A triplet generation method and system for multi-party secure computing

Abstract

The present specification relates to the field of information security, and in particular to a method and system for generating triples for multi-party secure computing. The method involves two parties, each of which holds a private matrix. The triple can assist the two parties in completing the secure matrix multiplication of the private matrix, which includes a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, and the product of the first matrix and the second matrix is ​​equal to the product matrix; the method is performed by the first party, including: obtaining a first basic vector and a first slice of a basic matrix; wherein the product of the first basic vector and the second basic vector is equal to the basic matrix, and the second basic vector and the second slice of the basic matrix are held by the second party; based on the transformation data shared by the two parties, the first basic vector and the first slice of the basic matrix are respectively dimensionally transformed to obtain the first matrix and the first slice of the product matrix in the triple.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and system for generating triples for multi-party secure computing. Background Art

[0002] Secure multi-party computation is also called multi-party secure computation, which means that multiple parties jointly calculate the result of a function without revealing the input data of each party of the function. The result of the calculation is stored in a shared form among multiple parties or disclosed to one or more of the parties. Therefore, through secure multi-party computation, the participating parties can calculate the result of the function without exposing their original data.

[0003] When performing multi-party secure multiplication, it is usually necessary to generate a multiplication triple (Beaver Triple). In some application scenarios, each multiplication calculation even consumes a triple. Therefore, the generation and configuration method of the triple is related to the efficiency of multi-party secure multiplication. Summary of the invention

[0004] One of the embodiments of the present specification provides a method for generating a triplet for multi-party secure computing, involving two parties, each of which holds a private matrix. The triplet can assist the two parties in completing secure matrix multiplication of the private matrices, and includes a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, wherein the product of the first matrix and the second matrix is ​​equal to the product matrix; the method is executed by the first party, and includes: obtaining a first basis vector and a first slice of the basis matrix; wherein the product of the first basis vector and the second basis vector is equal to the basis matrix, and the second basis vector and the second slice of the basis matrix are held by the second party; and performing dimensional transformation on the first basis vector and the first slice of the basis matrix based on transformation data shared by the two parties, to obtain the first matrix and the first slice of the product matrix in the triplet.

[0005] One of the embodiments of the present specification provides a triple generation system for multi-party secure computing, wherein the multi-party secure computing involves two parties, each of which holds a private matrix. The triple can assist the two parties in completing secure matrix multiplication of the private matrices, and includes a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, wherein the product of the first matrix and the second matrix is ​​equal to the product matrix; the system is deployed on the first party, and includes: a first acquisition module, which acquires a first basic vector and a first slice of the basic matrix; wherein the product of the first basic vector and the second basic vector is equal to the basic matrix, and the second basic vector and the second slice of the basic matrix are held by the second party; and a first transformation module, which performs dimensional transformation on the first basic vector and the first slice of the basic matrix based on the transformation data shared by the two parties, to obtain the first matrix and the first slice of the product matrix in the triple.

[0006] One of the embodiments of the present specification provides a triplet generation device for multi-party secure computing, including a processor, characterized in that the processor is used to execute the above method.

[0007] One of the embodiments of the present specification provides a multi-party secure matrix multiplication involving two parties, which is executed by the first party, including: obtaining a first matrix and a first slice of a product matrix; wherein the product of the first matrix and the second matrix is ​​equal to the product matrix, and the second matrix and the second slice of the product matrix are held by the second party; calculating the difference between the first private matrix and the first matrix to obtain a first difference matrix, and sending it to the second party; receiving a second difference matrix from the second party; the second difference matrix is ​​equal to the difference between the second private matrix held by the second party and the second matrix; obtaining a first slice of a privacy product matrix based on the first matrix, the second difference matrix and the first slice of the product matrix; wherein the privacy product matrix is ​​equal to the product of the first private matrix and the second private matrix.

[0008] One of the embodiments of the present specification provides a multi-party secure matrix multiplication involving two parties, which is executed by the second party, including: obtaining a second matrix and a second slice of a product matrix; wherein the product of a first matrix and a second matrix is ​​equal to the product matrix, and the first matrix and a first slice of the product matrix are held by the second party; calculating the difference between a second private matrix and the second matrix to obtain a second difference matrix, and sending it to the first party; receiving the first difference matrix from the first party; the first difference matrix is ​​equal to the difference between the first private matrix held by the first party and the first matrix; obtaining a second slice of a privacy product matrix based on the first difference matrix, the second private matrix and the second slice of the product matrix; wherein the privacy product matrix is ​​equal to the product of the first private matrix and the second private matrix. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] This specification will be further described in the form of exemplary embodiments, which will be described in detail by the accompanying drawings. These embodiments are not restrictive, and in these embodiments, the same number represents the same structure, wherein:

[0010] Figure 1 is a schematic diagram of an application scenario of a computing system according to some embodiments of this specification;

[0011] Figure 2 is an exemplary flow chart of a method for generating triples of multi-party secure computation according to some embodiments of this specification;

[0012] Figure 3 is an exemplary flow chart of a method for generating a triplet of multi-party secure computing according to other embodiments of this specification;

[0013] Figure 4is an exemplary flow chart of multi-party security matrix multiplication according to some embodiments of this specification;

[0014] Figure 5 It is an exemplary module diagram of a triple generation system for multi-party secure computation according to some embodiments of the present specification. DETAILED DESCRIPTION

[0015] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following is a brief introduction to the drawings required for the description of the embodiments. Obviously, the drawings described below are only some examples or embodiments of this specification. For ordinary technicians in this field, this specification can also be applied to other similar scenarios based on these drawings without creative work. Unless it is obvious from the language environment or otherwise explained, the same reference numerals in the figures represent the same structure or operation.

[0016] It should be understood that the "system", "device", "unit" and / or "module" used herein are a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.

[0017] As shown in this specification and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "comprise" and "include" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0018] Flowcharts are used in this specification to illustrate the operations performed by the system according to the embodiments of this specification. It should be understood that the preceding or following operations are not necessarily performed precisely in order. Instead, the steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes, or one or more operations may be removed from these processes.

[0019] Figure 1 It is a schematic diagram of an application scenario of a computing system according to some embodiments of the present specification.

[0020] like Figure 1 As shown, computing system 100 may include computing device 110 , computing device 120 , and network 140 . Computing device 110 and computing device 120 may be devices of two parties participating in multi-party secure computing.

[0021] The computing device may include various types of devices with computing capabilities, such as servers. In some embodiments, the server may be an independent server or a server group, which may be centralized or distributed. In some embodiments, the server may be regional or remote. In some embodiments, the server may be executed on a cloud platform. For example, the cloud platform may include one or any combination of a private cloud, a public cloud, a hybrid cloud, a community cloud, a decentralized cloud, an internal cloud, etc.

[0022] The network 140 connects the components of the system so that the components can communicate with each other. The network between the components in the system may include a wired network and / or a wireless network. For example, the network 140 may include a cable network, a wired network, a fiber optic network, a telecommunications network, an internal network, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network (ZigBee), a near field communication (NFC), a bus within a device, a line within a device, a cable connection, etc. or any combination thereof. The network connection between each two components may be in one of the above-mentioned ways, or in multiple ways.

[0023] In some embodiments, the computing system 100 may also include a third-party device 130, which can assist two computing devices in performing multi-party secure computing. For example, the third-party device 130 can generate random numbers, calculate sharding values, and distribute random numbers and / or sharding values ​​to the computing device 110, the computing device 120, etc.

[0024] In some scenarios, such as when training a machine learning model, multiplication operations are required to propagate the feature data of the sample forward or to propagate the gradient information obtained based on the loss function backward. Usually, the training data is propagated in batches as the smallest unit; assuming that a batch includes the feature data of 256 samples, and each feature data dimension is 100, it is necessary to perform matrix multiplication operations on the 256×100 sample feature matrix and the machine learning model parameters (which can also be equivalent to matrix or vector form) to propagate the feature data forward. In the multi-party secure computing scenario, in order to protect data privacy, the sample feature matrix is ​​stored in one party participating in the training, and the model parameter matrix is ​​stored in the other party participating in the training. Each participant can complete the forward propagation of feature data based on multi-party secure matrix multiplication, while avoiding samples and model parameters from going out of domain, thereby protecting data privacy.

[0025] In a multi-party secure computing scenario, when performing secure matrix multiplication, the matrix multiplication can be decomposed into multiple secure multiplications between elements, so that multiple secure multiplications between scalars (secure multiplications between numbers) are performed to obtain the result slices of the matrix product. However, such a calculation process requires the participants to perform a large amount of data communication and repeatedly generate multiplication triplets, which is inefficient. To this end, some embodiments of the present specification provide a matrix-form triple generation method for assisting multi-party secure matrix multiplication, and a multi-party secure matrix multiplication based on the method, so as to improve the processing efficiency of the multi-party secure matrix multiplication.

[0026] It should be noted that the sharding mentioned in this specification can be a secret sharding based on secret sharing technology. For example, it can be an additive sharding, and the sum of each sharding is equal to the original secret value. For the sharding of a matrix or vector, it can be that its element sharding is split into n additive shards, n ≥ 2, and a shard of each element is taken to form a shard of the matrix or vector, so that n matrix (or vector) shards can be obtained. It is not difficult to understand that the sum of n matrix (or vector) shards is equal to the original matrix (or original vector).

[0027] Some embodiments of the present specification provide a method for generating a triplet of multi-party secure computing, involving a first party and a second party, each of which holds a private matrix (such as a sample feature matrix private to one party and a model parameter matrix private to the other party). The triplet can assist the two parties in completing secure matrix multiplication of the private matrices, which includes a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, the product of the first matrix and the second matrix is ​​equal to the product matrix, and the first slice of the product matrix and the second slice of the product matrix are the sum slices of the product matrix.

[0028] In some embodiments, the first matrix has the same dimensions as the private matrix held by the first party, and the first slice of the product matrix has the same dimensions as the product result of the private matrices held by the two parties. Assuming that the private matrix held by the first party is a matrix of m rows and k, hereinafter referred to as an m×k matrix, and the private matrix held by the second party is a k×r matrix, then the first matrix is ​​an m×k matrix and the second matrix is ​​a k×r matrix, and the product matrix has the same dimensions as the product result of the private matrices held by the two parties, and can be expressed as an m×r matrix; from the relevant description of matrix or vector slices, it can be seen that the first slice and the second slice of the product matrix must have the same dimensions as the product matrix, that is, the first slice and the second slice of the product matrix can be expressed as an m×r matrix.

[0029] In some embodiments, the method can also be used to generate a triple for vector multiplication. In this scenario, two parties hold private vectors respectively, and the first matrix and the second matrix in the triple are replaced by the first vector and the second vector respectively. Since a vector can be regarded as a matrix with 1 row or column in some scenarios, matrix multiplication will be described as an example in the following text for ease of description.

[0030] Figure 2 It is an exemplary flow chart of a method for generating triples for multi-party secure computing according to some embodiments of this specification.

[0031] like Figure 2 As shown, one or more steps in process 200 may be performed by a first party (such as Figure 1 The method is executed by the computing device 110 in the embodiment of the present invention, and includes:

[0032] Step 210, obtaining a first basis vector and a first slice of a basis matrix; wherein the product of the first basis vector and the second basis vector is equal to the basis matrix, and the second basis vector and the second slice of the basis matrix are obtained by a second party (such as Figure 1 In some embodiments, step 210 may be performed by a first acquisition module.

[0033] In some embodiments, the first basis vector may be represented as α, assuming it is an n-dimensional column vector, and may be represented as an n×1 matrix. In some embodiments, the dimension of the second basis vector may be the same as the dimension of the first basis vector, and since the product of the first basis vector and the second basis vector is equal to the basis matrix, the second basis vector may be a row matrix. In some embodiments, the second basis vector may be represented as β T , where β can be an n×1 matrix of the same dimension as the first basis vector α. After performing matrix transposition calculation on it, the second basis vector β T That is, it is a 1×n matrix. In some embodiments, β can also be called the second basis vector. In order to perform matrix multiplication with the first basis vector to obtain the basis matrix, the necessary transposition can be performed by default. In some embodiments, the basis matrix is ​​equal to the first basis vector α and the second basis vector β T The product of , that is, the basic matrix can be expressed as αβ T For ease of description, this example will be used in the subsequent parts of this specification.

[0034] In some embodiments, the value of n is related to data security, but it should be noted that the value of n does not affect the execution of this solution, so the value of n is not limited in this specification. In some embodiments, the dimension of the second basis vector can be different from that of the first basis vector, such as the second basis vector can be an r-dimensional row vector, that is, a 1×r matrix, in which case the basis matrix can be represented as αβ, which is an n×r matrix.

[0035] In some embodiments, the base matrix αβ T It is stored in the first and second parties in the form of and shards, which can be expressed as: αβ T =A0+A1, where A0 is the first slice of the basis matrix held by the first party, and A1 is the second slice of the basis matrix held by the second party. Continuing with the above example, if the first basis vector α is an n×1 matrix, the second basis vector β T is a 1×n matrix, then the basic matrix αβ T Both its slices are square matrices of order n, that is, n×n matrices.

[0036] In some embodiments, the first party may obtain Figure 1 The third party device 130 in the embodiment of the present invention obtains the first basis vector and the first slice of the basis matrix; correspondingly, the second party can obtain the second basis vector and the second slice of the basis matrix from the third party, wherein the first slice and the second slice of the basis matrix are obtained by local calculation by the third party. Exemplarily, the third party device can randomly generate the first basis vector and the second basis vector, multiply the two to obtain the basis matrix, and then randomly split the basis matrix to obtain the first slice and the second slice of the basis matrix.

[0037] In some embodiments, the first basis vector and the second basis vector may be sparse vectors, so as to reduce the data transmitted from the third party to the two parties and reduce the transmission pressure. A sparse vector is generally a vector with more 0 elements, and specifically a vector with a 0 element ratio not less than a preset value. In some embodiments, the preset value may be 1 / 4, 1 / 3, or 1 / 2, etc. In some embodiments, the first basis vector, the second basis vector, and the slices of the basis matrix may all be transmitted in a sparse matrix transmission mode, for example, only non-0 elements and their positions are transmitted to save communication traffic.

[0038] In order to further reduce the amount of data transmission in step 210, in some embodiments, the participating parties can generate random numbers based on random number seeds through a pseudo-random number algorithm. In the pseudo-random number algorithm, a set of pseudo-random data seeds need to be set in advance, and each party generates a set of random numbers based on the preset random number seeds. When the same random number seed is input, the generated random number sequence is also the same. It should be noted that the random number seed can be configured in advance on the participating parties before executing the method.

[0039] In some embodiments, the first party may generate a first basis vector through a first random number seed, and generate a first slice of a basis matrix through a second random number seed, and the second party may generate a second basis vector through a third random number seed; correspondingly, the third party may generate the same first basis vector as the first party through the first random number seed, generate the same first slice of a basis matrix as the first party through the second random number seed, and generate the same second basis vector as the second party through the third random number seed, and then calculate the product of the first basis vector and the second basis vector to obtain a basis matrix, subtract the first slice from the basis matrix, obtain the second slice of the basis matrix and transmit it to the second party. That is, the second party can generate the second basis vector by itself and obtain the second slice of the basis matrix from the third party.

[0040] In some embodiments, the first party may generate a first basis vector through a first random number seed, and obtain a first slice of a basis matrix from a third party. The second party may generate a second basis vector through a third random number seed, and generate a second slice of a basis matrix through a fourth random number seed. Accordingly, the third party may generate the same first basis vector as the first party through the first random number seed, generate the same second basis vector as the second party through the third random number seed, and generate the same second slice of a basis matrix as the second party through the fourth random number seed, and then calculate the product of the first basis vector and the second basis vector to obtain a basis matrix, subtract the second slice from the basis matrix, obtain the first slice of the basis matrix and transmit it to the first party.

[0041] In some embodiments, the first basis vector and the first slice of the basis matrix obtained from the third party may be obtained based on a Function Secret Sharing (FSS) algorithm. Specifically, obtaining the first basis vector and the first slice of the basis matrix from the third party may include:

[0042] The third party randomly generates a first basis vector and a second basis vector, and calculates the product of the first basis vector and the second basis vector to obtain the basis matrix;

[0043] The first basic vector is obtained from a third party and the first slice of the basic matrix is ​​obtained by cooperating with the third party through a functional secret sharing algorithm.

[0044] In some embodiments, the third party may randomly generate a sparse first basis vector and a second basis vector, and calculate the product of the first basis vector and the second basis vector to obtain an n×n basis matrix, wherein the product may be a matrix product (or a tensor product). In some embodiments, the first basis vector and the second basis vector may be n-dimensional sparse vectors, containing only two elements, 0 and 1, with at most t 1 elements and t being much smaller than n. Therefore, the basis matrix as the tensor product of two sparse vectors may have at most t 1 elements. 2 non-zero elements, and the non-zero element can only be 1.

[0045] In some embodiments, the base matrix can be represented as t 2 point functions, the first party and the second party can respectively cooperate with the third party to obtain the first slice and the second slice of the basic matrix respectively through the function secret sharing algorithm (FSS). For example, the third party can split the basic matrix into t 2 A one-hot matrix (dimension is n×n, with only one element being 1 and the rest being 0), t 2 The sum of the one-hot matrices is equal to the basic matrix. For each one-hot matrix, the third party generates the first seed key0 and the second seed key1 through the Gen algorithm in the FSS algorithm, and then obtains t 2 The first seed key0 and the second seed key1 can be a string of 0 and 1 elements respectively, which are much smaller than the dimension of the basic matrix. 2 The first seed key0 and t 2 The second seed key1 is transmitted to the first party and the second party respectively. 2 After the first seed key0 is generated, the first slice of the corresponding one-hot matrix is ​​generated based on the first seed key0 through the Eval algorithm in the FSS algorithm. In this way, the first party can obtain t 2 The first slice of the one-hot matrix. Afterwards, the first party can generate t 2The first slices of the one-hot matrices are summed to obtain the first slice of the basic matrix. The second party can generate the second slice of the basic matrix in the same way. The basic matrix slices obtained by the participating parties through the functional secret sharing FSS algorithm are pseudo-random under the LPN (Learning Parity with Noise) assumption, which can significantly increase the security of the system. At the same time, the participating parties can effectively reduce the amount of transmitted data by transmitting the FSS seed to avoid directly transmitting the slices of the basic matrix. In addition, the third party can transmit the first basic vector and the second basic vector according to the sparse matrix transmission method (such as only transmitting the positions of non-zero elements in the vector), which can further effectively reduce the amount of data transmission.

[0046] Step 220, based on the transformation data shared by both parties, respectively transform the first basis vector and the first slice of the basis matrix to obtain the first matrix in the triplet and the first slice of the product matrix. In some embodiments, step 220 may be performed by a first transformation module.

[0047] The transformation data is shared by both parties. In some embodiments, it can be configured in advance to the participating parties before executing the method or generated by means of a random number seed or the like.

[0048] Continuing with the previous example, the transformation data can transform the dimension of the first basis vector α (n×1 matrix) and the first slice A0 of the basis matrix (n×n matrix) to obtain the first matrix in the triplet (m×k matrix) and the first slice of the product matrix (m×r matrix).

[0049] In some embodiments, the transformation data includes one or more groups of transformation matrices, and the number of groups of transformation matrices is related to the private data of the two parties. Specifically, the number of groups is the same as the number of columns of the private matrix held by the first party or the number of rows of the private matrix held by the second party, that is, in the aforementioned example, the transformation matrix includes k groups. In addition, in the aforementioned scenario where the two parties hold private vectors, the transformation matrix may include 1 group.

[0050] In some embodiments, each set of transformation matrices includes a first transformation matrix and a second transformation matrix; the number of rows of the first transformation matrix is ​​the same as the number of rows of the private matrix held by the first party, the number of columns of the first transformation matrix is ​​the same as the dimension of the first basis vector, the number of rows of the second transformation matrix is ​​the same as the dimension of the second basis vector, and the number of columns of the second transformation matrix is ​​the same as the number of columns of the private matrix held by the second party. In some embodiments, since the transformation data includes k sets of first transformation matrices and second transformation matrices, any set of first transformation matrices is represented as B i , the second transformation matrix is ​​expressed as C i , then the first transformation matrix B iis an m×n matrix, the second transformation matrix C i It is an n×r matrix, where i is a number among 1, 2, 3, ..., k.

[0051] In some embodiments, for each of the k groups of transformation matrices, step 220 may further include:

[0052] Step 222, calculate the product of the first transformation matrix and the first basis vector to obtain a first transformation result.

[0053] In some embodiments, the first transformation result may represent δ i , then δ i =B i α, easy to get, the first transformation result δ i is an m×1 matrix.

[0054] Step 224, calculate the product of the first transformation matrix, the first slice of the basic matrix and the second transformation matrix to obtain a second transformation result.

[0055] In some embodiments, the second transformation result can be expressed as D i , then D i =B i A0C i , the second transformation result D is easily obtained i is an m×r matrix.

[0056] Step 226, obtaining the first matrix based on the first transformation results of each group; and calculating the sum of the second transformation results of each group to obtain a first slice of the product matrix.

[0057] In some embodiments, the first transformation result δ in any set of transformation matrices i is an m×1 matrix (column vector), with a total of k groups; the first matrix is ​​represented as Δ, and the first transformation results of each group are arranged in sequence in the row direction to obtain the first matrix Δ, then Δ=(δ1, δ2, ...δ k ), and the first matrix Δ is an m×k matrix, which can be determined from the foregoing to have the same dimension as the private matrix of the first party.

[0058] In some embodiments, the second transformation result D of each group i The sum can be expressed as ∑ i D i , the first slice of the product matrix is ​​denoted as D, then D = ∑ i D i The first slice D of the product matrix and the second transformation result D i Same dimension, an m×r matrix.

[0059] In some embodiments, the first matrix Δ and the first slice D of the product matrix are held by the first party, and can assist the two parties to complete the secure matrix multiplication of the private matrix. The specific process of assisting the two parties to complete the secure matrix multiplication of the private matrix can be seen in Figure 4 Related description.

[0060] Figure 3 It is an exemplary flow chart of a method for generating triples of multi-party secure computing according to other embodiments of this specification.

[0061] like Figure 3 As shown, one or more steps in process 300 may be performed by a second party (such as Figure 1 The method is performed by the computing device 120 in the embodiment of the present invention, and the method includes:

[0062] Step 310, obtaining a second basis vector and a second slice of the basis matrix;

[0063] In some embodiments, the second basis vector β T For more information about the second slice of the basic matrix A1, please refer to the relevant description of step 210, which will not be repeated here.

[0064] Step 320: Dimensionally transform the second basis vector and the second slice of the basis matrix based on the transformation data shared by both parties, to obtain the second matrix in the triplet and the second slice of the product matrix.

[0065] In some embodiments, similar to step 220, the transformation data may include multiple sets of first transformation matrices and second transformation matrices, and step 320 may further include:

[0066] Step 322, calculate the product of the second transformation matrix and the second basis vector to obtain a third transformation result.

[0067] In some embodiments, the third transformation result may represent γ i , then γ i =β T C i , it is easy to get the third transformation result γ i is a 1×r matrix.

[0068] Step 324, calculate the product of the first transformation matrix, the second slice of the base matrix, and the second transformation matrix to obtain a fourth transformation result.

[0069] In some embodiments, the fourth transformation result can be expressed as E i , then E i =B i A1C i , the fourth transformation result E is easily obtained i is an m×r matrix.

[0070] Step 326, obtaining the second matrix based on the third transformation results of each group; and calculating the sum of the fourth transformation results of each group to obtain a second slice of the product matrix.

[0071] In some embodiments, the third transformation result γ in any set of transformation matrices i is a 1×r matrix (row vector), with a total of k groups; the second matrix is ​​represented as Γ, and the third transformation results of each group are arranged in the column direction to obtain the second matrix Γ, then And the second matrix Γ is a k×r matrix, which can be determined from the previous text and has the same dimension as the private matrix of the second party.

[0072] In some embodiments, the fourth transformation result E of each group i The sum can be expressed as ∑ i E i , the second slice of the product matrix is ​​represented by E, then E = ∑ i E i The first slice E of the product matrix and the second transformation result E i Same dimension, m×r matrix.

[0073] In some embodiments, the second matrix Γ and the first slice E of the product matrix are held by the second party, and can assist the two parties in completing the secure matrix multiplication of the private matrices.

[0074] From the above example, we have αβ T =A0+A1, for each set of changing data, we have: B i αβ T C i =B i A0C i +B i A1C i , so we can get: That is, ΔΓ=D+E, the product of the first matrix and the second matrix is ​​equal to the product matrix (the sum of two sum slices), which proves the correctness of the method.

[0075] Figure 4 is an exemplary flow chart of multi-party security matrix multiplication according to some embodiments of the present specification.

[0076] Some embodiments of the present disclosure provide a multi-party secure matrix multiplication method involving two parties, wherein the first party holds a first private matrix and the second party holds a second private matrix, and the method is executed to obtain a slice of the product of the two private matrices (private product matrix) without leaking any private data. In some embodiments, the method can be performed collaboratively by the first party and the second party. For simplicity, the following is described with the process 400 performed by the first party as the main line, including:

[0077] Step 410: Obtain a first matrix and a first slice of a product matrix.

[0078] For ease of description, some of the symbols in the previous text are used here. In some embodiments, the first matrix Δ and the first slice D of the product matrix can be obtained through process 200.

[0079] In some embodiments, the product of the first matrix and the second matrix is ​​equal to the product matrix; the second matrix and the second slice of the product matrix are held by the second party. In some embodiments, the second matrix Γ and the second slice E of the product matrix can be obtained by the second party through process 300.

[0080] Step 420, calculate the difference between the first private matrix and the first matrix to obtain a first difference matrix, and send it to the second party.

[0081] In some embodiments, the first private matrix is ​​represented as x, and the first difference matrix is ​​represented as f, then the first difference matrix f=x-Δ.

[0082] Step 430: Receive a second difference matrix from the second party; the second difference matrix is ​​equal to the difference between the second private matrix held by the second party and the second matrix.

[0083] In some embodiments, the second private matrix is ​​represented as y, and the second difference matrix is ​​represented as g, then the second difference matrix g=y-Γ.

[0084] Step 440: Obtain a first slice of the privacy product matrix based on the first matrix, the second difference matrix, and the first slice of the product matrix.

[0085] In some embodiments, the privacy product matrix is ​​equal to the product of the first private matrix x and the second private matrix y, and is stored in the first party and the second party in the form of sum slices. The first slice of the privacy product matrix is ​​represented as z0, then the first slice of the privacy product matrix z0 = Δg + D.

[0086] Correspondingly, the second party obtains the second slice of the private product matrix based on the first difference matrix, the second private matrix and the second slice of the product matrix. The second slice of the private product matrix is ​​represented as z1, and the second slice of the private product matrix held by the second party is z1=fy+E.

[0087] From ΔΓ=D+E, it can be proved that z0+z1=Δg+fy+ΔΓ. Substituting the formulas of step 420 and step 430 into the above formula, we can get z0+z1=Δy-ΔΓ+xy-Δy+ΔΓ. After removing the same terms, we can get z0+z1=xy. The correctness of the multi-party security matrix multiplication can be proved. In addition, this method can protect the privacy data of all parties while obtaining the result.

[0088] It should be noted that the above descriptions of process 200, process 300 and process 400 are only for example and illustration, and do not limit the scope of application of this specification. For those skilled in the art, various modifications and changes can be made to the process under the guidance of this specification. However, these modifications and changes are still within the scope of this specification.

[0089] Figure 5 It is an exemplary module diagram of a triple generation system for multi-party secure computation according to some embodiments of the present specification.

[0090] like Figure 5 As shown, the triple generation system 500 for multi-party secure computation may include a first acquisition module 510 and a first transformation module 520. The multi-party secure computation involves two parties, each of which holds a private matrix. The triple can assist the two parties in completing the secure matrix multiplication of the private matrix, which includes a first matrix, a second matrix, a first slice of the product matrix, and a second slice of the product matrix. The product of the first matrix and the second matrix is ​​equal to the product matrix.

[0091] The first acquisition module 510 is used to acquire a first basis vector and a first slice of a basis matrix, wherein the product of the first basis vector and the second basis vector is equal to the basis matrix, and the second basis vector and the second slice of the basis matrix are held by the second party.

[0092] In some embodiments, more details about the first basic vector and the basic matrix can be found in the description of step 210 and will not be repeated here.

[0093] The first transformation module 520 is used to perform dimension transformation on the first basic vector and the first slice of the basic matrix respectively based on the transformation data shared by both parties, so as to obtain the first matrix in the triplet and the first slice of the product matrix.

[0094] In some embodiments, more details about the first matrix and the product matrix in the triplet can be found in the description of step 220 and will not be repeated here.

[0095] It should be noted that the above description of the triple generation system 500 and its modules for multi-party secure computing is only for the convenience of description and cannot limit the present specification to the scope of the embodiments. It is understandable that for those skilled in the art, after understanding the principle of the system, it is possible to arbitrarily combine the modules or form a subsystem to connect with other modules without deviating from this principle. For example, in some embodiments, Figure 5The first acquisition module 510 and the first transformation module 520 disclosed in the specification can be different modules in a system, or one module can realize the functions of two or more modules. For example, each module can share a storage module, or each module can have its own storage module. Such variations are within the protection scope of this specification.

[0096] The beneficial effects that may be brought about by the embodiments of this specification include but are not limited to: (1) the computational efficiency of multi-party secure matrix multiplication is effectively improved through the triple generation method of multi-party secure computing; (2) during the triple generation process, the amount of communication data is effectively reduced by transmitting sparse basis vectors or matrix slices.

[0097] It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may be produced may be any one or a combination of the above, or any other beneficial effects that may be obtained.

[0098] The basic concepts have been described above. Obviously, for those skilled in the art, the above detailed disclosure is only for example and does not constitute a limitation of this specification. Although not explicitly stated here, those skilled in the art may make various modifications, improvements and corrections to this specification. Such modifications, improvements and corrections are suggested in this specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of this specification.

[0099] At the same time, this specification uses specific words to describe the embodiments of this specification. For example, "one embodiment", "an embodiment", and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of this specification. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different positions in this specification does not necessarily refer to the same embodiment. In addition, certain features, structures or characteristics in one or more embodiments of this specification can be appropriately combined.

[0100] In addition, unless explicitly stated in the claims, the order of the processing elements and sequences described in this specification, the use of alphanumeric characters, or the use of other names are not intended to limit the order of the processes and methods of this specification. Although the above disclosure discusses some invention embodiments that are currently considered useful through various examples, it should be understood that such details are only for illustrative purposes, and the attached claims are not limited to the disclosed embodiments. On the contrary, the claims are intended to cover all modifications and equivalent combinations that are consistent with the essence and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented only by software solutions, such as installing the described system on an existing server or mobile device.

[0101] Similarly, it should be noted that in order to simplify the description disclosed in this specification and thus help understand one or more embodiments of the invention, in the above description of the embodiments of this specification, multiple features are sometimes combined into one embodiment, figure or description thereof. However, this disclosure method does not mean that the features required by the subject matter of this specification are more than the features mentioned in the claims. In fact, the features of the embodiments are less than all the features of the single embodiment disclosed above.

[0102] In some embodiments, numbers describing the number of components and attributes are used. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "about", "approximately" or "substantially" in some examples. Unless otherwise specified, "about", "approximately" or "substantially" indicate that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may change according to the required features of individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of this specification are approximate values, in specific embodiments, the setting of such numerical values ​​is as accurate as possible within the feasible range.

[0103] Each patent, patent application, patent application publication, and other materials, such as articles, books, specifications, publications, documents, etc., cited in this specification are hereby incorporated by reference in their entirety. Except for application history documents that are inconsistent with or conflicting with the contents of this specification, documents that limit the broadest scope of the claims of this specification (currently or later attached to this specification) are also excluded. It should be noted that if the descriptions, definitions, and / or use of terms in the materials attached to this specification are inconsistent or conflicting with the contents described in this specification, the descriptions, definitions, and / or use of terms in this specification shall prevail.

[0104] Finally, it should be understood that the embodiments described in this specification are only used to illustrate the principles of the embodiments of this specification. Other variations may also fall within the scope of this specification. Therefore, as an example and not a limitation, alternative configurations of the embodiments of this specification may be considered consistent with the teachings of this specification. Accordingly, the embodiments of this specification are not limited to the embodiments explicitly introduced and described in this specification.

Claims

1. A method for generating a triplet for multi-party secure computation, involving two parties, each of which holds a private matrix, wherein the triplet can assist the two parties in completing secure matrix multiplication of the private matrix, and comprises a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, wherein the product of the first matrix and the second matrix is ​​equal to the product matrix; The method is performed by a first party and includes: Obtaining a first basis vector and a first slice of a basis matrix, wherein the product of the first basis vector and the second basis vector is equal to the basis matrix, and the second basis vector and the second slice of the basis matrix are held by the second party; Based on the transformation data shared by both parties, the first basic vector and the first slice of the basic matrix are respectively transformed in dimension to obtain the first matrix in the triplet and the first slice of the product matrix.

2. The method of claim 1, wherein: The first matrix has the same dimension as the private matrix held by the first party, and the first slice of the product matrix has the same dimension as the product result of the private matrices held by the two parties.

3. The method of claim 1, wherein: The obtaining of the first basic vector and the first slice of the basic matrix comprises: The first basis vector and the first slice of the basis matrix are obtained from a third party, and the first basis vector is a sparse vector.

4. The method according to claim 3, wherein the first basis vector and the second basis vector are randomly generated by the third party, and the basis matrix is ​​obtained by the third party calculating the product of the first basis vector and the second basis vector; The obtaining the first basic vector and the first slice of the basic matrix from a third party includes: Obtaining the first basis vector from a third party; Cooperating with the third party, obtaining a first slice of the basic matrix through a functional secret sharing algorithm.

5. The method of claim 1, wherein: The obtaining of the first basic vector and the first slice of the basic matrix comprises: generating a first basis vector by a first random number seed, and generating a first slice of a basis matrix by a second random number seed; or, A first basis vector is generated by using a first random number seed, and a first slice of a basis matrix is ​​obtained from a third party.

6. The method of claim 1, wherein: The transformation data includes one or more sets of transformation matrices; wherein, The number of groups of the transformation matrix is ​​the same as the number of columns of the private matrix held by the first party or the number of rows of the private matrix held by the second party; Moreover, each group of transformation matrices includes a first transformation matrix and a second transformation matrix; the number of rows of the first transformation matrix is ​​the same as the number of rows of the private matrix held by the first party, the number of columns of the first transformation matrix is ​​the same as the dimension of the first basis vector, the number of rows of the second transformation matrix is ​​the same as the dimension of the second basis vector, and the number of columns of the second transformation matrix is ​​the same as the number of columns of the private matrix held by the second party.

7. The method of claim 6, wherein: The step of performing dimension transformation on the first basis vector and the first slice of the basis matrix respectively based on the transformation data shared by both parties to obtain the first matrix in the triplet and the first slice of the product matrix includes, for each set of transformation matrices: Calculate the product of the first transformation matrix and the first basis vector to obtain a first transformation result; Calculate the product of the first transformation matrix, the first slice of the base matrix, and the second transformation matrix to obtain a second transformation result; Obtaining the first matrix based on the first transformation results of each group; And the sum of the second transformation results of each group is calculated to obtain the first slice of the product matrix.

8. A triplet generation system for multi-party secure computation, wherein the multi-party secure computation involves two parties, the two parties respectively hold private matrices, the triplet can assist the two parties in completing secure matrix multiplication of the private matrices, and the triplet includes a first matrix, a second matrix, a first slice of a product matrix, and a second slice of the product matrix, and the product of the first matrix and the second matrix is ​​equal to the product matrix; The system is deployed on the first party and includes: A first acquisition module acquires a first basis vector and a first slice of a basis matrix, wherein a product of the first basis vector and a second basis vector is equal to the basis matrix, and the second basis vector and a second slice of the basis matrix are held by a second party; The first transformation module performs dimension transformation on the first basic vector and the first slice of the basic matrix based on the transformation data shared by both parties, so as to obtain the first matrix in the triplet and the first slice of the product matrix.

9. A triplet generation device for multi-party secure computing, comprising a processor, characterized in that: The processor is configured to execute the method according to any one of claims 1 to 7.

10. An interactive method for multi-party secure matrix multiplication, involving two parties, performed by a first party, comprising: Obtaining a first matrix and a first slice of a product matrix, wherein the product of the first matrix and the second matrix is ​​equal to the product matrix, and the second matrix and a second slice of the product matrix are held by the second party; Calculate the difference between the first private matrix and the first matrix to obtain a first difference matrix, and send the first difference matrix to the second party; receiving a second difference matrix from the second party; the second difference matrix being equal to the difference between the second private matrix held by the second party and the second matrix; A first slice of a privacy product matrix is ​​obtained based on the first matrix, the second difference matrix, and the first slice of the product matrix; wherein the privacy product matrix is ​​equal to the product of the first private matrix and the second private matrix.

11. The method of claim 10, wherein: The first matrix and the first slice of the product matrix are obtained by the method according to any one of claims 1 to 7.

12. An interactive method for multi-party secure matrix multiplication, involving two parties, performed by the second party, comprising: Obtaining a second matrix and a second slice of a product matrix, wherein the product of the first matrix and the second matrix is ​​equal to the product matrix, and the first matrix and the first slice of the product matrix are held by the second party; Calculate the difference between the second private matrix and the second matrix to obtain a second difference matrix, and send it to the first party; receiving a first difference matrix from the first party; the first difference matrix being equal to a difference between a first private matrix held by the first party and the first matrix; A second slice of the privacy product matrix is ​​obtained based on the first difference matrix, the second private matrix, and the second slice of the product matrix; wherein the privacy product matrix is ​​equal to the product of the first private matrix and the second private matrix.

13. The method of claim 12, wherein: The second matrix and the second slice of the product matrix are obtained by the method according to any one of claims 1 to 7.

Images