WO2022237103A1 - 一种隐私求并集方法及装置 - Google Patents

一种隐私求并集方法及装置 Download PDF

Info

Publication number
WO2022237103A1
WO2022237103A1 PCT/CN2021/130448 CN2021130448W WO2022237103A1 WO 2022237103 A1 WO2022237103 A1 WO 2022237103A1 CN 2021130448 W CN2021130448 W CN 2021130448W WO 2022237103 A1 WO2022237103 A1 WO 2022237103A1
Authority
WO
WIPO (PCT)
Prior art keywords
participant
tuple
commitment
preset
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/130448
Other languages
English (en)
French (fr)
Inventor
王朝阳
严强
李昊轩
廖飞强
李辉忠
张开翔
范瑞彬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
WeBank Co Ltd
Original Assignee
WeBank Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by WeBank Co Ltd filed Critical WeBank Co Ltd
Publication of WO2022237103A1 publication Critical patent/WO2022237103A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • the present invention relates to financial technology (Fintech), in particular to a privacy union method and device.
  • the privacy union means that each participant has a set, and the participant can obtain the set intersection of all participants after going through the privacy union algorithm, but does not know any other participants except the union and its own set
  • the content of the set realizes the effect of protecting the privacy of the set content of the participants in the process of union.
  • there is currently no private method for union which is an urgent problem to be solved.
  • the invention provides a method and device for obtaining a union of privacy, which solves the problem that there is no method for obtaining a union of privacy in the prior art.
  • the present invention provides a privacy union method, including: a first participant generates a first set of judgment rules; the judgment rules correspond to multiple sub-items, and the multiple sub-items are used to determine the judgment rules , the judging rule is used to judge whether any element is an element in the first set;
  • the first participant For any subitem of the plurality of subitems, the first participant generates a commitment for the subitem according to a preset commitment algorithm based on the private key and the first confusion information of the subitem; the preset commitment The algorithm has homomorphism, and the commitments of the multiple subitems are used by the second participant to generate at least one tuple;
  • the first participant obtains the at least one tuple from the second participant; for any tuple in the at least one tuple, the tuple represents a corresponding element in the second set, the The tuple is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, the commitment of the tuple in the second set
  • the second obfuscation information of the corresponding element is obtained according to the preset commitment algorithm;
  • the first participant obtains elements in the second set other than the first set according to the private key and the at least one tuple, and according to the first set and the second set elements other than the first set, obtain the union of the first set and the second set.
  • the judgment rule corresponds to the commitment of multiple sub-items for the second participant to generate at least one tuple, and any tuple in the at least one tuple represents that in the second elements corresponding to the set, the first participant only obtains elements in the second set other than the first set according to the private key and the at least one tuple, but does not know the elements of the first set Which elements are specifically included in the two sets, so that the union of the first set and the second set is obtained, and the multi-party privacy union is realized.
  • the elements in the first set are all positive integers
  • the judgment rule is a polynomial
  • the multiple sub-items are the coefficients of each sub-term of the polynomial
  • the preset commitment algorithm is a preset elliptic curve Algorithm
  • the preset elliptic curve algorithm corresponds to the first base point, the second base point and the commitment public key
  • the commitment public key is obtained according to the private key and the second base point
  • the first participant generates a commitment for the subitem according to the private key and the first obfuscation information of the subitem according to a preset commitment algorithm, including:
  • the first participant According to the private key, the first obfuscation information of the subitem, the first base point, the second base point, and the commitment public key, the first participant generates The promise of the subkey.
  • the elements in the first set are all positive integers, and when the judgment rule is a polynomial, since the preset elliptic curve algorithm has a small amount of calculation and high security performance, the sub-items can be enhanced The generation efficiency of commitments.
  • the first participant uses the following formula, according to the private key, the first confusion information of the subitem, the first base point, the second base point, and the commitment public key, according to the The above preset elliptic curve algorithm, generating the commitment of the child:
  • x is the sub-item
  • E(x) is the commitment of the sub-item
  • G1 is the first base point
  • G2 is the second base point
  • r1 is the first confusion information of the sub-item
  • H is the The above-mentioned commitment public key
  • sk is the above-mentioned private key.
  • the tuple includes a first subpart and a second subpart;
  • the first subpart is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, and the tuple in the second set.
  • the second confusion information of the elements corresponding to the second set is obtained according to the preset commitment algorithm;
  • the second subpart is the commitment of the second participant to the element corresponding to the tuple in the second set and the second confusion information of the element corresponding to the tuple in the second set, according to obtained by the preset commitment algorithm.
  • both the first sub-part and the second sub-part in the tuple use the commitment of the second participant according to the element corresponding to the tuple in the second set, the tuple in the The second confusion information of the elements corresponding to the second set, and the first sub-part uses the elements corresponding to the tuple in the second set, so the two sub-parts of the tuple can put the tuple in the The corresponding elements of the second set are implicitly included.
  • the first participant obtains elements in the second set other than the first set according to the private key and the at least one tuple, including:
  • the first participant obtains the denominator analysis item and the numerator of the tuple according to the first subpart of the tuple and the second subpart of the tuple Parse item;
  • the first participant and the second participant are on the same block chain, and the method further includes: the first participant sends commitments of the plurality of subitems to the block On the chain: the commitment of the plurality of subitems is used by the second participant to obtain from the blockchain.
  • the first participant sends the commitments of the multiple subitems to the blockchain, so that there is no need to frequently send the commitments of the multiple subitems, even if the second participant needs to acquire multiple times, It can also be obtained directly from the block chain, thereby improving the efficiency of obtaining the commitments of the multiple subitems.
  • the first participant is any one of multiple participants, and the first participant obtains the private key in the following manner:
  • the first participant obtains the fragmentation homomorphism information of at least one participant through a preset privacy interaction protocol according to the fragmentation homomorphism information of the first participant, wherein the fragmentation homomorphism information of any participant
  • the information is obtained according to the preset homomorphic encryption operation according to the shard key of the participant; the at least one participant is a participant of the plurality of participants except the first participant;
  • the first participant acquires the private key according to the preset homomorphic encryption operation according to the fragment homomorphic information of the first participant and the fragment homomorphic information of the at least one participant.
  • the first participant can The fragmented homomorphic information of each party, through the preset privacy interaction protocol, obtains the fragmented homomorphic information of at least one participant, so as to jointly obtain the private key through a joint method, avoiding a single participant from doing evil, and improving the privacy of the union. safety.
  • the present invention provides a privacy union device, including:
  • a generating module configured to generate a judgment rule of the first set; the judgment rule corresponds to a plurality of subitems, and the plurality of subitems are used to determine the judgment rule, and the judgment rule is used to judge whether any element is the first elements of a set;
  • the preset commitment algorithm has the same Stateful, the commitment of the plurality of subitems is used by the second participant to generate at least one tuple;
  • An acquisition module configured to acquire the at least one tuple from the second participant; for any tuple in the at least one tuple, the tuple represents the corresponding element in the second set, and the tuple
  • the group is the second participant’s commitment according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, and the commitment of the element corresponding to the tuple in the second set
  • the second obfuscation information of the element is obtained according to the preset commitment algorithm;
  • the elements in the first set are all positive integers
  • the judgment rule is a polynomial
  • the multiple sub-items are the coefficients of each sub-term of the polynomial
  • the preset commitment algorithm is a preset elliptic curve Algorithm
  • the preset elliptic curve algorithm corresponds to the first base point, the second base point and the commitment public key
  • the commitment public key is obtained according to the private key and the second base point
  • the generating module is specifically used for:
  • the first confusion information of the subitem, the first base point, the second base point, and the commitment public key According to the private key, the first confusion information of the subitem, the first base point, the second base point, and the commitment public key, according to the preset elliptic curve algorithm, generate the commitment of the subitem .
  • the generation module is specifically configured to: according to the following formula, according to the private key, the first obfuscation information of the subitem, the first base point, the second base point, and the commitment public key, According to the preset elliptic curve algorithm, generate the commitment of the child:
  • x is the sub-item
  • E(x) is the commitment of the sub-item
  • G1 is the first base point
  • G2 is the second base point
  • r1 is the first confusion information of the sub-item
  • H is the The above-mentioned commitment public key
  • sk is the above-mentioned private key.
  • the tuple includes a first subpart and a second subpart;
  • the first subpart is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, and the tuple in the second set.
  • the second confusion information of the elements corresponding to the second set is obtained according to the preset commitment algorithm;
  • the second subpart is the commitment of the second participant to the element corresponding to the tuple in the second set and the second confusion information of the element corresponding to the tuple in the second set, according to obtained by the preset commitment algorithm.
  • the acquiring module is specifically used for:
  • any tuple in the at least one tuple according to the first subpart of the tuple and the second subpart of the tuple, obtain the denominator analysis item and the numerator analysis item of the tuple;
  • the device is executed by the first participant, and the first participant and the second participant are on the same block chain, and the device also includes a sending module, and the sending module specifically uses In: sending the commitments of the multiple subitems to the blockchain; the commitments of the multiple subitems are used by the second participant to obtain from the blockchain.
  • the device is a device executed by a first participant, and the first participant is any one of multiple participants, and the acquisition module specifically acquires the private key in the following manner:
  • the sharding homomorphic information of the first participant is obtained through a preset privacy interaction protocol, wherein the sharding homomorphic information of any participant is based on the participant
  • the shard key is obtained according to the preset homomorphic encryption operation; the at least one participant is a participant of the plurality of participants except the first participant;
  • the private key is obtained according to the preset homomorphic encryption operation according to the fragment homomorphic information of the first participant and the fragment homomorphic information of the at least one participant.
  • the present invention provides a computer device, including a program or an instruction, and when the program or instruction is executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.
  • the present invention provides a storage medium, including a program or an instruction, and when the program or instruction is executed, is used to execute the above-mentioned first aspect and each optional method of the first aspect.
  • FIG. 1 is a schematic flowchart corresponding to a privacy union method provided by an embodiment of the present invention
  • Fig. 2 is a schematic structural diagram of a privacy union device provided by an embodiment of the present invention.
  • a*G Indicates the dot multiplication operation of scalar a and any point G on the elliptic curve, * is the dot multiplication operation, and the operation result is still a point on the elliptic curve.
  • the privacy union means that each participant has a set, and the participant can obtain the set intersection of all participants after going through the privacy union algorithm, but does not know any other participants except the union and its own set
  • the content of the set realizes the effect of protecting the privacy of the set content of the participants in the process of union.
  • Blockchain is a chain composed of a series of blocks. In addition to recording the data of this block, each block also records the Hash value of the previous block. In this way, a chain is formed.
  • cryptography technology There are two core concepts of the blockchain, one is cryptography technology, and the other is the idea of decentralization. Based on these two concepts, the historical information on the blockchain cannot be tampered with.
  • blockchain technology can be used to disclose the characteristics of accessibility and tamper-proof, as a public database for securely storing data.
  • the present invention provides a privacy union method.
  • Step 101 The first participant generates a first set of judgment rules.
  • Step 102 For any subitem of the plurality of subitems, the first participant generates a commitment for the subitem according to a preset commitment algorithm according to the private key and the first obfuscation information of the subitem.
  • Step 103 The first participant obtains the at least one tuple from the second participant.
  • Step 104 The first participant obtains elements in the second set other than the first set according to the private key and the at least one tuple, and according to the first set and the For elements in the second set other than the first set, obtain the union of the first set and the second set.
  • the judgment rule corresponds to a plurality of sub-items, and the multiple sub-items are used to determine the judgment rule, and the judgment rule is used to judge whether any element is an element in the first set element.
  • the preset commitment algorithm has homomorphism, and the commitments of the multiple subitems are used by the second participant to generate at least one tuple. For any tuple in the at least one tuple, the tuple represents the corresponding element in the second set, and the tuple is the corresponding element in the second set according to the tuple of the second participant.
  • the element, the commitment of the element corresponding to the tuple in the second set, and the second confusion information of the element corresponding to the tuple in the second set are obtained according to the preset commitment algorithm.
  • the participants are P1, P2, ..., Pn, where n can be any positive integer.
  • the set owned by the participant Pi is Si, and the elements in the set are any numbers.
  • P1 is the first participant, and the set owned by P1 is the first set S1;
  • P2 is the second participant, and the set owned by P2 is the second set S2.
  • described judging rule can have multiple situations, can adopt regular expression as judging rule, can judge whether certain element is the element in the first set through regular expression, and regular expression corresponds to Multiple subitems of can be character strings and metacharacters in regular expressions, or information that can be mapped to character strings and metacharacters in regular expressions, such as using a0a0 to map " ⁇ ".
  • Judgment rules can also use logical expressions, and multiple sub-items corresponding to logical expressions can use logical conjunctions such as "and", "or” and “not” and logical conditions, so as to determine whether an element is an element in the first set, or There are many forms, as long as it can be determined whether any element is an element in the first set.
  • the commitment of the subitem can be a zero-knowledge proof of the subitem, and the subitem can be represented in an implicit form, and the commitment of the element corresponding to the tuple in the second set can be the zero of the element corresponding to the tuple in the second set In the proof of knowledge, the element corresponding to the tuple in the second set may be represented in an implicit form.
  • the elements in the first set are all positive integers
  • the judgment rule is a polynomial
  • the multiple sub-items are the coefficients of each sub-term of the polynomial
  • the preset commitment algorithm is A preset elliptic curve algorithm
  • the preset elliptic curve algorithm corresponds to the first base point, the second base point, and the commitment public key
  • the commitment public key is obtained according to the private key and the second base point.
  • n is a positive integer
  • the first participant generates a commitment for the subitem according to the private key and the first obfuscation information of the subitem according to a preset commitment algorithm, including:
  • the first participant According to the private key, the first obfuscation information of the subitem, the first base point, the second base point, and the commitment public key, the first participant generates The promise of the subkey.
  • the elements in the first set are all positive integers, and when the judgment rule is a polynomial, since the preset elliptic curve algorithm has a small amount of calculation and high security performance, the sub-items can be enhanced The generation efficiency of commitments.
  • the first participant uses the following formula, according to the private key, the first confusion information of the subitem, the first base point, the second base point, and the commitment public key, according to the The above preset elliptic curve algorithm, generating the commitment of the child:
  • x is the sub-item
  • E(x) is the commitment of the sub-item
  • G1 is the first base point
  • G2 is the second base point
  • r1 is the first confusion information of the sub-item
  • H is the The above-mentioned commitment public key
  • sk is the above-mentioned private key.
  • the private key and public key are used to cover up the information released by the first participant, and the private key is also used to restore the masked value at the end to obtain the union of the set of other participants and the first set of the first participant.
  • the elements in the first set are all positive integers
  • the judgment rule is a polynomial
  • the multiple sub-items are the coefficients of each sub-term of the polynomial
  • the preset commitment algorithm is a preset elliptic curve Algorithm
  • the preset elliptic curve algorithm corresponds to the first base point, the second base point and the commitment public key
  • the commitment public key is obtained according to the private key and the second base point
  • the first participant generates a commitment for the subitem according to the private key and the first obfuscation information of the subitem according to a preset commitment algorithm, including:
  • the first participant According to the private key, the first obfuscation information of the subitem, the first base point, the second base point, and the commitment public key, the first participant generates The promise of the subkey.
  • the elements in the first set are all positive integers, and when the judgment rule is a polynomial, since the preset elliptic curve algorithm has a small amount of calculation and high security performance, the sub-items can be enhanced The generation efficiency of commitments.
  • the first participant uses the following formula, according to the private key, the first confusion information of the subitem, the first base point, the second base point, and the commitment public key, according to the The above preset elliptic curve algorithm, generating the commitment of the child:
  • x is the sub-item
  • E(x) is the commitment of the sub-item
  • G1 is the first base point
  • G2 is the second base point
  • r1 is the first confusion information of the sub-item
  • H is the The above-mentioned commitment public key
  • sk is the above-mentioned private key.
  • the multiple sub-items that is, the coefficients of each sub-item are: 1, -6, 11, 6 respectively.
  • the first participant and the second participant are on the same blockchain.
  • the first participant sends the commitments of the multiple subitems to the blockchain; the commitments of the multiple subitems are used by the second participant to obtain them from the blockchain.
  • the first participant sends the commitments of the multiple subitems to the blockchain, so that there is no need to frequently send the commitments of the multiple subitems, even if the second participant needs to acquire multiple times, It can also be obtained directly from the block chain, thereby improving the efficiency of obtaining the commitments of the multiple subitems.
  • the tuple includes a first subpart and a second subpart;
  • the first subpart is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, and the tuple in the second set.
  • the second confusion information of the elements corresponding to the second set is obtained according to the preset commitment algorithm;
  • the second sub-part is the commitment of the second participant to the element corresponding to the tuple in the second set, and the second confusion information of the element corresponding to the tuple in the second set, according to obtained by the preset commitment algorithm.
  • the second participant can obtain at least one tuple in the following manner:
  • the second set S2 of the second participants P2 ⁇ 3,4,5 ⁇ .
  • P2 will calculate the commitment E(f1(3)) of f1(3) according to the homomorphic property of the preset commitment algorithm.
  • coefficients are respectively the coefficient commitments of each sub-item obtained from the first participant.
  • P2 calculates elements 4 and 5 according to the homomorphic property of the default commitment algorithm to obtain E(f1(4)) and E(f(5)).
  • the second participant P2 selects (second obfuscation information) a random number r2_1 for element 3, selects a random number r2_2 for element 4, and selects a random number r2_3 for element 5.
  • r2_i represents the random number selected by P2 for its i-th element).
  • Second subpart Z1 E(f1(3)*r2_1)
  • both the first sub-part and the second sub-part in the tuple use the commitment of the second participant according to the element corresponding to the tuple in the second set, the tuple in the The second confusion information of the elements corresponding to the second set, and the first sub-part uses the elements corresponding to the tuple in the second set, so the two sub-parts of the tuple can put the tuple in the The corresponding elements of the second set are implicitly included.
  • the first participant obtains elements in the second set other than the first set according to the private key and the at least one tuple, including:
  • the first participant obtains the denominator analysis item and the numerator of the tuple according to the first subpart of the tuple and the second subpart of the tuple Parse item;
  • Y1 (3 3 -6*3 2 +11*3+6)*3*r2_1*G1+(3 3 *r1_1+3 2 *r1_2+3*r1_3+r1_4)*3*r2_1*H, (3 3 *r1_1+3 2 *r1_2+3*r1_3+r1_4)*3*r2_1*G2.
  • P1 only knows that some elements of P2 are the intersection elements of both parties but does not know what these elements of P2 are. Therefore, P1 only obtains the final union result, but does not know the set content of P2; P2 cannot know the set elements of P1, so the effect of privacy union is realized.
  • the program flow of more (at least three) participants is basically the same as that of the above two participants, except that the interaction of more participants is involved, and any participant To find the union based on the tuples of multiple parties.
  • one or several parties can be designated to obtain the final union result.
  • each participant will agree on which party or parties jointly own the private key x.
  • the threshold determines the final result of the union. Several parties can obtain the union result. Example: If the threshold is (n,3), it means that among n participants, less than 3 participants cannot recover, and more than or equal to 3 participants can jointly recover to obtain the result.
  • the first participant is any one of multiple participants, and the first participant obtains the private key in the following manner:
  • the first participant obtains the fragmentation homomorphism information of at least one participant through a preset privacy interaction protocol according to the fragmentation homomorphism information of the first participant, wherein the fragmentation homomorphism information of any participant
  • the information is obtained according to the preset homomorphic encryption operation according to the shard key of the participant; the at least one participant is a participant of the plurality of participants except the first participant;
  • the first participant acquires the private key according to the preset homomorphic encryption operation according to the fragment homomorphic information of the first participant and the fragment homomorphic information of the at least one participant.
  • the first participant can The fragmented homomorphic information of each party, through the preset privacy interaction protocol, obtains the fragmented homomorphic information of at least one participant, so as to jointly obtain the private key through a joint method, avoiding a single participant from doing evil, and improving the privacy of the union. safety.
  • the judgment rule corresponds to the commitment of multiple subitems for the second participant to generate at least one tuple, and any tuple in the at least one tuple is characterizes the corresponding elements in the second set, and the first participant only obtains elements in the second set other than the first set according to the private key and the at least one tuple, but does not It is not known which elements are specifically included in the second set, so that the union of the first set and the second set is obtained, and a multi-party privacy union is realized.
  • the present invention provides a privacy union device, including:
  • the generating module 201 is configured to generate a first set of judging rules; the judging rules correspond to multiple sub-items, and the multiple sub-items are used to determine the judging rules, and the judging rules are used to judge whether any element is the elements in the first set;
  • the preset commitment algorithm has the same Stateful, the commitment of the plurality of subitems is used by the second participant to generate at least one tuple;
  • An acquisition module 202 configured to acquire the at least one tuple from the second participant; for any tuple in the at least one tuple, the tuple represents the corresponding element in the second set, the The tuple is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, the commitment of the tuple in the second set
  • the second obfuscation information of the corresponding element is obtained according to the preset commitment algorithm;
  • the elements in the first set are all positive integers
  • the judgment rule is a polynomial
  • the multiple sub-items are the coefficients of each sub-term of the polynomial
  • the preset commitment algorithm is a preset elliptic curve Algorithm
  • the preset elliptic curve algorithm corresponds to the first base point, the second base point and the commitment public key
  • the commitment public key is obtained according to the private key and the second base point
  • the generating module 201 is specifically used for:
  • the first confusion information of the subitem, the first base point, the second base point, and the commitment public key According to the private key, the first confusion information of the subitem, the first base point, the second base point, and the commitment public key, according to the preset elliptic curve algorithm, generate the commitment of the subitem .
  • the generating module 201 is specifically configured to: according to the following formula, according to the private key, the first obfuscation information of the subitem, the first base point, the second base point, and the commitment public key , according to the preset elliptic curve algorithm, generate the commitment of the child:
  • x is the sub-item
  • E(x) is the commitment of the sub-item
  • G1 is the first base point
  • G2 is the second base point
  • r1 is the first confusion information of the sub-item
  • H is the The above-mentioned commitment public key
  • sk is the above-mentioned private key.
  • the tuple includes a first subpart and a second subpart;
  • the first subpart is the commitment of the second participant according to the element corresponding to the tuple in the second set, the element corresponding to the tuple in the second set, and the tuple in the second set.
  • the second confusion information of the elements corresponding to the second set is obtained according to the preset commitment algorithm;
  • the second subpart is the commitment of the second participant to the element corresponding to the tuple in the second set and the second confusion information of the element corresponding to the tuple in the second set, according to obtained by the preset commitment algorithm.
  • the acquiring module 202 is specifically used for:
  • any tuple in the at least one tuple according to the first subpart of the tuple and the second subpart of the tuple, obtain the denominator analysis item and the numerator analysis item of the tuple;
  • the device is executed by the first participant, and the first participant and the second participant are on the same block chain, and the device also includes a sending module, and the sending module specifically uses In: sending the commitments of the multiple subitems to the blockchain; the commitments of the multiple subitems are used by the second participant to obtain from the blockchain.
  • the device is a device executed by a first participant, and the first participant is any one of multiple participants, and the acquisition module 202 specifically acquires the private key in the following manner:
  • the sharding homomorphic information of the first participant is obtained through a preset privacy interaction protocol, wherein the sharding homomorphic information of any participant is based on the participant
  • the shard key is obtained according to the preset homomorphic encryption operation; the at least one participant is a participant of the plurality of participants except the first participant;
  • the private key is obtained according to the preset homomorphic encryption operation according to the fragment homomorphic information of the first participant and the fragment homomorphic information of the at least one participant.
  • an embodiment of the present invention also provides a computer device, including a program or an instruction.
  • the program or instruction When the program or instruction is executed, the privacy union method and any optional method provided by the embodiment of the present invention be executed.
  • an embodiment of the present invention also provides a computer-readable storage medium, including a program or an instruction.
  • the program or instruction is executed, the privacy union method provided by the embodiment of the present invention and any The optional method is executed.
  • the embodiments of the present invention may be provided as methods or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Complex Calculations (AREA)

Abstract

一种隐私求并集方法及装置，其中方法为：第一参与方生成第一集合的判断规则（101），所述判断规则对应多个子项；针对所述多个子项任一子项，所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺（102）；所述第一参与方获取来自所述第二参与方的所述至少一个元组（103）；所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集（104）。上述方法应用于金融科技(Fintech)时，获得所述第一集合和所述第二集合的并集，实现了多方隐私求并集。

Description

一种隐私求并集方法及装置
相关申请的交叉引用
本申请要求在2021年05月14日提交中国专利局、申请号为202110530000.2、申请名称为“一种隐私求并集方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及金融科技(Fintech)，尤其涉及一种隐私求并集方法及装置。
背景技术
随着计算机技术的发展，越来越多的技术应用在金融领域，传统金融业正在逐步向金融科技(Fintech)转变，但由于金融行业的安全性、实时性要求，也对技术提出的更高的要求。金融领域常涉及多个参与方共同参与求并集的运算，如多家银行机构求逾期用户的并集。
然而，金融领域对隐私性要求较高，迫切需要隐私求并集的方法。隐私求并集指，每个参与方均具有一个集合，参与方经过隐私求并集算法之后，能够获得所有参与者的集合交集，但并不知道除了并集、自身集合之外其他任意参与者的集合内容，实现了求并集过程中对参与方集合内容隐私保护的效果。然而，目前还没有隐私求并集的方法，这是一个亟待解决的问题。
发明内容
本发明提供一种隐私求并集方法及装置，解决了现有技术中没有隐私求并集的方法的问题。
第一方面，本发明提供一种隐私求并集方法，包括：第一参与方生成第一集合的判断规则；所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素；
针对所述多个子项任一子项，所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺；所述预设承诺算法具有同态性，所述多个子项的承诺用于第二参与方生成至少一个元组；
所述第一参与方获取来自所述第二参与方的所述至少一个元组；针对所述至少一个元组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
上述方法中，第一参与方生成了判断规则后，其判断规则对应多个子项的承诺用于第二参与方生成至少一个元组，而至少一个元组中任一元组都表征了在第二集合对应的元素，所述第一参与方根据所述私钥和所述至少一个元组，仅获得所述第二集合中除所述第一集合之外的元素，但并不知悉所述第二集合具体包括哪些元素，从而获得所述第一集合和所述第二集合的并集，实现了多方隐私求并集。
可选的，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的；
所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺，包括：
所述第一参与方根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
上述方法中，所述第一集合中的元素均为正整数，所述判断规则为多项式的情形下，由于预设椭圆曲线算法计算量较小，安全性能较高，从而可以增强所述子项的承诺的生成效率。
可选的，所述第一参与方按照以下公式，根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
E(x)＝(x*G1+r1*H,sk*G2)；
H＝sk*G2；
x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
上述方法中，不仅同样能够实现对x的掩盖功能，而且后续经过计算后，E(x)可以转 换为(x*G1+y*H，y*G2)，第一参与方虽然不知道y，但由于H＝sk*G2，第一参与方可利用这一关系约掉y*H和y*G2，最终获得x*G1，从而既实现了对x的掩盖，又能最后通过遍历恢复出x。
可选的，针对所述至少一个元组中任一元组，所述元组包括第一子部分和第二子部分；
所述第一子部分是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
所述第二子部分是所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
上述方式下，元组中的第一子部分和第二子部分都用到了所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，而第一子部分用到了所述元组在所述第二集合对应的元素，所以通过元组的这两个子部分可以将所述元组在所述第二集合对应的元素隐含包括。
可选的，所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，包括：
针对所述至少一个元组中任一元组，所述第一参与方根据所述元组的第一子部分和所述元组的第二子部分，获得所述元组的分母解析项和分子解析项；
若所述分母解析项和所述分子解析项均不为0，则将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素。
上述方式下，若所述分母解析项和所述分子解析项均不为0，将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素，所以若所述分母解析项和所述分子解析项为0时，也不能判断元组中的元素究竟是哪个元素，从而即得到了所述第二集合中除所述第一集合之外的元素，又隐藏了所述第二集合中的具体元素。
可选的，所述第一参与方和所述第二参与方在同一区块链上，所述方法还包括：所述第一参与方将所述多个子项的承诺发送到所述区块链上；所述多个子项的承诺用于所述第二参与方从所述区块链上获取。
上述方式下，所述第一参与方将所述多个子项的承诺发送到所述区块链上，从而不需要频繁发送所述多个子项的承诺，即便第二参与方需要多次获取，也可以直接从区块链上获取，从而提高了所述多个子项的承诺的获取效率。
可选的，所述第一参与方为多个参与方中任一参与方，所述第一参与方按照以下方式获取所述私钥：
所述第一参与方根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，其中，任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的；所述至少一个参与方为所述多个参与方除了所述第一参与方之外的参与方；
所述第一参与方根据所述第一参与方的分片同态信息和所述至少一个参与方的分片同态信息，按照所述预设同态加密运算，获取所述私钥。
上述方式下，由于任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的，那么所述第一参与方可以根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，从而通过联合的方式共同获得私钥，避免单个参与方作恶，提升了隐私求并集的安全性。
第二方面，本发明提供一种隐私求并集装置，包括：
生成模块，用于生成第一集合的判断规则；所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素；
以及用于针对所述多个子项任一子项，根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺；所述预设承诺算法具有同态性，所述多个子项的承诺用于第二参与方生成至少一个元组；
获取模块，用于获取来自所述第二参与方的所述至少一个元组；针对所述至少一个元组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
以及用于根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
可选的，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的；
所述生成模块具体用于：
根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
可选的，所述生成模块具体用于：按照以下公式，根据所述私钥、所述子项的第一混 淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
E(x)＝(x*G1+r1*H,sk*G2)；
H＝sk*G2；
x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
可选的，针对所述至少一个元组中任一元组，所述元组包括第一子部分和第二子部分；
所述第一子部分是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
所述第二子部分是所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
可选的，所述获取模块具体用于：
针对所述至少一个元组中任一元组，根据所述元组的第一子部分和所述元组的第二子部分，获得所述元组的分母解析项和分子解析项；
若所述分母解析项和所述分子解析项均不为0，则将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素。
可选的，所述装置为第一参与方执行的装置，所述第一参与方和所述第二参与方在同一区块链上，所述装置还包括发送模块，所述发送模块具体用于：将所述多个子项的承诺发送到所述区块链上；所述多个子项的承诺用于所述第二参与方从所述区块链上获取。
可选的，所述装置为第一参与方执行的装置，第一参与方为多个参与方中任一参与方，所述获取模块具体按照以下方式获取所述私钥：
根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，其中，任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的；所述至少一个参与方为所述多个参与方除了所述第一参与方之外的参与方；
根据所述第一参与方的分片同态信息和所述至少一个参与方的分片同态信息，按照所述预设同态加密运算，获取所述私钥。
上述第二方面及第二方面各个可选装置的有益效果，可以参考上述第一方面及第一方面各个可选方法的有益效果，这里不再赘述。
第三方面，本发明提供一种计算机设备，包括程序或指令，当所述程序或指令被执行 时，用以执行上述第一方面及第一方面各个可选的方法。
第四方面，本发明提供一种存储介质，包括程序或指令，当所述程序或指令被执行时，用以执行上述第一方面及第一方面各个可选的方法。
本发明的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种隐私求并集方法对应的流程示意图；
图2为本发明实施例提供的一种隐私求并集装置的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
下面首先列出本申请实施例的名词。
G1,G2等大写字母：表示椭圆曲线上的点。
小写字母：表示标量。
a*G：表示标量a与椭圆曲线上任一点G的点乘运算，*为点乘运算，运算结果仍为椭圆曲线上的一个点。
隐私求并集指，每个参与方均具有一个集合，参与方经过隐私求并集算法之后，能够获得所有参与者的集合交集，但并不知道除了并集、自身集合之外其他任意参与者的集合内容，实现了求并集过程中对参与方集合内容隐私保护的效果。
区块链：区块链是由一系列区块组成的一条链，每个块上除了记录本块的数据还会记录上一块的Hash值，通过这种方式组成一条链。区块链的核心理念有两个，一个是密码学技术，另一个是去中心化思想，基于这两个理念做到区块链上的历史信息无法被篡改。本申请实施例中，可以使用区块链技术公开可访问和防篡改的特性，作为一个安全存储数据的公共数据库。
在金融机构(银行机构、保险机构或证券机构)在进行业务(如银行的贷款业务、存款业务等)运转过程中，常涉及多个参与方共同参与求并集的运算，如多家银行机构求逾期用户的并集。然而，金融领域对隐私性要求较高，但目前还没有隐私求并集的方法。这种情况不符合银行等金融机构的需求，无法保证金融机构各项业务的高效运转。
如图1所示，本发明提供一种隐私求并集方法。
步骤101：第一参与方生成第一集合的判断规则。
步骤102：针对所述多个子项任一子项，所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺。
步骤103：所述第一参与方获取来自所述第二参与方的所述至少一个元组。
步骤104：所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
步骤101～步骤104的方法中，所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素。所述预设承诺算法具有同态性，所述多个子项的承诺用于第二参与方生成至少一个元组。针对所述至少一个元组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
本申请实施例中，参与方为P1、P2、…、Pn，其中n可为任意正整数。参与方Pi拥有的集合为Si,集合中的元素为任意数字。P1为第一参与方，P1拥有的集合为第一集合S1；P2为第二参与方，P2拥有的集合为第二集合S2。
首先以2个参与方P1、P2为例，P1的集合S1＝{1，2，3}，P2的集合S2＝{3,4,5}，最终P1获得并集SU为例，介绍方案流程。
步骤101～步骤104的方法中，所述判断规则可以有多种情形，如判断规则可以采用正则表达式，通过正则表达式可以判断某一元素是否为第一集合中的元素，正则表达式对应的多个子项可以为正则表达式中的字符串和元字符，或者是能映射到正则表达式中的字符串和元字符的信息，如用a0a0映射“\”。判断规则也可以用逻辑表达式，逻辑表达式对应的多个子项可以“与”“或”“非”等逻辑连接词以及逻辑条件，从而判断某一元素是否为第一集合中的元素，还有多种形式，只要能判断出判断任一元素是否为所述第一集合中的元素均可。
子项的承诺可以为子项的零知识证明，可以隐式形式表征该子项，元组在所述第二集 合对应的元素的承诺可以为元组在所述第二集合对应的元素的零知识证明，可以隐式形式表征该元组在所述第二集合对应的元素。
在一种可能的情形中，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的。
若第一参与方P1的第一集合S1中的元素为s1_1,s1_2,…,s1_n，n为正整数，则判断规则f1(x)＝(x-s1_1)(x-s1_2)…(x-s1_n)。那么当x为第一集合中的元素时，f1(x)＝0；若f1(x)＝0，则说明x属于P1的第一集合S1。
举例来说，S1＝{1,2,3}，则f1(x)＝(x-1)(x-2)(x-3)＝x^3–6x^2+11x+6。所以P1的判断规则就为f1(x)，各子项即各次项系数分别为：1，-6，11，6。
所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺，包括：
所述第一参与方根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
上述方法中，所述第一集合中的元素均为正整数，所述判断规则为多项式的情形下，由于预设椭圆曲线算法计算量较小，安全性能较高，从而可以增强所述子项的承诺的生成效率。
可选的，所述第一参与方按照以下公式，根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
E(x)＝(x*G1+r1*H,sk*G2)；
H＝sk*G2；
x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
上述方法中，不仅同样能够实现对x的掩盖功能，而且后续经过计算后，E(x)可以转换为(x*G1+y*H，y*G2)，第一参与方虽然不知道y，但由于H＝sk*G2，第一参与方可利用这一关系约掉y*H和y*G2，最终获得x*G1，从而既实现了对x的掩盖，又能最后通过遍历恢复出x。
上述方法下，在步骤102之前，第一参与方P1选择椭圆曲线上的基点G1、G2，选择随机数sk作为第一参与方的私钥，并计算H＝sk*G2，得到公钥G1、G2、H。私钥和公钥 用于后续对第一参与方公布的信息进行掩盖，私钥还用于最后恢复掩盖值，得到其他参与方的集合和第一参与方的第一集合的并集。
可选的，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的；
所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺，包括：
所述第一参与方根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
上述方法中，所述第一集合中的元素均为正整数，所述判断规则为多项式的情形下，由于预设椭圆曲线算法计算量较小，安全性能较高，从而可以增强所述子项的承诺的生成效率。
可选的，所述第一参与方按照以下公式，根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
E(x)＝(x*G1+r1*H,sk*G2)；
H＝sk*G2；
x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
上述方法中，不仅同样能够实现对x的掩盖功能，而且后续经过计算后，E(x)可以转换为(x*G1+y*H，y*G2)，第一参与方虽然不知道y，但由于H＝sk*G2，第一参与方可利用这一关系约掉y*H和y*G2，最终获得x*G1，从而既实现了对x的掩盖，又能最后通过遍历恢复出x。
举例来说，判断规则为f1(x)＝x^3–6x^2+11x+6，则多个子项即各次项系数分别为：1，-6，11，6。
如果按照没有隐私保护的求并集方案，直接将系数发送给P2，P2会反推出P1的集合元素。所以需要对系数进行掩盖后再发送给P2。又因为，P2后续需要将自己的集合元素代入，所以掩盖后仍然需要能够支持这样的计算。于是本方案选择以下具有同态性质的承诺。
现在P1对这四个系数进行承诺：
以第一个系数1为例，P1选择第一混淆信息r1_1，然后使用自己的私钥sk和公钥G1、G2、H掩盖系数1：计算E(1)＝(1*G1+r1_1*H,sk*G2)。最终1的承诺就为E(1)。
类似地，计算第二个系数-6的承诺时，选择第一混淆信息r1_2，最终承诺为E(-6)＝(-6*G1+r1_2*H,sk*G2)；
计算第三个系数11的承诺时，选择第一混淆信息r1_3，最终承诺为E(11)＝(11*G1+r1_3*H,sk*G2)；
计算第四个系数6的承诺时，选择第一混淆信息r1_4，最终承诺为E(6)＝(6*G1+r1_4*H,sk*G2)。
多个子项的承诺为E(1),E(-6),E(11),E(6)。需要说明的是，P2获取多个子项(各次项系数)的承诺的方式可以有多种，如P1将各次项系数的承诺发送给P2，相当于将P1的判断规则，即多项式以隐式地形式告诉了P2，后续P2可以使用P1的系数承诺进行计算，P1使用私钥可恢复出P2的计算结果。
另一种获取方式中，所述第一参与方和所述第二参与方在同一区块链上。
所述第一参与方将所述多个子项的承诺发送到所述区块链上；所述多个子项的承诺用于所述第二参与方从所述区块链上获取。
上述方式下，所述第一参与方将所述多个子项的承诺发送到所述区块链上，从而不需要频繁发送所述多个子项的承诺，即便第二参与方需要多次获取，也可以直接从区块链上获取，从而提高了所述多个子项的承诺的获取效率。
可选的，针对所述至少一个元组中任一元组，所述元组包括第一子部分和第二子部分；
所述第一子部分是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
所述第二子部分是所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
举例来说，第二参与方可以按照以下方式得到至少一个元组：
第二参与方P2的第二集合S2＝{3,4,5}。
对于元素3，P2将根据预设承诺算法的同态性质计算f1(3)的承诺E(f1(3))。
E(f1(3))
＝E(33-6*32+11*3+6)
＝33*E(1)+32*E(-6)+3*E(11)+E(6)
(其中，上述系数分别为从第一参与方获取的各次项的系数承诺)。
＝(33-6*32+11*3+6)*G1+(33*r1_1+32*r1_2+3*r1_3+r1_4)*H，(33*r1_1+32*r1_2+3*r1_3+r1_4)*G2。
类似地，P2将元素4和5也分别根据预设承诺算法的同态性质计算，得到E(f1(4))和E(f(5))。
第二参与方P2为元素3选择(第二混淆信息)随机数r2_1,为元素4选择随机数r2_2,为元素5选择随机数r2_3。(符号解释：符号r2_i表示P2为自己的第i个元素选择的随机数)。
第一子部分Y1＝E(f1(3)*3*r2_1)
＝E(f1(3))*3*r2_1
＝(3 3-6*3 2+11*3+6)*3*r2_1*G1+(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*3*r2_1*H，(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*3*r2_1*G2。
第二子部分Z1＝E(f1(3)*r2_1)
＝E(f1(3))*r2_1
＝(3 3-6*3 2+11*3+6)*r2_1*G1+(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*r2_1*H，(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*r2_1*G2。
类似地对于元素4和5，P2类似计算出Y2＝E(f1(4)*4*r2_2))、Z2＝E(f1(4)*r2_2)、Y3＝E(f1(5)*5*r2_3)、Z3＝E(f1(5)*r2_3)。
所有第二参与方P2为三个元素生成了三个元组(Y1,Z1)、(Y2,Z2)、(Y3,Z3)。P2打乱这些元组相当于打乱第二集合中元素的顺序，后续P1恢复这些元组时，若得到并集元素，但并不知道该并集元素是第二集合中的第几个元素。
上述方式下，元组中的第一子部分和第二子部分都用到了所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，而第一子部分用到了所述元组在所述第二集合对应的元素，所以通过元组的这两个子部分可以将所述元组在所述第二集合对应的元素隐含包括。
可选的，所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，包括：
针对所述至少一个元组中任一元组，所述第一参与方根据所述元组的第一子部分和所述元组的第二子部分，获得所述元组的分母解析项和分子解析项；
若所述分母解析项和所述分子解析项均不为0，则将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素。
具体来说：
P1首先恢复第一个元组(Y1＝E(f1(3)*3*r2_1)，Z1＝E(f1(3)*r2_1))；
以恢复第一子部分Y1为例，介绍恢复方式：
Y1＝(3 3-6*3 2+11*3+6)*3*r2_1*G1+(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*3*r2_1*H，(3 3*r1_1+3 2*r1_2+3*r1_3+r1_4)*3*r2_1*G2。
令Y1的前半部分表示为Y11，Y1的后半部分表示为Y12。
P1使用私钥sk，计算Y12*sk＝(33*r1_1+32*r1_2+3*r1_3+r1_4)*3*r2_1*G2*sk。
因为H＝G2*sk,所以计算Y11-Y12*sk＝(33-6*32+11*3+6)*3*r2_1*G1。
遍历后，就可恢复得到Y1＝E(f1(3)*3*r2_1)中的值，即分子解析项y＝f1(3)*3*r2_1,该分子解析项恢复为y＝(33-6*32+11*3+6)*3*r2_1。
类似地，P1对Z1进行相同计算，Z11–Z12*sk＝(33-6*32+11*3+6)*r2_1*G1。
恢复得到分母解析项z＝(33-6*32+11*3+6)*r2_1。
若y、z都为0，则说明f1(3)＝0。由于步骤2中：若f1(x)＝0,则说明x属于P1的集合。所以f1(3)＝0说明P2的这一元素也属于P1的集合，即P1得知P2的这一元素为双方的交集元素，不是并集元素，所以继续解密下一元组。
P1恢复第二个元组：恢复E(f1(4)*4*r2_2)得到y＝f1(4)*4*r2_2；恢复E(f1(4)*r2_2)得到z＝f1(4)*r2_2。y、z都不为0，则P1计算y*z -1＝4，将4加入并集SU。继续解密下一元组。
P1恢复第三个元组：恢复E(f1(5)*5*r2_3)得到y＝f1(5)*5*r2_3；恢复E(f1(5)*r2_3)得到z＝f1(5)*r2_3。y、z都不为0，则P1计算y*z -1＝5，将5加入并集SU。
上述方式下，若所述分母解析项和所述分子解析项均不为0，将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素，所以若所述分母解析项和所述分子解析项为0时，也不能判断元组中的元素究竟是哪个元素，从而即得到了所述第二集合中除所述第一集合之外的元素，又隐藏了所述第二集合中的具体元素。
P1将自己的元素{1,2,3}加入并集SU，获得最终并集结果SU＝{1,2,3,4,5}。在上述过程中，P1只知道P2的某些一元素为双方的交集元素但不知道P2的这些元素具体是什么。所以P1只获得了最终的并集结果，但不知道P2的集合内容；P2无法知道P1的集合元素，所以实现了隐私求并集的效果。
一种可能的情形中，更多个(至少三个)参与方的方案流程与上述两个参与方的流程基本相同，只是涉及了更多参与方的交互，且求并集时任一参与方要基于多个参与方的元组求并集。
至少三个参与方的情形中，可以指定某一方或某几方获得最终并集结果，各参与方在初始化时，会约定由哪一方或者哪几方共同拥有私钥x，门限确定了最终有几方能够获得并集结果。举例：若门限为(n,3)，则说明n个参与方中，小于3个参与方无法恢复，大于等于3个参与者才能联合恢复获得结果。
在一种实现方式中，所述第一参与方为多个参与方中任一参与方，所述第一参与方按照以下方式获取所述私钥：
所述第一参与方根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，其中，任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的；所述至少一个参与方为所述多个参与方除了所述第一参与方之外的参与方；
所述第一参与方根据所述第一参与方的分片同态信息和所述至少一个参与方的分片同态信息，按照所述预设同态加密运算，获取所述私钥。
之前两个参与方时，只需将自己的承诺发给对方即可；对于多个参与方，P1需要将自己的承诺发给其他每个参与方P2,P3,…,Pn，这一过程繁琐，所以只需将自己的承诺发送到区块链，其他各参与方直接去区块链获取即可。在此区块链作为一个公开、防篡改的存储，存放各方发送的承诺。
上述方式下，由于任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的，那么所述第一参与方可以根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，从而通过联合的方式共同获得私钥，避免单个参与方作恶，提升了隐私求并集的安全性。
步骤101～步骤104的方法中，第一参与方生成了判断规则后，其判断规则对应多个子项的承诺用于第二参与方生成至少一个元组，而至少一个元组中任一元组都表征了在第二集合对应的元素，所述第一参与方根据所述私钥和所述至少一个元组，仅获得所述第二集合中除所述第一集合之外的元素，但并不知悉所述第二集合具体包括哪些元素，从而获得所述第一集合和所述第二集合的并集，实现了多方隐私求并集。
如图2所示，本发明提供一种隐私求并集装置，包括：
生成模块201，用于生成第一集合的判断规则；所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素；
以及用于针对所述多个子项任一子项，根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺；所述预设承诺算法具有同态性，所述多个子项的承诺 用于第二参与方生成至少一个元组；
获取模块202，用于获取来自所述第二参与方的所述至少一个元组；针对所述至少一个元组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
以及用于根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
可选的，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的；
所述生成模块201具体用于：
根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
可选的，所述生成模块201具体用于：按照以下公式，根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
E(x)＝(x*G1+r1*H,sk*G2)；
H＝sk*G2；
x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
可选的，针对所述至少一个元组中任一元组，所述元组包括第一子部分和第二子部分；
所述第一子部分是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
所述第二子部分是所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
可选的，所述获取模块202具体用于：
针对所述至少一个元组中任一元组，根据所述元组的第一子部分和所述元组的第二子部分，获得所述元组的分母解析项和分子解析项；
若所述分母解析项和所述分子解析项均不为0，则将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素。
可选的，所述装置为第一参与方执行的装置，所述第一参与方和所述第二参与方在同一区块链上，所述装置还包括发送模块，所述发送模块具体用于：将所述多个子项的承诺发送到所述区块链上；所述多个子项的承诺用于所述第二参与方从所述区块链上获取。
可选的，所述装置为第一参与方执行的装置，第一参与方为多个参与方中任一参与方，所述获取模块202具体按照以下方式获取所述私钥：
根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，其中，任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的；所述至少一个参与方为所述多个参与方除了所述第一参与方之外的参与方；
根据所述第一参与方的分片同态信息和所述至少一个参与方的分片同态信息，按照所述预设同态加密运算，获取所述私钥。
基于同一发明构思，本发明实施例还提供了一种计算机设备，包括程序或指令，当所述程序或指令被执行时，如本发明实施例提供的隐私求并集方法及任一可选方法被执行。
基于同一发明构思，本发明实施例还提供了一种计算机可读存储介质，包括程序或指令，当所述程序或指令被执行时，如本发明实施例提供的隐私求并集方法及任一可选方法被执行。
本领域内的技术人员应明白，本发明的实施例可提供为方法、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方 式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种隐私求并集方法，其特征在于，包括：
    第一参与方生成第一集合的判断规则；所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素；
    针对所述多个子项任一子项，所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺；所述预设承诺算法具有同态性，所述多个子项的承诺用于第二参与方生成至少一个元组；
    所述第一参与方获取来自所述第二参与方的所述至少一个元组；针对所述至少一个元组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
    所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
  2. 如权利要求1所述的方法，其特征在于，所述第一集合中的元素均为正整数，所述判断规则为多项式，所述多个子项为所述多项式的各次项系数；所述预设承诺算法为预设椭圆曲线算法；所述预设椭圆曲线算法对应第一基点、第二基点和承诺公钥；所述承诺公钥是根据所述私钥和所述第二基点得到的；
    所述第一参与方根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺，包括：
    所述第一参与方根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺。
  3. 如权利要求2所述的方法，其特征在于，所述第一参与方按照以下公式，根据所述私钥、所述子项的第一混淆信息、所述第一基点、所述第二基点和所述承诺公钥，按照所述预设椭圆曲线算法，生成所述子项的承诺：
    E(x)＝(x*G1+r1*H,sk*G2)；
    H＝sk*G2；
    x为所述子项，E(x)为所述子项的承诺，G1为所述第一基点，G2为所述第二基点，r1为所述子项的第一混淆信息，H为所述承诺公钥，sk为所述私钥。
  4. 如权利要求2所述的方法，其特征在于，针对所述至少一个元组中任一元组，所 述元组包括第一子部分和第二子部分；
    所述第一子部分是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
    所述第二子部分是所述第二参与方根据所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的。
  5. 如权利要求4所述的方法，其特征在于，所述第一参与方根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，包括：
    针对所述至少一个元组中任一元组，所述第一参与方根据所述元组的第一子部分和所述元组的第二子部分，获得所述元组的分母解析项和分子解析项；
    若所述分母解析项和所述分子解析项均不为0，则将所述分子解析项除以所述分母解析项的商，作为所述第二集合中除所述第一集合之外的元素。
  6. 如权利要求1至5任一项所述的方法，其特征在于，所述第一参与方和所述第二参与方在同一区块链上，所述方法还包括：
    所述第一参与方将所述多个子项的承诺发送到所述区块链上；所述多个子项的承诺用于所述第二参与方从所述区块链上获取。
  7. 如权利要求1至5任一项所述的方法，其特征在于，所述第一参与方为多个参与方中任一参与方，所述第一参与方按照以下方式获取所述私钥：
    所述第一参与方根据所述第一参与方的分片同态信息，通过预设隐私交互协议，获取至少一个参与方的分片同态信息，其中，任一参与方的分片同态信息是根据该参与方的分片密钥，按照预设同态加密运算得到的；所述至少一个参与方为所述多个参与方除了所述第一参与方之外的参与方；
    所述第一参与方根据所述第一参与方的分片同态信息和所述至少一个参与方的分片同态信息，按照所述预设同态加密运算，获取所述私钥。
  8. 一种隐私求并集装置，其特征在于，包括：
    生成模块，用于生成第一集合的判断规则；所述判断规则对应多个子项，所述多个子项用于确定所述判断规则，所述判断规则用于判断任一元素是否为所述第一集合中的元素；
    以及用于针对所述多个子项任一子项，根据私钥和所述子项的第一混淆信息，按照预设承诺算法，生成所述子项的承诺；所述预设承诺算法具有同态性，所述多个子项的承诺用于第二参与方生成至少一个元组；
    获取模块，用于获取来自所述第二参与方的所述至少一个元组；针对所述至少一个元 组中任一元组，所述元组表征了在第二集合对应的元素，所述元组是所述第二参与方根据所述元组在所述第二集合对应的元素、所述元组在所述第二集合对应的元素的承诺、所述元组在所述第二集合对应的元素的第二混淆信息，按照所述预设承诺算法得到的；
    以及用于根据所述私钥和所述至少一个元组，获得所述第二集合中除所述第一集合之外的元素，并根据所述第一集合和所述第二集合中除所述第一集合之外的元素，获得所述第一集合和所述第二集合的并集。
  9. 一种计算机设备，其特征在于，包括程序或指令，当所述程序或指令被执行时，如权利要求1至7中任意一项所述的方法被执行。
  10. 一种计算机可读存储介质，其特征在于，包括程序或指令，当所述程序或指令被执行时，如权利要求1至7中任意一项所述的方法被执行。
PCT/CN2021/130448 2021-05-14 2021-11-12 一种隐私求并集方法及装置 Ceased WO2022237103A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110530000.2A CN113158253B (zh) 2021-05-14 2021-05-14 一种隐私求并集方法及装置
CN202110530000.2 2021-05-14

Publications (1)

Publication Number Publication Date
WO2022237103A1 true WO2022237103A1 (zh) 2022-11-17

Family

ID=76876085

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/130448 Ceased WO2022237103A1 (zh) 2021-05-14 2021-11-12 一种隐私求并集方法及装置

Country Status (2)

Country Link
CN (1) CN113158253B (zh)
WO (1) WO2022237103A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115865306A (zh) * 2022-11-25 2023-03-28 深圳市洞见智慧科技有限公司 可扩展的多方隐私保护集合求交方法、系统及相关设备
CN116545773A (zh) * 2023-07-05 2023-08-04 北京天润基业科技发展股份有限公司 一种处理隐私数据的方法、介质及电子设备
CN120223282A (zh) * 2025-03-13 2025-06-27 西安电子科技大学 基于全同态加密的非平衡隐私集合并集方法及合并集系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113158253B (zh) * 2021-05-14 2023-05-12 深圳前海微众银行股份有限公司 一种隐私求并集方法及装置
CN115473707A (zh) * 2022-08-29 2022-12-13 贵州华云信安科技有限公司 一种隐私交集求和的方法和装置
CN115913539A (zh) * 2022-11-17 2023-04-04 天翼电子商务有限公司 一种多方隐私数据集合求并集的方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090307045A1 (en) * 2008-06-10 2009-12-10 International Business Machines Corporation System and method for optimization of meetings based on subject/participant relationships
CN109104413A (zh) * 2018-07-17 2018-12-28 中国科学院计算技术研究所 用于安全多方计算的私有数据求交集的方法及验证方法
CN110719159A (zh) * 2019-09-24 2020-01-21 河南师范大学 抗恶意敌手的多方隐私集合交集方法
CN111885079A (zh) * 2020-07-31 2020-11-03 支付宝(杭州)信息技术有限公司 保护数据隐私的多方联合处理数据的方法及装置
CN113158253A (zh) * 2021-05-14 2021-07-23 深圳前海微众银行股份有限公司 一种隐私求并集方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109559122B (zh) * 2018-12-07 2021-02-02 北京瑞卓喜投科技发展有限公司 区块链数据传输方法及区块链数据传输系统
CN109951443B (zh) * 2019-01-28 2021-06-04 湖北工业大学 一种云环境下隐私保护的集合交集计算方法及系统
CN111931207B (zh) * 2020-08-07 2024-04-09 北京百度网讯科技有限公司 获得隐私集合交集的方法、装置、设备及存储介质
CN112003695B (zh) * 2020-08-11 2024-01-05 天翼电子商务有限公司 隐私集合求交方法、系统、介质及装置
CN112597524B (zh) * 2021-03-03 2021-05-18 支付宝(杭州)信息技术有限公司 隐私求交的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090307045A1 (en) * 2008-06-10 2009-12-10 International Business Machines Corporation System and method for optimization of meetings based on subject/participant relationships
CN109104413A (zh) * 2018-07-17 2018-12-28 中国科学院计算技术研究所 用于安全多方计算的私有数据求交集的方法及验证方法
CN110719159A (zh) * 2019-09-24 2020-01-21 河南师范大学 抗恶意敌手的多方隐私集合交集方法
CN111885079A (zh) * 2020-07-31 2020-11-03 支付宝(杭州)信息技术有限公司 保护数据隐私的多方联合处理数据的方法及装置
CN113158253A (zh) * 2021-05-14 2021-07-23 深圳前海微众银行股份有限公司 一种隐私求并集方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SUN MAO-HUA, ZHE GONG: "A Privacy-preserving Outsourcing Set Union Protocol", JOURNAL OF CRYPTOLOGIC RESEARCH, vol. 3, no. 3, 30 April 2016 (2016-04-30), pages 114 - 125, XP093003967, ISSN: 2095-7025, DOI: 10.13868/j.cnki.jcr.000114 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115865306A (zh) * 2022-11-25 2023-03-28 深圳市洞见智慧科技有限公司 可扩展的多方隐私保护集合求交方法、系统及相关设备
CN116545773A (zh) * 2023-07-05 2023-08-04 北京天润基业科技发展股份有限公司 一种处理隐私数据的方法、介质及电子设备
CN116545773B (zh) * 2023-07-05 2023-09-08 北京天润基业科技发展股份有限公司 一种处理隐私数据的方法、介质及电子设备
CN120223282A (zh) * 2025-03-13 2025-06-27 西安电子科技大学 基于全同态加密的非平衡隐私集合并集方法及合并集系统

Also Published As

Publication number Publication date
CN113158253B (zh) 2023-05-12
CN113158253A (zh) 2021-07-23

Similar Documents

Publication Publication Date Title
CN113158253B (zh) 一种隐私求并集方法及装置
US10778410B2 (en) Homomorphic data encryption method and apparatus for implementing privacy protection
CN110348231B (zh) 实现隐私保护的数据同态加解密方法及装置
Wu et al. Secure and efficient outsourced k-means clustering using fully homomorphic encryption with ciphertext packing technique
Luo et al. SVFL: Efficient secure aggregation and verification for cross-silo federated learning
CN112446052B (zh) 一种适用于涉密信息系统的聚合签名方法及系统
CN113114454B (zh) 一种高效隐私的外包k均值聚类方法
CN113708927B (zh) 基于sm2数字签名的泛指定验证者签名证明系统
CN102263636A (zh) 一种融合神经网络与混沌映射的流密码密钥控制方法
CN111162912B (zh) 一种适用于区块链的验证方法、装置及存储介质
CN111639367B (zh) 基于树模型的两方联合分类方法、装置、设备及介质
CN111325535A (zh) 基于椭圆曲线偏移的区块链私钥管理方法、系统及存储介质
WO2023056763A1 (zh) 一种隐私数据共享方法及装置
WO2021109718A1 (zh) 一种基于区块链系统的验证方法及装置
Li et al. Secure and efficient bloom-filter-based image search in cloud-based Internet of Things
CN115987479B (zh) 一种用于自然语言处理的深度学习模型的同态加密方法
CN114553395B (zh) 一种风控场景下的纵向联邦特征衍生方法
CN117235342A (zh) 基于同态哈希函数和虚拟索引的动态云审计方法
CN116527281A (zh) 一种通用的两方适配器签名方法
CN114398662B (zh) 基于安全多方计算的隐私保护机器学习推理方法及系统
CN113691371B (zh) 区块链上基于身份的环签密方法
CN104852799B (zh) 基于分段序列的数字音频伪装及重构方法
CN116595562B (zh) 数据处理方法和电子设备
Huang et al. A federated learning framework with blockchain-based auditable participant selection
CN112580071A (zh) 一种数据处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21941667

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21941667

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: OTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 13.05.2024)

122 Ep: pct application non-entry in european phase

Ref document number: 21941667

Country of ref document: EP

Kind code of ref document: A1