Method and System for Cryptographic Decision-making of Set Membership

Abstract

A cryptographic decision-making of set membership is a method or system which make a secure decision-making for positive membership e∈S or negative membership e∉S in an unforgeable and non-repudiation way for any element e and a set S. The proposed method of the present invention comprises: acquire a set U={e1, . . . , en} and map each element ei in U into a random point vi in a cryptography space; acquire a set S={e′1, . . . , e′m}⊂U, determine a random point v′i corresponding to each element e′i in the set S, and construct a function ƒS(x) according to all random points v′i; introduce a random secret γ to generate ƒS(γ) by using the function ƒS(x), and produce a public parameter mpk according to the random secret γ; and generate the cryptographic representation of set S by using the function ƒS(γ) and the public parameter mpk. In the embodiments, we provide two kinds of cryptographic representations of set, including Poles-based Aggregation and Zeros-based Aggregation, to make the decision on positive membership ei∈S and negative membership ei∉S.

Description

FIELD OF THE INVENTION

The presently claimed invention relates generally to information technology. The invention also relates to cryptographic methods for secure decision-making of set-membership used in secure group communication.

BACKGROUND OF THE INVENTION

The ‘positive’ membership and ‘negative’ membership are two of most common binary relations. For a given set U={e₁, . . . , e_n} and any a subset S⊂U, the positive membership is usually expressed as ∈, e.g., e∈S denotes the element e is in the set S. Similarly, the negative membership is as ∉, e.g., e∉S denotes e is not in S. When there exists only one element in the set, the ‘positive’ membership and ‘negative’ membership are converted into the ‘equal’ and ‘unequal’ relationship, respectively. These two basic memberships also induce several complex relationships, including ‘inclusion’, ‘exclusion’, ‘set-equal’, ‘set-unequal’, etc. Especially, the ‘negative’ membership is also regarded as NOT-logic or Complement-logic that is used widely in decision analysis and logic judgment.

In cryptography, ‘positive’ and ‘negative’ membership are always used to make a secure decision on set membership, that is, the ‘positive’ and ‘negative’ membership denote whether a given element e exists (or does not exist) in a set S. This kind of decisions is required to be cryptographically secure, for example, if e∈S (or e∉S), no one can declare wrong relationship e∉S (or e∈S) to the others.

Cryptographic set operations over ‘positive’ and ‘negative’ membership and NOT-logic have an important value in theory and application for designing security protocols and secure computation algorithms, such as broadcast encryption (BE), attribute-based encryption (ABE), predicate encryption (PE), function encryption (FE), and privacy-protection keyword query (PPKQ), etc. The cryptographic ‘positive’ and ‘negative’ membership is in essence a secure computation technology, which is a basic mechanism to protect information assets under open network environment. This kind of technology has been widely used in the E-commerce, E-government, online trading, and even military networks.

Let us see an example in group-oriented broadcast encryption. We assume that a broadcaster wants to send an encrypted sensitive message to all users, but only specified users can use their private keys to decrypt received messages. It will be easy to implement with help of cryptographic ‘positive’ and ‘negative’ membership: Let S be a set of these specified users. The broadcaster encapsulates S into the encrypted message, and e is tied to user's private key. If e∈S, the user can decrypt the received message; otherwise, the user, even if he has the previous license, is unable to decrypt the received message.

Let us see another example in attribute-based encryption (ABE). An attribute set is composed of different values, e.g., City={‘Beijing’, ‘Shanghai’, ‘Shenzheng’, ‘London’, ‘New York’ . . . }. The message sender can choose some values from this set to form an ‘authorized’ or ‘non-authorized’ subset, which will decide what values will be authorized or unauthorized to decrypt the message. In addition, each member in cryptosystem is assigned some attribute values and the corresponding attribute-keys to identify his identity. With help of cryptographic decision-making method of set-membership in this invention, the receiver compares the values hidden by the attribute-keys with the encrypted subset in the ciphertext when he tries to recover the message. If the comparison result satisfies the ‘positive’ (or ‘negative’) membership over the subset, he can decrypt the message correctly. However, there does not exist this kind of cryptographic decision-making method of set-membership in the literature at present. Our method will fill the vacancy of this field in cryptography.

SUMMARY OF THE INVENTION

It is, accordingly, an object of this invention to provide a construction, method, and system for cryptographic decision-making of set membership, in order to solve the problem that there does not exist an effective method to implement cryptographic representation of set membership in the existing literature.

The present invention provides a cryptographic construction method for determining a set membership, comprising:

• • acquiring any given set U={e₁, . . . , e_n}, and transforming each element e_i in the set U into a random point v_i in a cryptographic space;
  • acquiring a given set S={e′₁, . . . , e′_m}⊂U, determining a random point v′_i corresponding to each element e′_i in the set S according to the random point v_i, and constructing a function ƒ_S(x) according to the random point v′_i;
  • introducing a random secret γ, determining a function ƒ_S(γ) according to the function ƒ_S(x), and determining a public parameter mpk according to the random secret γ; and
  • processing the function ƒ_S(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method.

Further, the random point comprises a random number or a random vector; constructing a function ƒ_S(x) according to the random point v′_i comprises:

• • constructing a zeros-based polynomial ƒ_S(x) by setting the random point v′_i corresponding to each element e′_i in the set S as a zero of the polynomial H(x); or
  • constructing a poles-based polynomial ƒ_S(x) by setting the random point v′_i corresponding to each element e′_i in the set S as a pole of the polynomial H(x);
  • wherein H(x) is a rational polynomial with a form H(x)=P(x)/Q(x), which is the quotient of two polynomial P(x) and Q(x); for a variable z, the root z of P(x) is called a zero of H(x) if P(z)=0, and the root z of Q(x) is called a pole of H(x) if Q(z)=0;
  • the constructed function also comprises a Lagrange interpolation polynomial, Newton interpolation polynomials, Hermite interpolation polynomials, Bernstein polynomials and Fibonacci polynomials, Binomial polynomials or corresponding algebraic curves constructed from the random point v′_i.

Further, the processing the function ƒ_S(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method comprises:

• • processing the function ƒ_S(γ) by using the public parameter mpk as an input to generate an aggregation function Aggregate(mpk,S) of the set S via cryptographic method, wherein the aggregation function is called a zeros-based aggregation function ZerosAggr(mpk,S) if the function ƒ_S(x) is a zeros-based polynomial, or the aggregation function is called a poles-based aggregation function PolesAggr(mpk,S) if the function ƒ_S(x) is a poles-based polynomial; and
  • compressing the set S into a constant-size random number or random vector R_S by means of the aggregation function, wherein R_S is an aggregated value outputted by the aggregation function Aggregate(mpk,S), and the size of R_S is independent of the number of elements in the set S.

Further, after the compressing the set S into a constant-size random number R_S by means of the aggregation function, further comprising:

• • constructing a cryptographic determination algorithm by means of the aggregation function for determining equality and inequality relationships between elements; and/or constructing a cryptographic determination method by means of the aggregation function for determining positive and negative affiliation memberships between elements and the set; and/or
  • constructing a cryptographic determination method by means of the aggregation function for determining positive and negative containment relationships between the sets.

Further, the constructing a cryptographic determination algorithm by means of the aggregation function for determining a positive affiliation membership between elements and the set comprises:

• • acquiring an element e_i, and when e_i∈S, setting S₋=S\{e_i}, then determining the aggregated value R_S− by the zeros-based aggregation function ZerosAggr(mpk,S₋); and
  • when e_i∉S, setting S₋=s\{e_i}, then determining the aggregated value R_S− by none of polynomial-time algorithms, the polynomial-time algorithms comprise ZerosAggr(mpk,S₋);
  • the constructing a cryptographic determination algorithm by means of the aggregation function for determining a negative affiliation membership between elements and the set comprises:
  • acquiring an element e_i, when e_i∉S, setting S₊=S∪{e_i}, then determining the aggregated value R_S+ by the pole-based aggregation function PoiesAggr(mpk,S₊); and
  • when e_i∈S, setting S₊=S∪{e_i}, then determining the aggregated value R_S+ by none of polynomial-time algorithms, the polynomial-time algorithms comprise PolesAggr(mpk,S₊).

Further, the constructing a cryptographic determination algorithm by means of the aggregation function for determining a positive affiliation membership between elements and the set comprises:

• • constructing a commitment on the aggregated value R_S according to the outputted aggregated value R_S of the set S from the poles-based aggregation function PolesAggr(mpk,S);
  • for the element e_i, when e_i∉S, verifying the commitment according to the determined aggregated value R_S− outputted by the zeros-based aggregation function ZerosAggr(mpk,S₋); and
  • when e_i∈S, verifying the commitment by none of polynomial-time algorithms;
  • the constructing a cryptographic determination algorithm by means of the aggregation function for determining a negative affiliation membership between elements and the set comprises:
  • constructing a commitment on the aggregated value R_S according to the outputted aggregated value R_S of the set S from the zeros-based aggregation function ZerosAggr(mpk,S);
  • for the element e_i, when e_i∈S, verifying the commitment according to the determined aggregated value R_S− outputted by the poles-based aggregation function PolesAggr(mpk,S₊); and
  • when e_i∈S, verifying the commitment by none of polynomial-time algorithms.

A cryptographic construction system for determining a set membership, comprising:

• • a randomizing unit, which is configured to acquire any given set U={e₁, . . . , e_n} and transform each element e_i in the set U into a random point v_i in a cryptographic space;
  • a function generating unit, which is configured to acquire a given set S={e′₁, . . . , e′_m}⊂U, determine a random point v′_i corresponding to each element e′_i in the set S according to the random point v_i, and construct a function ƒ_S(x) according to the random point v′_i;
  • a secret point determining unit, which is configured to introduce a random secret γ, determine a function ƒ_S(γ) according to the function ƒ_S(x), and determine a public parameter mpk according to the random secret γ; and
  • a cryptographic processing unit, which is configured to process the function ƒ_S(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method.

Further, the cryptographic processing unit comprises:

• • a processing module, which is configured to process the function ƒ_S(γ) by using the public parameter mpk as an input to generate an aggregation function Aggregate(mpk,S) of the set S via cryptographic method, wherein the aggregation function is called a zeros-based aggregation function ZerosAggr(mpk,S) if the function ƒ_S(x) is a zeros-based polynomial, or the aggregation function is called a poles-based aggregation function PolesAggr(mpk,S) if the function ƒ_S(x) is a poles-based polynomial; and
  • a compressing module, which is configured to compress the set S into a constant-size random number or random vector R_S by means of the aggregation function, wherein R_S is an aggregated value outputted by the aggregation function Aggregate(mpk,S), and the size of R_S is independent of the number of elements in the set S.

Further, the cryptographic construction system further comprising:

• • a first determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining equality and inequality relationships between elements; and/or
  • a second determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative affiliation memberships between elements and the set; and/or
  • a third determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative containment relationships between the sets.

Further, the second determination unit is further configured to acquire an element e_i, and when e_i∈S, set S₋=S\{e_i}, then determine the aggregated value R_S− by the zeros-based aggregation function ZerosAggr(mpk,S₋); and when e_i∉S, set S₋=S\{e_i}, then determine the aggregated value R_S− by none of polynomial-time algorithms, the polynomial-time algorithms comprise ZerosAggr(mpk,S₋); and

• • the second determination unit is further configured to acquire an element e_i, when e_i∉S, set S₊=S∪{e_i}, then determine the aggregated value R_S+ by the pole-based aggregation function PoiesAggr(mpk,S₊); and when e_i∈S, set S₊=S∪{e_i}, then determine the aggregated value R_S+ by none of polynomial-time algorithms, the polynomial-time algorithms comprise PoiesAggr(mpk,S₊).
  • According to the fourth aspect of the presented invention, there are provided some advantageous features comprising:

The Aggregation algorithm supports the aggregation of any number of elements in a given set, that is, there is no restrict on the number of aggregated elements, such that our system will provide the cryptographic decision-making for membership over a set of any size.

The presented system supports cryptographic decision-making for ‘positive’ and ‘negative’ membership, simultaneously. The reason is that these two kinds of decision-making methods only need two aggregation functions: PolesAggr(•) and ZerosAggr(•).

The presented decision-making method for ‘positive’ and ‘negative’ membership is secure with unforgeability and non-repudiation based on the difficulty in computing the aggregated values for two error settings, e_i∉S but S₋=S\{e_i}, and e_i∈S but S₊=S∪{e_i}. The reason is that the zeros-based (or poles-based) aggregation values R_S− (or R_S+) cannot be computed by any polynomial-time algorithm (regarded as any attacker), including the aggregation function ZerosAggr(mpk,S₋) (or PolesAggr(mpk,S₊)).

The presented cryptographic decision-making method may provide a foundation for the cryptography research on set theory. Considering that modern mathematic is foundation on set theory, the solution to the decision-making problem of basic membership inevitably lead to solving a series of related cryptographic problems, especially in secure (unilateral, two-party, multiparty) computing, including Privacy-based Data Retrieval, Keyword Search of Confidential Database, Group Encryption, Predicate Encryption, Attribute-based Encryption, Cryptography-based Access Control and so on.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a system diagram illustrating cryptographic decision-making of positive membership in accordance with the embodiment of the invention;

FIG. 2 is a system diagram illustrating cryptographic decision-making of negative membership in accordance with the embodiment of the invention;

FIG. 3 is a structural diagram of cryptosystem illustrating decision-making of membership in accordance with the embodiments of the invention.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

In order that the invention may be more clearly understood, embodiments thereof will now be described, by way of example only, with reference to the accompanying drawings, in detail.

The presented invention aims at the issue that the set-membership cannot be expressed and decided in cryptography in the literature at present, and provide the cryptographic methods of secure decision-making of set-memberships.

An embodiment of the invention is described as follows:

(1) Aggregation Function

In this embodiment, the core notion is aggregation function based on cryptographic representation of subsets. Given a set U, an aggregation function is a cryptographic function to compress the information of any subset S⊂U into a constant-size value. The output of aggregation function is called the cryptographic representation of subset. This function is stated as follows:

Let PK denote the public key space over a group G and U={e₁,L,e_n}, the function Aggregate: PK×2^U→G is a deterministic polynomial-time algorithm satisfying:

Aggregate(mpk,S)=R_S,  (1)

where mpk is the public key in PK, S⊂U, and R_S is an element in G.

Note that, the aggregation function is an open function because it merely takes as input the public key and does not require any secret information for its operation.

The aggregation function serves as the foundation for making cryptographic decisions on set memberships, i.e., positive membership e∈S and negative membership e∉S. More exactly, we construct two aggregation functions, ZerosAggr and PolesAggr, for decision-making on positive membership (e∈S) and negative membership (e∉S), respectively.

Before we present the two aggregation functions, we first give the definition of zeros and poles in a rational polynomial function as follows:

H(x) is a rational polynomial with a form H(x)=P(x)/Q(x), which is the quotient of two polynomial P(x) and Q(x); for a variable z, the root z of P(x) is called a zero of H(x) if P(z)=0, and the root z of Q(x) is called a pole of H(x) if Q(z)=0;

Based on this definition, there is provided a construction method for two aggregation functions, Zeros-based aggregation ZerosAggr and Poles-based aggregation PolesAggr.

(2) Construction of Zeros-Based Aggregation Function

Firstly, the function ZerosAggr is constructed according to four following phases:

1) Randomizing Phase

Let G be a multiplicative cyclic group of prime order p and g is a generator of G. Given a set U={e₁,L,e_n}, each element e_i in U is converted into a random point v_i in one dimensional space. The collision-resistant Hash function hash is used to realize this conversation, that is,

(v₁,L,v_n)=(hash(e₁),L,hash(e_n))∈¢ⁿ_p  (2)

Where, ¢ⁿ_p denotes the n integers under module p and each element e_i is represented by the arbitrary length binary string. We do not limit the size of U because the number of elements is usually far less than the size of ¢ⁿ_p (e.g., p>2²⁵⁶ for a secure elliptic curve).

2) Function-Generating Phase

Given a subset S={e′₁,L,e′_m}⊂U, a zeros-based polynomial ƒ_S(x) could be derived from all random points (v′₁,L,v′_n)=(hash(e′¹),L,hash(e′_n)) which are considered as the (negative) zeros of polynomial. Exactly, the polynomial ƒ_S(x) is defined as:

$\begin{array}{cc}{f}_S\left(x\right)=x\left(x+v_1^{\prime }\right)\dots \left(x+v_m^{\prime }\right)=x·\prod _{e_i^{\prime }\in S}\left(x+v_i^{\prime }\right)\mathrm{mod}p.& \left(3\right)\end{array}$

3) Secret-Determining Phase

A random secret γ is introduced to generate ƒ_S(γ) by using the polynomial ƒ_S(x), that is,

ƒ_S(γ)=γΣ_e′i∈S(γ+v′_i)mod p.  (4)

And then produces the public parameter mpk=(g₁,g₂,L,g_m)=(g^γ,g^γ2,L,g^γm) from γ.

4) Cipher-Processing Phase

In this phase, the zeros-based representation of set S is generated by using the function ƒ_S(γ) and the public parameter mpk. Firstly, the zeros-based representation of set S is defined as

$\begin{array}{cc}{g}^{f_S\left(\gamma \right)}=g^{\gamma \prod _{e_i^{\prime }\in S}\left(\gamma +v_i^{\prime }\right)}\in G,& \left(5\right)\end{array}$

where, g is the generator of group G.

Next ƒ_S(x)=xΠ_e′i∈S(x+v′_i)=Σ_k=0^ma_kx^k+1, where the coefficient a_k can be computed only if all elements in S are known. According to Equation (5), the zeros-based aggregation value is also able to computed by using the public parameter mpk={g_i=g^γi}_i∈[1,m] as follows:

G _S =gΣ _k=0 ^m a _kγ^(k+1)=Π_k=1^m+1g_k^ak−1.  (6)

Note that, when S=Ø, the output of this function is ZerosAggr(mpk,Ø)=g₁=g^γ.

In this embodiment, a function is called the Zeros-based Aggregation (in short, ZerosAggr) function since the hash values of all elements in S are used for the (negative) zeros in the polynomial ƒ_S(x). The Zeros-based Aggregation is defined as follows:

Given a subset S={e₁,L,e_n}⊂U and a cyclic group G, an algorithm is called Zeros-based Aggregation function if there exists a polynomial-time algorithm that outputs

$G_S=\mathrm{ZerosAggr}\left(\mathrm{mpk},S\right)=g^{\gamma ·\prod _{e_i^{\prime }\in S}\left(\gamma +v_i\right)},$

where, mpk={g_i=g^γi}_i∈[1,|U|] is the public parameter, g is a generator in G, v_i=hash(e_i) and γ is a secret.

(3) Construction of Poles-Based Aggregation Function

Secondly, the poses-based aggregation function PolesAggr is constructed according to four following phases:

1) Randomizing Phase

Let G be the same cyclic group of prime order p in ZerosAggr and h is a generator of G. Given a set U={e₁,L,e_n}, the collision-resistant Hash function hash is used to realize the mapping from elements to random points, that is,

(v₁,L,v_n)=(hash(e₁),L,hash(e_n))∈¢ⁿ_p.  (7)

2) Function-Generating Phase

Given a subset S={e′₁,L,e′_m}⊂U, a poles-based polynomial g_S(x) could be derived from all points (v′₁,L,v′_n)=(hash(e′₁),L,hash(e′_n)) which are considered as the (negative) poles of polynomial. Exactly, the polynomial g_S(x) is defined as:

$\begin{array}{cc}{g}_S\left(x\right)=\frac{1}{\left(x+v_i^{\prime }\right)\dots \left(x+v_m^{\prime }\right)}=\frac{1}{\prod _{e_i^{\prime }\in S}\left(x+v_i^{\prime }\right)}\mathrm{mod}p.& \left(8\right)\end{array}$

3) Secret-Determining Phase

A random secret γ is introduced to generate g_S(γ), that is,

g _S(γ)=Π_e′i∈S(γ+v′_i)⁻¹ mod p.  (9)

And then produces the public parameter mpk=(h₁,h₂,L,h_m)=(h^1/γ+v′1,h^1/γ+v′2,L,h^1/γ+v′m) from γ.

4) Cipher-Processing Phase

The poles-based representation of set S is defined as

$\begin{array}{cc}{H}_S=h^{g_S\left(\gamma \right)}=h^{\frac{1}{\prod _{e_i^{\prime }\in S}\left(x+v_i^{\prime }\right)}}\in G,& \left(10\right)\end{array}$

where, h is the generator of cyclic group G.

We provide a fast recursive method to realize the PolesAggr function from the public parameter

$\mathrm{mpk}={\left\{h_i=h^{\frac{1}{y+v_i}}\right\}}_{e_i\in U}.$

Firstly, let us see the aggregation between two elements: given h_i and h_j, it is easy to obtain the equation

$\begin{array}{cc}{\left(h_j/h_i\right)}^{\frac{1}{v_i^{\prime }-v_j^{\prime }}}={\left(h^{\frac{1}{\gamma +v_j^{\prime }}/}h^{\frac{1}{\gamma +v_i^{\prime }}}\right)}^{\frac{1}{v_i^{\prime }-v_j^{\prime }}}=h^{\frac{1}{\left(\gamma +v_i^{\prime }\right)\left(\gamma +v_j^{\prime }\right)}},& \left(11\right)\end{array}$

where v_i≠v_j is a precondition for this equation for avoiding error with dividing by zero. Next, we expand this equation to multi-value cases. Set

$B_{i,j}=h^{\frac{1}{\prod _{k=i}^j\left(\gamma +v_k^{\prime }\right)}}=h^{\frac{1}{\gamma +v_i^{\prime }}L\frac{1}{\gamma +v_j^{\prime }}},$

The poles-based aggregation value

$H_S=B_{1,m}=h^{\frac{1}{\prod _{e_i^{\prime }\in S}^{}\left(x+v_i^{\prime }\right)}}$

can be computed by

$\begin{array}{cc}\{\begin{array}{cc}{B}_{i,i}=h_i& \forall i\in \left[1,m\right]\\ B_{i,j}={\left(B_{i,j}/B_{i+1,j+1}\right)}^{\frac{1}{v_{j+1}^{\prime }-v_i^{\prime }}}& i\in \left[1,m-1\right],j\in \left[2,m\right]\end{array}& \left(12\right)\end{array}$

In this embodiment, a function is called the Poles-based Aggregation (in short, PolesAggr) function since the hash values of all elements in S are used for the (negative) poles in the polynomial g_S(x). The Poles-based Aggregation is defined as follows:

Given a subset S={e₁,L,e_m}⊂U and a cyclic group G, an algorithm is called Poles-based Aggregation function if there exists a polynomial-time algorithm that outputs

$H_S=\mathrm{PolesAggr}\left(\mathrm{mpk},S\right)=h^{\frac{1}{\prod _{e_i^{\prime }\in S}\left(\gamma +v_i\right)}},$

where,

$\mathrm{mpk}={\left\{h_i=h^{\frac{1}{y+v_i}}\right\}}_{e_i\in U}$

is the public parameter, h is a generator in G, v_i=hash(e_i) and γ is a secret.

In this embodiment, the information of the set S is compressed and represented as a random number (or vector) in a cryptographic space by zeros-based aggregation function or poles-based aggregation function. Next, the aggregated value can decided the memberships in a cryptographic approach, such as: ‘equal’ and ‘unequal’ between two elements, ‘inclusion’ and ‘exclusion’ between two sets, and ‘positive’ and ‘negative’ membership whether one element is in a set of elements.

(4) Security of Zeros-Based Aggregation Function

The accuracy and reliability of decision-making of ‘positive’ membership depends on the security of the zeros-based aggregation function. In this embodiment, the security of zeros-based aggregation function satisfies the following requirements:

Given an element e_i∈U and a subset S⊂U, let S₋=S\{e_i} and

$\begin{array}{cc}{G}_{S-}=G_{S\backslash \left\{e_i\right\}}=g^{\frac{f_S\left(\gamma \right)}{\gamma +v_i}}=g^{\frac{\gamma \prod _{e_i^{\prime }\in S}\left(\gamma +v_i^{\prime }\right)}{\gamma +v_i}}.& \left(13\right)\end{array}$

A function on S is called the secure zeros-based aggregation if it has the following two properties:

• • Easy to compute G_S− for e_i∈S, that is, the value G_S− can be computed by

$\mathrm{ZerosAggr}\left(\mathrm{mpk},S_{-}\right)=g^{\gamma \prod _{e_i^{\prime }\in S,e_i^{\prime }\ne e_i}\left(\gamma +v_i^{\prime }\right)}$

within a polynomial-time;

• • Hard to compute G_S− for e_i∉S, that is, any PPT algorithm (including ZerosAggr(mpk,S₋)) computing G_S− succeeds with negligible probability.

These two properties can ensure the security of decision-making of positive membership.

(5) Security of Poles-Based Aggregation Function

The accuracy and reliability of decision-making of ‘negative’ membership depends on the security of the poles-based aggregation function. In this embodiment, the security of poles-based aggregation function satisfies the following requirements:

Given an element e_i∈U and a subset S⊂U, let S₊=S\{e_i} and

$\begin{array}{cc}{H}_{S+}=H_{S\bigcup \left\{e_i\right\}}=h^{g_S\left(\gamma \right)·\frac{1}{\gamma +v_i}}=h^{\frac{1}{\prod _{e_i^{\prime }\in S}^{}\left(x+v_i^{\prime }\right)}·\frac{1}{{}^{\left(\gamma +v_i\right)}}}& \left(14\right)\end{array}$

A function on S is called the secure poles-based aggregation if it has the following two properties:

• • Easy to compute H_S+ for e_i∉S, that is, the value H_S+ can be computed by

$\mathrm{PolesAggr}\left(\mathrm{mpk},S_{+}\right)=h^{\frac{1}{\prod _{e_i^{\prime }\in S}^{}\left(x+v_i^{\prime }\right)}·\frac{1}{{}^{\left(\gamma +v_i\right)}}}$

within a polynomial-time;

• • Hard to compute H_S+ for e_i∈S, that is, any PPT algorithm (including PolesAggr(mpk,S₊)) computing H_S+ succeeds with negligible probability.

These two properties can ensure the security of decision-making of negative membership.

(6) Cryptographic Decision-Making of Positive Membership

In order to achieve the decision-making of positive membership, this invention introduces the concept of commitment. Commitment, which contains two processes: commitment-generating and commitment-verifying, is a basic concept in cryptography. No one can guess the secret in the commitment after the commitment is built, but we can verify the consistency between the commitment and its hidden secret if we obtain some specific values (called clues).

In this embodiment, the cryptographic decision-making of positive and negative membership is built on the general bilinear pairing system that can be indicated as S={p,G,G_T,e(•,•)}. In this system, G and G_T are two multiplicative cyclic groups of prime order p, and elements g and h are the generators of G_T and then the bilinear pairing can be indicated as e: G×G a G_T. This system should have the following properties:

1) Bilinear: For any a,b belong to ¢*_p, it can get e(g^a,h^b)=e(g,h)^ab;

2) Non-degenerate: e(g,h)≠1;

3) Computable: There is a polynomial-time algorithm to calculate e(g,h).

FIG. 1 is a flow diagram that implementing cryptographic decision-making of positive membership, described as follows:

For any given set S, the poles-based aggregate function 1 PolesAggr(mpk,S) is invoked to calculate the aggregation value H_S of set S. And then, a random secret k is introduced to construct the value H_S's commitment

$H_S=h^{g_s\left(\gamma \right)k}=h^{\frac{k}{{}^{\prod _{r_i\in S}^{}\left(\gamma +v_i\right)}}}\mathrm{and}g^{\gamma k}.$

For a given element e satisfying e∉S, let S₋=S\{e} 2 according to the security definition of zeros-based aggregation function.

The zeros-based aggregation function 3 ZerosAggr(mpk,S₋) is invoked to calculate the aggregation value

$\begin{array}{cc}{G}_{s-}=\mathrm{ZerosAggr}\left(\mathrm{mpk},S_{-}\right)=G_{S\backslash \left\{e\right\}}=g^{f_{S-}\left(\gamma \right)}=g^{\frac{f_S\left(\gamma \right)}{\gamma +v}}=g^{\frac{\gamma \prod _{e_i\in S}\left(\gamma +v_i\right)}{\gamma +v}}.& \left(15\right)\end{array}$

Where, v=hash(e) and v_i=hash(e_i).

The following secret value is recovered 4 from

$\begin{array}{cc}e\left(G_{S-},H_S\right)=e\left(g^{{f_S}_{-}\left(\gamma \right)},h^{g_S\left(\gamma \right)k}\right)=e\left(g^{\frac{\gamma \prod _{e_i\in S}\left(\gamma +v_i\right)}{\gamma +v}},h^{\frac{k}{\prod _{e_i\in S}\left(\gamma +v_i\right)}}\right)={e\left(g,h\right)}^{\frac{\gamma ·k}{\gamma +v}}.& \left(16\right)\end{array}$

The above commitment is verified 5 by using

${e\left(g,h\right)}^{\frac{\gamma k}{\gamma +v}}=e\left(g^{\gamma k},h^{\frac{1}{\gamma +v}}\right),$

where is

$h^{\frac{1}{\gamma +v}}$

directly derived from mpk.

Conversely, if e∉S, according to the security definition of zeros-based aggregation function, it is computably difficult to recover the particular value

${e\left(g,h\right)}^{\frac{\gamma ·k}{\gamma +v}},$

therefore the commitment verification 5 cannot be passed.

In summary, the above-mentioned method makes more efficient and precise for decision-making of positive membership. That is, it not only improves the efficiency of decision-making process, but also ensures the security and consistency of decision-making.

(7) Cryptographic Decision-Making of Negative Membership

FIG. 2 is a flow diagram that implementing cryptographic decision-making of negative membership, described as follows:

For any given set S, the zeros-based aggregate function 3 ZerosAggr(mpk,S) is invoked to calculate the aggregation value G_S of set S. And then, a random secret k is introduced to construct the value G_S's commitment

$G_s=g^{f_s\left(\gamma \right)k}=g^{k{\mathrm{\gamma \Pi }}_{e_i\in S}\left(\gamma +v_i\right)}$

and g^γk.

For a given element e satisfying e∉S, let S₊=S∪{e} 6 according to the security definition of poles-based aggregation function.

The poles-based aggregation function 1 PolesAggr(mpk,S+) is invoked to calculate the aggregation value

$\begin{array}{cc}{H}_{S_{+}}=\mathrm{PolesAggr}\left(\mathrm{mpk},S_{+}\right)=H_{S\bigcup \left\{e\right\}}=h^{g_{S_{+}\left(\gamma \right)}}=h^{g_S\left(\gamma \right)·\frac{1}{\gamma +v}}=h^{\frac{1}{\prod _{k=s}^r\left(\gamma +v_k\right)}·\frac{1}{{}^{\left(\gamma +v\right)}}}& \left(17\right)\end{array}$

Where, v=hash(e) and v_i=hash(e_i).

The following secret value is recovered 4 from

$\begin{array}{cc}e\left(G_s,H_{S+}\right)=e\left(g^{f_S\left(\gamma \right)k},h^{g_{S+}\left(\gamma \right)}\right)=e\left(g^{k\gamma \prod _{q\in S}\left(\gamma +v_i\right)},h^{\frac{1}{\prod _{e_i\in s}^{}\left(\gamma +v_i\right)}·\frac{1}{{}^{\left(\gamma +v\right)}}}\right)={e\left(g,h\right)}^{\frac{\gamma ·k}{\gamma +v}}& \left(18\right)\end{array}$

The above value is verified 5 by using

${e\left(g,h\right)}^{\frac{\gamma k}{\gamma +v}}=e\left(g^{\gamma k},h^{\frac{1}{{}^{\gamma +v}}}\right),$

where

$h^{\frac{1}{{}^{\gamma +v}}}$

is directly derived from mpk.

Conversely, if e∈S, according to the security definition of poles-based aggregation function, it is computably difficult to recover the particular value

${e\left(g,h\right)}^{\frac{\gamma ·k}{\gamma +v}},$

therefore the verification 5 cannot be passed.

In summary, the above-mentioned method makes more efficient and precise for decision-making of negative membership. That is, it not only improves the efficiency of decision-making process, but also ensures the security and consistency of decision-making.

In this embodiment of the invention, for instance, it can take some similar cryptographic implementation to verify other relationships, such as the equation relationship between two sets, the inclusion relationship between a set and another set, or the disjoint relationship (also known as not totally inclusion) of two sets.

Another embodiment of the invention is described as follows:

The invention also provides a specific embodiment of cryptographic system of secure decision-making of membership. Considering that the corresponding relation between the construction of this system and the above-mentioned embodiment of decision-making method of membership, the embodiment of cryptographic system can execute the above-mentioned decision-making method of membership to achieve the purpose of the invention. Therefore, the explanation of implementation of cryptographic method of decision-making of membership also applied to the implementation of cryptographic system of decision-making of membership. We do not repeat to explain in the following specific embodiment of the invention.

FIG. 3 is a structural diagram of cryptographic system of decision of membership on set, which includes:

• • Randomizing Unit 101, which is configured to acquire any given set U={e₁, . . . , e_n} and transform each element e_i in the set U into a random point v_i in a cryptographic space;
  • Function-Generating Unit 102, which is configured to acquire a given set S={e′₁, . . . , e′_m}⊂U, determine a random point v′_i corresponding to each element e′_i in the set S according to the random point v_i, and construct a function ƒ_S(x) according to the random point v′_i;
  • Secret-determining Unit 103, which is configured to introduce a random secret γ, determine a function ƒ_S(γ) according to the function ƒ_S(x), and determine a public parameter mpk according to the random secret γ; and
  • Cipher-Processing Unit 104, which is configured to process the function ƒ_S(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method.

During the procedure described above, all elements in a given set might be represented as a random number or a random vector in the cryptographic space, which can be used in cryptographic decision-making of membership between the set and the set, the set and the element, or the element and the element.

In this embodiment, optionally, the cipher-processing unit comprising:

Processing module, which is configured to process the function ƒ_S(γ) by using the public parameter mpk as an input to generate an aggregation function Aggregate(mpk,S) of the set S via cryptographic method, wherein the aggregation function is called a zeros-based aggregation function ZerosAggr(mpk,S) if the function ƒ_S(x) is a zeros-based polynomial, or the aggregation function is called a poles-based aggregation function PolesAggr(mpk,S) if the function ƒ_S(x) is a poles-based polynomial; and

Compressing module, which is configured to compress the set S into a constant-size random number or random vector R_S by means of the aggregation function, wherein R_S is an aggregated value outputted by the aggregation function Aggregate(mpk,S), and the size of R_S is independent of the number of elements in the set S.

According to one or more embodiments of the present invention, the constant-size random number or random vector R_S is used to generate the cryptographic decision-making device, includes:

The First Decision-Making Unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining equality and inequality relationships between elements; and/or

The Second Decision-Making Unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative affiliation memberships between elements and the set; and/or

The Third Decision-Making Unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative containment relationships between the sets.

In the foregoing specification, optionally, the embodiments of the invention can construct the second decision device that realizes the cryptographic system of decision-making of membership. The following processes may perform the decision-making of membership:

the second determination unit is further configured to acquire an element e_i, and when e_i∈S, set S=S\{e_i}, then determine the aggregated value R_S− by the zeros-based aggregation function ZerosAggr(mpk,S₋); and when e_i∉S, set S₋=S\{e_i}, then determine the aggregated value R_S− by none of polynomial-time algorithms, the polynomial-time algorithms comprise ZerosAggr(mpk,S₋); and

the second determination unit is further configured to acquire an element e_i, when e_i∉S, set S₊=S∪{e_i}, then determine the aggregated value R_S+ by the pole-based aggregation function PolesAggr(mpk,S₊); and when e_i∈S, set S₊=S∪{e_i}, then determine the aggregated value R_S+ by none of polynomial-time algorithms, the polynomial-time algorithms comprise PolesAggr(mpk,S₊).

The preferred embodiment of the present invention is described above. It should be pointed out that the general technical individual of technical field can also make some improvement and polishing, without departing from the principles of the present invention, which should be regarded as the scope of protection.

Claims

1. A cryptographic construction method for determining a set membership, comprising: acquiring any given set U={e1, . . . , en}, and transforming each element ei in the set U into a random point vi in a cryptographic space;acquiring a given set S={e′1, . . . , e′m}⊂U, determining a random point v′i corresponding to each element e′i in the set S according to the random point vi, and constructing a function ƒS(x) according to the random point v′i;introducing a random secret γ, determining a function ƒS(γ) according to the function ƒS(x), and determining a public parameter mpk according to the random secret γ; andprocessing the function ƒS(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method.

2. The cryptographic construction method according to claim 1, wherein the random point comprises a random number or a random vector; constructing a function ƒS(x) according to the random point v′i comprises: constructing a zeros-based polynomial ƒS(x) by setting the random point v′i corresponding to each element e′i in the set S as a zero of the polynomial H(x); orconstructing a poles-based polynomial ƒS(x) by setting the random point v′i corresponding to each element e′i in the set S as a pole of the polynomial H(x);wherein H(x) is a rational polynomial with a form H(x)=P(x)/Q(x), which is the quotient of two polynomial P(x) and Q(x); for a variable z, the root z of P(x) is called a zero of H(x) if P(z)=0, and the root z of Q(x) is called a pole of H(x) if Q(z)=0;the constructed function also comprises a Lagrange interpolation polynomial, Newton interpolation polynomials, Hermite interpolation polynomials, Bernstein polynomials and Fibonacci polynomials, Binomial polynomials or corresponding algebraic curves constructed from the random point v′i.

3. The cryptographic construction method according to claim 1, wherein the processing the function ƒS(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method comprises: processing the function ƒS(γ) by using the public parameter mpk as an input to generate an aggregation function Aggregate(mpk,S) of the set S via cryptographic method, wherein the aggregation function is called a zeros-based aggregation function ZerosAggr(mpk,S) if the function ƒS(x) is a zeros-based polynomial, or the aggregation function is called a poles-based aggregation function PolesAggr(mpk,S) if the function ƒS(x) is a poles-based polynomial; andcompressing the set S into a constant-size random number or random vector RS by means of the aggregation function, wherein RS is an aggregated value outputted by the aggregation function Aggregate(mpk,S), and the size of RS is independent of the number of elements in the set S.

4. The cryptographic construction method according to claim 3, after the compressing the set S into a constant-size random number RS by means of the aggregation function, further comprising: constructing a cryptographic determination algorithm by means of the aggregation function for determining equality and inequality relationships between elements; and/orconstructing a cryptographic determination method by means of the aggregation function for determining positive and negative affiliation memberships between elements and the set; and/orconstructing a cryptographic determination method by means of the aggregation function for determining positive and negative containment relationships between the sets.

5. The cryptographic construction method according to claim 4, wherein the constructing a cryptographic determination algorithm by means of the aggregation function for determining a positive affiliation membership between elements and the set comprises: acquiring an element ei, and when ei∈S, setting S−=S\{ei}, then determining the aggregated value RS− by the zeros-based aggregation function ZerosAggr(mpk,S−); andwhen ei ∉S, setting S−=S\{ei}, then determining the aggregated value RS− by none of polynomial-time algorithms, the polynomial-time algorithms comprise ZerosAggr(mpk,S−);the constructing a cryptographic determination algorithm by means of the aggregation function for determining a negative affiliation membership between elements and the set comprises:acquiring an element ei, when ei ∉S, setting S+=S∪{ei}, then determining the aggregated value RS+ by the pole-based aggregation function PoiesAggr(mpk,S+); andwhen ei∈S, setting S+=S∪{ei}, then determining the aggregated value RS+ by none of polynomial-time algorithms, the polynomial-time algorithms comprise PolesAggr(mpk,S+).

6. The cryptographic construction method according to claim 5, wherein the constructing a cryptographic determination algorithm by means of the aggregation function for determining a positive affiliation membership between elements and the set comprises: constructing a commitment on the aggregated value RS according to the outputted aggregated value RS of the set S from the poles-based aggregation function PolesAggr(mpk,S);for the element ei, when ei ∈S, verifying the commitment according to the determined aggregated value RS− outputted by the zeros-based aggregation function ZerosAggr(mpk,S−); andwhen ei∉S, verifying the commitment by none of polynomial-time algorithms;the constructing a cryptographic determination algorithm by means of the aggregation function for determining a negative affiliation membership between elements and the set comprises:constructing a commitment on the aggregated value RS according to the outputted aggregated value RS of the set S from the zeros-based aggregation function ZerosAggr(mpk,S);for the element ei, when ei ∉S, verifying the commitment according to the determined aggregated value RS− outputted by the poles-based aggregation function PolesAggr(mpk,S+); andwhen ei∉S, verifying the commitment by none of polynomial-time algorithms.

7. A cryptographic construction system for determining a set membership, comprising: a randomizing unit, which is configured to acquire any given set U={e1, . . . , en} and transform each element ei in the set U into a random point vi in a cryptographic space;a function generating unit, which is configured to acquire a given set S={e′1, . . . , e′m}⊂U, determine a random point v′i corresponding to each element e′i in the set S according to the random point vi, and construct a function ƒS(x) according to the random point v′i;a secret point determining unit, which is configured to introduce a random secret γ, determine a function ƒS(γ) according to the function ƒS(x), and determine a public parameter mpk according to the random secret γ; anda cryptographic processing unit, which is configured to process the function ƒS(γ) by using the public parameter mpk as an input to generate a cryptographic representation of the set S via a cryptographic method.

8. The cryptographic construction system according to claim 7, wherein the cryptographic processing unit comprises: a processing module, which is configured to process the function ƒS(γ) by using the public parameter mpk as an input to generate an aggregation function Aggregate(mpk,S) of the set S via cryptographic method, wherein the aggregation function is called a zeros-based aggregation function ZerosAggr(mpk,S) if the function ƒS(x) is a zeros-based polynomial, or the aggregation function is called a poles-based aggregation function PolesAggr(mpk,S) if the function ƒS(x) is a poles-based polynomial; anda compressing module, which is configured to compress the set S into a constant-size random number or random vector RS by means of the aggregation function, wherein RS is an aggregated value outputted by the aggregation function Aggregate(mpk,S), and the size of RS is independent of the number of elements in the set S.

9. The cryptographic construction system according to claim 8, further comprising: a first determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining equality and inequality relationships between elements; and/ora second determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative affiliation memberships between elements and the set; and/ora third determination unit, which is configured to construct a cryptographic determination algorithm by means of the aggregation function for determining positive and negative containment relationships between the sets.

10. The cryptographic construction system according to claim 9, wherein the second determination unit is further configured to acquire an element ei, and when ei ∈S, set S−=S\{ei}, then determine the aggregated value RS− by the zeros-based aggregation function ZerosAggr(mpk,S−); and when ei ∉S, set S−=S\{ei}, then determine the aggregated value RS− by none of polynomial-time algorithms, the polynomial-time algorithms comprise ZerosAggr(mpk,S−); and the second determination unit is further configured to acquire an element ei, when ei ∉S, set S+=S∪{ei}, then determine the aggregated value RS+ by the pole-based aggregation function PoiesAggr(mpk,S+); and when ei∈S, set S+=S∪{ei}, then determine the aggregated value RS+ by none of polynomial-time algorithms, the polynomial-time algorithms comprise PoiesAggr(mpk,S+).