Method and apparatus for two-party secure computation of vector inner product

Abstract

The embodiment of the specification provides a method and device for two-party secure vector inner product, in the process of two-party secure vector inner product, the particularity of the one-hot vector determined by the one-hot encoding mode is utilized, that is, only one dimension is 1 and other dimensions are 0, and when the one-hot vector and the public vector are used for inner product calculation, the value in one dimension of the public vector is selected, reasonable single-party calculation is constructed by two parties, the vector inner product calculation is converted into scalar secure multiplication calculation, and therefore the communication data amount of interaction between the two parties is reduced.

Description

Technical Field

[0001] This specification relates to the field of secure computing technology, and more particularly to a method and apparatus for securely computing the inner product of two vectors. Background Technology

[0002] Secure multi-party computation (MPC), also known as secure multi-party computation, involves multiple parties collaboratively computing a function without revealing their individual input data. The result is disclosed to one or more parties. MPC can be applied to privacy-preserving intersection problems, joint training of machine learning models, data querying, and more. A typical application is joint statistical analysis and machine learning using privacy-preserving multi-party data. MPC allows participating parties to compute statistical and machine learning results based on joint data without exposing their individual raw data. However, to protect the data privacy of each participant, MPC typically involves various encryption methods, significantly increasing computational and communication overhead. In particular, communication overhead is a major factor affecting business efficiency in MPC. Summary of the Invention

[0003] This specification describes one or more embodiments of a method and apparatus for securely calculating the inner product of two vectors, in order to solve one or more problems mentioned in the background art.

[0004] According to a first aspect, a method for securely calculating the inner product of vectors by two parties is provided, for determining the inner product of a one-hot vector p and a public vector T by a first party and a second party, wherein the one-hot vector p is constructed and shared by the first party and the second party; the method is performed by the first party and includes: obtaining a first slice of the one-hot vector p modulo 2; calculating a first slice of at least one intermediate reference value based on the products of each dimension element of the first slice of the one-hot vector p modulo 2 and the square root values ​​corresponding to the corresponding dimension elements of the public vector T; and securely calculating the inner product with the second party using the first slices of the intermediate reference values ​​to obtain the first slice of the inner product.

[0005] In one embodiment, when the one-hot vector p forms a non-modulo-2 sum-shared form in the first and second parties, obtaining the first modulo-2 slice of the one-hot vector p includes: taking the least bit of each element in the first slice of the sum-shared form of the one-hot vector p as each element in the first modulo-2 slice of the one-hot vector p.

[0006] In one embodiment, the calculation of the first slice of the intermediate reference value based on the product of each dimension element of the first slice modulo 2 of the one-hot vector p with the square root value corresponding to the corresponding dimension element of the public vector T includes: summing the products to obtain the corresponding sum; adding a first sign adjustment coefficient to the sum to obtain the first slice of the intermediate reference value.

[0007] In a further embodiment, the first sign adjustment coefficient is: a first predetermined value, which is equal in magnitude and opposite in sign to the second sign adjustment coefficient added by the second party; or, a value determined by a first power of -1, where the first power and the second power used by the second party to calculate the intermediate reference value are adjacent natural numbers.

[0008] In one embodiment, the at least one intermediate reference value includes a first intermediate reference value b, and the inner product is determined based on the square of the first intermediate reference value b.

[0009] In a further embodiment, when all elements of the public vector T in each dimension are non-negative, the square root value of the corresponding element in the public vector T is the square root of that element, and the inner product is the square of the first intermediate reference value b.

[0010] In a further embodiment, when all elements of the public vector T in each dimension are non-positive, the square root of the corresponding element in the public vector T is the square root of the absolute value of that element, and the inner product is the negative of the square of the first intermediate reference value b.

[0011] In a further embodiment, the step of securely calculating the inner product with the second party using the first slices of each intermediate reference value includes: performing a secure squared protocol with the second party to calculate the first squared value of the first intermediate reference value b, thereby obtaining a first slice of the first squared value; and determining the first slice of the inner product based on the first slice of the first squared value.

[0012] In another further embodiment, the step of securely calculating the inner product with the second party using the first fragments of each intermediate reference value b includes: performing a secure multiplication protocol with the second party to calculate a first product of the first fragment of the first intermediate reference value b and a second fragment of the first intermediate reference value b, to obtain a first fragment of the first product; and determining the first fragment of the inner product based on the sum of the first fragment of the first product and the square of the first fragment of the first intermediate reference value b calculated locally.

[0013] In a further embodiment, when the elements of each dimension of the public vector T have both positive and negative values, the square root value corresponding to a single dimension element of the public vector T is: the square root of a single first reference element obtained by adding a first reference value C1 to the single dimension element, wherein the first reference value is not less than the absolute value of the smallest element in the public vector T, and the inner product is the difference between the square of the first intermediate reference value b and the first reference value C1.

[0014] In a further embodiment, the step of securely calculating the inner product with the second party using the first slices of each intermediate reference value to obtain the first slice of the inner product includes: obtaining a first slice of the square of the first intermediate reference value b based on performing a secure square protocol or a secure multiplication protocol with the second party on the first intermediate reference value; determining the first slice of the inner product using the difference between the first slice of the square of the first intermediate reference value b and the first slice of the first reference value C1, wherein the first slice of the first reference value C1 is one of 0, C1, a first predetermined value, or a first slice obtained by randomly splitting the first reference value C1.

[0015] In a further embodiment, when the elements of each dimension of the public vector T have both positive and negative values, the square root value corresponding to a single dimension element of the public vector T is: the square root of a single second reference element obtained by subtracting the second reference value C2 from the single dimension element, where the second reference value C2 is not less than the largest element in the public vector T, and the inner product is the sum of the negative of the square of the first intermediate reference value b and the second reference value C2.

[0016] In a further embodiment, the step of securely calculating the inner product with the second party using the first slices of each intermediate reference value to obtain the first slice of the inner product includes: obtaining the first slice of the square of the first intermediate reference value b based on performing a secure square protocol or a secure multiplication protocol with the second party on the first intermediate reference value; determining the first slice of the inner product by summing the first slice of the square of the first intermediate reference value b with the first slice of the second reference value C2, wherein the first slice of the second reference value C2 is one of 0, C1, a first predetermined value, or a first slice obtained by randomly splitting the second reference value C2.

[0017] In one embodiment, the elements of each dimension of the public vector T have both positive and negative values. The at least one intermediate reference value includes a second intermediate reference value c corresponding to the positive element and a third intermediate reference value d corresponding to the negative element. The square root value of a single positive element of the public vector T is the square root of that element, and the square root value of a single negative element is the square root of the absolute value of that element.

[0018] The calculation of at least one intermediate reference value by multiplying each dimension element of the first slice based on the modulus 2 of the one-hot vector p with the square root value corresponding to the corresponding dimension element of the public vector T includes: summing the products corresponding to each positive element of the public vector T and adding a second sign adjustment coefficient to obtain the first slice of the second intermediate reference value c; summing the products corresponding to each negative element of the public vector T and adding a second sign adjustment coefficient to obtain the first slice of the third intermediate reference value d.

[0019] In a further embodiment, the public vector T also includes zero-value elements, and the products corresponding to the zero-value elements are processed in one of the following ways: positive-value elements are incorporated to determine the first slice of the second intermediate reference value c; or negative-value elements are incorporated to determine the first slice of the third intermediate reference value d.

[0020] In another further embodiment, the first slice of the inner product is obtained by securely calculating the inner product with the second party using the first slice of each intermediate reference value: using the first slice of the second intermediate reference value c and the first slice of the third intermediate reference value d, the second party determines the square of the second intermediate reference value c and the square of the third intermediate reference value d based on the execution of a secure multiplication protocol or a secure square protocol, thereby obtaining the first slice of the square of the second intermediate reference value c and the first slice of the square of the third intermediate reference value d; the first slice of the inner product is determined by the difference between the first slice of the square of the second intermediate reference value c and the first slice of the square of the third intermediate reference value d.

[0021] According to a second aspect, an apparatus for securely calculating the inner product of vectors by two parties is provided, for a first party and a second party to determine the inner product of a one-hot vector p and a public vector T, wherein the one-hot vector p is configured and shared by the first party and the second party; the apparatus is disposed on the first party and includes:

[0022] The acquisition unit is configured to acquire the first slice modulo 2 of the one-hot vector p;

[0023] The conversion unit is configured to calculate at least one intermediate reference value for the first slice based on the product of the square root values ​​of each dimension element of the first slice modulo 2 of the one-hot vector p and the corresponding dimension element of the public vector T.

[0024] The secure computing unit is configured to use a first slice of each intermediate reference value to securely compute the inner product with a second party, thereby obtaining the first slice of the inner product.

[0025] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0026] According to a fourth aspect, a computing device is provided, including a memory and a processor, characterized in that the memory stores executable code, and when the processor executes the executable code, it implements the method of the first aspect.

[0027] The methods and apparatus provided in the embodiments of this specification utilize the special characteristics of one-hot encoded vectors during the secure computation of vector inner products between two parties. Specifically, one-hot vectors have only one dimension of 1 and all other dimensions of 0. Considering that the inner product calculation of a one-hot vector and a public vector is equivalent to selecting a value in one dimension of the public vector, a reasonable one-sided computation is constructed between the two parties. This transforms the vector inner product calculation into a scalar secure multiplication calculation, thereby reducing the amount of communication data exchanged between the two parties and improving the efficiency of related business processing under the secure computation architecture. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This diagram illustrates a multi-party secure computing architecture.

[0030] Figure 2 A flowchart illustrating a specific example of safe two-way multiplication is provided.

[0031] Figure 3 This diagram illustrates the interaction of two parties securely calculating the inner product of vectors according to the technical concept of this specification.

[0032] Figure 4 A flowchart illustrating a method for securely computing vector inner products performed by one party according to one embodiment is shown.

[0033] Figure 5 A schematic block diagram of an apparatus for securely calculating the inner product of vectors according to one embodiment is shown. Detailed Implementation

[0034] The technical solutions provided in this specification are described below with reference to the accompanying drawings.

[0035] Figure 1 A schematic diagram of the implementation architecture for secure multi-party computation is shown. For example... Figure 1 As shown, in a multi-party secure computation architecture, each participant (at least two participants, such as...) Figure 1Participants 1, 2, 3, etc., can each hold their local business data and perform calculations using homomorphic encryption, secret sharing, and obfuscated circuits. During the calculation process, each pair of participants can communicate and perform calculations in a privacy-preserving manner, maintaining a fragmented form of the intermediate or final business processing result for each participant. Because each participant cannot disclose its local privacy data, and each holds a fragment of the intermediate result, all data exchanged during the calculation process is conducted securely.

[0036] The following describes some concepts involved in a multi-party secure computation architecture, as well as other concepts that may be involved.

[0037] Sharing can take various forms, such as arithmetic sharing and Boolean sharing. Taking arithmetic sharing as an example, in secure computation between two parties, an integer x from 0 to M-1 is shared using the formula x = x... L +x R Modulo M=2 N The shared form is distributed and stored between two parties, so that one party does not know x. R The other party is unaware of x L Neither of the two sides can yield the complete form of x. Furthermore, the two sides can be extended to multiple sides, as denoted as x = x1 + x2 + ... + x. d Assuming N = 64, then x can be represented as a single slice of a single participant using a 64-byte (bit) binary number.

[0038] Boolean sharing is a secret sharing method that uses an XOR operation on bits. For example, considering two participants, suppose x is a one-bit data (with a value of 0 or 1), and... In a Boolean shared form between two participants, x0 and x1 are two Boolean shared partitions of x in the two participants, each taking a value of 0 or 1. This represents the XOR operation. A single participant is unaware of the other participant's share and therefore cannot deduce the data x. For data x' consisting of n bits, an n-bit binary number can be randomly generated as one party's Boolean shared share (e.g., x0'). The other party's Boolean shared share (e.g., x1') can be obtained by XORing x' with that party's Boolean shared share. )Sure.

[0039] In this context, arithmetic sharing occurs in modulo-2 space, where each number is represented by 1 bit. Multiplication is equivalent to the Boolean AND operation, and modulo-2 addition and subtraction are equivalent to the Boolean XOR operation.

[0040] Secure computation in a shared manner: Computation is performed in a shared manner, where neither party can deduce the portions of data stored by the other parties during the computation process, and the computation results are still stored in a shared manner. This shared manner can also be called a share state. For data in a share state, a single computation party holds a single fragment (i.e., a share).

[0041] In multi-party secure computation, in addition to secure addition and secure multiplication of numerical values, basic operations such as matrix addition and matrix multiplication can also be included. Here, basic operations refer to the basic operational modules that the business process can be broken down into. For example, secure addition and secure multiplication are basic operational modules; a squaring operation of a numerical value shared by all participants can be broken down into secure multiplication and secure addition operations.

[0042] One-hot encoding, also known as one-bit valid encoding, typically uses an N-bit state register to encode N states. Each state has its own independent register bit, and at any given time, only one bit is valid. That is, for any given state, one register is valid (represented by 1), while the other N-1 registers are invalid (represented by 0). The encoding result of one-hot encoding can be represented by a vector, referred to in this specification as a one-hot vector. Each dimension of the one-hot vector corresponds to a different register state. Typically, only one dimension of the one-hot vector is 1, while the other dimensions are 0.

[0043] One-hot encoding has important applications in specific business processing scenarios. For example, in a table lookup calculation scenario, the element T[k] of table T can be retrieved from the input k. Specifically, the input k is first converted into a one-hot encoded vector p with the k-th dimension having a value of 1, and then the inner product of the one-hot vector p and table T (or matrix T, vector T, hereinafter referred to as vector) is calculated.<p,T> This allows you to retrieve the data in the k-th column (or row) of table T. Furthermore, table lookup calculations can also be used to calculate factorials, AES (Advanced Encryption Standard) sboxes (the basic structure for permutation calculations in symmetric key algorithms), and other functions with single inputs and a limited number of input values.

[0044] Typically, the one-hot vector p can be constructed and shared by the parties participating in the multi-party secure computation, while the vector T can be publicly disclosed by each party. The inner product of the one-hot vector p and the publicly disclosed vector t is...<p,T> The calculation results are presented in a form that is both constructed and shared by all parties.

[0045] Those skilled in the art will readily understand that a one-hot vector is a vector where one dimension (let's say the k-th dimension) has a value of 1, and all other dimensions have values ​​of 0. Therefore, an n-dimensional one-hot vector p can be in a shared state modulo q1, where the minimum value of q1 is 2. T is the publicly available n-dimensional plaintext vector. Typically, the inner product h =<p,T> This constitutes a shared state modulo q2. Here, q2 is typically a power of 2 that is not equal to q1, and q2 > 2.

[0046] In conventional techniques, the parties involved in secure computation typically first convert a one-hot vector p from a shared state modulo q1 to a shared state modulo q2 (equivalent to extending the number of bits of a single element to q2). Then, in the shared state modulo q2, they perform a secure inner product calculation with the public vector T (e.g., using secret sharing techniques). The secure inner product involves a significant amount of secure computation; with large data volumes or a large q2, the high communication volume may negatively impact the performance of the secure computation.

[0047] In view of this, and considering the special characteristics of one-hot vectors, this specification provides an operation that converts the vector inner product into scalar-safe multiplication in modulo 2 shared state, thereby greatly reducing the amount of communication.

[0048] The following section first describes the principles and concepts behind the implementation architecture of this manual.

[0049] It is understandable that we can assume the one-hot vector p is denoted as [p1, p2, p3...p] n The public vector T is denoted as [T1, T2, T3, ..., T]. n Then the inner product of p and T is: h = p1T1 + p2T2 + p3T3 + ... + p n T n Since p has only one dimension with a value of 1 and the other dimensions with a value of 0, the first party holds the first slice of p[p]. 11 p 21 p 31 ...p n1 The second party holds the first fragment of p[p]. 12 p 22 p 32 ...p n2 In the case of p1 = p 11 +p 12 Modulo 2, p2 = p 21 +p 22 Modulo 2... in essence, it is equivalent to p1 = |p 11 -p 12 |p2=|p 21 -p 22 ...equivalent to.

[0050] Therefore, given the modulo 2 state of each element in the partition of p, assuming the g-th dimension of p is 1, theoretically we have:

[0051] h = p1T1 + p2T2 + p3T3 + ... + p n T n

[0052] =|p 11 -p 12 |T1+|p 21 -p 22 |T2+……+|p n1 -p n2 |T n

[0053] =|p g1 -p g2 |T i ;

[0054] It can be known that p g1 p g2 They are dissimilar, being 0 and 1 respectively. However, since the difference (p) cannot be determined... g1 -p g2 The specific symbol for h is not available, therefore h cannot be directly calculated using the above formula.

[0055] Therefore, we consider using the square roots of 0 and 1 as their own property to construct a scalar multiplication method to restore the original structure after taking the square roots of the elements in T. It can be seen that:

[0056]

[0057] In practice, h can be positive or negative, depending on the value of the public vector T in the corresponding dimension. Since the dimension of 1 in p cannot be determined in multi-party secure computation, the sign of h cannot be directly determined. Under the technical concept of this specification, analysis can be performed when the values ​​in T have the same sign (positive or negative).

[0058] Based on one possible scenario, assuming the elements in T have the same sign (to allow for a value of 0, the sign can be represented as either non-positive or non-negative), we can consider... As an intermediate reference value, the square of b is non-negative, and the sign of the inner product of p and T is determined based on the signs of the elements in T. Specifically, when all elements in T are non-negative, we have h = b. 2 =b×b, and if all elements in T are non-positive, then h = -b. 2= -b × b. Where b is constructed and shared by the first and second parties. To determine the intermediate reference value b, the first segment b1 of b can be determined by the first party, and the second segment b2 of b can be determined by the second party, then b = b1 + b2. Here, subscripts 1 and 2 correspond to the first and second parties respectively. In other embodiments, the segment subscripts corresponding to the first and second parties can also be 0, 1, or other adjacent values, which are not limited here.

[0059] Considering the different signs of the elements in T, the methods for determining b1, b2, and h are different. These will be described separately below.

[0060] In one example, if all elements in T are non-negative, then the first and second powers can be derived using T respectively. i The square root (or root of the square root) determines b1 and b2. For example:

[0061]

[0062] Where -1 is a power j = 1, 2 (the first and second powers can be referred to as the first power and the second power, respectively, and the first and second powers can also be adjacent natural numbers such as 0 and 1), t is the dimension of p and T, and p[i] j This represents the value of the j-th slice of p held by the j-th party in the i-th dimension. (-1) j As a sign adjustment coefficient, it is used to adjust the sign of each term, so that when the corresponding dimension values ​​of the two slices of p held by the first and second parties are the same, the product values ​​of corresponding terms in b1 and b2 are the same but with opposite signs. Thus, according to the principle of b = b1 + b2, the two terms cancel each other out, ultimately retaining the dimensions with different values ​​in the two slices of p held by the first and second parties. Therefore, (-1) j The exponent j in b can be related to b j The subscript j in the equations can be kept consistent, or it can be 0 or 1 respectively, so that the signs of the product terms in the first and second powers are opposite. Assuming the g-th dimension of the one-hot vector p is 1, then... Therefore, h = T g =b×b, can be determined by performing safe multiplication or safe squaring operations on the first and second sides.

[0063] It is worth noting that the sign adjustment coefficient here is (-1). j Alternatively, it can be replaced with a first predetermined value and a second predetermined value. The first predetermined value and the second predetermined value are numerical values ​​that are equal in magnitude but opposite in sign, such as 1 and -1 respectively.

[0064] In another example, if all elements in T are non-positive, then the first and second powers can be determined by taking the square root of the absolute value of each element in T. For example:

[0065]

[0066] Where |T[i]| is the absolute value of the i-th element in T, and other symbols are described in the previous examples, which will not be repeated here.

[0067] At this time, there are still And because of T i Since it is a non-positive value, therefore, h = T g = -b×b, can be determined by performing safe multiplication or safe squaring operations on the first and second sides.

[0068] In another possible scenario, each element in T has both positive and negative values. Based on the technical concept of this specification, in an optional implementation, all elements in T can be transformed into non-negative or non-positive values ​​by adding constant terms as reference values ​​to each element, thus obtaining a reference vector T' corresponding to the public vector T, and then using the aforementioned method to determine h' = T. g ' = ±b × b. Specifically: When increasing a reference value C1, which is not less than the absolute value of the smallest element (the largest negative value) in the public vector T, T' = T + [C1] can transform all elements in T into non-negative values, and h = h' - C1; when decreasing a reference value C2, which is not less than the largest element (the largest positive value) in the public vector T, T' = T - [C2] can transform all elements in T into non-positive values, and h = h' + C2. Here, C1 and C2 are both positive numbers, and [C1] and [C2] represent vectors with dimensions C1 and C2 respectively.

[0069] The above embodiments calculate intermediate reference values ​​based on the consistency of the signs of all elements in T. In possible implementations, since T is a public vector, positive and negative values ​​in T can be calculated separately, corresponding to two intermediate reference values ​​c and d respectively. If a value of 0 exists in T, the corresponding term can be omitted from calculation or merged into the positive and negative value terms for calculation. The calculation process for positive and negative values ​​is similar to that described above. As a specific example, consider the calculation of the j-th power: and Or calculate the j-th power: and At this time, h = T g = c × cd × d, where c × c and d × d can be determined by performing safe multiplication and / or safe square calculations using the first and second powers. Since in c × cd × d, positive elements correspond to a positive sign (c × c), negative elements correspond to a negative sign (-d × d), and one of the terms is 0, the result of c × cd × d is consistent with T. g The symbols are consistent.

[0070] Based on the principles described above, the technical concept of this specification allows the first and second parties to calculate one or two intermediate reference values ​​locally. Then, by executing a secure square protocol or secure multiplication protocol once or twice, the sum-sharing form of the inner product of p and T can be determined. The communication volume between the two parties is the communication volume generated during the execution of the secure square protocol or secure multiplication protocol once or twice.

[0071] Figure 2 A schematic diagram illustrating the calculation process of a safe multiplication performed by both parties is shown. Figure 2 As shown, taking a safe multiplication of values ​​a and b as an example, in modulo 2... N In the shared form, the communication volume is at most 4N bits offline and 2N bits online. Here, offline communication can be understood as data preparation before secure multiplication, such as the communication volume of u, v, z0, z1 transmitted from the pseudo-random number generator server to the first and second parties. Online communication volume is the communication volume of the first and second parties exchanging values ​​e and f. The calculation process for secure multiplication is as follows:

[0072] The first party obtains a random number u, and the second party obtains a random number v. u and v can be obtained by a third party (…). Figure 2 The random number generator (in this context, a random number generator server) generates and distributes the numbers to the first and second parties, or the first and second parties can generate them locally. The third party generates u and v locally or obtains u and v from the first and second parties, calculates u×v, and splits it according to a sharing method to obtain random components z0 and z1, then z0 + z1 = u×v = uv. The third party can provide z0 and z1 to the first and second parties respectively. Assume the first party receives z0 and the second party receives z1. Here, u and v can be considered as perturbation or noise terms for a and b respectively, with e and f representing the perturbation results after adding noise to a and b respectively. The first party calculates the perturbation result e = au and sends it to the second party, while the second party calculates the perturbation result f = bv and sends it to the first party. Further, the first party can calculate one sharing component of a×b, c0 = uf + z0, and the second party can calculate another sharing component of a×b, c1 = eb + z1. Substituting the expressions for e and f, the feasibility principle is: c0+c1=uf+z0+eb+z1=ub-uv+z0+ab-ub+z1=ab.

[0073] It is understandable that in the secure calculation of vector inner product, at least t secure multiplications in the shared state modulo q2 are required for t dimensions. However, under the technical concept of this specification, after converting it into secure multiplication calculations using one or two intermediate reference values, the amount of communication is greatly reduced.

[0074] Figure 3A schematic flowchart illustrating a secure vector inner product computation process according to one embodiment is shown. This secure vector inner product computation process can be used to determine the inner product of a one-hot vector p and a public vector T. The one-hot vector p is constructed and shared by the first and second parties, and the inner product h =<p,T> It also forms a shared structure between the first and second parties, and vector T is known to both the first and second parties. The following combines... Figure 1 As shown, the inner product h = 1 / 2 is described for secure computation of the first and second parties.<p,T> The process.

[0075] First, in step 302, the first party obtains the first slice of the modulo 2 of the one-hot vector p, and the second party obtains the second slice of the modulo 2 of the one-hot vector p.

[0076] When the one-hot vector p exists in a shared state modulo 2, the first party and the second party respectively hold the first and second fragments of the one-hot vector p modulo 2, and the two parties can directly obtain the corresponding fragments from their local machines.

[0077] When the unique heat vector p forms a non-modulo 2 (e.g., modulo 2) structure in the first and second directions, t In the case of a non-modulo 2 shared state (t > 1), both parties can convert the one-hot vector p into a modulo 2 shared state. Specifically, considering the special characteristic that a single element in p can take the value of 0 or 1, the first party and the second party can each take the least bit of the corresponding fragment in the non-modulo 2 shared state as the corresponding fragment in the modulo 2 shared state.

[0078] As an example, suppose the one-hot vector p is a four-dimensional vector (0, 1, 0, 0), in modulo 2 3 In the arithmetic share state, if the first party holds share (3, 5, 2, 7), then the second party holds share (5, 4, 6, 1). Representing these two shares in binary as (0011, 0101, 0010, 0111) and (0101, 0100, 0110, 0001), respectively, taking the least significant bit of each element yields two slices (1, 1, 0, 1) and (1, 0, 0, 1), forming a modulo 2 share state for the vector (0, 1, 0, 0). However, if the one-hot vector p (0, 1, 0, 0) forms a 4-bit Boolean share state between the two parties, then the two slices of the corresponding element differ only in their least significant bit. Taking the least significant bit also yields a modulo 2 share state. Suppose two Boolean shares are (0011, 0101, 0010, 0111) and (0011, 0100, 0010, 0111), and the least significant bit of each element is (1, 1, 0, 1) and (1, 0, 0, 1).

[0079] Thus, without communication between the first and second parties, the sum-shared form of the one-hot vector p can be converted into a modulo 2 shared state, and each party holds a fragment. In this specification, the data fragment held by the first party can be referred to as the first fragment, and the data fragment held by the second party can be referred to as the second fragment.

[0080] Next, via step 304, the first party calculates at least one intermediate reference value by multiplying each dimension element of the first slice based on the modulo 2 of the one-hot vector p with the square root value of the corresponding dimension element of the public vector T. The second party calculates at least one intermediate reference value by multiplying each dimension element of the second slice based on the modulo 2 of the one-hot vector p with the square root value of the corresponding dimension element of the public vector T.

[0081] As can be seen from the principle analysis above, there are one or two intermediate reference values.

[0082] Setting only one intermediate reference value (denoted as the first intermediate reference value b) can accommodate the following situations:

[0083] (1) All elements in T are either non-negative or non-positive. The first and second sides can calculate the first slice b1 and the second slice b2 of the intermediate reference value b locally, respectively. If all elements in T are non-negative, the first side calculates... Second-party calculation When all elements in T are non-positive, the first-party calculation... Second-party calculation

[0084] (2) Since elements in T can take both negative and positive values, a constant term can be added to convert it into a public vector T' where all elements take either non-negative or non-positive values. For the first and second sides of the public vector T', the first slice b1 and the second slice b2 of the first intermediate reference value b can be calculated respectively. Wherein, the public vector T' = T + [C1], or T' = T - [C2]. C1 is a reference value not less than the absolute value of the smallest element in the public vector T, and C2 is a reference value not less than the largest element in the public vector T.

[0085] Setting two intermediate reference values ​​(such as the second reference value c and the third reference value d) is applicable in the following situations:

[0086] Elements in T can take both positive and negative values. The dimensions for positive and negative values ​​are separated, and a second intermediate reference value *c* corresponding to the positive dimension and a third intermediate reference value *d* corresponding to the negative dimension are determined separately. Thus, the first party can obtain the first slice of *c* and *d* through local calculation, and the second party can obtain the second slice of *c* and *d* through local calculation. The dimension with zero values ​​can be merged into the positive dimension for calculation, or it can be merged into the negative dimension for calculation; this specification does not limit this. The specific determination method is as described above and will not be repeated here.

[0087] Then, in step 306, the first party and the second party jointly perform a security calculation based on the first and second slices of each intermediate reference value to determine the inner product of the one-hot vector p and the public vector T, and the first party and the second party respectively obtain the first slice and the second slice of the inner product.

[0088] As can be seen from the principles mentioned above, the number of intermediate reference values ​​varies depending on the value of the public vector T. The methods by which the first and second parties determine the inner product of the one-hot vector p and the public vector T are also different, and these will be described one by one below.

[0089] According to one embodiment, all elements in T are non-negative. The first party and the second party locally calculate the first fragment b1 and the second fragment b2, respectively, with a first intermediate reference value b. The inner product is h = b × b. Then: In one calculation method, the inner product h can be calculated using the safe square protocol of b. The first party obtains the first fragment h1 of the inner product h, and the second party obtains the second fragment h2 of the inner product h. In another calculation method, according to h = b × b = (b1 + b2) × (b1 + b2) = b The principle of 1×b1+2b1b2+b2×b2 is as follows: the first party calculates b1×b1 locally, the second party calculates b2×b2 locally, and the first and second parties jointly execute the secure multiplication protocol to calculate b1b2, obtaining the first and second fragments of b1b2. Then, the first party calculates the sum of b1×b1 and the first fragment of 2b1b2 as the first fragment h1 of the inner product h, and the second party calculates the sum of b2×b2 and the second fragment of 2b1b2 as the second fragment h2 of the inner product h.

[0090] According to another embodiment, all elements in T are non-positive values. The first party and the second party locally calculate the first fragment b1 and the second fragment b2, respectively, with a first intermediate reference value b. The inner product is h = -b × b. Then: In one calculation method, -h can be calculated using the safe square protocol of b. The first party obtains the first fragment of -h, and by taking the negative of the first fragment of -h, the first fragment h1 of the inner product h is obtained. In the second party, the second fragment of -h is obtained, and by taking the negative of the second fragment of -h, the second fragment h2 of the inner product h is obtained. In another calculation method, according to h = The principle of -b×b=-(b1+b2)×(b1+b2)=-b1×b1-2b1b2-b2×b2 is as follows: the first party calculates -b1×b1 locally, the second party calculates -b2×b2 locally, and the first and second parties jointly execute the secure multiplication protocol to calculate b1b2, obtaining the first and second fragments of b1b2. Then, the first party calculates the difference between -b1×b1 and the first fragment of 2b1b2 as the first fragment h1 of the inner product h, and the second party calculates the difference between -b2×b2 and the second fragment of 2b1b2 as the second fragment h2 of the inner product h.

[0091] In another embodiment, the elements in T have both negative and positive values. By adding a constant term, it can be transformed into a public vector T' whose elements all have non-negative or non-positive values. Then, the first slice b1 and the second slice b2 of the intermediate reference value b are calculated for the public vector T'. Wherein, the public vector T' = T + [C1] or T' = T - [C2].

[0092] Where C1 is a reference value not less than the absolute value of the smallest element in the public vector T. By adding C1 to the element values ​​of each dimension in T, a non-negative public vector T' = T + [C1] can be obtained. Then, the first and second parties jointly calculate the reference value h' = b × b of the inner product of p and T', respectively obtaining the first and second slices of the inner product reference value h'. Then, based on h = h' - C1, the first and second slices of the inner product h can be obtained from the first and second parties respectively. Specifically, C1 can be subtracted from either the first or second party to obtain the corresponding slice of h, while the other party keeps the slice of h' unchanged as the corresponding slice of h. Alternatively, C1 can be split into a shared form, and the first and second parties can obtain the corresponding first and second slices respectively. Then, the first party takes the difference between the first slice of h' and the first slice of C1 as the first slice of h, and the second party takes the difference between the second slice of h' and the second slice of C1 as the second slice of h.

[0093] On the other hand, C2 is a reference value not less than the largest element in the public vector T. By subtracting C2 from the element values ​​of each dimension in T, we can obtain a non-positive public vector T' = T - [C2]. Then, the first and second methods are used to jointly calculate the reference value h' = -b × b of the inner product of p and T', obtaining the first and second slices of the inner product reference value h'. Then, based on h = h' + C2, the first and second slices of the inner product h can be obtained from the first and second methods, similar to h = h' - C1, and will not be repeated here.

[0094] In another embodiment, since the elements in T can have both positive and negative values, the dimensions for positive and negative values ​​can be calculated separately to determine a first intermediate reference value c and a second intermediate reference value d. The first party obtains the first fragment of c and d through local calculation, and the second party obtains the second fragment of c and d through local calculation. Then, using h = c × cd × d, the first and second parties calculate c × c and d × d using a secure multiplication or secure square protocol. The first party obtains the first fragment of c × c and d × d by performing local subtraction on each of their respective first fragments to obtain the first fragment of h, and the second party obtains the second fragment of c × c and d × d by performing local subtraction on each of their respective second fragments to obtain the second fragment of h.

[0095] It is worth noting that the above vector inner product calculation procedure applies to the scenario of secure calculation of one-hot vectors and public vector inner products by the first and second parties. In fact, since the original data can only be recovered by fully acquiring the fragments of each participant in the shared form, in a multi-party secure computation architecture with more than two parties, the fragments of other participants can be aggregated by the first or second party, thereby implementing the secure inner product calculation procedure provided in this specification in a two-party secure computation architecture.

[0096] Figure 3 The process of securely calculating the vector inner product between the two parties is described from the perspective of first-party and second-party interaction. Figure 3 As can be seen, the operations performed by the first party and the second party during the secure inner product calculation process correspond to each other, and they each use the privacy data held locally to perform similar operations. Therefore, the first party and the second party are only used to distinguish two different participants, and the two can be interchanged.

[0097] Furthermore, Figure 4 This illustrates the operations performed by either party (with the first party as the reference) during the secure computation of the vector inner product between the two parties, used to determine the inner product of the one-hot vector p and the public vector T by the first and second parties. For example... Figure 4 As shown, the operations performed by the first party include:

[0098] Step 402: Obtain the first slice of the one-hot vector p modulo 2;

[0099] Step 404: Calculate the first slice with at least one intermediate reference value by multiplying each dimension element of the first slice modulo 2 of the one-hot vector p with the square root value of the corresponding dimension element of the public vector T.

[0100] Step 406: Using the first slice of each intermediate reference value, calculate the inner product with the second party to obtain the first slice of the inner product.

[0101] In step 402, if the one-hot vector p forms a modulo 2 sum-shared form in the first and second parties, the first modulo 2 slice of the one-hot vector p can be directly obtained; otherwise, the least bit of each element in the first slice of the one-hot vector p in the sum-shared form is taken as each element in the first modulo 2 slice of the one-hot vector p.

[0102] In one embodiment, step 404 further includes: summing the products to obtain a corresponding sum; adding a first sign adjustment coefficient to the sum to obtain a first slice of the intermediate reference value.

[0103] The first sign adjustment coefficient is:

[0104] A first predetermined value, which is equal in magnitude and opposite in sign to the second predetermined value corresponding to the second sign adjustment coefficient added by the second party; or...

[0105] The value determined by the first power of -1, the first power and the second power used in the second segment of the intermediate reference value calculation are adjacent natural numbers.

[0106] According to one possible design, at least one intermediate reference value includes a first intermediate reference value b, and the inner product is determined based on the square of the first intermediate reference value b.

[0107] Specifically:

[0108] When all elements of the public vector T in each dimension are non-negative, the square root of the corresponding element in the public vector T is the square root of that element, and the inner product is the square of the first intermediate reference value b.

[0109] When all elements of the public vector T in each dimension are non-positive, the square root of the corresponding element in the public vector T is the square root of the absolute value of that element, and the inner product is the opposite of the square of the first intermediate reference value b.

[0110] When the elements of each dimension of the public vector T have both positive and negative values, the square root value corresponding to a single dimension element of the public vector T can be: the square root of a single first reference element obtained by adding the first reference value C1 to the single dimension element, where the first reference value is not less than the absolute value of the smallest element in the public vector T, and the inner product is the difference between the square of the first intermediate reference value b and the first reference value C1.

[0111] When the elements of each dimension of the public vector T have both positive and negative values, the square root value corresponding to a single dimension element of the public vector T can be: the square root of a single second reference element obtained by subtracting the second reference value C2 from the single dimension element, where the second reference value C2 is not less than the largest element in the public vector T, and the inner product is the sum of the negative of the square of the first intermediate reference value b and the second reference value C2.

[0112] In a further embodiment, step 406 may include:

[0113] Perform a safe squared protocol with the second party, calculate the first squared value of the first intermediate reference value b, and obtain the first piece of the first squared value; determine the first piece of the inner product based on the first piece of the first squared value; or...

[0114] The secure multiplication protocol is executed with the second party to calculate the first product of the first slice of the first intermediate reference value b and the second slice of the first intermediate reference value b, thereby obtaining the first slice of the first product; the first slice of the inner product is determined by summing the squares of the first slice of the first product and the first slice of the first intermediate reference value b calculated locally.

[0115] In the case of constructing non-positive, non-negative public vectors by adding a constant term, the first slice of the inner product can be determined in step 406 in the following way:

[0116] Based on the secure square protocol or secure multiplication protocol of the first intermediate reference value executed with the second party, the first piece of the square of the first intermediate reference value b is obtained; the first piece of the inner product is determined by the difference between the first piece of the square of the first intermediate reference value b and the first piece of the first reference value C1, wherein the first piece of the first reference value C1 is one of 0, C1, a first predetermined value, or a first piece obtained by randomly splitting the first reference value C1;

[0117] Alternatively, based on a secure square protocol or secure multiplication protocol for the first intermediate reference value executed with the second party, a first slice of the square of the first intermediate reference value b is obtained; the first slice of the inner product is determined by summing the first slice of the square of the first intermediate reference value b with the first slice of the second reference value C2, wherein the first slice of the second reference value C2 is one of 0, C1, a first predetermined value, or a first slice obtained by randomly splitting the second reference value C2.

[0118] According to another possible design, the elements of each dimension of the public vector T have both positive and negative values, and at least one intermediate reference value includes a second intermediate reference value c corresponding to the positive element and a third intermediate reference value d corresponding to the negative element. The square root value of a single positive element of the public vector T is the square root of that element, and the square root value of a single negative element is the square root of the absolute value of that element.

[0119] Step 404 may further include: summing the products corresponding to each positive element of the public vector T and adding a second sign adjustment coefficient to obtain the first slice of the second intermediate reference value c; summing the products corresponding to each negative element of the public vector T and adding a second sign adjustment coefficient to obtain the first slice of the third intermediate reference value d.

[0120] If the public vector T also includes zero-value elements, the product corresponding to the zero-value elements is processed in one of the following ways: positive-value elements are incorporated to determine the first segment of the second intermediate reference value c; or negative-value elements are incorporated to determine the first segment of the third intermediate reference value d.

[0121] At this point, step 406 may further include: using the first slice of the second intermediate reference value c and the first slice of the third intermediate reference value d, and the second party, based on the execution of a secure multiplication protocol or a secure square protocol, to determine the square of the second intermediate reference value c and the square of the third intermediate reference value d, to obtain the first slice of the square of the second intermediate reference value c and the first slice of the square of the third intermediate reference value d; and determining the first slice of the inner product by the difference between the first slice of the square of the second intermediate reference value c and the first slice of the square of the third intermediate reference value d.

[0122] In summary, the embodiments of this specification utilize the special properties of one-hot vectors to transform secure vector multiplication into secure scalar multiplication when representing one-hot vectors in modulo-2 sum-shared form. This significantly reduces the amount of communication between the two parties and improves the efficiency of related business processing under the MPC architecture.

[0123] According to another embodiment, an apparatus for securely calculating a vector inner product between two parties is also provided. This apparatus can be located on either party in the secure calculation of the vector inner product, such as denoted as the first party. Figure 5 An embodiment of a two-party secure vector inner product calculation apparatus 500 is shown. This is to determine the inner product of a one-hot vector p formed and shared by the first and second parties with a public vector T. Figure 5 As shown, the device 500 includes:

[0124] Acquisition unit 501 is configured to acquire the first slice of the modulo 2 of the one-hot vector p;

[0125] The transformation unit 502 is configured to calculate the first slice with at least one intermediate reference value by multiplying the square root values ​​of each dimension element of the first slice based on the modulus 2 of the one-hot vector p with the corresponding dimension element of the public vector T.

[0126] The security calculation unit 503 is configured to use the first slice of each intermediate reference value and the second-party security calculation inner product to obtain the first slice of the inner product.

[0127] It is worth noting that, Figure 5 The device 500 shown is Figure 4 The methods described correspond to, Figure 4 The corresponding descriptions in the method embodiments also apply to the device 500, and will not be repeated here.

[0128] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 4 The methods described above.

[0129] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 4 The methods described above.

[0130] Those skilled in the art will recognize that the functions described in the embodiments of this specification in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0131] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the technical concept in this specification. It should be understood that the above description is only a specific embodiment of the technical concept in this specification and is not intended to limit the scope of protection of the technical concept in this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solutions of the embodiments in this specification should be included within the scope of protection of the technical concept in this specification.

Claims

1. A method for two-party secure computation of vector inner product, used to determine the inner product of a one-hot vector p and a public vector T by a first party and a second party, wherein the one-hot vector p is constructed and shared by the first party and the second party; The method is performed by a first party and includes: Obtain the first slice modulo 2 of the one-hot vector p; Based on the products of each dimension element of the first slice modulo 2 of the one-hot vector p and the square root values ​​of the corresponding dimension elements of the public vector T, calculate the first slice with at least one intermediate reference value. The first slice of the inner product is obtained by using the first slice of each intermediate reference value and the second-party secure calculation.

2. The method as described in claim 1, wherein, When the one-hot vector p forms a non-modulo 2 sum-shared form in the first and second parties, obtaining the first modulo 2 slice of the one-hot vector p includes: In the first slice of the one-hot vector p in the sum-shared form, the least bit of each element is taken as each element in the first slice of the one-hot vector p modulo 2.

3. The method as described in claim 1, wherein, The first slice for calculating the intermediate reference value, based on the modulo 2 of the one-hot vector p, includes the following steps: Each dimension element in the first slice is multiplied by the square root value of the corresponding dimension element of the public vector T. Sum the products to obtain the corresponding sum; A first sign adjustment coefficient is added to the sum to obtain the first slice of the intermediate reference value.

4. The method of claim 3, wherein, The first sign adjustment coefficient is: A first predetermined value, which is equal in magnitude and opposite in sign to a second predetermined value corresponding to a second sign adjustment coefficient added by the second party; or... The value determined by the first power of -1, the first power and the second power used in the second segment of the intermediate reference value calculation are adjacent natural numbers.

5. The method of claim 1, wherein, The at least one intermediate reference value includes a first intermediate reference value b, and the inner product is determined based on the square of the first intermediate reference value b.

6. The method of claim 5, wherein, When all elements of the public vector T in each dimension are non-negative, the square root of the corresponding element in the public vector T is the square root of that element, and the inner product is the square of the first intermediate reference value b.

7. The method of claim 5, wherein, When all elements of the public vector T in each dimension are non-positive, the square root of the corresponding element in the public vector T is the square root of the absolute value of that element, and the inner product is the opposite of the square of the first intermediate reference value b.

8. The method as described in any one of claims 5-7, wherein, The calculation of the inner product using the first slice with each intermediate reference value and the second party securely includes: Perform a secure squared protocol with the second party to calculate the first squared value of the first intermediate reference value b, and obtain the first slice of the first squared value; The first piece of the inner product is determined based on the first piece of the first squared value.

9. The method as described in any one of claims 5-7, wherein, The calculation of the inner product using the first slice with each intermediate reference value and the second party securely includes: The secure multiplication protocol is executed with the second party to calculate the first product of the first slice of the first intermediate reference value b and the second slice of the first intermediate reference value b, thereby obtaining the first slice of the first product. The first piece of the inner product is determined by summing the squares of the first piece of the first product and the first piece of the first intermediate reference value b calculated locally.

10. The method of claim 5, wherein, When the elements of each dimension of the public vector T have both positive and negative values, the square root value corresponding to a single dimension element of the public vector T is: the square root of a single first reference element obtained by adding a first reference value C1 to the single dimension element, where the first reference value is not less than the absolute value of the smallest element in the public vector T, and the inner product is the difference between the square of the first intermediate reference value b and the first reference value C1.

11. The method of claim 10, wherein, The first slice that uses each intermediate reference value to securely calculate the inner product with the second party to obtain the first slice of the inner product includes: Based on the secure square protocol or secure multiplication protocol of the first intermediate reference value executed with the second party, a first slice of the square of the first intermediate reference value b is obtained; The first piece of the inner product is determined by the difference between the first piece of the square of the first intermediate reference value b and the first piece of the first reference value C1, wherein the first piece of the first reference value C1 is one of 0, C1, a first predetermined value, or a first piece obtained by randomly splitting the first reference value C1.

12. The method of claim 5, wherein, When the elements of each dimension of the public vector T have both positive and negative values, the square root value of a single dimension element of the public vector T is: the square root of a single second reference element obtained by subtracting the second reference value C2 from the single dimension element, where the second reference value C2 is not less than the largest element in the public vector T, and the inner product is the sum of the negative of the square of the first intermediate reference value b and the second reference value C2.

13. The method of claim 12, wherein, The first slice that uses each intermediate reference value to securely calculate the inner product with the second party to obtain the first slice of the inner product includes: Based on the secure square protocol or secure multiplication protocol of the first intermediate reference value executed with the second party, a first slice of the square of the first intermediate reference value b is obtained; The first piece of the inner product is determined by summing the first piece of the square of the first intermediate reference value b with the first piece of the second reference value C2, wherein the first piece of the second reference value C2 is one of 0, C1, a first predetermined value, or a first piece obtained by randomly splitting the second reference value C2.

14. The method of claim 1, wherein, The elements of each dimension of the public vector T have both positive and negative values. The at least one intermediate reference value includes a second intermediate reference value c corresponding to the positive element and a third intermediate reference value d corresponding to the negative element. The square root value of a single positive element of the public vector T is the square root of that element, and the square root value of a single negative element is the square root of the absolute value of that element. The first slice, which calculates at least one intermediate reference value by multiplying each dimension element of the first slice based on the modulo 2 of the one-hot vector p with the square root value of the corresponding dimension element of the public vector T, includes: The first slice of the second intermediate reference value c is obtained by summing the products corresponding to each positive element of the public vector T and adding the second sign adjustment coefficient. The first slice of the third intermediate reference value d is obtained by summing the products corresponding to each negative element of the public vector T and adding a second sign adjustment coefficient.

15. The method of claim 14, wherein, The public vector T also includes zero-value elements. The products corresponding to the zero-value elements are processed in one of the following ways: Incorporate positive elements to determine the first slice of the second intermediate reference value c; or, Negative elements are incorporated to determine the first slice of the third intermediate reference value d.

16. The method of claim 14, wherein, The first slice that uses each intermediate reference value to securely calculate the inner product with the second party to obtain the first slice of the inner product includes: Using the first fragment of the second intermediate reference value c and the first fragment of the third intermediate reference value d, and the second party, based on the execution of a secure multiplication protocol or a secure square protocol, determine the square of the second intermediate reference value c and the square of the third intermediate reference value d, and obtain the first fragment of the square of the second intermediate reference value c and the first fragment of the square of the third intermediate reference value d. The first piece of the inner product is determined by the difference between the first piece of the square of the second intermediate reference value c and the first piece of the square of the third intermediate reference value d.

17. An apparatus for two-party secure calculation of vector inner product, used by a first party and a second party to determine the inner product of a one-hot vector p and a public vector T, wherein the one-hot vector p is configured and shared by the first party and the second party; The device is located on the first party and includes: The acquisition unit is configured to acquire the first slice modulo 2 of the one-hot vector p; The conversion unit is configured to calculate at least one intermediate reference value for the first slice based on the product of the square root values ​​of each dimension element of the first slice modulo 2 of the one-hot vector p and the corresponding dimension element of the public vector T. The secure computing unit is configured to use a first slice of each intermediate reference value to securely compute the inner product with a second party to obtain the first slice of the inner product.

18. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-16.

19. A computing device, comprising a memory and a processor, characterized in that, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-16.

Images