Cloud-based intersection sample ID protection multi-party feature data alignment method

Abstract

The invention discloses a cloud-based intersection sample ID protection multi-party feature data alignment method, relates to the technical field of machine learning, and designs a cloud-based PSI expansion protocol, the protocol is divided into three stages: data outsourcing, feature data alignment (combination) and PPML, and the first two stages are mainly concerned. In a data outsourcing stage, each party encrypts own feature data and uploads the encrypted feature data to a cloud server, when a certain party (a data requesting party) needs to be combined with feature data of other parties for model training, the cloud only needs to be informed of an ID of a participating party which the party wants to combine, and then the cloud carries out a protocol of feature data alignment with the party; the output of the protocol is one secret sharing of feature data after the protocol is combined with other participant intersection users, the other secret sharing is grasped by the cloud, and then a data requester can execute a PPML protocol based on secret sharing with the cloud to carry out model training.

Description

Technical Field

[0001] The present invention relates to the field of machine learning technology, and more specifically to a multi-party feature data alignment method for protecting intersection sample IDs based on the cloud. Background Art

[0002] In this highly information-based society, data has gradually become the most valuable asset of this era. One important reason is that each user can be accurately represented by the various data they generate, which contains information about their habits, preferences, personality, etc. Using the representation power of data, a large amount of user data (feature data) can be used to train a "function" (hereinafter referred to as a model) that "records" the behavior of different users with different feature data. Once the training is completed, if the model is provided with various feature data about the user, it can predict the probability of the user taking certain actions.

[0003] This process is called machine learning and has been widely adopted in the industry. In machine learning tasks, a key factor is feature data, or more precisely, a large amount of feature data of different dimensions. In fact, both the number and dimensionality of feature data significantly affect the quality of the final trained model, that is, the accuracy of the prediction. With the popularity of various electronic devices, they continuously collect user data, making it relatively simple to obtain sufficient data, but obtaining user data of different dimensions is still challenging because user data of different dimensions are maintained by different entities.

[0004] For example, if a bank wants to train a risk control model that can be used to predict a user's repayment ability, it needs multi-dimensional feature data that may affect whether a person can repay the loan, such as criminal record, annual income, health record, browsing history, etc. However, the data is isolated by different aspects, such as Figure 1 Due to various privacy regulations, it is not a trivial matter for banks to unify the databases of other institutions, which leads to the "data island" problem.

[0005] To solve this problem, the concept of privacy-preserving machine learning (PPML) was introduced. PPML allows multiple parties to participate in the training of the model while ensuring the privacy of the data of all parties. In the scenario where feature data is distributed vertically, the complete process of PPML usually includes two steps: (1) multi-party sample alignment, that is, finding the common users of all parties based on user IDs; (2) using the aligned user data to train the model through secure multi-party computation (MPC) technology.

[0006] In order to ensure the privacy of each participant's user ID, the first step is usually to use private set intersection (PSI) technology, so that PPML participants can know the intersection users based on the user ID without revealing other user IDs in their user database. After that, all parties use the feature data of the intersection users to jointly train a model using the PPML protocol.

[0007] Unfortunately, the two steps in the current research on PPML are often carried out separately, that is, the research on PSI only focuses on how to efficiently find the intersection under privacy protection, while the research on PPML only focuses on the multi-party model training process under privacy protection. This leads to the inevitable privacy leakage problem between the two steps: the intersection user ID is leaked. Because in the PPML protocol, the designers always assume that the samples are aligned, or they just explain that the sample alignment can be done through the PSI protocol, however, they ignore the problem that the traditional PSI protocol will leak the intersection user ID.

[0008] Sometimes, the leakage of intersection user IDs can indeed undermine user privacy, even when most of the users in both sets are intersections. For example, in reality, people always prefer banks, hospitals and other institutions that are close to home, and the intersection users of these institutions contain the user's address information. Even worse, if the participants of PPML include some security institutions, their intersection users will leak sensitive information about whether the user has a bad record.

[0009] To address the issue of intersection user ID information leakage, some PSI extension protocols can hide these intersections, but they often cannot be directly and seamlessly linked to the subsequent PPML protocol. An intuitive solution is to use circuit-based PSI protocols (CPSI), but this approach has been proven to be inefficient in previous studies for the following reasons: (1) CPSI leads to huge communication overhead; (2) since the output of CPSI is encrypted, additional overhead is required during training to remove non-intersection users.

[0010] Another problem in the existing PPML protocol is the lack of flexibility. The existing multi-party PSI (MPSI) protocol or PPML protocol requires the participants to remain online and perform continuous calculations and responses until the end of the protocol. According to the previous example, if a bank wants to train a risk control model, it needs all the institutions involved - hospitals, Internet companies, governments, security agencies - to participate in the training process, but the risk control model is only useful for banks. Such a training process is not flexible enough because as long as one party reacts negatively during the protocol, the training process will stagnate.

[0011] Therefore, how to solve the privacy leakage problem of intersection sample ID and the inflexibility problem of the current PPML protocol is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0012] In view of this, the present invention provides a multi-party feature data alignment method for protecting intersection sample IDs based on the cloud, which solves the problems existing in the background technology.

[0013] In order to achieve the above object, the present invention provides the following technical solutions:

[0014] A multi-party feature data alignment method based on cloud-based protection intersection sample ID includes the following steps:

[0015] Step 1: Select a data holder from the PSI extension protocol as the "leader" to generate public parameters and secret parameters, send the secret parameters to the remaining data holders, and broadcast the public parameters to the remaining data holders and cloud server C;

[0016] Step 2: All data holders {P0, P1...P n-1}、Cloud server C generates its own homomorphic encryption public key and private key pair (pk I ,sk I )、(pk c ,sk c ), where pk I YesP I The public key of the party, sk I YesP I Party's private key, pk c is the public key of cloud server C, sk c is the private key of cloud server C, and each party broadcasts its public key to other participants;

[0017] Step 3: n data holders use secret parameters to encrypt their own sample ID set ID I And the corresponding feature data X I , where ID I , XI YesP I The sample ID set and the corresponding feature data set owned by the party, and the encrypted ID I , X I Upload to cloud server C for storage;

[0018] Step 4: When a data holder P I When the data requester wants to combine multiple feature data for model training, the data holder P I Request cloud server C to perform feature data alignment protocol;

[0019] Step 5: Cloud Server C and Data Holder P I After completing the feature data alignment protocol, each party has a secret share of the aligned feature data. Then, the cloud server C and the data holder P I A privacy-preserving machine learning protocol based on secret sharing is used to complete the model training.

[0020] Optionally, step 1 specifically includes the following contents:

[0021] Data holder P I Input a symmetric security parameter σ and use a random algorithm to generate k secret seeds s0, s1...s k-1 and a shared key ss as a secret parameter, and the secret parameter is sent directly or encrypted and transmitted to other data holders through the cloud;

[0022] P I Select a public hash algorithm h, a pseudo-random function F, and the length m of the Bloom filter as public parameters and broadcast them to other data holders and the cloud server C.

[0023] Optionally, in step 2, for the data holder P I , P I Input an asymmetric security parameter λ to the key generation algorithm (pk I ,sk I )←KGen(λ) generates a homomorphic encryption public and private key pair, and transmits the public key to other participants through a secure channel.

[0024] Optionally, step 3 specifically includes the following steps:

[0025] Step 3.1: Data holder P I Set your own id I Insert into a Bloom filter BF I ;

[0026] Step 3.2: P I Take your own feature data set X IInsert into a confused Bloom filter GBF I ;

[0027] Step 3.3: P I BF I and GBF I Send to cloud server C for storage.

[0028] Optionally, the specific content of step 3.1 is:

[0029] Step 3.1.1: Data holder P I Initialize a Bloom filter of length m and set all its positions to bit 1;

[0030] Step 3.1.2: For ID I The id of the i-th sample in I i , P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate its k different pseudo-random values:

[0031]

[0032]

[0033]

[0034] Step 3.1.3: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, the Bloom filter BF I The corresponding position is set to 0:

[0035]

[0036] Where: ind0, ind k-1 Represents the index value;

[0037] Step 3.1.4: Repeat steps 3.1.2 and 3.1.3 until the ID is inserted I All ids in .

[0038] Optionally, the specific content of step 3.2 is:

[0039] Step 3.2.1: Data holder P I Initialize an m-length confusion Bloom filter GBF I ;

[0040] Step 3.2.2: For the feature data set X I The i-th feature data xi , P I First, encrypt x using the shared key ss i :

[0041] <x i >←x i -F ss (x i )

[0042] Where: <x i > represents x i A secret share of each x i Divided into <x i >1 and <x i >2, <x i >1+ <x i >2=x i ; F ss Indicates that the key is a pseudo-random function of ss;

[0043] Step 3.2.3: P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate <x i >k pseudo-random values:

[0044]

[0045] Step 3.2.4: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, calculate GBF I The k position indexes are:

[0046]

[0047] Step 3.2.5: P I Using the confusion bloom filter algorithm <x i > Secret sharing to the k positions of the obfuscated Bloom filter; repeat steps 3.2.2 to 3.2.4 until insert,,NX I All elements in to GBF I middle;

[0048] Step 3.2.6: Check GBF I If each position in is 0, it is filled with a random string.

[0049] Optionally, the specific content of step 4 is:

[0050] Step 4.1: Data holder P I Send the set of data holders it wants to associate with, U, to the cloud server C;

[0051] Step 4.2: Cloud server C will use the bloom filter BF I Merge into one BF U , where the specific operation of merging is: for BF I For each position in , cloud server C adds it up and assigns it to BF U The corresponding position of:

[0052] BF U [i]←∑BF I [i]

[0053] Step 4.3: Cloud server C uses its homomorphic encryption public key pk c BF U and P I Data holder P who wants to join u (u∈U) Confusion Bloom Filter GBF u After encryption, send to P I ;

[0054] Step 4.4: P I Received BF U and GBF u After that, for its sample ID set ID I Each element in Calculate and generate the message matrix M = {m i}Send to cloud server C;

[0055] Step 4.5: For each message m in the message matrix M i , cloud server C first decrypts int i , check int i Is it 0? If int i =0, then the characteristic data in this message corresponds to the characteristic data of an intersection sample ID;

[0056] Step 4.6: P I Decrypt with your own homomorphic encryption private key and As a secret share of feature data corresponding to an aligned intersection sample ID; where, express A secret shared by Represents an intermediate variable.

[0057] Optionally, the specific content of step 4.4 is:

[0058] Step 4.4.1: P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate k pseudo-random values ​​of:

[0059]

[0060] Step 4.4.2: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, calculate k position indices:

[0061]

[0062] Step 4.4.3: P I BF U Add the values ​​of these k positions to generate an intersection value int i , int i Used for judgment Is it an intersection sample ID?

[0063] int i ←∑BFU[ind i ]

[0064] Step 4.4.4: P I Blind int i Values:

[0065] int i ←int i ×t

[0066] Where t is a random value. If int i = 0, then t will not affect int i value, otherwise int i will be randomized;

[0067] Step 4.4.5: P I Each GBF u Add the k positions in the sum, and finally get |U| values <x u >:

[0068] <x u >←∑GBF u [ind i ]

[0069] Step 4.4.6: P I use and the shared key ss to calculate the restored feature data x u Value

[0070]

[0071] Step 4.4.7: For each <x u > and P I Generate a random value to blind them:

[0072]

[0073] <x u >← <x u >+t

[0074] Step 4.4.8: P I Encrypt using your own homomorphic encryption public key pkI and corresponds to Characteristic data Then generate a message vector

[0075] Step 4.4.9: Repeat steps 4.4.1 to 4.4.8 until all elements of the sample ID set are calculated. Finally, the generated message matrix M = {m i}Sent to cloud server C.

[0076] Optionally, the specific content of step 4.5 is:

[0077] Step 4.5.1: For m i In Cloud server C generates a random number r and Send to P I As A secret share of Another secret shared by oneself;

[0078] Step 4.5.2: For m i In and{ <x u >} u∈U}, for each Cloud server C generates a random number t blinded

[0079]

[0080] <x u >← <x u >+t

[0081] Cloud Server C Decryption <x u > as x u A secret shared to keep for yourself, As x u Another secret share is sent to P I;

[0082] Step 4.5.3: Cloud server C repeats steps 4.5.1 and 4.5.2 until the calculation of the message matrix M is completed.

[0083] It can be seen from the above technical solutions that, compared with the prior art, the present invention provides a multi-party feature data alignment method based on the cloud to protect the intersection sample ID, and proposes an extended protocol of PSI, in which a cloud server is added. In the protocol proposed by the present invention, the data requester can interact with the cloud to complete the alignment operation of the intersection sample feature data without the participation of other data holders, and effectively protect the privacy of the intersection sample ID. The protocol proposed by the present invention can be directly linked to a two-party PPML protocol based on secret sharing, so that the data requester and the cloud server can complete the training of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0085] Figure 1 A schematic diagram of the bank as a data requester aligning feature data with the cloud;

[0086] Figure 2 It is a flowchart of a multi-party feature data alignment method based on cloud-based protection of intersection sample ID;

[0087] Figure 3 Flowchart of the insertion algorithm for obfuscated Bloom filters. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0089] In view of the problems existing in the background technology, the present invention designs a cloud-based PSI extension protocol, which can combine the feature data of the intersection users of each participating party without leaking the intersection user ID of the PPML participating party. The combined feature data is secretly shared between the data requester and the cloud. After that, the data requester can interact with the cloud alone to complete the model training without the participation of other parties.

[0090] To this end, in this embodiment, a multi-party feature data alignment method based on cloud-based protection intersection sample ID is disclosed, and a PSI extension protocol for feature data alignment in the early stage of privacy-preserving machine learning is designed. The protocol includes n data holders {P0, P1...P n-1} and a cloud server C, such as Figure 2 As shown, the following steps are included:

[0091] Step 1: Select a data holder from the PSI extended protocol as the "leader" to generate public parameters and secret parameters, send the secret parameters (directly or encrypted and sent through the cloud) to the remaining data holders, and broadcast the public parameters to the remaining data holders and cloud server C.

[0092] Specifically, the data holder P I Input a symmetric security parameter σ and use a random algorithm to generate k secret seeds s0, s1...s k-1 and a shared key ss as a secret parameter, and transmit the secret parameter to other data holders through a secure channel; I Select a public hash algorithm h, a pseudo-random function F, and the length m of the Bloom filter as public parameters and broadcast them to other data holders and the cloud server C.

[0093] Step 2: All data holders {P0, P1...P n-1}、Cloud server C generates its own homomorphic encryption public key and private key pair (pk I ,sk I )、(pk c ,sk c ), where pk I YesP I The public key of the party, sk I YesP I Party's private key, pk c is the public key of cloud server C, sk c is the private key of cloud server C, and each party broadcasts its public key to other participants.

[0094] Specifically, for the data holder P I , P I Input an asymmetric security parameter λ to the key generation algorithm (pk I ,sk I )←KGen(λ) generates a homomorphic encryption public and private key pair, and transmits the public key to other participants through a secure channel.

[0095] Step 3: n data holders use secret parameters to encrypt their own sample ID set ID I And the corresponding feature data X I , where ID I , X I YesP I The sample ID set and the corresponding feature data set owned by the party (in order to simplify the description, it is assumed that each ID corresponds to only one feature data x), and the encrypted ID I , X I Upload to cloud server C for storage. The specific steps are as follows:

[0096] Step 3.1: Data holder P I Set your own id I Insert into a Bloom filter BF I ; Among them, the specific steps of insertion are:

[0097] Step 3.1.1: Data holder P I Initialize a Bloom filter of length m and set all its positions to bit 1;

[0098] Step 3.1.2: For ID I The id of the i-th sample in I i , P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate its k different pseudo-random values:

[0099]

[0100] Step 3.1.3: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, the Bloom filter BF I The corresponding position is set to 0:

[0101] ind0←h(val0)

[0102] BF I [ind0]←0

[0103]

[0104] Where: ind0, ind k-1 Represents the index value, short for indices;

[0105] Step 3.1.4: Repeat steps 3.1.2 and 3.1.3 until the ID is inserted I All ids in .

[0106] Step 3.2: P I Take your own feature data set X I Insert into a confused Bloom filter GBF I ; Among them, the specific steps of insertion are:

[0107] Step 3.2.1: Data holder P I Initialize an m-length confusion Bloom filter GBF I ;

[0108] Step 3.2.2: For the feature data set X I The i-th feature data x i , P I First, encrypt x using the shared key ss i :

[0109] <x i >←x i -F ss (x i )

[0110] Where: <x i > represents x i A secret share of each x i Divided into <x i >1 and <x i >2, <x i >1+ <x i >2=x i ; F ss Indicates that the key is a pseudo-random function of ss;

[0111] Step 3.2.3: P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate <x i >k pseudo-random values:

[0112]

[0113] Step 3.2.4: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, calculate GBF I The k position indexes are:

[0114]

[0115] Step 3.2.5: P I Using the confusion bloom filter algorithm <x i> Secret sharing to the k positions of the obfuscated Bloom filter; repeat steps 3.2.2 to 3.2.4 until X is inserted I All elements in to GBF I Among them, the specific steps of the insertion algorithm of confusing Bloom filter are as follows Figure 3 As shown;

[0116] Step 3.2.6: Check GBF I If each position in is 0, it is filled with a random string.

[0117] Step 3.3: P I BF I and GBF I Send to cloud server C for storage.

[0118] Step 4: When a data holder P I When the data requester wants to combine multiple feature data for model training, the data holder P I Request cloud server C to perform feature data alignment protocol. The specific steps are as follows:

[0119] Step 4.1: Data holder P I Send the set of data holders it wants to associate with, U, to the cloud server C;

[0120] Step 4.2: Cloud server C will use the bloom filter BF I Merge into one BF U , where the specific operation of merging is: for BF I For each position in , cloud server C adds it up and assigns it to BF U The corresponding position of:

[0121] BF U [i]←∑BF I [i]

[0122] Step 4.3: Cloud server C uses its homomorphic encryption public key pk c BF U and P I Data holder P who wants to join u The confusion Bloom filter GBF of (u∈U) u After encryption, send to P I ;

[0123] Step 4.4: P I Received BF U and GBF u After that, for its sample ID set ID I Each element in Calculate and generate the message matrix M = {mi} is sent to cloud server C; the specific calculation method is as follows:

[0124] Step 4.4.1: P I Using k secret seeds {s0, s1...s k-1} and a pseudo-random function F to calculate k pseudo-random values ​​of:

[0125]

[0126] Step 4.4.2: P I Using hash function h: (0, 1) * →[m] and k pseudo-random values, calculate k position indices:

[0127]

[0128] Step 4.4.3: P I BF U Add the values ​​of these k positions (homomorphic addition) to generate an intersection value int i , int i Used for judgment Is it an intersection sample ID?

[0129] int i ←∑BF U [ind i ]

[0130] Step 4.4.4: P I Blind int i Values:

[0131] int i ←int i ×t

[0132] Where t is a random value. If int i = 0, then t will not affect int i value, otherwise int i Will be randomized:

[0133] Step 4.4.5: P I Each GBF u Add the k positions in (u∈U) (homomorphic addition), and finally get |U| values <x u >(u∈U):

[0134] <x u >←∑GBF u [ind i ]

[0135] Step 4.4.6: P I use and the shared key ss to calculate the restored feature data x u Value

[0136]

[0137] Step 4.4.7: For each <x u > and P I Generate a random value to blind them:

[0138]

[0139] <x u >← <x u >+t

[0140] Step 4.4.8: P I Use your own homomorphic encryption public key pk I encryption and corresponds to Characteristic data Then generate a message vector

[0141] Step 4.4.9: Repeat steps 4.4.1 to 4.4.8 until all elements of the sample ID set are calculated. Finally, the generated message matrix M = {m i}Sent to cloud server C.

[0142] Step 4.5: For each message m in the message matrix M i , cloud server C first decrypts int i , check int i Is it 0? If int i =0, then the characteristic data in the message corresponds to the characteristic data of an intersection sample ID; wherein, the cloud server C performs the following calculation:

[0143] Step 4.5.1: For m i In Cloud server C generates a random number r and Send to P I As A secret share of Another secret shared by oneself;

[0144] Step 4.5.2: For m i In and{ <x u >}u∈U}, for each Cloud server C generates a random number t blinded

[0145]

[0146] (x u >← <x u >+t

[0147] Cloud Server C Decryption <x u > as x u A secret shared to keep for yourself, As x u Another secret share is sent to P I ;

[0148] Step 4.5.3: Cloud server C repeats steps 4.5.1 and 4.5.2 until the calculation of the message matrix M is completed;

[0149] Step 4.6: P I Decrypt with your own homomorphic encryption private key and As a secret share of feature data corresponding to an aligned intersection sample ID; where express A secret shared by Indicates an intermediate variable (possibly P I necessary, or not necessary).

[0150] Step 5: Cloud Server C and Data Holder P I After completing the feature data alignment protocol, each party has a secret share of the aligned feature data. Then, the cloud server C and the data holder P I A privacy-preserving machine learning protocol based on secret sharing is used to complete the model training.

[0151] In summary, when observing the privacy leakage and inflexibility of the intersection sample ID of the current PPML protocol, this embodiment proposes a cloud-based PSI extension protocol, which is divided into three stages: data outsourcing, feature data alignment (union) and PPML. Among them, in the data outsourcing stage, each party encrypts the feature data they own and uploads it to the cloud server. When a party (data requester) needs to combine the feature data of other parties for model training, it only needs to tell the cloud the ID of the participant it wants to combine. Then the cloud will perform a feature data alignment protocol with it. The output of the protocol is a secret sharing of the feature data after it and the intersection user of other participants are combined, and the other secret sharing is controlled by the cloud. Then the data requester can execute a PPML protocol based on secret sharing with the cloud to train the model.

[0152] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0153] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-party feature data alignment method based on cloud-based protection of intersection sample ID, characterized in that: The following steps are involved: Step 1: Select a data holder from the PSI extension protocol as the "leader" to generate public parameters and secret parameters, send the secret parameters to the remaining data holders, and broadcast the public parameters to the remaining data holders and cloud server C; Step 2: All data holders {P0,P1…P n-1 }、Cloud server C generates its own homomorphic encryption public key and private key pair (pk I ,sk I )、(pk c ,sk c ), where pk I YesP I The public key of the party, sk I YesP I Party's private key, pk c is the public key of cloud server C, sk c is the private key of cloud server C, and each party broadcasts its public key to other participants; Step 3: n data holders use secret parameters to encrypt their own sample ID set ID I And the corresponding feature data X I , where ID I , X I YesP I The sample ID set and the corresponding feature data set owned by the party, and the encrypted ID I , X I Upload to cloud server C for storage; Step 4: When a data holder P I When the data requester wants to combine multiple feature data for model training, the data holder P I Request cloud server C to perform feature data alignment protocol; Step 5: Cloud Server C and Data Holder P I After completing the feature data alignment protocol, each party has a secret share of the aligned feature data. Then, the cloud server C and the data holder P I A privacy-preserving machine learning protocol based on secret sharing is used to complete the model training.

2. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 1, it is characterized in that: Step 1 specifically includes the following: Data holder P I Input a symmetric security parameter σ and use a random algorithm to generate k secret seeds s0, s1…s k-1 and a shared key ss as a secret parameter, and the secret parameter is sent directly or encrypted and transmitted to other data holders through the cloud; P I Select a public hash algorithm h, a pseudo-random function F, and the length m of the Bloom filter as public parameters and broadcast them to other data holders and the cloud server C.

3. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 1, it is characterized in that: In step 2, for data holder P I , P I Input an asymmetric security parameter λ to the key generation algorithm (pk I ,sk I )←KGen(λ) generates a homomorphic encryption public and private key pair, and transmits the public key to other participants through a secure channel.

4. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 1, it is characterized in that: Step 3 specifically includes the following steps: Step 3.1: Data holder P I Set your own id I Insert into a Bloom filter BF I ; Step 3.2: P I Take your own feature data set X I Insert into a confused Bloom filter GBF I ; Step 3.3: P I BF I and GBF I Send to cloud server C for storage.

5. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 4, it is characterized in that: The specific contents of step 3.1 are: Step 3.1.1: Data holder P I Initialize a Bloom filter of length m and set all its positions to bit 1; Step 3.1.2: For ID I The id of the i-th sample in I i , P I Using k secret seeds {s0,s1…s k-1 } and a pseudo-random function F to calculate its k different pseudo-random values: Step 3.1.3: P I Using hash function h:(0,1) * →[m] and k pseudo-random values, the Bloom filter BF I The corresponding position is set to 0: ind0←h(val0) BF I [ind0]←0 in k-1 ←h(val k-1 ) BF I [in k-1 ]←0 Where: ind0, ind k-1 Represents the index value; Step 3.1.4: Repeat steps 3.1.2 and 3.1.3 until the ID is inserted I All ids in .

6. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 4, it is characterized in that: The specific contents of step 3.2 are: Step 3.2.1: Data holder P I Initialize an m-length confusion Bloom filter GBF I ; Step 3.2.2: For the feature data set X I The i-th feature data x i , P I First, encrypt x using the shared key ss i : <x i >←x i -F ss (x i ) Where: <x i > represents x i A secret share of each x i Divided into <x i >1 and <x i >2, <x i >1+ <x i >2=x i ; F ss Indicates that the key is a pseudo-random function of ss; Step 3.2.3: P I Using k secret seeds {s0,s1…s k-1 } and a pseudo-random function F to calculate <x i >k pseudo-random values: Step 3.2.4: P I Using hash function h:(0,1) * →[m] and k pseudo-random values, calculate GBF I The k position indexes are: ind0←h(val0) in k-1 ←h(val k-1 ) Step 3.2.5: P I Using the confusion bloom filter algorithm <x i > Secret sharing to the k positions of the obfuscated Bloom filter; repeat steps 3.2.2 to 3.2.4 until X is inserted I All elements in to GBF I middle; Step 3.2.6: Check GBF I If each position in is 0, it is filled with a random string.

7. According to the cloud-based multi-party feature data alignment method for protecting intersection sample IDs according to claim 1, it is characterized in that: The specific contents of step 4 are: Step 4.1: Data holder P I Send the set of data holders it wants to associate with, U, to the cloud server C; Step 4.2: Cloud server C will use the bloom filter BF I Merge into one BF U , where the specific operation of merging is: for BF I For each position in , cloud server C adds it up and assigns it to BF U The corresponding position of: BF U [i]←∑BF I [i] Step 4.3: Cloud server C uses its homomorphic encryption public key pk c BF U and P I Data holder P who wants to join u The confusion Bloom filter GBF of (u∈U) u After encryption, send to P I ; Step 4.4: P I Received BF U and GBF u After that, for its sample ID set ID I Each element in Calculate and generate the message matrix M = {m i }Send to cloud server C; Step 4.5: For each message m in the message matrix M i , cloud server C first decrypts int i , check int i Is it 0? If int i =0, then the characteristic data in this message corresponds to the characteristic data of an intersection sample ID; Step 4.6: P I Decrypt with your own homomorphic encryption private key and As a secret share of feature data corresponding to an aligned intersection sample ID; where express A secret shared by Represents an intermediate variable.

8. The multi-party feature data alignment method based on cloud-based protection intersection sample ID according to claim 7 is characterized in that: The specific content of step 4.4 is: Step 4.4.1: P I Using k secret seeds {s0,s1…s k-1 } and a pseudo-random function F to calculate k pseudo-random values ​​of: Step 4.4.2: P I Using hash function h:(0,1) * →[m] and k pseudo-random values, calculate k position indices: ind0←h(val0) in k-1 ←h(val k-1 ) Step 4.4.3: P I BF U Add the values ​​of these k positions to generate an intersection value int i , int i Used for judgment Is it an intersection sample ID? int i ←∑BF U [ind i ] Step 4.4.4: P I Blind int i Values: int i ←int i ×t Where t is a random value. If int i = 0, then t will not affect int i value, otherwise int i will be randomized; Step 4.4.5: P I Each GBF u Add the k positions in the sum, and finally get |U| values <x u >: <x u >←∑GBF u [in i ] Step 4.4.6: P I use and the shared key ss to calculate the restored feature data x u Value Step 4.4.7: For each <x u > and P I Generate a random value to blind them: <x u >←<x u >+t Step 4.4.8: P I Use your own homomorphic encryption public key pk I encryption and corresponds to Characteristic data Then generate a message vector Step 4.4.9: Repeat steps 4.4.1 to 4.4.8 until all elements of the sample ID set are calculated. Finally, the generated message matrix M = {m i }Sent to cloud server C.

9. The multi-party feature data alignment method based on cloud-based protection intersection sample ID according to claim 7 is characterized in that: The specific contents of step 4.5 are: Step 4.5.1: For m i In Cloud server C generates a random number r and Send to P I As A secret share of Another secret shared by oneself; Step 4.5.2: For m i In and{ <x u >} u∈U }, for each Cloud server C generates a random number t blinded <x u >←<x u >+t Cloud Server C Decryption <x u > as x u A secret shared to keep for yourself, As x u Another secret share is sent to P I ; Step 4.5.3: Cloud server C repeats steps 4.5.1 and 4.5.2 until the calculation of the message matrix M is completed.

Images