiments of the present specification, in a manner of collecting bloom filter element values and then masking the bloom filter element values with a random number, a decryption result may be either a predetermined value or a random value, thereby avoiding leakage of additional information, and improving security in determining the number of shared data that protects private data.

According to an embodiment of another aspect, a shared data number determination system for protecting privacy data is also provided, and the system is used for executing the method provided by the embodiment of the specification. Fig. 7 shows a schematic block diagram of a common data number determination system for protecting private data according to one embodiment. As shown in fig. 7, the system 700 includes:

a first party 71, configured to map a first set of private data that it has to an m-bit bloom filter, resulting in a first array of m bits; wherein a single item of private data corresponds to k locations in the bloom filter; homomorphic encryption is performed on each element in the first array, and the first ciphertext array obtained through encryption is sent to the second party 72;

the second party 72 is configured to determine k target positions of any private data in the second private data set that the second party has in the bloom filter, extract encryption elements of the k target positions in the first ciphertext array, and obtain k encrypted values; performing homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one of the private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; sending result ciphertexts corresponding to the private data in the second private data set to the first party 71;

the first party 71 is further configured to decrypt each of the resulting ciphertexts, and determine the number of data shared by both parties based on a statistical result of predetermined values in each of the decrypted results.

Optionally, as an embodiment, the first party 71 is specifically configured to calculate, for any private data in the first private data set, k hash values through k hash functions, where each hash value corresponds to one location in the bloom filter; the bloom filter comprises m elements, and the initial values of the elements are all 0; and setting the value of the element of k positions corresponding to any privacy data in the bloom filter as 1 to obtain a first array of m bits.

Optionally, as an embodiment, the first party 71 is specifically configured to perform homomorphic encryption supporting addition homomorphism on each element in the first array;

the second party 72 is specifically configured to perform homomorphic summation on the k encrypted values to obtain a first ciphertext convergence result; subtracting k from the first ciphertext aggregation result in a homomorphic manner to obtain a second ciphertext aggregation result; and homomorphically multiplying the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

Optionally, as an embodiment, the first party 71 is specifically configured to take each element in the first array as a subtrahend and 1 as a subtrahend, and obtain a processing value corresponding to each element through a subtraction operation; homomorphic encryption supporting the addition homomorphic is carried out aiming at each processing value;

the second party 72 is specifically configured to perform homomorphic summation on the k encrypted values to obtain a third ciphertext convergence result; and homomorphically multiplying the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

Optionally, as an embodiment, when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; and when at least one of the element values of the k target positions is 0, the value of the decryption result is a random value.

Optionally, as an embodiment, the predetermined value is 0.

With the system provided in the embodiment of the present specification, first party 71 maps the first private data set that it has to the bloom filter of m bits, to obtain a first array of m bits; wherein a single item of private data corresponds to k locations in the bloom filter; then the first party 71 performs homomorphic encryption on each element in the first array, and sends the first ciphertext array obtained by encryption to the second party; then, the second party 72 determines k target positions of any private data in the second private data set in the bloom filter, and extracts the encryption elements of the k target positions in the first ciphertext array to obtain k encryption values; then, the second party 72 performs homomorphic function operation on the k encrypted values to obtain a result ciphertext corresponding to any one private data; the homomorphic function operation is used for converging element values of k target positions and carrying out random number masking on a convergence result; the second party 72 sends the result ciphertexts corresponding to the privacy data in the second privacy data set to the first party; finally, the first party 71 decrypts the result ciphertexts, and determines the number of data shared by the two parties according to the statistical result of the preset value in each decrypted result. As can be seen from the above, in the embodiments of the present specification, in a manner of collecting bloom filter element values and then masking the bloom filter element values with a random number, a decryption result may be either a predetermined value or a random value, thereby avoiding leakage of additional information, and improving security in determining the number of shared data that protects private data.

According to an embodiment of another aspect, there is also provided a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in connection with fig. 2, 4 or 5.

According to an embodiment of yet another aspect, there is also provided a computing device comprising a memory having stored therein executable code, and a processor that, when executing the executable code, implements the method described in connection with fig. 2, 4 or 5.

Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.

Claims

1. A method of determining a number of shared data for protecting private data, the method comprising:

2. The method of claim 1, wherein the first party mapping the first set of privacy data that the first party has to an m-bit bloom filter, comprising:

3. The method of claim 1, wherein the first party homomorphically encrypts each element in the first array, comprising:

4. The method of claim 1, wherein the first party homomorphically encrypts each element in the first array, comprising:

5. The method according to claim 1, wherein when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; and when at least one of the element values of the k target positions is 0, the value of the decryption result is a random value.

6. The method of claim 1, wherein the predetermined value is 0.

7. A method of determining a number of shared data for protecting private data, the method comprising:

8. The method of claim 7, wherein said second party performs homomorphic function operations on said k cryptographic values, comprising:

9. The method of claim 7, wherein said second party performs homomorphic function operations on said k cryptographic values, comprising:

10. A system for determining a number of shared data for protecting private data, the system comprising:

11. The system of claim 10, wherein the first party, in particular for any private data in the first set of private data, respectively computes k hash values by k hash functions, each hash value corresponding to a location in a bloom filter; the bloom filter comprises m elements, and the initial values of the elements are all 0; and setting the value of the element of k positions corresponding to any privacy data in the bloom filter as 1 to obtain a first array of m bits.

12. The system of claim 10, wherein the first party is specifically configured to perform homomorphic encryption supporting additive homomorphism for each element in the first array;

the second party is specifically configured to perform homomorphic summation on the k encrypted values to obtain a first ciphertext convergence result; subtracting k from the first ciphertext aggregation result in a homomorphic manner to obtain a second ciphertext aggregation result; and homomorphically multiplying the second ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

13. The system according to claim 10, wherein the first party is specifically configured to take each element in the first array as a subtrahend and 1 as a subtrahend, and obtain a processing value corresponding to each element by a subtraction operation; homomorphic encryption supporting the addition homomorphic is carried out aiming at each processing value;

the second party is specifically configured to perform homomorphic summation on the k encrypted values to obtain a third ciphertext convergence result; and homomorphically multiplying the third ciphertext aggregation result by a random number to obtain a result ciphertext corresponding to any privacy data.

14. The system according to claim 10, wherein when the element values of the k target positions are all 1, the value of the decryption result is the predetermined value; and when at least one of the element values of the k target positions is 0, the value of the decryption result is a random value.

15. The system of claim 10, wherein the predetermined value is 0.

16. A common data number determination apparatus that protects private data, the apparatus being provided to a second party, comprising:

17. The apparatus of claim 16, wherein the arithmetic unit comprises:

18. The apparatus of claim 16, wherein the arithmetic unit comprises:

19. A computer-readable storage medium, on which a computer program is stored which, when executed in a computer, causes the computer to carry out the method of any one of claims 1-9.

20. A computing device comprising a memory having stored therein executable code and a processor that, when executing the executable code, implements the method of any of claims 1-9.