Secure multi-party computation system operating method thereof

Abstract

A secure multi-party computation system and its operating method are proposed. The method includes: the first and second devices jointly performing linear operations in a neural network layer on input data to each generate an intermediate result, wherein the input data is stored in the first device, and the model corresponding to the neural network layer is stored in the second device. The first and second devices combine noise with their respective intermediate result to produce merged results. The first and second devices rearrange multiple elements in the merged result according to a shuffling key to generate an obfuscated result. The third device performs a nonlinear operation in the neural network layer based on the obfuscated result to generate an output result, which is then split into a first output and a second output and transmitted to the first and second devices, respectively. The first and second devices extract the output data based on the shuffling key and store it in the first device.

Description

[Technical Field]

[0001] This invention relates to secure multi-party computation and deep neural networks, and in particular to a secure multi-party computation system and its operation method. [Previous Technology]

[0002] The computation of Deep Neural Networks (DNNs) can be divided into two parts: linear computation and nonlinear computation. In DNN encrypted inference techniques, common methods include Fully Homomorphic Encryption (FHE) and Secure Multi-Party Computation (MPC). These techniques have been successfully applied to inference computation in encrypted environments to protect sensitive information from being leaked.

[0003] However, existing technologies face significant performance bottlenecks when handling nonlinear operations. Nonlinear operations (such as Softmax, GeLU, LayerNorm, ReLU, and Batch Normalization) are extremely computationally expensive in FHE and MPC architectures, significantly increasing inference time. For example, in Transformer inference under an MPC environment, nonlinear operations may account for the majority of the total computation time. Similarly, in ResNet inference under an FHE environment, nonlinear operations also constitute the main computational burden. This shows that while existing DNN privacy protection technologies can ensure data security, they still suffer from inefficiency when handling nonlinear operations, affecting their practical application. [Summary of the Invention]

[0004] In summary, the present invention proposes a secure multi-party computation system and its operation method to solve the above-mentioned problems.

[0005] An operation method of a secure multi-party computation system according to an embodiment of the present invention includes: performing linear operations in a neural network layer on input data by a first device and a second device to generate an intermediate result, wherein the input data is stored in the first device and the model corresponding to the neural network layer is stored in the second device; merging noise into the intermediate results generated by the first device and the second device to generate a merged result having multiple elements; rearranging the multiple elements according to a shuffling key by the first device and the second device to generate an obfuscated result and transmitting it to a third device; performing nonlinear operations in a neural network layer on the obfuscated result by the third device to generate an output result; splitting the output result into a first output and a second output by the third device and transmitting them to the first device and the second device respectively; and extracting input data from the first output and the second output according to the shuffling key by the first device and storing it in the first device.

[0006] A secure multi-party computation system according to an embodiment of the present invention includes a first device, a second device, and a third device. The first device is used to store input data and output data. The second device is communicatively connected to the first device and is used to store a model corresponding to a neural network layer. The first and second devices are used to jointly perform linear operations in the neural network layer on the input data to each generate an intermediate result, merge noise into the respective generated intermediate results to generate a merged result with multiple elements, and rearrange the elements according to a shuffling key to generate and transmit a scrambled result. The third device is communicatively connected to the first and second devices. The third device is used to perform nonlinear operations in the neural network layer according to the scrambled result to generate an output result, split the output result into a first output and a second output, and transmit them to the first and second devices respectively. The first and second devices are further used to extract input data from the first and second outputs according to the shuffling key and store it in the first device.

[0007] In summary, the secure multi-party computation system and its operation method proposed in this invention construct an innovative Trusted Computing Framework (TCF). This framework combines differential privacy technology with multi-party computation methods to provide security guarantees during the inference and training processes of deep neural networks. TCF effectively improves the efficiency of nonlinear operations and successfully reduces the time cost of related operations by more than 100 times, significantly improving processing speed and economic benefits, and fully demonstrating the possibility of privacy protection and efficient computation in parallel.

[0008] The above description of the disclosure and the following description of the embodiments are intended to demonstrate and explain the spirit and principles of the present invention, and to provide a further explanation of the scope of the patent application of the present invention.

Implementation Method

[0009] The detailed features and advantages of the present invention are described below in the embodiments. The content is sufficient to enable anyone skilled in the art to understand the technical content of the present invention and implement it accordingly. Furthermore, based on the content disclosed in this specification, the scope of the patent application, and the drawings, anyone skilled in the art can easily understand the relevant objectives and advantages of the present invention. The following embodiments further illustrate the viewpoints of the present invention, but are not intended to limit the scope of the present invention in any way.

[0010] Figure 1 is a block architecture diagram of a secure multi-party computation system according to an embodiment of the present invention. As shown in Figure 1, the secure multi-party computation system includes a first device 10, a second device 20, and a third device 30.

[0011] The first device 10 is used to store input data and output data. The first device 10 is a hardware device that provides data, and users can use artificial intelligence services through the first device 10.

[0012] The second device 20 is communicatively connected to the first device 10 and is used to store the model corresponding to the neural network layer. The second device 20 is a hardware device that provides artificial intelligence services.

[0013] The third device 30 is communicatively connected to the first device 10 and the second device 20. The third device 30 acts as an auxiliary device, responsible for assisting in the nonlinear calculations performed in the artificial intelligence service. It is worth noting that the third device 30 neither provides input nor acquires output during the calculation process. The feature of this invention is the introduction of the third device 30 to assist in nonlinear calculations, effectively protecting the input privacy of the first device 10 and the second device 20.

[0014] In one embodiment, the first device 10, the second device 20 and the third device 30 may be implemented using at least one of the following examples: personal computer, network server, central processing unit (CPU), graphics processing unit (GPU), microcontroller (MCU), application processor (AP), field programmable gate array (FPGA), application specific integrated circuit (ASIC), system-on-a-chip (SOC), deep learning accelerator, or any electronic device with similar functions. The present invention does not limit the hardware type of the first device 10, the second device 20 and the third device 30.

[0015] Figure 2 is a flowchart illustrating the operation method of a secure multi-party computation system according to an embodiment of the present invention, including steps S1 to S6. Step S1: The first device 10 and the second device 20 jointly perform linear operations in a neural network layer on the input data to generate an intermediate result, wherein the input data is stored in the first device 10, and the model corresponding to the neural network layer is stored in the second device 20. Step S2: The first device 10 and the second device 20 merge noise into the intermediate result to generate a merged result with multiple elements. Step S3: The first device 10 and the second device 20 rearrange the multiple elements according to a shuffling key to generate a scrambled result, and transmit it to a third device. Step S4: The third device performs nonlinear operations in a neural network layer based on the scrambled result to generate an output result. Step S5: The third device splits the output result into a first output and a second output and transmits them to the first device 10 and the second device 20 respectively. In step S6, the first device 10 and the second device 20 extract output data from the first output and the second output according to the shuffling key and store it in the first device 10. The process shown in Figure 2 is applicable to any layer of the neural network. Before reaching the output layer, after step S6 is completed, it will return to step S1 to perform the operation of the next layer.

[0016] Figure 3 is a flowchart illustrating the operation method of a secure multi-party computation system according to another embodiment of the present invention, including steps P1 to P5, steps S11 to S12, and steps S2 to S6, wherein steps S11 to S12 are one implementation of step S1. Steps S11 to S12 and S2 to S6 are online operations. Steps P1 to P4 are offline operations and must be completed before the online operations.

[0017] Before the first device 10 and the second device 20 execute steps S11 to S12, steps P1 to P3 must be completed first:

[0018] Step P1: Generate random numbers required for secret sharing, such as Beaver Triples, which are multiplication protocols used for Secure Multi-Party Computation (MPC) and are used for the linear operations in step S1 and the nonlinear operations in step S6. Step P1 can be performed by the first device 10, the second device 20, or the third device 30.

[0019] In convolutional neural networks and fully connected neural networks, linear operations involve performing matrix operations on model weights with input data or the output data of the previous neural network layer. In the Transformer architecture, in addition to performing matrix operations on model weights with input data or the output data of the previous neural network layer, matrix operations on intermediate generated data are also included. In one embodiment, the present invention uses the Beaver protocol in MPC and the matrix multiplication function of the Fully Homomorphic Encryption (FHE) scheme to implement these linear operations.

[0020] Step P2: Share the data of the first device 10. Specifically, the first device 10 splits the input data into a first sub-data and a second sub-data based on secret sharing, and transmits the second sub-data to the second device 20.

[0021] Step P3: Share the model of the second device 20. Specifically, the second device 20 splits the model into a first sub-model and a second sub-model based on secret sharing, and transmits the first sub-model to the first device 10.

[0022] In step S11, the first device 10 performs linear operations based on the first sub-data and the first sub-model to generate a first intermediate result. In step S12, the second device 20 performs linear operations based on the second sub-data and the second sub-model to generate a second intermediate result. The intermediate result generated in step S1 includes the first intermediate result and the second intermediate result.

[0023] Before the first device 10 and the second device 20 execute step S2, steps P4 to P5 must be completed first:

[0024] Step P4: Generate the noise required for data obfuscation in step S3. Specifically, at least one of the first device 10 and the second device 20 jointly generates this noise based on a parameter. The parameter includes at least one of the noise's mean, variance, and diffusion range, and the noise is generated using either a Gaussian mechanism or a Laplace mechanism.

[0025] Step P5: The shuffle key used in steps S3 and S6 is generated using at least one of the first device 10 and the second device 20. In one embodiment, the Fisher-Yates shuffle algorithm can be used to generate the shuffle key.

[0026] In steps S2 and S3, the first device 10 and the second device 20 execute a randomized mechanism (RM) to obfuscate the data to protect privacy. First, the intermediate result of the linear operation is merged with noise. Then, according to the shuffling key, the elements within the merged result are randomly sorted to obtain a new array. Specifically, the first device 10 merges the first intermediate result with noise to generate a first merged result, and the second device 20 merges the second intermediate result with noise to generate a second merged result. The merged result in step S2 includes both the first and second merged results. The first device 10 rearranges multiple elements of the first merged result according to a shuffling key to generate a first obfuscated result, and the second device 20 rearranges multiple elements of the second merged result according to a shuffling key to generate a second obfuscated result. The obfuscated results in steps S3 and S4 include both the first and second obfuscated results.

[0027] In step S4, the third device 30 performs nonlinear operations on the confusion result, including but not limited to: ReLU, sorting, exponentiation, division, square root and Softmax.

[0028] Overall, the secure multi-party computation system and its operation method proposed in this invention construct an innovative Trusted Computing Framework (TCF). Tables 1 and 2 are used to illustrate the symbols and functions used in this framework. Specifically, the TCF includes the three modules shown in Table 3 and the eight basic protocols shown in Table 4.

[0029] Table 1, Explanation of Symbols. symbol describe Symbols for multi-party computation protocols Input data for neural network layers Output data of neural network layers Weights of neural network layers Parameters of the noise generator Noise The output of the randomization mechanism, i.e., the confusion result of step S3. The output result of the nonlinear operation in step S4 Secret Sharing Homomorphic encryption Secretly shared encryption and decryption keys Fully homomorphic encryption encryption and decryption keys Shuffle encryption and decryption keys Homomorphic encryption after secret sharing

[0030] Table 2, Function Description function describe Cryptographic functions for secret sharing Decryption function for secret sharing Fully homomorphic encryption functions Decryption function for fully homomorphic encryption Noise generator The result of the merger Reorder as Extract and sort them back to their original order. Corrected linear unit Sort Exponentiation Normalized division square root

[0031] Table 3, Modules Working Online Module describe Linear operations Performed jointly by the first device 10 and the second device 20 Randomization mechanism Performed jointly by the first device 10 and the second device 20 Nonlinear operations The second device 20 performs nonlinear operations on the output confusion result, including ReLU(), Sort(), Exp(), Div(), and Sqrt().

[0032] Table 4, Basic Agreement protocol symbol enter Output Linear operations Randomization mechanism

[0033] Based on the symbols and functions defined in the table above, the following describes practical examples of various nonlinear operations.

[0034] Example 1: 1. The first device 10 and the second device 20 execute together. 2. The first device 10 and the second device 20 execute together. 3. The first device 10 and the second device 20 execute together. 4. The first device 10 and the second device 20 jointly transmit to the third device 30. 5. The third device 30 executes. 6. The third device 30 splits and transmits to the first device 10 and the second device 20. 7. The first device 10 and the second device 20 execute together.

[0035] Example 2 includes the following three implementation methods:

[0036] First Implementation: 1. The first device 10, the second device 20, and the third device 30 are executed jointly. 2. The first device 10 and the second device 20 are executed jointly, specifically, the summation of all elements in the calculation. 3. The first device 10 and the second device 20 are executed jointly, wherein the summation is an arbitrary integer used as a mask. 4. The first device 10 and the second device 20 are transmitted to the third device 30. 5. The third device 30 is executed, wherein the masked plaintext is used. 6. The third device 30 is executed, wherein the masked plaintext is used as noise, wherein the masked plaintext is used. 7. The third device 30 is transmitted to the first device 10 and the second device 20. 8. The first device 10 and the second device 20 obtain the result from removing the mask. 9. The first device 10 and the second device 20 are executed jointly.

[0037] Second Embodiment: 1. The first device 10, the second device 20, and the third device 30 are executed in conjunction. 2. The first device 10 and the second device 20 are executed in conjunction. 3. The first device 10, the second device 20, and the third device 30 are executed in conjunction. 4. The first device 10 and the second device 20 are executed in conjunction.

[0038] Third Embodiment: 1. The first device 10, the second device 20, and the third device 30 are executed jointly. 2. The first device 10 and the second device 20 are executed jointly. 3. The first device 10 and the second device 20 are executed jointly. 4. The first device 10 and the second device 20 transmit. 5. The second device 20 executes. 6. The second device 20 transmits to the first device 10 and the second device 20. 7. The first device 10 and the second device 20 are executed jointly. 8. The first device 10 and the second device 20 are executed jointly.

[0039] Table 5, Protocol of Convolutional Neural Network Model Based on TCF. protocol symbol enter Output Input layer Hidden layer Output layer

[0040] As shown in Table 5, common neural networks such as convolutional neural networks and fully connected neural networks can be implemented according to the modules and protocols proposed in Tables 3 and 4. Specifically, the implementation examples of the input layer and hidden layer are as follows: 1. The first device 10 and the second device 20 are executed together. 2. The first device 10, the second device 20 and the third device 30 are executed together.

[0041] The implementation examples of the output layer are as follows: 1. The first device 10 and the second device 20 are executed together. 2. The first device 10, the second device 20 and the third device 30 are executed together.

[0042] Table 6, Contract of Transformer Model Based on TCF protocol symbol enter Output Attention layer

[0043] As shown in Table 6, the attention layer in a common Transformer neural network can be implemented according to the modules and protocols proposed in Tables 3 and 4, as follows: 1. First device 10 and second device 20 execute together. 2. First device 10 and second device 20 execute together. 3. First device 10 and second device 20 execute together. 4. First device 10 and second device 20 execute together. 5. First device 10, second device 20 and third device 30 execute together. 6. First device 10 and second device 20 execute together.

[0044] Table 7 below is a comparison table of the runtime between the present invention and the prior art. The environment settings are as follows: CIFAR-10 dataset, CNN-6 layers and AMD Ryzen Threadripper PRO 5975WX CPU. Total Time Linear operation time Nonlinear operation time FHE-DNN 540 seconds (64 Execution Thread) 27 seconds 513 seconds MPC-DNN 38.4804 seconds 0.3255 seconds (1 Execution Line) 38.1549 seconds (≈5 threads) TCF-DNN This invention 0.6453 seconds (1 Execution Line) 0.3177 seconds 0.3276 seconds Baseline 0.0372 seconds (1 Execution Line)

[0045] In summary, the secure multi-party computation system and its operation method proposed in this invention are an innovative Trusted Computation Framework (TCF). Combining differential privacy technology with multi-party computation methods, it can provide security guarantees during the inference and training processes of deep neural networks. TCF effectively solves the efficiency problem of nonlinear operations, successfully reducing the time cost of related calculations by more than 100 times, significantly improving processing speed and economic benefits, and demonstrating the possibility of maintaining high-efficiency computation while protecting privacy.

[0046] Although the present invention has been disclosed above with reference to the foregoing embodiments, it is not intended to limit the present invention. Any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the appended claims. [Simplified Explanation of the Diagram]

[0047] Figure 1 is a block architecture diagram of a secure multi-party computation system according to an embodiment of the present invention;

[0048] Figure 2 is a flowchart illustrating the operation method of a secure multi-party computation system according to an embodiment of the present invention; and

[0049] Figure 3 is a flowchart illustrating the operation method of a secure multi-party computation system according to another embodiment of the present invention.

Claims

1. A method for operating a secure multi-party computation system, comprising: The first and second devices jointly perform linear operations in the neural network layer on the input data to each generate an intermediate result, wherein the input data is stored in the first device and the model corresponding to the neural network layer is stored in the second device; the first and second devices jointly generate noise based on a parameter, wherein the parameter includes at least one of the noise's mean, variance, and diffusion range, and the noise is generated by a Gaussian mechanism or a Laplace mechanism; the first and second devices merge the noise into their respective intermediate results to produce a merged result with multiple elements; the first and second devices rearrange the elements according to a shuffling key to generate a scrambled result, which is then transmitted to a third device; the third device performs nonlinear operations in the neural network layer based on the scrambled result to generate an output result; The third device splits the output result into a first output and a second output and transmits them to the first device and the second device respectively; and the first device and the second device extract output data from the first output and the second output according to the shuffling key and store it in the first device.

2. The method of operating the secure multi-party computation system as described in claim 1 further includes: The first device splits the input data into a first sub-data and a second sub-data, and transmits the second sub-data to the second device; The second device is used to split the model into a first sub-model and a second sub-model, and the first sub-model is transmitted to the first device; wherein the first device and the second device jointly perform the linear operation in the neural network layer on the input data to generate the intermediate result respectively, including: the first device performs the linear operation based on the first sub-data and the first sub-model to generate the first intermediate result; And the second device performs the linear operation based on the second sub-data and the second sub-model to generate a second intermediate result.

3. The method of operating the secure multi-party computation system as described in claim 1 further includes: The first device and at least one of the second device generate Beaver triples for use in the linear operation.

4. A secure multi-party computation system, comprising: The first device is used to store input data and output data; The second device is communicatively connected to the first device and used to store the model corresponding to the neural network layer. The first device and the second device are used to jointly perform linear operations in the neural network layer on the input data to generate an intermediate result, merge a noise into the intermediate result to generate a merged result with multiple elements, and rearrange the elements according to a shuffling key to generate and transmit a scrambling result. The third device is communicatively connected to the first and second devices and is used to perform nonlinear operations in the neural network layer based on the confusion result to generate an output result. The output result is split into a first output and a second output and transmitted to the first and second devices respectively. The first and second devices are further used to extract the output data from the first and second outputs based on the shuffling key and store it in the first device. At least one of the first and second devices is further used to jointly generate the noise based on a parameter, wherein the parameter includes at least one of the mean, variance and diffusion range of the noise, and the noise is generated by a Gaussian mechanism or a Laplace mechanism.

5. The secure multi-party computation system as claimed in claim 4, wherein the first device is further configured to split the input data into a first sub-data and a second sub-data, and transmit the second sub-data to the second device; the second device is further configured to split the model into a first sub-model and a second sub-model, and transmit the first sub-model to the first device; and the first device and the second device jointly perform the linear operation in the neural network layer on the input data to generate the intermediate result, including: The first device performs the linear operation based on the first sub-data and the first sub-model to generate a first intermediate result, and the second device performs the linear operation based on the second sub-data and the second sub-model to generate a second intermediate result.

6. The secure multi-party computation system as claimed in claim 4, wherein at least one of the first device and the second device is further configured to generate Beaver triples for use in the linear operation.

Images