Skip to main content

Predicate Private Set Intersection with Linear Complexity

  • Conference paper
  • First Online:
Applied Cryptography and Network Security (ACNS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13906))

Included in the following conference series:

  • 943 Accesses

Abstract

Private Set Intersection (PSI) enables two parties to learn the intersection of their input sets without exposing other items that are not within the intersection. However, real-world applications often require more complex computations than just obtaining the intersection. In this paper, we consider the setting where each item in the input set has an associated payload, and the desired output is a subset of the intersection obtained by evaluating certain conditions over the payload. We call this new primitive Predicate Private Set Intersection (PPSI) and show its applicability in many different scenarios. While a PPSI protocol can be obtained by combining existing circuit-PSI and generic circuit-based secure computation, this naive approach is not efficient. Therefore, we also provide a specially designed PPSI protocol with linear complexity and good concrete efficiency. We implemented the protocol and evaluated it with extensive experiments. The results validated the efficacy of our PPSI protocol.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Alibaba-Gemini-Lab: Opencheetah (2022). https://github.com/Alibaba-Gemini-Lab/OpenCheetah

  2. Bogdanov, D., Niitsoo, M., Toft, T., Willemson, J.: High-performance secure multi-party computation for data mining applications. Int. J. Inf. Secur. 11(6), 403–418 (2012)

    Article  Google Scholar 

  3. Chandran, N., Gupta, D., Shah, A.: Circuit-psi with linear complexity via relaxed batch OPPRF. Proc. Privacy Enhanc. Technol. 1, 353–372 (2022)

    Article  Google Scholar 

  4. Chase, M., Miao, P.: OPRF-PSI (2020). https://github.com/peihanmiao/OPRF-PSI

  5. Chase, M., Miao, P.: Private set intersection in the internet setting from lightweight oblivious PRF. In: Micciancio, D., Ristenpart, T. (eds.) CRYPTO 2020. LNCS, vol. 12172, pp. 34–63. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-56877-1_2

    Chapter  Google Scholar 

  6. Chen, H., Huang, Z., Laine, K., Rindal, P.: Labeled PSI from fully homomorphic encryption with malicious security. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1223–1237. ACM, Los Angeles, CA, USA (2018)

    Google Scholar 

  7. Chen, H., Laine, K., Rindal, P.: Fast private set intersection from homomorphic encryption. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1243–1255. ACM, New York, NY, United States (2017)

    Google Scholar 

  8. Cong, K., et al.: Labeled PSI from homomorphic encryption with reduced computation and communication. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 1135–1150. ACM, New York, NY, United States (2021)

    Google Scholar 

  9. Demmler, D., Schneider, T., Zohner, M.: ABY - a framework for efficient mixed-protocol secure two-party computation. In: NDSS (2015)

    Google Scholar 

  10. Dong, C., Chen, L., Wen, Z.: When private set intersection meets big data: an efficient and scalable protocol. In: ACM SIGSAC Conference on Computer and Communications Security, pp. 789–800. ACM, Berlin, Germany (2013)

    Google Scholar 

  11. EdalatNejad, K., Raynal, M., Lueks, W., Troncoso, C.: Private set matching protocols. arXiv preprint arXiv:2206.07009 (2022)

  12. Fan, J., Vercauteren, F.: Somewhat practical fully homomorphic encryption. Cryptology ePrint Archive (2012)

    Google Scholar 

  13. Garimella, G., Mohassel, P., Rosulek, M., Sadeghian, S., Singh, J.: Private set operations from oblivious switching. In: Garay, J.A. (ed.) PKC 2021. LNCS, vol. 12711, pp. 591–617. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-75248-4_21

    Chapter  Google Scholar 

  14. Huang, K., Liu, X., Fu, S., Guo, D., Xu, M.: A lightweight privacy-preserving CNN feature extraction framework for mobile sensing. IEEE Trans. Depend. Secur. Comput. 18(3), 1441–1455 (2019)

    Google Scholar 

  15. Huang, Y., Evans, D., Katz, J.: Private set intersection: are garbled circuits better than custom protocols? In: NDSS, San Diego, California, USA (2012)

    Google Scholar 

  16. Huang, Z., Lu, W.J., Hong, C., Ding, J.: Cheetah: lean and fast secure two-party deep neural network inference. Cryptology ePrint Archive (2022)

    Google Scholar 

  17. Ishai, Y., Kilian, J., Nissim, K., Petrank, E.: Extending oblivious transfers efficiently. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 145–161. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45146-4_9

    Chapter  Google Scholar 

  18. Kolesnikov, V., Kumaresan, R.: Improved OT extension for transferring short secrets. In: Canetti, R., Garay, J.A. (eds.) CRYPTO 2013. LNCS, vol. 8043, pp. 54–70. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40084-1_4

    Chapter  Google Scholar 

  19. Kolesnikov, V., Kumaresan, R., Rosulek, M., Trieu, N.: Efficient batched oblivious PRF with applications to private set intersection. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 818–829. ACM, New York, USA (2016)

    Google Scholar 

  20. Laur, S., Talviste, R., Willemson, J.: From oblivious AES to efficient and secure database join in the multiparty setting. In: Jacobson, M., Locasto, M., Mohassel, P., Safavi-Naini, R. (eds.) ACNS 2013. LNCS, vol. 7954, pp. 84–101. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38980-1_6

    Chapter  MATH  Google Scholar 

  21. Le, P.H., Ranellucci, S., Gordon, S.D.: Two-party private set intersection with an untrusted third party. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2403–2420. ACM, New York, USA (2019)

    Google Scholar 

  22. Lepoint, T., Patel, S., Raykova, M., Seth, K., Trieu, N.: Private join and compute from pir with default. In: Tibouchi, M., Wang, H. (eds.) ASIACRYPT 2021. LNCS, vol. 13091, pp. 605–634. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-92075-3_21

    Chapter  Google Scholar 

  23. Lindell, Y.: How to simulate it-a tutorial on the simulation proof technique. Tutor. Found. Cryptogr. 277–346 (2017)

    Google Scholar 

  24. Liu, Y., Zhang, X., Wang, L.: Asymmetrical vertical federated learning. arXiv preprint arXiv:2004.07427 (2020)

  25. Meadows, C.: A more efficient cryptographic matchmaking protocol for use in the absence of a continuously available third party. In: 1986 IEEE Symposium on Security and Privacy, pp. 134–134. IEEE (1986)

    Google Scholar 

  26. Mohassel, P., Rindal, P., Rosulek, M.: Fast database joins and psi for secret shared data. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 1271–1287 (2020)

    Google Scholar 

  27. Mohassel, P., Rosulek, M., Trieu, N.: Practical privacy-preserving k-means clustering. Cryptology ePrint Archive (2019)

    Google Scholar 

  28. Pagh, R., Rodler, F.F.: Cuckoo hashing. J. Algorithms 51(2), 122–144 (2004)

    Article  MathSciNet  MATH  Google Scholar 

  29. Pinkas, B., Rosulek, M., Trieu, N., Yanai, A.: SpOT-light: lightweight private set intersection from sparse OT extension. In: Boldyreva, A., Micciancio, D. (eds.) CRYPTO 2019. LNCS, vol. 11694, pp. 401–431. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-26954-8_13

    Chapter  Google Scholar 

  30. Pinkas, B., Rosulek, M., Trieu, N., Yanai, A.: PSI from PaXoS: fast, malicious private set intersection. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020. LNCS, vol. 12106, pp. 739–767. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45724-2_25

    Chapter  Google Scholar 

  31. Pinkas, B., Schneider, T., Tkachenko, O., Yanai, A.: Efficient circuit-based PSI with linear communication. In: Ishai, Y., Rijmen, V. (eds.) EUROCRYPT 2019. LNCS, vol. 11478, pp. 122–153. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-17659-4_5

    Chapter  Google Scholar 

  32. Pinkas, B., Schneider, T., Weinert, C., Wieder, U.: Efficient circuit-based PSI via cuckoo hashing. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10822, pp. 125–157. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78372-7_5

    Chapter  Google Scholar 

  33. Pinkas, B., Schneider, T., Zohner, M.: Scalable private set intersection based on OT extension. ACM Trans. Privacy Secur. (TOPS) 21(2), 1–35 (2018)

    Article  Google Scholar 

  34. Rathee, D., et al.: Cryptflow2: practical 2-party secure inference. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 325–342. ACM, New York, USA (2020)

    Google Scholar 

  35. Rindal, P.: libpsi (2020). https://github.com/osu-crypto/libPSI

  36. Taassori, M., Shafiee, A., Balasubramonian, R.: Vault: reducing paging overheads in SGX with efficient integrity verification structures. In: Proceedings of the Twenty-Third International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 665–678. ACM, New York, USA (2018)

    Google Scholar 

  37. Takeshita, J., Karl, R., Mohammed, A., Striegel, A., Jung, T.: Provably secure contact tracing with conditional private set intersection. In: Garcia-Alfaro, J., Li, S., Poovendran, R., Debar, H., Yung, M. (eds.) SecureComm 2021. LNICST, vol. 398, pp. 352–373. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-90019-9_18

    Chapter  Google Scholar 

  38. Wang, X., Malozemoff, A.J., Katz, J.: EMP-toolkit: efficient MultiParty computation toolkit (2016). https://github.com/emp-toolkit

  39. Yang, K., Weng, C., Lan, X., Zhang, J., Wang, X.: Ferret: fast extension for correlated OT with small communication. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 1607–1626. ACM, New York, USA (2020)

    Google Scholar 

  40. Ying, J.H., Cao, S., Poh, G.S., Xu, J., Lim, H.W.: PSI-stats: private set intersection protocols supporting secure statistical functions. In: Ateniese, G., Venturi, D. (eds.) ACNS 2022. LNCS, vol. 13269, pp. 585–604. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-09234-3_29

Download references

Acknowledgments

This work was supported by Major Program of Guangdong Basic and Applied Research Project under Grant No. 2019B030302008, National Natural Science Foundation of China under Grant Nos. 61825203, U22B2028 and 62072132, National Key Research and Development Plan of China under Grant No. 2020YFB1005600, Guangdong Provincial Science and Technology Project under Grant No. 2021A0505030033, Science and Technology Major Project of Tibetan Autonomous Region of China under Grant No. XZ202201ZD0006G, National Joint Engineering Research Center of Network Security Detection and Protection Technology, Guangdong Key Laboratory of Data Security and Privacy-Preserving, and Guangdong Hong Kong Joint Laboratory for Data Security and Privacy Protection. We would also thank the anonymous reviewers for their valuable comments.

Author information

Authors and Affiliations

Authors

Corresponding authors

Correspondence to Jian Weng or Changyu Dong .

Editor information

Editors and Affiliations

Appendices

Appendix 1: Secure Comparison

To compare \(x \in \{0,1\}^\ell \) provided by \(\mathcal {C}\) and \(y \in \{0,1\}^\ell \) provided by \(\mathcal {S}\), the secure comparison protocol performs the following four stages:

Splitting stage: \(\mathcal {C}\) and \(\mathcal {S}\) split their inputs x and y equally into q parts, and q is a power of 2. Each part has k bits, and assume k divides \(\ell \). Let K be a parameter and \(K=2^k\). That is \(x=x^{q-1}||...||x^0\) and \(y=y^{q-1}||...||y^0\), where \(x^t,y^t \in \{0,1\}^k\), \(t \in [0,q-1]\).

Masking stage: For each part \(t \in [0,q-1]\), \(\mathcal {C}\) prepares \(\langle \textrm{lt}_0^t \rangle _\mathcal {C}^B, \langle \textrm{eq}_0^t \rangle _\mathcal {C}^B {\mathop {\leftarrow }\limits ^{\$}}\{0,1\}\). For all \(u \in [0,K-1]\), \(\mathcal {C}\) sets \(s_u^t = \langle \textrm{lt}_0^t \rangle _\mathcal {C}^B \oplus 1\{x^t <u\}\) and \(v_u^t = \langle \textrm{eq}_0^t \rangle _\mathcal {C}^B \oplus 1\{x^t = u\}\).

Choosing stage: \(\mathcal {C}\) and \(\mathcal {S}\) invoke an instance of \(\left( {\begin{array}{c}K\\ 1\end{array}}\right) \)-OT\(_{\ell }\) where \(\mathcal {C}\) inputs \(\{s_u^t\}_{u \in [0,K-1]}\) and \(\mathcal {S}\) inputs the choose bit \(y^t\). Then \(\mathcal {S}\) gets the output \(\langle \textrm{lt}_0^t \rangle _\mathcal {S}^B\). Similarly, \(\mathcal {C}\) and \(\mathcal {S}\) invoke another instance of \(\left( {\begin{array}{c}K\\ 1\end{array}}\right) \)-OT\(_{\ell }\) where \(\mathcal {C}\) inputs \(\{v_u^t\}_{u \in [0,K-1]}\) and \(\mathcal {S}\) inputs the choose bit \(y^t\). Then \(\mathcal {S}\) gets the output \(\langle \textrm{eq}_0^t \rangle _\mathcal {S}^B\).

Merging stage: \(\mathcal {C}\) and \(\mathcal {S}\) recursively compute the shares they have using the idea of Equation (3). For \(i \in [1,\textrm{log} q]\) and \(t \in [1,(q/(2^i)-1)]\), \(\mathcal {C}\) and \(\mathcal {S}\) invoke \(F_\textrm{AND}\) to compute \(\langle \textrm{lt}_{i}^{t} \rangle ^B_\mathcal {C} = \langle \textrm{lt}_{i-1}^{2t} \rangle ^B_\mathcal {C} \wedge \langle \textrm{eq}_{i-1}^{2t+1} \rangle ^B_\mathcal {C} \oplus \langle \textrm{lt}_{i-1}^{2t+1} \rangle ^B_\mathcal {C}\) and \(\langle \textrm{lt}_{i}^{t} \rangle ^B_\mathcal {S} = \langle \textrm{lt}_{i-1}^{2t} \rangle ^B_\mathcal {S} \wedge \langle \textrm{eq}_{i-1}^{2t+1} \rangle ^B_\mathcal {S} \oplus \langle \textrm{lt}_{i-1}^{2t+1} \rangle ^B_\mathcal {S}\). Then \(\mathcal {C}\) and \(\mathcal {S}\) can compute \(\langle \textrm{eq}_{i}^{t} \rangle ^B_\mathcal {C} = \langle \textrm{lt}_{i-1}^{2t} \rangle ^B_\mathcal {C} \wedge \langle \textrm{eq}_{i-1}^{2t+1} \rangle ^B_\mathcal {C}\) and \(\langle \textrm{eq}_{i}^{t} \rangle ^B_\mathcal {S} = \langle \textrm{lt}_{i-1}^{2t} \rangle ^B_\mathcal {S} \wedge \langle \textrm{eq}_{i-1}^{2t+1} \rangle ^B_\mathcal {S}\). Final, \(\mathcal {C}\) gets \(\langle \textrm{lt}_{i}^{0} \rangle ^B_\mathcal {C} \) and \(\mathcal {S}\) gets \(\langle \textrm{lt}_{i}^{0} \rangle ^B_\mathcal {S}\).

After the above four stages, \(\mathcal {C}\) and \(\mathcal {S}\) get the boolean shares of the comparison result of x and y.

Appendix 2: Security Proof

The proof of Theorem 1 is as follows.

Proof

As shown in Algorithm 1, for \(\mathcal {C}\), the view during the protocol execution will be \({\textbf {view}}_\mathcal {C}=(\langle p^* \rangle _\mathcal {C}^B,z)\). Since z is generated by ROT protocol and is a random value, according to Lemma 1, it is trivial to see that all values of \(\mathcal {C}\)’s view are uniformly random. \(\mathcal {C}\) outputs nothing during this protocol. Therefore, \({\textbf {view}}_\mathcal {C}\) and \({\textbf {output}}_\mathcal {C}\) can be simulated by a simulator \(Sim_\mathcal {C}\). Then \(Sim_\mathcal {C}\) can generate a view for the adversary \(Adv_\mathcal {C}\), who can not distinguish the generated view from its real view.

For \(\mathcal {S}\), the view during the protocol execution will be \({\textbf {view}}_\mathcal {S}=(\langle p^* \rangle _\mathcal {S}^B)\). Then \(\mathcal {S}\) outputs \(R_0,R_1\) during this protocol. Since \(R_0,R_1\) is generated by ROT protocol and are random values, according to Lemma 1, all values of \(\mathcal {S}\)’s view are uniformly random. Therefore, \({\textbf {view}}_\mathcal {S}\) and \({\textbf {output}}_\mathcal {S}\) can be simulated by a simulator \(Sim_\mathcal {S}\). Then \(Sim_\mathcal {S}\) can generate a view for the adversary \(Adv_\mathcal {S}\), who can not distinguish the generated view from its real view.

The proof of Theorem 2 is as follows.

Proof

As shown in Algorithm 5.3, for \(\mathcal {C}\), the view in the protocol execution will be \({\textbf {view}}_\mathcal {C}=(\alpha ,\{\textrm{s}_{1,\alpha ^t}^t||...||\textrm{s}_{n,\alpha ^t}^t\},\{\textrm{v}_{1,\alpha ^t}^t||\) \(...||\textrm{v}_{n,\alpha ^t}^t\})\). Since \(\{\textrm{s}_{1,\alpha ^t}^t||...||\textrm{s}_{n,\alpha ^t}^t\},\{\textrm{v}_{1,\alpha ^t}^t||...||\textrm{v}_{n,\alpha ^t}^t\}\) are generated from the random elements (step 7–8 in Algorithm 5.3), according to Lemma 1, it is trivial to see that all values of \(\mathcal {C}\)’s view are uniformly random. The output of \(\mathcal {C}\) is \({\textbf {output}}_\mathcal {C}=\langle 1\{\alpha < p_i\} \rangle _\mathcal {C}\), which is generated from the random values \(\{\textrm{s}_{1,\alpha ^t}^t||...||\textrm{s}_{n,\alpha ^t}^t\},\{\textrm{v}_{1,\alpha ^t}^t||...||\textrm{v}_{n,\alpha ^t}^t\}\) (step 14–20 in Algorithm 5.3). Therefore, \({\textbf {view}}_\mathcal {C}\) and \({\textbf {output}}_\mathcal {C}\) can be simulated by a simulator \(Sim_\mathcal {C}\). Then \(Sim_\mathcal {C}\) can generate a view for the adversary \(Adv_\mathcal {C}\), who can not distinguish the generated view from its real view.

For \(\mathcal {S}\), the view in the protocol execution will be \({\textbf {view}}_\mathcal {S}=({\textbf {p}},\langle lt_{0,j}^t \rangle ,\langle eq_{0,j}^t \rangle \})\). Since \(\{\langle lt_{0,j}^t \rangle ,\langle eq_{0,j}^t \rangle \}\) are generated from the random elements (step 5 in Algorithm 5.3), all values of \(\mathcal {S}\)’s view are uniformly random. The output of \(\mathcal {S}\) is \({\textbf {output}}_\mathcal {S}=\langle 1\{\alpha < p_i\} \rangle _\mathcal {S}\), which is generated from the random values \(\{\langle lt_{0,j}^t \rangle ,\langle eq_{0,j}^t \rangle \}\) (step 6–8 in Algorithm 5.3). Therefore, \({\textbf {view}}_\mathcal {S}\) and \({\textbf {output}}_\mathcal {S}\) can be simulated by a simulator \(Sim_\mathcal {S}\). Then \(Sim_\mathcal {S}\) can generate a view for the adversary \(Adv_\mathcal {S}\), who can not distinguish the generated view from its real view.

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Yang, Y., Weng, J., Yi, Y., Dong, C., Zhang, L.Y., Zhou, J. (2023). Predicate Private Set Intersection with Linear Complexity. In: Tibouchi, M., Wang, X. (eds) Applied Cryptography and Network Security. ACNS 2023. Lecture Notes in Computer Science, vol 13906. Springer, Cham. https://doi.org/10.1007/978-3-031-33491-7_6

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-33491-7_6

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-33490-0

  • Online ISBN: 978-3-031-33491-7

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics