A homomorphic encryption method and its application in privacy protection classifier

Abstract

The application discloses a homomorphic encryption method and application thereof to a privacy protection classifier. The specific steps of the method comprise generating a public key pk and a private key sk by using a key generation algorithm KeyGen, encrypting a plaintext Q, and decrypting a ciphertext c. Compared with the prior art, the application avoids the disadvantage that in a fixed-point representation system, a number must be represented as a shared integer to perform multiplication, achieves a good balance between calculation efficiency and communication interaction, reduces expected misclassification loss in application to privacy protection classifier encryption, and maintains the same accuracy as an original minimum Bayes risk Bayes classifier.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data encryption algorithm, and particularly relates to a homomorphic encryption method and application thereof to a privacy protection classifier. BACKGROUND

[0002] In the field of machine learning, a classifier is a key core. In the current situation of increasing complexity of data properties, data volume, data calculation, classification and data mining requirements, how to ensure data privacy in the classification process is particularly important, and encryption for protecting privacy needs to focus on the training phase and the prediction phase.

[0003] In the prior art, different cryptographic tools are used to protect the privacy in the prediction phase according to the complexity difference of the classifier; for a relatively simple classifier, partial homomorphic encryption (PHE) tools are used to realize privacy protection; for a more complex classifier, fully homomorphic encryption (FHE) is usually used to improve the security of encrypted input. The multiply-add (M-A) type classifier belongs to a type of classifiers with multiply-add structure, and the multiply-add structure refers to a function structure that can be represented as Σ i (Π j α i,j ).

[0004] However, for the multiply-add (M-A) type classifier, the partial homomorphic encryption (PHE) method is not applicable, and the fully homomorphic encryption (FHE) method has poor ciphertext expansion performance, large computational overhead, low complex operation efficiency in the real number domain, cannot process real value plaintext, and cannot batch process multiplication or addition. The fully homomorphic encryption (FHE) also has the disadvantage that the Bayesian risk is not small enough when applied to a naive Bayes classifier. SUMMARY

[0005] In order to overcome the defects and deficiencies of the prior art, the first purpose of the present application is to provide a homomorphic encryption method, and the second purpose is to provide an application of the homomorphic encryption method in the first purpose to a privacy protection classifier, so as to introduce a new homomorphic encryption algorithm into the multiply-add (M-A) type classifier with multiply-add structure, so as to realize the balance between the calculation efficiency and the data interaction performance.

[0006] In order to achieve the above purpose, the present application adopts the following technical solutions:

[0007] A homomorphic encryption method, comprising the following steps:

[0008] Constructing a homomorphic encryption tool based on a Paillier encryption system:

[0009] MASE=(KeyGen,Enc,Dec-int,Dec,Mul,Add),

[0010] Wherein, the KeyGen algorithm is used for generating public key and private key, Enc represents the encryption sub-algorithm, Dec-int represents the integer decryption sub-algorithm, Dec represents the integer decryption sub-algorithm, Mul represents the multiplication operator, and Add represents the addition operator.

[0011] The sender and the receiver of the message generate the public key and the private key according to the KeyGen algorithm;

[0012] The sender uses the encryption sub-algorithm Enc to encrypt the plaintext, and uses the multiplication operator Mul and the addition operator Add to express the ciphertext as an output form with multiplication-addition structure;

[0013] The receiver first uses the integer decryption sub-algorithm Dec-int to convert the ciphertext into an integer form, and then uses the integer decryption sub-algorithm Dec to decrypt the integer form to obtain the corresponding plaintext.

[0014] Preferably, the process of generating the public key and the private key is specifically as follows:

[0015] The sender and the receiver of the message both use the KeyGen algorithm to generate the public key pk and the private key sk; the KeyGen is a probability algorithm for adopting a security parameter κ∈N in the Paillier encryption system and returning a public key / private key pair (pk, sk), and is denoted as: (pk, sk)←KeyGen(1 κ ), and pk=(n, g), sk=(λ, μ);

[0016] Wherein, n=p*q, p and q are two different large prime numbers randomly selected; λ=lcm(p-1, q-1), lcm(·,·) represents the least common multiple of two parameters; g is a random number, and satisfies represents a set less than n 2 and coprime with n 2 , is a group of multiplication modulo n 2 , m represents the input integer form, gcd(·,·) represents the greatest common divisor of two parameters; μ=(L(g λ mod n 2 ) -1 and The function L(x) for calculating the reciprocal of μ is defined as

[0017] Further, the process of the sender encrypting the plaintext is as follows:

[0018] The plaintext Q∈R + is encrypted by using the encryption sub-algorithm Enc and then sent; the encryption process of the encryption sub-algorithm Enc is The value of is The value of the value of Q;

[0019] where type-i denotes the encryption mode, and i∈{1,2},l i denotes the precision parameter and l i ∈N; denotes m, which is obtained by processing plaintext Q in type-1 encryption mode, denotes m, which is obtained by processing plaintext Q in type-2 encryption mode; Enc-P pk (·,·) denotes the encryption function of the Paillier encryption system, whose modulus is n, uses public key pk=(n,g), and input uses random number to obtain ciphertext c=Enc-P pk (m,r)=g m mod n ·r n mod n 2 .

[0020] Further, the output ciphertext process is specifically:

[0021] The encryption process is denoted as c=<Q>, and for multiple ciphertexts, there is:

[0022] The multiple ciphertexts output after type-1 encryption mode encryption are formally expressed as multiplicative homomorphism, let their number be T∈N, the precision parameter be l1∈N, and the messages be Q1,Q2,...,Q T ∈R + , then the structure is denoted as c=Mul pk (c1,c2,...,c T ) using the multiplication operator Mul;

[0023] The multiple ciphertexts output after type-2 encryption mode encryption are formally expressed as additive homomorphism, let their number be K∈N, the precision parameters be l1,l2∈N, and the messages be Q1,Q2,...,Q K ∈R + , then the structure is denoted as c=Add pk (c1,c2,...,c K ) using the addition operator Add.

[0024] Further, the process of converting ciphertext into integer form by the receiving party is:

[0025] The received ciphertext c is converted into input related to integer form using the integer decryption sub-algorithm Dec-int sk (c)=Dec-Psk (c); Dec-P sk (·) is the encryption function of Paillier encryption system, which uses the private key sk=(λ, μ), input ciphertext c, and calculates Get

[0026] Further, the process of receiving party decrypting the plaintext is specifically:

[0027] Using the decryption sub-algorithm Dec, the input related to the integer form is decrypted to get the plaintext Q∈R corresponding to the encryption mode + ;

[0028] The decryption sub-algorithm Dec takes the decryption mode i∈{1, 2}, the precision parameter l i ∈N, the private key sk, and the ciphertext c as input, and outputs the plaintext Q∈R corresponding to the decryption mode + ; The decryption process of the decryption sub-algorithm Dec is represented as

[0029] Wherein, is the value of , represents the decryption operation on type-1 ciphertext c, is the value of , represents the decryption operation on type-2 ciphertext c, and outputs the plaintext Q with a multiply-add structure 11 Q 12 …Q 1T +…+Q K1 Q K2 …Q KT .

[0030] An application of the foregoing homomorphic encryption method to a privacy protection classifier, the privacy protection classifier being a naive Bayes classifier with minimum Bayesian risk, and the homomorphic encryption method being applied to the process of protecting the privacy of user data in the naive Bayes classifier with minimum Bayesian risk.

[0031] Preferably, the naive Bayes classifier with minimum Bayesian risk includes a classification server and user data; and l1 and l2 in the homomorphic encryption method are taken as public precision parameters of the classification server.

[0032] Further, the private key sk in the homomorphic encryption method is taken as one of the input quantities on the side of the classification server, and the public key pk of the homomorphic encryption method is taken as one of the input quantities on the side of the user.

[0033] Further, after inputting the user data and the public key pk, encryption is performed according to the encryption steps of the homomorphic encryption method.

[0034] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0035] The method supports real value input, avoiding the disadvantage that numbers must be represented as shared integers for multiplication in a fixed-point representation system;

[0036] The method achieves a good balance between calculation efficiency and communication interaction, can significantly reduce the interaction rounds of batch addition or multiplication, and only needs 2 rounds of interaction for batch addition, and no interaction for multiplication;

[0037] When the method is applied to a privacy protection classifier, the Bayesian risk is reduced, that is, the expected misclassification loss is reduced, and the same accuracy as the original minimum Bayesian risk Bayesian classifier (MBR-NB) is maintained, without causing more loss. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 is a flowchart of the method of the present application;

[0039] Figure 2 is a schematic diagram of the homomorphic encryption method in Figure 1 application in a privacy protection classifier. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application, and are not used to limit the present application.

[0041] EMBODIMENT

[0042] As shown in Figure 1 , the homomorphic encryption method of the present embodiment is constructed on the basis of a Paillier encryption system:

[0043] MASE=(KeyGen,Enc,Dec-int,Dec,Mul,Add),

[0044] The specific steps are as follows:

[0045] S1, the sender and the receiver of the message both use the KeyGen algorithm to generate a public key pk and a private key sk;

[0046] KeyGen is a probability algorithm for adopting a security parameter κ∈N in the Paillier encryption system and returning a public key / private key pair (pk,sk), denoted as: (pk,sk)←KeyGen(1 κ ), and pk=(n,g), sk=(λ,μ).

[0047] where n = p * q, p and q are two different large prime numbers randomly selected; λ = lcm(p - 1, q - 1), lcm(·, ·) represents the least common multiple of two parameters; g is a random number, satisfying 2 and coprime with n 2 , is a group of multiplication modulo n 2 , m represents the form of the input integer, gcd(·, ·) represents the greatest common divisor of two parameters; μ = (L(g λ mod n 2 )) -1 and The function L(x) for calculating the reciprocal of μ is defined as

[0048] S2, the sender encrypts the plaintext;

[0049] The plaintext Q ∈ R + is encrypted using the encryption sub-algorithm Enc and then sent; the encryption process of the encryption sub-algorithm Enc is The value of is The value of is

[0050] where type-i represents the encryption mode, and i ∈ {1, 2}, l i represents the precision parameter, and l i ∈ N; m represents the m obtained by processing the plaintext Q in the type-1 encryption mode, m represents the m obtained by processing the plaintext Q in the type-2 encryption mode; Enc-P pk (·, ·) represents the encryption function of the Paillier encryption system, whose modulus is n, uses the public key pk = (n, g), and inputs Using a random number , the ciphertext c = Enc-P pk (m, r) = g m mod n · r n mod n 2 ;

[0051] If the encryption process is simply denoted as c = <Q>, then for multiple ciphertexts, there is:

[0052] The multiple ciphertexts output after the type-1 encryption mode encryption are in the form of multiplication homomorphism, let their number be T ∈ N, the precision parameter be l1 ∈ N, and the messages be Q1, Q2,..., Q T ∈ R + ​Then the structure is is represented as c = Mul pk (c1,c2,...,c T );

[0053] The output of the type-2 encryption mode encryption is in the form of additive homomorphism, and the number K is in N, the precision parameters l1 and l2 are in N, and the messages Q1, Q2,..., Q K ∈R + Then the structure is is represented as c = Add pk (c1,c2,...,c K );

[0054] S4, the receiver decrypts the ciphertext;

[0055] First, the received ciphertext c is converted into an input related to the integer form by using the integer decryption sub-algorithm Dec-int, and the integer decryption sub-algorithm is represented as Dec-int sk (c) = Dec-P sk (c); Dec-P sk (·) is an encryption function of the Paillier encryption system, which uses the private key sk=(λ,μ), inputs the ciphertext c, and calculates to obtain

[0056] Then, the input related to the integer form is decrypted by using the decryption sub-algorithm Dec to obtain the plaintext Q∈R + corresponding to the encryption mode;

[0057] The decryption sub-algorithm Dec takes the decryption mode i∈{1,2}, the precision parameter l i ∈N, the private key sk, and the ciphertext c as inputs, and outputs the plaintext Q∈R + corresponding to the decryption mode; the decryption process of the decryption sub-algorithm Dec is represented as

[0058]

[0059] wherein, is the value of , and represents a decryption operation on the type-1 ciphertext c, is the value of , and represents a decryption operation on the type-2 ciphertext c, and outputs the plaintext Q 11 Q 12 …Q 1T+...+Q K1 Q K2 …Q KT .

[0060] As Figure 2 shown, the aforementioned homomorphic encryption method is applied in the privacy protection classifier, and the specific application is as follows:

[0061] The privacy protection classifier is set to the naive Bayes classifier with the minimum Bayesian risk, and the homomorphic encryption method is applied to the process of protecting the user data privacy of the naive Bayes classifier with the minimum Bayesian risk;

[0062] First, construct the naive Bayes classifier with the minimum Bayesian risk:

[0063] The naive Bayes (NB) classifier assumes that each feature of the user data is conditionally independent given the target attribute, and trains the classifier by collecting a set of classification parameters; assuming that the target attribute of a sample X has k possible classes C1,...,C k , and X=(X1,...,X t ) is its feature vector with dimension t, let x=(x1,...,x t ) be the specific value of the feature vector X=(X1,...,X t ), and the class of the target attribute X predicted by the naive Bayes (NB) classifier is defined as: the product of the conditional probabilities Pr(X s =x s |Y=C i ) of each dimension vector x i of all t classes Y=C i given the class Y=C s , and the probability Pr(Y=C s ) of this class C s is expressed as s that maximizes this objective is the class of the target attribute, which is expressed in formula:

[0064]

[0065] To minimize the Bayesian risk (BR), the minimum Bayesian risk (MBR) criterion is adopted. The classifier with the minimum Bayesian risk (MBR) uses a loss function to describe its reduced Bayesian risk (BR), and the loss function is defined by a loss matrix, which introduces the cost of various misclassifications. Assuming that the loss matrix is L, L i,s represents the cost of misclassifying class C i as class C s , and misclassifying the sample into C​s Bayesian risk (BR) is defined as the loss matrix L and the class Y = C i The probability Pr(X=x,Y=C) of sample x i The product of ) can be expressed by the formula:

[0066]

[0067] Because of L i,i The value of i is 0, therefore L is excluded. i,i The above formula can be simplified to:

[0068]

[0069] The task of a classifier with minimum Bayesian risk (MBR) is to make a prediction that minimizes the Bayesian risk (BR), which means calculating the incorrect assignment of samples to C. s The minimum Bayesian risk (BR) is given by the formula k. * =argmin s∈[1,k] LP s The final obtained k * It is the predicted value that minimizes the expected loss;

[0070] The Naive Bayes classifier with minimum Bayesian risk employs a two-party protocol, where the input to the classification server is the private classifier parameters. The user's input is x = (x1, ..., x2) t ), k j Let represent the number of possible values ​​for the j-th feature, k represent the number of categories for the Y attribute (target attribute), b represent the feature value, and C represent the number of possible values ​​for the j-th feature. i Indicates category value;

[0071] At the end of the protocol, the user receives the classifier's output value k* = argmins ∈ [1,k]LPs, while the server receives nothing. The classifier's privacy is based on a framework of secure computation between the two parties. For the minimum Bayesian risk Naive Bayes (MBR-NB) classifier, starting from the Naive Bayes (NB) independence assumption, the prediction value k that minimizes the expected loss is calculated securely. * =argmin s∈[1,k] LP s Rearranging the previous formulas, we obtain the final formula as follows:

[0072]

[0073] As shown in the above formula, LP s It has a multiply-add structure;

[0074] The homomorphic encryption method (MASE) is introduced into the privacy protection process of the Naive Bayes classifier with minimum Bayesian risk, including:

[0075] The two precision parameters l1 and l2 in the homomorphic encryption method are used as the public precision parameters of the encrypted classifier.

[0076] The secret parameters and the private key sk in the homomorphic encryption method (MASE) are used as the inputs of the classification server; wherein b satisfies b∈[1,k j ], k represents the number of categories Y, i is an integer satisfying i∈[1,k], C i represents the i-th category, X represents the data object, t represents the dimension of the data object X, j is an integer satisfying j∈[1,t], {Pr(Y=C i )} i∈[1,k] represents the probability of the category being C i , represents the probability of the j-th dimension of X being equal to b given that the category is C i .

[0077] The data of the user in the Naive Bayes classifier with minimum Bayesian risk is denoted as x=(x1,...,x t ), and x=(x1,...,x t ) and the public key pk of the homomorphic encryption method are used as the inputs of the user; and is returned to the user as the output of the encrypted classifier, k * represents the minimum prediction of the expected loss of the classifier.

[0078] The application of the homomorphic encryption method in the Naive Bayes classifier with minimum Bayesian risk specifically includes:

[0079] The classification server and the user jointly perform the protocol of the offline stage and the online stage, the offline stage is performed by the server, and the online stage is performed by the user and the server together.

[0080] In the offline stage, the classification server obtains the input data x=(x1,...,x t ) of the user and the public key pk, and encrypts the user data as a message according to the homomorphic encryption method (MASE): calculates all i∈[1,k], j∈[1,t], b∈[1,k j ] using the type-1 encryption method in the homomorphic encryption method and and sends the encrypted ciphertext to the user, wherein l1 satisfies l i ∈N.

[0081] In the online phase, the phase steps correspond to the construction process of the aforementioned Naive Bayes classifier with minimum Bayesian risk, and the encryption and decryption of the aforementioned homomorphic encryption method (MASE) are introduced to protect the construction process, Indicates the corresponding protected symbol;

[0082] When the user processes the data obtained in the offline phase, for all i, s∈[1, k], The use of type-1 multiplication homomorphism characteristics for combined multiplication calculation errors will assign samples to C s The Bayesian risk LP i,s Is encrypted as type-1 ciphertext

[0083]

[0084] When the server and the user jointly execute the addition sub-algorithm Add in the homomorphic encryption method (MASE), the server and the user respectively play the roles of A and B in the addition sub-algorithm Add protocol, and convert the type-1 ciphertext to type-2 ciphertext, the process is For all s∈[1, k] in parallel, use the characteristics of type-2 addition homomorphism to perform combined addition calculation, and the final result is:

[0085]

[0086] The server and the user jointly execute the secure comparison operation P argmin Indicates a two-party protocol for jointly computing the argmin of encrypted data, the process is Finally, the prediction k * With the minimum expected loss is provided as output to the user, and the classification server cannot obtain any information in the process.

[0087] The technical scheme of the embodiment has the beneficial effects that:

[0088] The method of the embodiment supports real value input and can achieve good performance on a floating point representation system of real numbers, avoiding the disadvantage that numbers must be represented as shared integers for multiplication in a fixed point representation system; in addition, since the method of the embodiment is implemented on a Paillier system, the modulus of the Paillier encryption system is 2048 bits, which is equivalent to the security performance of a 2048-bit private key of an integer factorization cipher system.

[0089] The method of the embodiment achieves a good balance between calculation efficiency and communication interaction, can significantly reduce the interaction rounds of batch addition or multiplication, and the batch addition only needs 2 rounds of interaction, and the multiplication does not need interaction.

[0090] When the method of the embodiment is applied to a privacy protection classifier, the Bayesian risk is reduced, that is, the expected misclassification loss is reduced, and the same accuracy as the original minimum Bayesian risk Bayesian classifier (MBR-NB) is maintained, and no more loss is generated.

[0091] The above embodiment is a preferred embodiment of the present application, but the embodiments of the present application are not limited to the above embodiment, and any change, modification, substitution, combination, simplification made without departing from the spirit and principle of the present application should be an equivalent replacement mode, and all are included in the protection scope of the present application.

Claims

1. A homomorphic encryption method characterized by, Comprise the following steps: Homomorphic encryption tool is constructed on the basis of Paillier encryption system: ， wherein, an algorithm for generating a public key and a private key, denotes an encryption sub-algorithm, denotes an integer decryption sub-algorithm, denotes an integer decryption sub-algorithm, denotes a multiplication operator, denotes an addition operator; The sender and receiver of the message are both based on The algorithm generates a public key and a private key, specifically: The sender and receiver of the message both use An algorithm generates a public key and a private key ; The security parameters used in the Paillier encryption system and returns a public / private key pair The probabilistic algorithm is denoted by: and , ; in, p and q are two randomly selected distinct large prime numbers; , This is expressed as finding the least common multiple of two parameters; g is a random number that satisfies... , Indicates less than And with A set of coprime elements is a modulo A group of multiplication, Represents the integer form of the input. This indicates finding the greatest common divisor of two parameters. and ;calculate Reciprocal function Defined as ; The sender uses An encryption sub-algorithm encrypts the plaintext and uses a multiplication operator and an addition operator The ciphertext is represented as an output form having a multiplication-addition structure; The process that the sender encrypts plaintext is: Using encryption sub-algorithm The plaintext is encrypted and sent; the encryption sub-algorithm The encryption process of the encryption sub-algorithm , is the value of is the value of wherein, denotes an encryption mode, and , denotes a precision parameter and ; denotes processing of plaintext in encryption mode to obtain , denotes processing of plaintext in encryption mode to obtain ; denotes an encryption function of a Paillier encryption system, whose modulus is n, uses a public key , input , uses a random number , to obtain ciphertext ; The process that the output ciphertext is: Let the encryption process be denoted by For multiple ciphertexts, we have: through The multiple ciphertexts output after encryption in the encryption mode are in the form of a multiplicative homomorphism. Let their number be... Precision parameters ,information The structure is as follows: Using multiplication operators Represented as ; The encrypted mode encrypted output is in the form of ciphertext, which is in the form of additive homomorphism, and the number of ciphertexts is set to , the precision parameter , the message , and the structure is , which is represented by the addition operator as . ; The receiver first uses an integerized decryption sub-algorithm The ciphertext is converted into an integer form, and then an integer decryption sub-algorithm is used The integer form is decrypted to obtain the corresponding plaintext The process that the receiver converts ciphertext into integer form is: received ciphertext into an input associated with an integer form using an integerizing decryption sub-algorithm, the integerizing decryption sub-algorithm represented as ; ; ; is an encryption function for the Paillier encryption system that uses a private key , an input ciphertext , computes , and results in .

2. The homomorphic encryption method according to claim 1, wherein, The process that the receiver decrypts plaintext is: Using a decryption sub-algorithm , the input related to the integer form is decrypted to obtain the plaintext corresponding to the encryption mode ; Decryption sub-algorithm In decryption mode , precision parameter , private key , ciphertext As input, the output is plaintext corresponding to the decryption mode ; decryption sub-algorithm The decryption process is represented as ; wherein, is a value of denotes a decryption operation on ciphertext , outputting plaintext is a value of denotes a decryption operation on ciphertext , outputting plaintext with a multiply-add structure.

3. The application of the homomorphic encryption method according to any one of claims 1-2 on a privacy-preserving classifier, characterized in that, The privacy protection classifier is a naive Bayes classifier with minimum Bayesian risk, and the homomorphic encryption method is applied to the process of user data privacy protection of the naive Bayes classifier with minimum Bayesian risk.

4. The use of the homomorphic encryption method according to claim 3 on a privacy preserving classifier, characterized in that, The Naive Bayes classifier with the minimum Bayesian risk includes a classification server and user data; a homomorphic encryption method is used A public precision parameter encrypted by the classification server.

5. The use of the homomorphic encryption method according to claim 4 on a privacy preserving classifier, characterized in that, a private key of a homomorphic encryption method a public key of a homomorphic encryption method as one of the input quantities on the classification server side as one of the input quantities on the user side 6. The use of the homomorphic encryption method according to claim 5 on a privacy preserving classifier, characterized in that, The input user data and the public key are encrypted according to the homomorphic encryption method The encryption step is performed according to the homomorphic encryption method.

Images