WO2023216403A1

WO2023216403A1 - Ciphertext restoration method for private set intersection based on homomorphic encryption

Info

Publication number: WO2023216403A1
Application number: PCT/CN2022/103668
Authority: WO
Inventors: 周朕; 谢翔; 李升林; 孙立林
Original assignee: 上海阵方科技有限公司
Priority date: 2022-05-07
Filing date: 2022-07-04
Publication date: 2023-11-16
Also published as: CN114826552A

Abstract

Disclosed in the present invention is a ciphertext restoration method for a private set intersection based on homomorphic encryption. A dual version corresponding to a known existing postage stamp problem is: given that h＝2 ^L and M(h, A _k )＝m + 1 are known, solving for the smallest possible k and a corresponding set A _k. In the present invention, a method for converting a solution of a problem instance with a relatively small numerical value M(h/D, A _KD ) into a solution of a problem instance with a relatively large numerical value M(h, A _k ) is implemented, and the problem of lacking a solution in the case of a relatively large numerical value is solved. Moreover, the total number of addition expressions needing to be stored is only as in formula (I), and compared with the total number m of addition expressions needing to be stored in the case of the optimal solution, the storage cost can be greatly saved on by means of this method.

Description

A ciphertext restoration method under the intersection of homomorphic encryption privacy sets

Technical field

The invention relates to the field of computer software, and in particular to a ciphertext restoration method under homomorphic encryption privacy set intersection.

Background technique

Privacy set intersection is a private computing technology based on modern cryptography, which allows both execution parties holding corresponding data sets to calculate the intersection of the data sets while ensuring that any content outside the intersection in their respective data sets will not be exposed to the other party. There are many cryptographic techniques that can realize the intersection of privacy sets. Fully homomorphic encryption is one of the popular methods, especially when the size of the data sets of both execution parties is relatively unbalanced. For example, one party's data entries are thousands of levels, and the other's are. One side is in the billions range. Paper 1(Resende A C D,Aranha D F. Faster unbalanced private set intersection[C]//International Conference on Financial Cryptography and Data Security. Springer,Berlin,Heidelberg,2018:203-22)1.

The function of fully homomorphic encryption is to allow data to be added, subtracted, multiplied, etc. in an encrypted state, which makes it possible to outsource calculations of private data. For the privacy set intersection application scenario based on fully homomorphic encryption, the party holding the small set data is generally called the user side, and the party holding the large set data is generally called the server side. The specific operation process is briefly described as follows:

1) The client and the server jointly negotiate the fully homomorphic encryption scheme Scheme-FHE, and determine the relevant public parameters pparams of the scheme;

2) Based on the Scheme-FHE and pparams determined by the negotiation, the client randomly generates the private key sk used to encrypt the client data, and the conversion key evk used for ciphertext homomorphic calculation;

3) The client sends the conversion key evk to the server and securely stores the private key sk to ensure that sk will not be leaked;

4) The client encrypts the client data plaintext Y through the private key sk to generate the data ciphertext cY, and sends cY to the server;

5) The server calculates the intersection result ciphertext cInsec through the conversion key evk, the server-side data plaintext X and the received user-side data ciphertext cY, and sends cInsec to the client;

6) The client decrypts the ciphertext cInsec through the private key sk, obtains the intersection result plaintext Insec, and then obtains the set intersection result.

In the above privacy set intersection process, the server-side data , ensuring that the server will not know any information other than the intersection in Y; for details, please refer to Figure 1; after 1)-6) is executed, the client has obtained the intersection information of X and Y, and the client can directly pass Some secure transmission methods (such as symmetric encryption) send intersection information to the server, but this requires that the client must be completely honest. However, in some current privacy set intersection application scenarios (such as data alignment, privacy retrieval), the intersection results of data sets are not required to be bidirectional, that is, the server does not need to know the intersection results.

In the homomorphism-based privacy set intersection, the intersection set is determined by traversing each user data y and determining whether it is in the server-side data X = {x ₁ , x ₂ , x ₃ ,..., x _m } is calculated based on the same data existing in .

More specifically, the expression (yx ₁ )(yx ₂ )(yx ₃ )...(yx _m ) is evaluated. If the value is 0, it proves that y is in the intersection, otherwise it is not. However, under the premise of fully homomorphic encryption, all y in the expression are ciphertext states.

It is worth noting that the fully homomorphic encryption scheme is essentially an encryption scheme that introduces noise, and the calculation of the ciphertext state will increase the noise of the ciphertext, especially the multiplication calculation of the ciphertext. Once the noise reaches a certain level, the ciphertext will not be able to decrypt the correct result. The cost of increasing the number of allowable additions and multiplications of the ciphertext is the increase in the parameters of the homomorphic encryption scheme, which also means greater calculation and storage requirements. volume, communication transmission volume. For the user data ciphertext cy, directly calculating (yx ₁ )(yx ₂ )(yx ₃ )...(yx _m ) means m-1 ciphertext multiplication operations.

The work in paper 2 (Chen H, Laine K, Rindal P. Fast private set intersection from homomorphic encryption [C]//Proceedings of the 2017ACM SIGSAC Conference on Computer and Communications Security.2017:1243-1255) points out that if the The y in the expression is regarded as a polynomial independent variable, and it is expanded according to the polynomial operation rules as y ^m +a _m-1 y ^m-1 +a _m-2 y ^m-2 +...+a ₁ y+a ₀ , then the client can simultaneously send the corresponding ciphertext cy ⁱ of multiple specific powers of the data y, and all cy, cy ² , cy ³ ,... can be restored while reducing the number of ciphertext multiplications required. ., cy ^m , and then complete the ciphertext calculation of the above expression. As shown in Figure 2 and Figure 3, for example, for the expression y ¹⁵ +a ₁₄ y ¹⁴ +a ₁₃ y ¹³ +...+a ₁ y+a ₀ , only the premise of data ciphertext cy is provided on the user side , restoring the ciphertext under all powers requires 4 layers of ciphertext multiplication; if the client provides data ciphertext cy, cy ² , cy ⁴ , cy ⁶ at the same time, only 2 layers of ciphertext multiplication are required.

In the existing technology, the maximum number of layers allowed for the ciphertext multiplication operation is L, and the total number of ciphertexts at different powers provided by the user for the same data y is s. The server needs to use the initial cipher given by the user. The maximum ciphertext power restored by ciphertext multiplication is m. From the above description and analysis, it can be seen that when the parameters of the fully homomorphic encryption scheme are fixed, the value of L is also determined; the size of the s value corresponds to the amount of data sent from the client to the server; the size of the m value corresponds to the single result encryption The maximum number of equality judgments corresponding to the text; in summary, a problem that needs to be solved is how to determine the power value corresponding to the seed ciphertext sent by the user, so that the value of s is as small as possible and the value of m is as large as possible.

Paper 3 (Cong K, Moreno R C, da Gama M B, et al. Labeled PSI from Homomorphic Encryption with Reduced Computation and Communication [C]//Proceedings of the 2021ACM SIGSAC Conference on Computer and Communications Security.2021:1135-1150) The research work pointed out that the above problem can be abstracted into a classic problem in combinatorial mathematics: the stamp problem. The problem is defined as follows: Let h and k be positive integers, A _k ={a ₁ , a ₂ , a ₃ ,..., a _k } is a positive integer set containing k elements, where a ₁ =1＜ a ₂ <a ₃ <...<a _k , and M(h,A _k ) represents the smallest number that cannot be represented by the sum of no more than h elements (repeatable) in A _k .

Let’s give an example to explain in detail: h=3, k=4, A ₄ ={1, 4, 7, 8}, then at this time M (3, A ₄ )=25 (because 1=1, 2=1+ 1,3＝1+1+1,4＝4,5＝4+1,6＝4+1+1,7＝7,8＝7+1,9＝8+1,10＝8+1+ 1,11＝7+4, 12＝8+4, 13＝8+4+1, 14＝7+7, 15＝7+8, 16＝8+8, 17＝8+8+1, 18＝ 7+7+4, 19＝8+7+4, 20＝8+8+4, 21＝7+7+7, 22＝7+7+8, 23＝7+8+8, 24＝8+ 8+8, and 25 cannot be expressed as the sum of within three of {1, 4, 7, 8}.) The goal of solving the stamp problem is to solve M(h, The maximum value of A _k ) and the corresponding set of positive integers A _k ={a ₁ , a ₂ , a ₃ ,..., a _k }, the stamp problem is an NP-hard problem. At the same time, there are some corresponding dual versions of the stamp problem, that is, solving the minimum value of k when h, M(h, A _k ) is known, or solving h when knowing k, M(h, A _k ). the minimum value.

In the intersection process of privacy sets based on fully homomorphic encryption: the user-side value of the total number of ciphertexts for different powers of the same data y corresponds to the k value in the stamp problem, specifically k=s; ciphertext The maximum number of layers allowed for the multiplication operation is L corresponding to the h value in the stamp problem, specifically h=2 ^L. This is because the multiplication structure of a complete binary tree is adopted; A _k = {a ₁ , a ₂ , a ₃ ,... , each a _i in a _k } corresponds to the ciphertext power value of data y (i.e.

); the definition of the M(h, A _k ) value corresponds to the power m value of the maximum ciphertext restored by ciphertext multiplication, specifically m=M(h, A _k )-1; and for any value less than M The positive integer z of (h, A _k ), the summation form corresponds to the reduction route of the ciphertext cy ^z . Specifically, if

then pass

The multiplication route restores the ciphertext cy ^z .

The design of the privacy set intersection scheme in Paper 3 also actually utilizes the optimization techniques of solving the stamp problem. However, since the solution of the stamp problem is an NP-hard problem, the accurate and optimal A _k ={ can be obtained under any parameter group setting. The implementation of the intersection of a ₁ , a ₂ , a ₃ ,..., a _k } with auxiliary privacy sets is hardly shown. In Paper 3, only small parameters are considered for this problem. Specifically, by directly using Paper 4 (Challis M F, Robinson J P. Some extremal postage stamp bases[J]. Journal of Integer Sequences, 2010, 13 (2): 3) is implemented with ready-made solutions when part h and k are small (h = 2, 3, 4, 5, 6, k = 2, 3, 4, 5, 6, 7, 8) of.

For the intersection of privacy sets based on fully homomorphic encryption, the direct benefit brought by the use of the optimization technique of solving the stamp problem is that it can reduce the number of ciphertexts sent between the client and the server, thereby saving communication overhead costs. However, Paper 3 only uses the ready-made solutions in the case of h=2, 3, 4, 5, 6, k= 2, 3, 4, 5, 6, 7, 8 given in Paper 4 to plan the starting power density from the seed. The restoration route from text to all power ciphertext.

This method mainly has the following two disadvantages:

First, the method lacks sufficient generality. At present, in the specific use of fully homomorphic encryption, the number of ciphertext multiplication layers L allowed by it is generally up to 5-6 layers, and the corresponding h value can be up to 64. Obviously, the ready-made solution list given in Paper 4 is not enough. Covers all situations.

Secondly, the solution of the stamp problem itself only guarantees the existence of the restoration route of the ciphertext under each power, and cannot directly reflect the specific content of the restoration route. For the optimal solution to a certain problem instance, when using private set intersection, it is often necessary to additionally store all the summation expressions on the server side. Since there is no commonality or correlation between each summation expression, it cannot be expressed through a loop. For compression, a total of m summation expressions need to be stored, which means additional storage overhead and control difficulty.

Therefore, the existing technology is defective and needs improvement.

Contents of the invention

The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method with a smaller numerical value

The method of converting the solution of the problem instance into the solution of the M(h,A _k ) problem instance with a larger value solves the problem of solution vacancy under the larger value, and the total number of summation expressions required to be stored is only

Compared with the total number m required in the optimal solution, this method can significantly save storage costs and is a ciphertext restoration method under the intersection of homomorphic encryption privacy sets.

The technical solution of the present invention is as follows: a ciphertext restoration method under the intersection of homomorphic encryption privacy sets. The dual version corresponding to the known existing stamp problem is: known h=2 ^L , M(h,A _k )= Under the premise of m+1, solving k and the corresponding set A _k as small as possible includes the following steps: 1) Select D = 2; 2) Set h _D = h/D,

in

means rounding up; 3) Query the solution list of the dual version of the known existing stamp problem to find out whether there is any solution in the dual version

The solutions k _D and corresponding to the problem instance

If yes, go to step 4), otherwise go to step 5); 4) Record the current D,

All corresponding summation expressions, and: k=D·k _D ,

5) Use 2D as the new D value to determine whether there is a relationship

Or h=D is established, if yes, go to step 6), if not, return to step 2) to continue execution; 6) According to the requirements, select the best one among all the solutions recorded in 4) for privacy set intersection Cipher text restoration route planning.

Applied to the above technical solution, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, in step 6), the multiplication structure of a complete binary tree is adopted; A _k = {a ₁ , a ₂ , a ₃ , ..., the ciphertext power value of each a _i in a _k } corresponding to data y is

The definition of the M(h, A _k ) value corresponds to the power m value of the maximum ciphertext restored by ciphertext multiplication, specifically m=M(h, A _k )-1; for any value less than M(h, The positive integer z of A _k ), the summation expression corresponds to the restoration route of the ciphertext cy ^z , specifically, if

then pass

The multiplication route restores the ciphertext cy ^z .

Applied to each of the above technical solutions, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, in step 6), the one with the smaller k value among all the solutions recorded in 4) is selected according to the requirements. Ciphertext recovery route planning for privacy set intersection.

Applied to each of the above technical solutions, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, when the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L = 5 layers, the ciphertext to be restored Maximum power m = 1000000; in step 6), select the one with the smallest k value among all solutions: k = 8, A _k = {1, 11, 78, 216, 1001, 11011, 78078, 216216}, and the length is A list of 1001 summation expressions.

Applied to each of the above technical solutions, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, in step 6), all solutions recorded in 4) are selected according to the requirements, and the length of the sum expression list is shorter. A ciphertext restoration route planning for privacy set intersection.

Applied to each of the above technical solutions, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, when the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L = 5 layers, the ciphertext to be restored Maximum power m = 1000000; in step 6), select the shorter summation expression list length among all solutions: k = 12, A _k = {1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376}, a list of summation expressions with a length of 32.

Adopting the above solution, the present invention solves the problem of designing a ciphertext restoration method for privacy set intersection under homomorphic encryption by using the stamp problem, which has the problem of known existing solution gaps and the need for additional information storage. Provides a smaller value

The method of converting the solution of the problem instance into the solution of the M(h, A _k ) problem instance with a larger value, which can basically be found in the known existing solution list, solving the problem of solution vacancy for larger values; At the same time, although the theoretical minimum (i.e., optimal value) has not been reached in terms of the size of the k value, the total number of summation expressions required to be stored under this method is only

Therefore, compared with the total number m required in the optimal solution, this method can significantly save storage costs.

Description of the drawings

In order to explain the technical solutions of the present invention more clearly, the drawings that need to be used in the implementation will be briefly introduced below. Obviously, the drawings in the following description are only some implementations of the present invention. For those of ordinary skill in the art, As far as workers are concerned, other drawings can also be obtained from these drawings without exerting creative work.

Figure 1 is a schematic diagram of the intersection concept of privacy sets in the prior art;

Figure 2 is a schematic diagram of the ciphertext restoration process under homomorphic encryption in the prior art;

Figure 3 is a schematic diagram 2 of the ciphertext restoration process under homomorphic encryption in the prior art.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present invention.

This embodiment provides a ciphertext restoration method under the intersection of homomorphic encryption privacy sets. The core solution idea of the present invention is to reuse the small parameter solution of the stamp problem at multiple scales. Among them, this embodiment corresponds to the ciphertext reduction method. Considering the allowable number of layers of multiplication operations L, the maximum ciphertext power is fixed to m, and the total number of ciphertexts provided by the user is reduced as much as possible. It is known that the current The dual version of the stamp problem is: given that h=2 ^L and M(h, A _k )=m+1, solve for the smallest possible k and the corresponding set A _k , including the following steps: 1) Select D =2; 2) Set h _D =h/D,

in

Indicates rounding up; for example

3) Query the solution list of the dual version of the known existing stamp problem to find out whether there is one in the dual version

The solutions k _D and corresponding to the problem instance

Among them, h=h _D means that the value of h in the dual version is h _D . If yes, go to step 4), otherwise go to step 5); 4) Record the current D,

All corresponding sum expressions, and records:

k＝D·k _D ,

5) Use 2D as the new D value to determine whether there is a relationship

Among them, in the ciphertext restoration method under the intersection of homomorphic encryption privacy sets, in step 6), the multiplication structure of a complete binary tree is adopted; A _k = {a ₁ , a ₂ , a ₃ ,..., The ciphertext power value of each a _i in a _k } corresponding to data y is

then pass

The multiplication route restores the ciphertext cy ^z . The ciphertext restoration process under homomorphic encryption is shown in Figure 2 and Figure 3. Figure 2 shows the situation where the user only sends the ciphertext cy. Figure 3 shows the situation where the user sends the ciphertext cy at the same time. The situation of cy ² , cy ⁴ and cy ⁸ .

A specific application example of the ciphertext restoration method under the intersection of homomorphic encryption privacy sets introduced in this embodiment is given below.

Assume that the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme jointly negotiated by the client and the server is L = 5 layers, and the maximum power of the ciphertext to be recovered is m = 1000000 (one million). According to the dual version: it is known that h=2 ^L and M(h, A _k )=m+1. The corresponding stamp problem example under this requirement setting is h=32, M(h, A _k )=1000001.

This problem instance does not exist in the currently known solutions to the stamp problem. Even if it does exist, using it directly means that all one million summation expressions must be stored on the server side to be used as one million power ciphertexts. Restore calculations; the amount of data is very large.

Below we use the method described in this invention to solve it (in order to make the description more concise, we directly use a single cycle as the item unit):

1) When D=2, it is calculated that h _D =16, m _D =1001; query the known existing solution list to find h=16,

Corresponding to the solution under the problem instance, find a solution k _D = 4,

Record D=2,

All summation expressions (1＝1, 2＝1+1,..., 16＝11+1+1+1+1+1, 17＝11+1+1+1+1+1+1, ...,1001=216+216+216+216+78+11+11+11+11+11+1+1+1+1, a total of 1001) and a solution to the dual version of the original problem instance k=8 , A _k = {1, 11, 78, 216, 1001, 11011, 78078, 216216};

At this time, any number N less than M=1000001 can be expressed by adding the numbers in A _k within h=32. For example: assuming N=234567<M, first express it as N=234× 1001+333, extract the expressions 234 and 333 from the 1001 recorded summation expressions (the number of right-hand addends of each expression is within 16), and get 234=216+11+1+1+1 +1+1+1+1 and 333=216+78+11+11+11+1+1+1+1+1+1, from which it is deduced that N=234567 in A _k ={1, 11, 78 , 216, 1001, 11011, 78078, 216216}, that is, 234567=234×1001+333=(216+11+1+1+1+1+1+1+1)×1001+( 216+78+11+11+11+1+1+1+1+1+1)＝216216+11011+1001+1001+1001+1001+1001+1001+1001+216+78+11+11+11 +1+1+1+1+1+1;

2) When D=4, it is calculated that h _D =8, m _D =32; query the known existing solution list to find h=8,

Corresponding to the solution under the problem instance, find a solution k _D = 3,

Record D=4,

All summation expressions (1=1, 2=1+1,..., 31=7+6+6+6+6, 32=7+7+6+6+6, 32 in total) and the original question A solution to the dual version of the example k = 12, A _k = {1, 6, 7, 32 × 1, 32 × 6, 32 × 7, 32 2 × 1, 32 ² × 6, 32 ² ^× 7, 32 ³ × 1, 32 ³ × 6, 32 ³ × 7} = {1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376}; at this time, for any number less than M = 1000001 N can be expressed by adding the numbers in A _k within h=32. For example: assuming N=666666<M, first express it as

N＝20×32 ³ +11×32 ² +1×32 ¹ +10＝20×32768+11×1024+1×32+10, extract 20,11,1 from the 32 recorded summation expressions and the expression of 10 (the number of right-hand addends of each expression is within 8), we get 20=7+7+6, 11=7+1+1+1+1, 1=1, 10=7+ 1+1+1, from which the expression of N=666666 in A _k ={1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376} is derived, that is, 666666= 20×32 ³ +11×32 ² +1×32 ¹ +10＝(7+7+6)×32768+(7+1+1+1+1)×1024+1×32+(7+1+ 1+1)＝229376+229376+196608+7168+1024+1024+1024+1024+32+7+1+1+1

I) When D=8, it is calculated that h _D =4, m _D =4<10; the loop is terminated, and two sets of solutions under D=2 and D=4 are finally obtained:

Solution 1: k = 8, A _k = {1, 11, 78, 216, 1001, 11011, 78078, 216216}, a list of summation expressions with a length of 1001;

Solution 2: k = 12, A _k = {1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376}, a list of summation expressions with a length of 32;

It can be seen that the above two solutions each have certain advantages. The number of seed ciphertext powers in the first solution, that is, the k value is smaller, and the corresponding amount of information interaction between the client and the server is smaller. The summation expression list of the second solution A shorter total length will save storage costs on the server side. At the same time, it can be observed that whether it is 32 expressions or 1001 expressions, its length is corresponding to the optimal solution under h=32 and M=1000001. For 1,000,000 expressions, the storage cost is greatly reduced. As for how to make further choices between the two solutions, it can be judged based on the actual solution performance requirement indicators. However, the existence of the two solutions is sufficient to show that the ciphertext restoration method in the present invention can solve the existing problem to a certain extent. The problems described exist in the technology.

Therefore, the present invention uses the stamp problem to solve and design a ciphertext restoration method for privacy set intersection under homomorphic encryption. There are known problems in the existing solution gaps and the need for additional information storage. Provides a smaller value

The method of converting the solution of the problem instance (which can basically be found in the known existing solution list) into the solution of the M(h, A _k ) problem instance with a larger value solves the problem of solution vacancies under larger values; and At the same time, although the method of the present invention does not reach the theoretical minimum value (ie, the optimal value) in terms of the k value, the total number of summation expressions required to be stored under this method is only

Claims

A ciphertext restoration method under the intersection of homomorphic encryption privacy sets, corresponding to the dual version of the known existing stamp problem: solving it under the premise of knowing h=2 L , M(h, A k )=m+1 The smallest possible k and the corresponding set A k are characterized by including the following steps:

1) Select D=2;

2) Set h D =h/D,
in
means rounding up;

3) Query the solution list of the dual version of the known existing stamp problem and find out whether h=h D in the dual version,
The solutions k D and corresponding to the problem instance
If yes, go to step 4), otherwise go to step 5);

4) Record the current D,
All corresponding summation expressions, and records: k=D·k D ,

5) Use 2D as the new D value to determine whether there is a relationship
Or h=D is established, if yes, go to step 6), if not, return to step 2) to continue execution;

6) According to the requirements, select the best one among all the solutions recorded in 4) for ciphertext restoration route planning for the intersection of privacy sets.
The ciphertext restoration method under homomorphic encryption privacy set intersection according to claim 1, characterized in that: in step 6), the multiplication structure of a complete binary tree is adopted; A k = {a 1 , a 2 , a 3 ,..., a k } The ciphertext power value of each a i corresponding to data y is
The definition of the M(h, A k ) value corresponds to the power m value of the maximum ciphertext restored by ciphertext multiplication, specifically m=M(h, A k )-1; for any value less than M(h, The positive integer z of A k ), the summation expression corresponds to the restoration route of the ciphertext cy z , specifically, if
then pass
The multiplication route restores the ciphertext cy z .
The ciphertext restoration method under homomorphic encryption privacy set intersection according to claim 2, characterized in that: in step 6), the one with a smaller k value among all the solutions recorded in 4) is selected according to the requirements. Ciphertext recovery route planning for privacy set intersection.
The ciphertext restoration method under homomorphic encryption privacy set intersection according to claim 3, characterized in that: when the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L=5 layers, the ciphertext to be restored Maximum power m = 1000000; in step 6), select the smaller k value among all solutions: k = 8, A k = {1, 11, 78, 216, 1001, 11011, 78078, 216216}, length A list of summation expressions for 1001.
The ciphertext restoration method under homomorphic encryption privacy set intersection according to claim 2, characterized in that: in step 6), all the solutions recorded in 4) are selected according to the requirements, and the length of the sum expression list is shorter. A ciphertext restoration route planning for privacy set intersection.
The ciphertext restoration method under homomorphic encryption privacy set intersection according to claim 5, characterized in that: when the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L=5 layers, the ciphertext to be restored The maximum power m=1000000; in step 6), select the one with the shorter summation expression list length among all solutions: k=12,

A k = {1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376}, a list of summation expressions with a length of 32.
A ciphertext restoration method under the intersection of homomorphic encryption privacy sets, corresponding to the dual version of the known existing stamp problem: solving it under the premise of knowing h=2 L , M(h, A k )=m+1 The smallest possible k and the corresponding set A k are characterized by including the following steps:

1) Select D=2;

2) Set h D =h/D,,
in
means rounding up;

3) Query the solution list of the dual version of the known existing stamp problem and find out whether h=h D in the dual version,
The solutions k D and corresponding to the problem instance
If yes, go to step 4), otherwise go to step 5);

4) Record the current D,
All corresponding summation expressions, and records: k=D·k D ,

5) Use 2D as the new D value to determine whether there is a relationship
Or h=D is established, if yes, go to step 6), if not, return to step 2) to continue execution;

6) According to the requirements, select the best one among all the solutions recorded in 4) for ciphertext restoration route planning for the intersection of privacy sets.

In step 6), the multiplication structure of a complete binary tree is adopted; the ciphertext power value of each a i in A k = {a 1 , a 2 , a 3 ,..., a k } corresponding to the data y is
The definition of the M(h, A k ) value corresponds to the power m value of the maximum ciphertext restored by ciphertext multiplication, specifically m=M(h, A k )-1; for any value less than M(h, The positive integer z of A k ), the summation expression corresponds to the restoration route of the ciphertext cy z , specifically, if
then pass
The multiplication route restores the ciphertext cy z ;

In step 6), according to the requirements, select the ciphertext restoration route planning with the smaller k value among all the solutions recorded in 4) for the intersection of privacy sets;

When the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L = 5 layers, the maximum power of the ciphertext required to be recovered is m = 1000000; in step 6), select the smaller k value among all solutions: k =8, A k ={1, 11, 78, 216, 1001, 11011, 78078, 216216}, a list of summation expressions with a length of 1001;

In step 6), according to the requirements, select the ciphertext restoration route plan for privacy set intersection that has a shorter summation expression list length among all the solutions recorded in 4);

When the number of ciphertext multiplication layers allowed by the homomorphic encryption scheme is L = 5 layers, the maximum power of the ciphertext required to be recovered is m = 1000000; in step 6), select the shorter summation expression list length among all solutions One is: k=12,

Ak={1, 6, 7, 32, 192, 224, 1024, 6144, 7168, 32768, 196608, 229376}, a list of summation expressions with a length of 32.