US 12,250,292 B2
Private set intersection from branching programs
Anselme Tueno, Ettlingen (DE); and Jonas Janneck, Mannheim (DE)
Assigned to SAP SE, Walldorf (DE)
Filed by SAP SE, Walldorf (DE)
Filed on May 24, 2022, as Appl. No. 17/752,326.
Prior Publication US 2023/0388102 A1, Nov. 30, 2023
Int. Cl. H04L 9/00 (2022.01); G06F 7/523 (2006.01); G06F 21/60 (2013.01); H04L 9/32 (2006.01)
CPC H04L 9/008 (2013.01) [G06F 7/523 (2013.01); G06F 21/602 (2013.01); H04L 9/32 (2013.01); H04L 2209/46 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
at least one hardware processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the at least one hardware processor, perform operations for intersecting a first private data set of a server computing device and a second private data set of a client computing device, the operations comprising:
building a binary tree data structure representing the first private data set, the binary tree data structure representing a plurality of bit strings, each inner node in the binary tree data structure containing a left edge label for a left child node and a right edge label for a right child node;
receiving, from the client computing device, a plurality of data items in the second private data set, at least one of the data items having been bitwise encrypted into corresponding ciphertexts using a homomorphic encryption scheme;
computing a left decision bit and a right decision bit for a plurality of inner nodes in the binary tree data structure by comparing each of the ciphertexts to the left edge label and the right edge label for each of the plurality of inner nodes in the binary tree data structure;
for each leaf node in the binary tree data structure, aggregating the decision bits along a path, using homomorphic multiplication, from a root to the corresponding leaf node of the binary tree data structure and storing the aggregated decision bits with the corresponding leaf node, and performing a homomorphic multiplication of the aggregated decision bits for the corresponding leaf node and the node label for the corresponding leaf node, producing a product for the corresponding leaf node;
summing the products for the corresponding leaf node; and
for at least one data item in the second private data set, returning the summed product for a leaf node corresponding to the data item as an indication of whether the data item is contained in the first private data set.