CN109525386B - Paillier homomorphic encryption private aggregation and method based on Paillier - Google Patents

Abstract

The invention provides a Paillier homomorphic encryption private aggregation and privacy protection-based method, and relates to the technical field of network space security and privacy protection. The method comprises a agreement of a private intersection set and a reverse private intersection set based on Paillier homomorphic encryption, wherein in the agreement of the private intersection set, two parties negotiate about basic settings of the encrypted private intersection set and carry out three rounds of encryption, finally, 2 parties use private key decryption to obtain the intersection set, in the agreement of the reverse private intersection set, the two parties negotiate about the basic settings of the encrypted reverse private intersection set and carry out two rounds of encryption, then, 2 parties use the private key to decrypt the intersection set with disturbing factors and judge whether the size of the intersection base number can enter a third round of decryption, and if the conditions are met, 1 party removes the disturbing factors to obtain the intersection set. The method provides the ciphertext segmentation scheme by utilizing the property of modular operation, has higher efficiency, and both sides of the protocol can accurately calculate the base number and the sum of the intersection, thereby avoiding information leakage possibly caused by two-by-two calculation of habitual thinking.

Description

Paillier homomorphic encryption private aggregation and method based on Paillier

Technical Field

The invention relates to the technical field of network space security and privacy protection, in particular to a Paillier homomorphic encryption private aggregation and privacy protection-based method.

Background

In recent years, data shows an explosive growth trend, the data quantity and the data types become more and more complex, and a great amount of valuable customer information, personal privacy records and enterprise operation data are continuously mined. In the era of data explosion, the problem of privacy protection under big data is very important.

Privacy Set Intersection (PSI) is an important protocol for secure multiparty computation. The method participates in calculating the input data sets of two or more parties, but only the result of intersection can be obtained, and no information beyond the intersection can be obtained. The correlation protocol only allows these parties to know certain properties of the intersection, such as the cardinality of the intersection or whether the size of the intersection exceeds some threshold. Various approaches have been proposed in previous work, including protocols that use a semi-honest model as well as a malicious model.

Disclosure of Invention

Aiming at the problems in the prior art, the invention provides a Paillier homomorphic encryption private intersection set-based method, which comprises a Paillier homomorphic encryption private intersection set-based protocol and a Paillier homomorphic encryption reverse private intersection set-based protocol, wherein two parties, namely a party 1 and a party 2, exist in the two protocols, private intersection and protocol are private input data sets containing user identifiers held by the two parties, the data set of one party additionally contains integer values related to each user identifier, the two parties are not allowed to know the actual user identifier of intersection or the additional information (except the size of intersection) of the data of the other party on the basis that the two parties want to know the sum of the cardinality of intersection and the intersection related integer values, namely the privacy information of users, and the result obtained by the private intersection and protocol is that the cardinality of the party 1 can only obtain the cardinality of intersection, while 2 parties can only get an aggregate; the reverse private intersection and the protocol ensure the minimum value of the number of intersection elements by a mode of terminating communication before obtaining the intersection set if the intersection set is too small, so that the privacy information of the user is protected, and the result obtained by the reverse private intersection and the protocol is that both sides can obtain the cardinality of the intersection set, and only 1 side can obtain the intersection set.

In order to achieve the purpose, the method for encrypting the private aggregation and the private aggregation based on the Paillier homomorphic comprises a protocol based on the Paillier homomorphic encryption private aggregation and a protocol based on the Paillier homomorphic encryption reverse private aggregation;

(1) the agreement based on the Paillier homomorphic encryption private aggregation comprises the following steps:

step 1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

step 1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

step 1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[m]Wherein, the ith user u of the 1 st party_i∈U；

Step 1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j，t_j)}_j∈[n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_i∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space suitable for the security parameter lambda and defining U₂＝{v_j}_j∈[n]；

Step 1.4: each party a selects a random secret index k in the group G_a；

Step 1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

step 2: party 1 encrypts its own set of user identifiers U₁Sending the data to the 2 parties in a disordered way, and specifically comprising the following steps:

step 2.1: party 1 sets each user u in own user identifier_iApplied to a random oracle RO and then using the secret key k₁The first encryption is carried out to obtain a 1-party user ciphertext after the 1-party encryption

Step 2.2: party 1 cipher text cipher after encryption_u1Set of constructs

Sending the data to the 2 parties out of order;

and step 3: party 2 encrypts user data sent by party 1 and own user identifier set U₂And sending the data to the party 1 in a disordered way, and the specific steps are as follows:

step 3.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

The elements are encrypted for the second time to obtain the ciphertext of the party 1 encrypted by the two parties

Step 3.2: ciphertext cipher obtained by encrypting 1-party user by both parties by 2 parties_u12Set of constructs

Sending the data to the party 1 out of order;

step 3.3: party 2 uses key k₂For the input set element (v)_j，t_j) For each user identifier v in the pair_jEncrypting the elements after being applied to the RO mapping of the random oracle machine, and then using the Paillier public key pk to input the set elements (v)_j，t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

step 3.4: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

Sending the data to the party 1 out of order;

and 4, step 4: party 1 encrypts data sent from party 2 and obtains cipher_v12With a nepher_u12And then the ciphertext Pai of the integer value sum matched with the intersection is obtained according to the set H (S)_H) And sending the data to the party 2, which comprises the following steps:

step 4.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each element in (1)

Carrying out secondary encryption to obtain ciphertext after the two parties jointly encrypt the 2-party user_v12And integer value cipher text cipher paired with it_t2To pair

Step 4.2: 1-square computing cirher_v12With a nepher_u12The intersection of (H):

step 4.3: for each element H in the set H, the 1 st party will pair with H the integer value ciphertext nephr_t2＝Pai(t_j) Multiplication, homomorphically obtaining the sum S of integer values paired with the intersection_HCiphertext Pai (S)_H)：Pai(S_H)＝Pai(∑_j∈Ht_j)＝Pai.Sum({Pai(t_j)}_j∈H)；

Step 4.4: sum S of integer values that the 1 party will pair with the intersection_HCiphertext Pai (S)_H) Sending to the party 2;

and 5: party 2 decrypts the sum S of the received Paillier encrypted integer values paired with the intersection using Paillier private key sk_HCiphertext Pai (S)_H) Obtaining the sum S of integer values paired with the intersection_H；

(2) The Paillier homomorphic encryption reverse private aggregation and based protocol comprises the following steps:

s1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

s1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

s1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[m]Wherein, the ith user u of the 1 st party_i∈U；

S1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j，t_j)}_j∈[n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_j∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space adapted to the security parameter λ and defining an input set U of 2-party user identifiers₂＝{v_j}_j∈[n]；

S1.4: each party a selects a random secret index k in the group G_a；

S1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

s2: party 2 encrypts its own set of user identifiers U₂And sending the data to the party 1 in sequence, and the specific steps are as follows:

s2.1: party 2 uses key k₂For the input set element (v)_j，t_j) For each user identifier v in the pair_jEncrypting the elements applied to the random prediction machine RO, and then using Paillier public key pk to input set elements (v)_j，t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

s2.2: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

Sending the data to the 1 party in sequence;

s3: party 1 encrypts user data sent from party 2 and its own user identifier set U₁And send to 2 parties in sequenceThe method comprises the following specific steps:

s3.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each of which is

The elements are encrypted for the second time to obtain the ciphertext after the two parties encrypt the 2-party user together

And randomly choosing the mapping under Paillier modulus N (j → r)_j) Wherein r is_j∈Z⁺Through Pai (t)_j+r_j)＝Pai(t_j)×Pai(r_j) To each received in a homomorphic way

Element and user identifier v_jExpected paired related integer value t_jPerforming one-time filling encryption to finally obtain ciphertext after the two parties encrypt the 2-party user together_v12Padded cipher with its paired integer value_tr2To pair

S3.2: side 1 save map (j → r)_j) And the two parties encrypt the ciphertext after the 2 parties of the users_v12Padded cipher with its paired integer value_tr2To a set of formations

Sending the data to the 2 parties in sequence;

s3.3: party 1 uses key k₁For user u to be input into set 1_iThe method is applied to encryption of elements subjected to RO mapping of the random oracle machine to obtain the encrypted 1-party usage of the 1-partyHousehold cipher text

S3.4: party 1 cipher text cipher after encryption_u1Set of constructs

Sending the data to the 2 parties out of order;

s4: party 2 encrypts data sent by party 1 and obtains cipher_v12With a nepher_u12And filling and encrypting the subscript set J to obtain the sum S of integer values matched with the intersection_JrAnd sending the data to the party 1, which comprises the following steps:

s4.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

Performing secondary encryption to obtain a ciphertext obtained by encrypting the 1-party user by both parties

S4.2: 2-square computing cirher_v12With a nepher_u12Subscript set J of intersection:

s4.3: judging whether the intersection cardinality is smaller than a set threshold value, if so, terminating the protocol by the 2-party, and if not, continuing S4.4;

s4.4: the 2 nd party converts all elements Pai (t) corresponding to subscripts in the subscript set J_j+r_j) Multiplying, and decrypting by using a private key sk to obtain a sum S of integer values matched with the intersection and provided with one-time filling encryption_Jr＝∑_j∈Jt_j+r_j；

S4.5: 2-party sum S of encrypted integer values paired with intersection_JrAnd sending the subscript set J to the party 1;

s5: 1-way computation of the sum of integer values paired with an intersection

The invention has the beneficial effects that:

the invention provides a Paillier homomorphic encryption private aggregation and based method, which researches and adopts a Paillier homomorphic encryption based algorithm, utilizes the property of modular operation to provide a ciphertext segmentation scheme, segments and encrypts a plaintext, has higher efficiency, and can obtain the result of the encrypted plaintext without decryption. According to the agreement based on the Paillier homomorphic encryption private intersection set and the agreement based on the Paillier homomorphic encryption reverse private intersection set, both parties of the agreement can accurately calculate the base number and the intersection sum of the intersection set, information leakage possibly caused by two-by-two calculation of habitual thinking is avoided, if the base number of the set is found to be too small in the reverse private intersection set and the agreement, in order to prevent the intersection set from being acquired by a certain party, and therefore private information of certain users is deduced, and privacy of the users is leaked, the problem of privacy leakage is effectively prevented by adopting a protocol termination mode, in the process of adopting the Paillier homomorphic encryption, one party randomly selects mapping to carry out blind processing on the encrypted user id related integer values, before the intersection sum is obtained, blind factors are removed according to the mapping, and safety of the agreement is greatly improved.

Drawings

FIG. 1 is a diagram of private intersection and protocol architecture in an embodiment of the present invention;

FIG. 2 is a diagram illustrating private intersection and protocol timing diagrams in an embodiment of the present invention;

FIG. 3 is a flow diagram of private intersection and protocol in an embodiment of the present invention;

FIG. 4 is a diagram of reverse private aggregation and protocol architecture in an embodiment of the present invention;

FIG. 5 is a timing diagram of reverse private aggregation and protocol in an embodiment of the present invention;

fig. 6 is a flow chart of reverse private aggregation and protocol in an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail with reference to the accompanying drawings and specific embodiments. The specific embodiments described herein are merely illustrative of the invention and are not intended to be limiting.

A method for encrypting private collections based on Paillier homomorphic encryption comprises a protocol based on the Paillier homomorphic encryption private collections and a protocol based on the Paillier homomorphic encryption reverse private collections;

(1) paillier homomorphic encryption private aggregation and based protocol

In this embodiment, an architecture based on Paillier homomorphic encryption private intersection and protocol is shown in fig. 1, in the private intersection and protocol, two parties input all user resource identifier sets of themselves, and when outputting, party 1 obtains the cardinality of the intersection, and party 2 obtains the intersection. Two parties of the private intersection and protocol implement the process of aggregation and aggregation through setup and three rounds of interaction, as shown in fig. 2.

As can be seen from fig. 2, in the setup step, both parties agree on a security parameter λ, a group G ∈ G (λ), and a user identifier space U ═ U (λ). Both parties can use a random oracle RO: u → G. First round, 1 square with k₁Encrypts its own set of user identifiers and sends it to party 2. Second round, 2 squares with k₂Encrypting the set sent by party 1 and using k₂And pk encrypts its own set of user identifiers and sends it to party 1. Calculating to obtain the cirher by 1 square_v12With a nepher_u12The intersection of (a). The third round, party 1 sends the encrypted set H to party 2, party 2 uses sk decryption to get the sum of integer values paired with the intersection, i.e. the intersection and S_H。

In the present embodiment, for convenience of the following description, the representation and explanation shown in table 1 are given.

TABLE 1 symbolic description of communications between entities

The specific flow is shown in fig. 3, and includes the following steps:

step 1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

step 1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

step 1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[m]Wherein, the ith user u of the 1 st party_i∈U；

Step 1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j，t_j)}_j∈[n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_j∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space suitable for the security parameter lambda and defining U₂＝{v_j}_j∈[n]；

Step 1.4: each party a selects a random secret index k in the group G_a；

Step 1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

step 2: party 1 encrypts its own set of user identifiers U₁Sending the data to the 2 parties in a disordered way, and specifically comprising the following steps:

step 2.1: party 1 sets each user u in own user identifier_iApplied to a random oracle RO and then using the secret key k₁The first encryption is carried out to obtain a 1-party user ciphertext after the 1-party encryption

Step 2.2: party 1 will encryptLater user ciphertext_u1Set of constructs

Sending the data to the 2 parties out of order;

and step 3: party 2 encrypts user data sent by party 1 and own user identifier set U₂And sending the data to the party 1 in a disordered way, and the specific steps are as follows:

step 3.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

The elements are encrypted for the second time to obtain the ciphertext of the party 1 encrypted by the two parties

Step 3.2: ciphertext cipher obtained by encrypting 1-party user by both parties by 2 parties_u12Set of constructs

Sending the data to the party 1 out of order;

step 3.3: party 2 uses key k₂For the input set element (v)_j，t_j) For each user identifier v in the pair_jEncrypting the elements after being applied to the RO mapping of the random oracle machine, and then using the Paillier public key pk to input the set elements (v)_j，t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

step 3.4: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

Sending the data to the party 1 out of order;

and 4, step 4: party 1 encrypts data sent from party 2 and obtains cipher_v12With a nepher_u12And then the ciphertext Pai of the integer value sum matched with the intersection is obtained according to the set H (S)_H) And sending the data to the party 2, which comprises the following steps:

step 4.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each element in (1)

Carrying out secondary encryption to obtain ciphertext after the two parties jointly encrypt the 2-party user_vl2And integer value cipher text cipher paired with it_t2To pair

Step 4.2: 1-square computing cirher_v12With a nepher_u12The intersection of (H):

step 4.3: for each element H in the set H, the 1 st party will pair with H the integer value ciphertext nephr_t2＝Pai(t_j) Multiplication, homomorphically obtaining the sum S of integer values paired with the intersection_HCiphertext Pai (S)_H)：Pai(S_H)＝Pai(∑_j∈Ht_j)＝Pai.Sum({Pai(t_j)}_j∈H)；

Step 4.4: sum S of integer values that the 1 party will pair with the intersection_HCiphertext Pai (S)_H) Sending to the party 2;

and 5: party 2 decrypts the sum S of the received Paillier encrypted integer values paired with the intersection using Paillier private key sk_HCiphertext Pai (S)_H) Obtaining the aggregate and S_H；

(2) Paillier homomorphic encryption reverse private aggregation and based protocol

In this embodiment, the framework based on Paillier homomorphic encryption reverse private intersection and protocol is as shown in fig. 4, in the reverse private intersection and protocol, both parties also input all their own user resource identifier sets, and the protocol is terminated if the intersection cardinality is too small during output. Otherwise, the 1 party obtains the base number of the intersection and the intersection set, and the 2 party obtains the base number of the intersection set. Two parties of the reverse private intersection and protocol implement the intersection and set process through setup and three rounds of interaction, as shown in fig. 5.

As can be seen from fig. 5, in the setup step, both parties agree on a security parameter λ, a group G ∈ G (λ), and a user identifier space U ═ U (λ). Both parties can use a random oracle RO: u → G. First round, 2 squares with k₂And pk encrypts its own set of user identifiers and sends it to party 1. Second round, 1 square with k₁Encrypt its own set of user identifiers, k for each element in the set sent by 2 parties₁After encrypting the user identifier, a scrambling factor is added and sent to party 2. Calculating by 2-square to obtain the nepher_v12With a nepher_u12A set J of intersecting indices, and a sum S of integer values paired with the intersection with a disturbing factor is decrypted using sk_JrIf the intersection cardinality is too small, the protocol is terminated. Third round, the 2 nd party will have the sum S of the integer values paired with the intersection of the perturbing factor_JrAnd sending the subscript set J to the 1 side, and removing the disturbing factors by the 1 side to obtain the sum of integer values matched with the intersection, namely the intersection and the S_J。

The specific flow is shown in fig. 6, and includes the following steps:

s1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

s1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

s1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[m]Wherein, the ith user u of the 1 st party_i∈U；

S1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j，t_j)}_j∈[n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_j∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space adapted to the security parameter λ and defining an input set U of 2-party user identifiers₂＝{v_j}_j∈[n]；

S1.4: each party a selects a random secret index k in the group G_a；

S1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

s2: party 2 encrypts its own set of user identifiers U₂And sending the data to the party 1 in sequence, and the specific steps are as follows:

s2.1: party 2 uses key k₂For the input set element (v)_j，t_j) For each user identifier v in the pair_jEncrypting the elements applied to the random prediction machine RO, and then using Paillier public key pk to input set elements (v)_j，t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

s2.2: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

Sending the data to the 1 party in sequence;

s3: party 1 encrypts user data sent from party 2 and its own user identifier set U₁And sending the data to the 2 parties in sequence, and the concrete steps are as follows:

s3.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each of which is

The elements are encrypted for the second time to obtain the ciphertext after the two parties encrypt the 2-party user together

And randomly choosing the mapping under Paillier modulus N (j → r)_j) Wherein r is_j∈Z⁺Through Pai (t)_j+r_j)＝Pai(t_j)×Pai(r_j) To each received in a homomorphic way

Element and user identifier v_jExpected paired related integer value t_jPerforming one-time filling encryption to finally obtain ciphertext after the two parties encrypt the 2-party user together_v12Padded cipher with its paired integer value_tr2To pair

S3.2: side 1 save map (j → r)_i) And the two parties encrypt the ciphertext after the 2 parties of the users_v12Padded cipher with its paired integer value_tr2To a set of formations

Sending the data to the 2 parties in sequence;

S3.3: party 1 uses key k₁For user u to be input into set 1_iThe method is applied to encryption of elements after RO mapping of the random prediction machine to obtain 1-party user ciphertext after 1-party encryption

S3.4: party 1 cipher text cipher after encryption_u1Set of constructs

Sending the data to the 2 parties out of order;

s4: the data sent by the party 1 is encrypted by the party 2, a subscript set J of the integer value sum matched with the intersection is obtained, and then the subscript set J is subjected to filling encryption to obtain the sum S of the integer value sum matched with the intersection_JrAnd sending the data to the party 1, which comprises the following steps:

s4.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

Performing secondary encryption to obtain a ciphertext obtained by encrypting the 1-party user by both parties

S4.2: 2-square computing cirher_v12With a nepher_u12Subscript set J of intersection:

s4.3: judging whether the intersection cardinality is smaller than a set threshold value, if so, terminating the protocol by the 2-party, and if not, continuing S4.4;

s4.4: the 2 nd party converts all elements Pai (t) corresponding to subscripts in the subscript set J_j+r_j) Multiplying, and decrypting by using a private key sk to obtain a sum S of integer values matched with the intersection and provided with one-time filling encryption_Jr＝∑_j∈Jt_j+r_j；

S4.5: 2 Party pairs encrypted with intersectionSum of integer values of S_JrAnd sending the subscript set J to the party 1;

s5: 1-way computation of the sum of integer values paired with an intersection

Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art; the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; such modifications and substitutions do not depart from the spirit and scope of the corresponding technical solutions as defined in the appended claims.

Claims (7)

1. A method for encrypting private collections based on Paillier homomorphic encryption is characterized by comprising a protocol based on the Paillier homomorphic encryption private collections and a protocol based on the Paillier homomorphic encryption reverse private collections;

(1) the agreement based on the Paillier homomorphic encryption private aggregation comprises the following steps:

step 1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

step 1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

step 1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[1,m]Wherein, the ith user u of the 1 st party_i∈U；

Step 1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j,t_j)}_j∈[1,n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_j∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space suitable for the security parameter lambda and defining U₂＝{v_j}_j∈[1,n]；

Step 1.4: each party a selects a random secret index k in the group G_a；

Step 1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

step 2: party 1 encrypts its own set of user identifiers U₁Sending the data to the 2 parties out of order;

and step 3: party 2 encrypts user data sent by party 1 and own user identifier set U₂Sending the data to the party 1 out of order;

and 4, step 4: party 1 encrypts data sent from party 2 and obtains cipher_v12With a nepher_u12And then the ciphertext Pai of the integer value sum matched with the intersection is obtained according to the set H (S)_H) And sending to party 2; said

The cipher text obtained by encrypting the identifier of the user on the 1 side by the 1, 2 sides; said

The cipher text obtained by encrypting the identifier of the user of the 2 parties by the 1 and 2 parties; k is a radical of₁A key used for party 1; k is a radical of₂A key used for party 2;

and 5: party 2 decrypts the sum S of the received Paillier encrypted integer values paired with the intersection using Paillier private key sk_HCiphertext Pai (S)_H) Obtaining the sum S of integer values paired with the intersection_H；

(2) The Paillier homomorphic encryption reverse private aggregation and based protocol comprises the following steps:

s1: the two parties negotiate about the basic setting of the encryption private transaction set, and the specific steps are as follows:

s1.1: the two parties negotiate to set a security parameter lambda, a group G epsilon G (lambda), a user identifier space U ═ U (lambda) and a random speaker RO: u → G, where the random oracle RO maps the user identifier into a random element of group G;

s1.2: input set U with m user identifiers held by 1 party₁＝{u_i}_i∈[1,m]Wherein, the ith user u of the 1 st party_i∈U；

S1.3: party 2 holds a set of n user identifiers and associated integer values with which to pair { (v)_j,t_j)}_j∈[1,n]Wherein, the jth user v of the 2 parties_jE and associated integer value t of the expected pairing with U_j∈Z⁺，Z⁺For positive integers, sum of private sums ∑ t_jA Paillier message space adapted to the security parameter λ and defining an input set U of 2-party user identifiers₂＝{v_j}_j∈[1,n]；

S1.4: each party a selects a random secret index k in the group G_a；

S1.5: generating a new key pair (pk, sk) by the 2 parties by using a Pai.Gen (lambda) function in the Pailler encryption scheme, and sharing the public key pk to the 1 party;

s2: party 2 encrypts its own set of user identifiers U₂And sending the data to the 1 party in sequence;

s3: party 1 encrypts user data sent from party 2 and its own user identifier set U₁And send to 2 parties in order;

s4: party 2 encrypts data sent by party 1 and obtains cipher_v12With a nepher_u12And filling and encrypting the subscript set J to obtain the sum S of integer values matched with the intersection_JrAnd sending to the party 1;

s5: 1-way computation of the sum of integer values paired with an intersection

Under Paillier modulus N, the mapping is chosen randomly (j → r)_j) Wherein r is_j∈Z⁺。

2. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step 2 comprises the steps of:

step 2.1: party 1 sets each user u in own user identifier_iApplied to a random oracle RO and then using the secret key k₁The first encryption is carried out to obtain a 1-party user ciphertext after the 1-party encryption

Step 2.2: party 1 cipher text cipher after encryption_u1Set of constructs

And sending the data to the 2 parties out of order.

3. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step 3 comprises the steps of:

step 3.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

The elements are encrypted for the second time to obtain the ciphertext of the party 1 encrypted by the two parties

Step 3.2: ciphertext cipher obtained by encrypting 1-party user by both parties by 2 parties_u12Set of constructs

Sending the data to the party 1 out of order;

step 3.3: party 2 uses key k₂For the input set element (v)_j,t_j) For each user identifier v in the pair_jEncrypting the elements after being applied to the RO mapping of the random oracle machine, and then using the Paillier public key pk to input the set elements (v)_j,t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

step 3.4: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

And sending the data out of order to the 1 party.

4. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step 4 comprises the steps of:

step 4.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each element in (1)

Carrying out secondary encryption to obtain ciphertext after the two parties jointly encrypt the 2-party user_v12And integer value cipher text cipher paired with it_t2To pair

Step 4.2: 1-square computing cirher_v12With a nepher_u12The intersection of (H):

step 4.3: for each element H in the set H, the 1 st party will pair with H the integer value ciphertext nephr_t2＝Pai(t_j) Multiplication, homomorphically obtaining the sum S of integer values paired with the intersection_HCiphertext Pai (S)_H)：Pai(S_H)＝Pai(∑_j∈Ht_j)＝Pai.Sum({Pai(t_j)}_j∈H)；

Step 4.4: sum S of integer values that the 1 party will pair with the intersection_HCiphertext Pai (S)_H) And sending to the 2 side.

5. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step S2 comprises the steps of:

s2.1: party 2 uses key k₂For the input set element (v)_j,t_j) For each user identifier v in the pair_jEncrypting the elements applied to the random prediction machine RO, and then using Paillier public key pk to input set elements (v)_j,t_j) With each user identifier v in the pair_jExpected paired related integer value t_jEncrypting to obtain 2-party encrypted user ciphertext

Ciphertext cipher of integer value paired with 2-party encrypted 2-party user_t2＝Pai(t_j) Carrying out pairing;

s2.2: party 2 cipherer for encrypted user ciphertext_v2And integer value cipher text cipher paired with it_t2To a set of formations

And the information is sent to the 1 party in sequence.

6. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step S3 comprises the steps of:

s3.1: party 1 uses key k₁Cipher text cipher for received 2-party encrypted user_v2And integer value cipher text cipher paired with it_t2To a set of formations

Each of which is

The elements are encrypted for the second time to obtain the ciphertext after the two parties encrypt the 2-party user together

And randomly choosing the mapping under Paillier modulus N (j → r)_j) Wherein r is_j∈Z⁺Through Pai (t)_j+r_j)＝Pai(t_j)×Pai(r_j) To each received in a homomorphic way

Element and user identifier v_jExpected paired related integer value t_jPerforming one-time filling encryption to finally obtain ciphertext after the two parties encrypt the 2-party user together_v12Padded cipher with its paired integer value_tr2To pair

S3.2: side 1 save map (j → r)_j) And the two parties encrypt the ciphertext after the 2 parties of the users_v12Padded cipher with its paired integer value_tr2To a set of formations

Sending the data to the 2 parties in sequence;

s3.3: party 1 uses key k₁For user u to be input into set 1_iApplication to random predictionEncrypting the elements after RO mapping to obtain 1-party encrypted 1-party user ciphertext

S3.4: party 1 cipher text cipher after encryption_u1Set of constructs

And sending the data to the 2 parties out of order.

7. The Paillier homomorphic encryption private aggregation and based method of claim 1, wherein the step S4 comprises the steps of:

s4.1: party 2 uses key k₂Receiving 1 party user cipher text after 1 party encryption

Performing secondary encryption to obtain a ciphertext obtained by encrypting the 1-party user by both parties

S4.2: 2-square computing cirher_v12With a nepher_u12Subscript set J of intersection:

s4.3: judging whether the intersection cardinality is smaller than a set threshold value, if so, terminating the protocol by the 2-party, and if not, continuing S4.4;

s4.4: the 2 nd party converts all elements Pai (t) corresponding to subscripts in the subscript set J_j+r_j) Multiplying, and decrypting by using a private key sk to obtain a sum S of integer values matched with the intersection and provided with one-time filling encryption_Jr＝∑_j∈Jt_j+r_j；

S4.5: 2-party sum S of encrypted integer values paired with intersection_JrAnd subscript set J is sent to party 1.

Images