Security processing method and device for privacy vector

Abstract

The embodiments of this specification provide a method and device for secure processing of privacy vectors, which are implemented by multi-party secure computing. The method includes: obtaining the own slice of the privacy vector in the modulo 2 space; accumulating the bits of the own slice to obtain a first summation result; determining the first sign bit according to the corresponding index of the own side; determining the first slice of the first scalar according to the first summation result and the first sign bit; locally calculating the inner product of the own slice and the plaintext vector to obtain a second summation result; determining the first slice of the second scalar according to the second summation result and the first sign bit; performing a secure multiplication operation on the first slice of the first scalar, the first slice of the second scalar, the second slice of the first scalar and the second slice of the second scalar provided by the other party, and obtaining the first slice of the vector inner product result, which corresponds to the product of the first scalar and the second scalar. It is possible to reduce the amount of communication in the secure processing of privacy vectors.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the computer field, and more particularly, to a method and apparatus for securely processing privacy vectors. Background Art

[0002] Many current scenarios involve determining the vector inner product result of a privacy vector and a plaintext vector. The privacy vector is a one-hot encoded vector, which is distributed between two parties in the form of a sum and sharing. Either party knows the plaintext vector. A one-hot encoded vector is a vector in which one dimension element takes the value of 1 and all other dimensions take the value of 0. If the k-th dimension element of the one-hot encoded vector takes the value of 1 and the plaintext vector is T, then the above vector inner product result h = T[k], that is, the k-th dimension element value of T. In the calculation of determining the vector inner product result, since the privacy vector needs to be protected, that is, the value of k cannot be leaked, secure multi-party computing is required to implement it.

[0003] In the prior art, in the process of determining the above vector inner product result, the communication volume is very large.

[0004] Therefore, it is hoped that there will be an improved solution that can reduce the amount of communication in the secure processing of privacy vectors. Summary of the invention

[0005] One or more embodiments of the present specification describe a method and apparatus for secure processing of privacy vectors, which can reduce communication traffic in secure processing of privacy vectors.

[0006] In a first aspect, a security processing method for a privacy vector is provided, wherein the privacy vector is a one-hot encoded vector, which is distributed to a first party and a second party in a shared form, and the method is used to obtain a vector inner product result of the privacy vector and a plaintext vector, and is executed by either party, including:

[0007] Obtaining the local slice of the privacy vector in the modulo 2 space;

[0008] Accumulate each bit of the local fragment to obtain a first sum result;

[0009] Determine the first sign bit for identifying a positive or negative number according to the corresponding index of the party;

[0010] Determine a first slice of a first scalar according to the first summation result and the first sign bit;

[0011] Locally calculating the inner product of the local fragment and the plaintext vector to obtain a second summation result;

[0012] determining a first slice of a second scalar according to the second summation result and the first sign bit;

[0013] A secure multiplication operation is performed jointly on the first slice of the first scalar and the first slice of the second scalar owned by the party, and the second slice of the first scalar and the second slice of the second scalar provided by the other party to obtain a first slice of a vector inner product result, where the vector inner product result corresponds to the product of the first scalar and the second scalar.

[0014] In a possible implementation manner, obtaining the local slice of the privacy vector in the modulo 2 space includes:

[0015] Through the local secure module conversion operation, the slice of the module q1 space of the privacy vector held by the party is converted into the slice of the module 2 space of the party.

[0016] In a possible implementation manner, determining the first sign bit for identifying a positive number or a negative number according to the index corresponding to the party includes:

[0017] If the index corresponding to the party is an even number, the first sign bit is determined to be 1;

[0018] If the index corresponding to the party is an odd number, the first sign bit is determined to be -1.

[0019] In a possible implementation manner, determining a first slice of a first scalar according to the first summation result and the first sign bit includes:

[0020] After adding the first sign bit to the first summation result, modulo the first constant is taken to obtain a first slice of the first scalar.

[0021] Furthermore, the selection of the first constant needs to make the following conditions hold:

[0022] The sum of the least significant bit of the first slice of the first scalar and the least significant bit of the second slice of the first scalar is 1, and there is no carry;

[0023] When the first scalar is 1 or -1, the value of the second lowest bit of the first scalar is different.

[0024] Furthermore, the first constant is a power of 2 and is not less than 4.

[0025] In a possible implementation manner, determining a first slice of a second scalar according to the second summation result and the first sign bit includes:

[0026] After adding the first sign bit to the second summation result, a first slice of a second scalar is obtained.

[0027] In a possible implementation, the secure multiplication operation includes:

[0028] The first shard of the first random number, the first shard of the second random number, and the first shard of the random multiplication result are obtained from the third party; the second shard of the first random number, the second shard of the second random number, and the second shard of the random multiplication result are obtained by the other party; wherein the random multiplication result is the product of the first random number and the second random number;

[0029] Locally calculating the difference between the first slice of the first scalar and the first slice of the first random number to obtain the first slice of the first difference;

[0030] Locally calculating the difference between the first slice of the second scalar and the first slice of the second random number to obtain the first slice of the second difference;

[0031] receiving from the other party a second slice of the first difference and a second slice of the second difference; the second slice of the first difference is a difference between the second slice of the first scalar and the second slice of the first random number; the second slice of the second difference is a difference between the second slice of the second scalar and the second slice of the second random number;

[0032] Summing the first slice of the first difference and the second slice of the first difference to obtain the first difference; summing the first slice of the second difference and the second slice of the second difference to obtain the second difference;

[0033] According to local calculation among the first difference, the second difference, the first slice of the first random number, the first slice of the second random number, and the first slice of the random multiplication result, a first slice of the product of the first scalar and the second scalar is obtained; the other party obtains a second slice of the product.

[0034] In a second aspect, a security processing device for a privacy vector is provided, wherein the privacy vector is a one-hot encoded vector, which is distributed to a first party and a second party in a shared form, and the device is used to obtain a vector inner product result of the privacy vector and a plaintext vector, and is set on any one party, including:

[0035] An acquisition unit, used for acquiring a local slice of the privacy vector in the modulo 2 space;

[0036] An accumulation calculation unit, used for accumulating each bit of the local slice acquired by the acquisition unit to obtain a first sum result;

[0037] A sign determination unit, used to determine a first sign bit for identifying a positive number or a negative number according to the corresponding index of the party;

[0038] A first scalar determination unit, configured to determine a first slice of a first scalar according to a first summation result obtained by the accumulation calculation unit and a first sign bit obtained by the sign determination unit;

[0039] An inner product calculation unit, used to locally calculate the inner product of the local fragment and the plaintext vector to obtain a second summation result;

[0040] a second scalar determination unit, configured to determine a first slice of a second scalar according to a second summation result obtained by the inner product calculation unit and the first sign bit;

[0041] A joint operation unit is used to perform a secure multiplication operation on a first slice of the first scalar obtained by the first scalar determination unit of the party, a first slice of the second scalar obtained by the second scalar determination unit, and a second slice of the first scalar and a second slice of the second scalar provided by the other party, so as to obtain a first slice of a vector inner product result, wherein the vector inner product result corresponds to the product of the first scalar and the second scalar.

[0042] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0043] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.

[0044] Through the method and device provided in the embodiments of this specification, first, the own slice of the privacy vector in the modulo 2 space is obtained; then, each bit of the own slice is accumulated to obtain a first sum result; then, according to the corresponding index of the own side, the first sign bit for identifying positive or negative numbers is determined; then, according to the first sum result and the first sign bit, the first slice of the first scalar is determined; then, the inner product of the own slice and the plaintext vector is locally calculated to obtain a second sum result; then, according to the second sum result and the first sign bit, the first slice of the second scalar is determined; finally, a secure multiplication operation is performed jointly based on the first slice of the first scalar and the first slice of the second scalar owned by the own side, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the product of the first scalar and the second scalar. As can be seen from the above, the embodiments of this specification only involve local calculations and secure multiplication operations of scalars. No communication is required in local calculations, and the communication volume of secure multiplication operations of scalars is very small. By converting the secure inner product of two vectors into the secure multiplication of two scalars, the communication volume can be reduced in the secure processing of privacy vectors. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0047] Figure 2 A flow chart of a method for securely processing a privacy vector according to an embodiment is shown;

[0048] Figure 3 A schematic diagram of secure multiplication in a sharded state according to one embodiment is shown;

[0049] Figure 4 A schematic block diagram of a secure processing device for a privacy vector according to an embodiment is shown. DETAILED DESCRIPTION

[0050] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0051] Figure 1 Schematic diagram of an implementation scenario of an embodiment disclosed in this specification. The implementation scenario involves security processing for a privacy vector, where the privacy vector is a one-hot encoded vector that is distributed to a first party and a second party in the form of a sum and sharing, and the method is used to obtain the vector inner product result of the privacy vector and the plaintext vector. Figure 1 As shown, the scenario for secure processing of the privacy vector involves participants A and B, or the first party and the second party, or Party A and Party B. Each participant can be implemented as any device, platform, server or device cluster with computing and processing capabilities. Both parties should jointly determine the vector inner product result of the privacy vector and the plaintext vector while protecting the privacy vector from being leaked, and the vector inner product result is distributed to both parties in the form of sum sharing. Sum sharing is a specific form of secret sharing.

[0052] Secret sharing means that n participants split a secret s and share it. Each share is managed by a different participant. The secret can only be fully restored when the number of participants is not less than m.

[0053] Two-party arithmetic secret sharing refers to a secret information shared by two parties. A single party cannot recover the secret information, and the shares held by both parties are needed to fully recover the secret. Usually the recovery operation is addition on a finite ring. The above secret information can also be called private data. The secret information under two-party arithmetic secret sharing is also called private data in the form of sum and sharing.

[0054] Reference Figure 1 , p represents an n-dimensional one-hot encoding vector, T is a public n-dimensional plaintext vector. Party A holds a slice of p 0, Party B holds another shard of p 1，p＝ 0+ 1. Both A and B know the plaintext vector T. Without exposing the private vector, A and B calculate the inner product of p and T, that is, calculate h =<p,T> , Party A obtains a slice of the vector inner product result <h>0=<<p,T> >0, Party B obtains another slice of the vector inner product result <h>1=<<p,T> >1. p is a vector whose element in one dimension is 1 and whose elements in other dimensions are all 0. Assuming that the element in the k-th dimension of p is 1, the inner product result of the above vector h = T[k], that is, the value of the element in the k-th dimension of T. For example, p = (0, 1, 0), T = (3, 5, 7), then the inner product result of the vector is 5.

[0055] It can be understood that p represents an n-dimensional vector, which is composed of n elements. The slice of p can be regarded as a combination of the slices of each element it contains. For example, P is a 4-dimensional vector (0,1,0,0). From right to left, if the slice of the first element 0 of party A is 1, the slice of the second element 0 of party A is 0, the slice of the third element 1 of party A is 1, and the slice of the fourth element 0 of party A is 1, then party A holds a slice of p.< / h> < / h> 0 can be represented as (1,1,0,1). Accordingly, the first element 0 of party B has a slice of 1, the second element 0 of party B has a slice of 0, the third element 1 of party B has a slice of 0, and the fourth element 0 of party B has a slice of 1. Then party B holds another slice of p. 1 can be represented as (1,0,0,1).

[0056] In the embodiments of this specification, secure multi-party computation is used to implement secure processing of a privacy vector, so as to obtain a vector inner product result of the privacy vector and a plaintext vector.

[0057] Secure multi-party computation is also known as multi-party secure computing, that is, multiple parties jointly calculate the result of a function without disclosing the input data of each party of this function, and the result of the calculation is made public to one or more of the parties.

[0058] The embodiments of this specification propose corresponding solutions to reduce the communication volume in the security processing of privacy vectors.

[0059] One-hot encoded vectors are common in statistics and machine learning, and the above calculation to determine the inner product of vectors can be used in related fields. The above calculation can also be used for table lookup calculation, that is, to find the element T[k] of table T from the input k: first convert the input k into a one-hot encoded vector p with the kth dimension element value 1, and convert the table T into a vector form, and then calculate the vector inner product of p and T. Table lookup calculation can be used to calculate single-input functions with a limited number of input values, such as factorial.

[0060] Figure 2 A flowchart of a method for securely processing a privacy vector according to an embodiment is shown. The method can be based on Figure 1 In the implementation scenario shown, the privacy vector is a one-hot encoded vector, which is distributed to the first party and the second party in the form of a sum and sharing. The method is used to obtain the vector inner product result of the privacy vector and the plaintext vector, which is executed by either party. Figure 2 As shown, the security processing method for the privacy vector in this embodiment includes the following steps: Step 21, obtaining the own slice of the privacy vector in the modulo 2 space; Step 22, accumulating the bits of the own slice to obtain a first summation result; Step 23, determining the first sign bit for identifying a positive number or a negative number according to the corresponding index of the own side; Step 24, determining the first slice of the first scalar according to the first summation result and the first sign bit; Step 25, locally calculating the inner product of the own slice and the plaintext vector to obtain a second summation result; Step 26, determining the first slice of the second scalar according to the second summation result and the first sign bit; Step 27, performing a secure multiplication operation on the first slice of the first scalar and the first slice of the second scalar owned by the own side, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the product of the first scalar and the second scalar. The specific execution method of each of the above steps is described below.

[0061] First, in step 21, the local slice of the privacy vector in the modulo 2 space is obtained. It can be understood that if the privacy vector p is an n-dimensional vector, which is composed of n elements, the slice of p can be regarded as a combination of the slices of each element it contains, and the slice of each element belongs to the modulo 2 space.

[0062] In this embodiment of the specification, any party holds a slice of the privacy vector p j , a slice of the i-th element of the privacy vector p is denoted as<p[i]> j , where j is the index corresponding to the party and i is the index of the element. The indexes corresponding to the two parties are usually two consecutive integers, for example, the index corresponding to the first party is 0 and the index corresponding to the second party is 1; or, the index corresponding to the first party is 1 and the index corresponding to the second party is 2. For example, if the index corresponding to the first party is 0 and the index corresponding to the second party is 1, then the first party holds a fragment of p 0, the second party holds another shard of p 1，p＝ 0+ 1. The index of each element is usually in the order of the elements in the vector from right to left, starting from 0 and increasing by 1. For an n-dimensional vector, the index of each element in the vector ranges from 0 to n-1.

[0063] In one example, obtaining the local slice of the privacy vector in the modulo 2 space includes:

[0064] Through the local secure module conversion operation, the slice of the module q1 space of the privacy vector held by the party is converted into the slice of the module 2 space of the party.

[0065] In this example, if either the first party or the second party holds a slice of the modulo q1 space of the privacy vector, and if q1 is equal to 2, the slice of the privacy vector in the modulo 2 space can be directly obtained; if q1 is not equal to 2, the slice of the modulo q1 space of the privacy vector held by the party can be converted into the slice of the modulo 2 space by the local secure modulo conversion operation. The above secure modulo conversion operation can be performed separately for the slice of the modulo q1 space of each element of the privacy vector. It can be understood that the local secure modulo conversion operation does not need to communicate with the other party. Both parties can each determine the lowest bit of the slice of the modulo q1 space of any element of their privacy vector as the slice of the modulo 2 space of the element of the privacy vector. For example, the slice of the modulo q1 space of an element of the privacy vector is 1001, and its lowest bit is 1, then the slice of the modulo 2 space of the element of the privacy vector is 1.

[0066] Each element of the privacy vector is one bit in the local slice of the modulo-2 space, so the n-dimensional privacy vector is n bits in the local slice of the modulo-2 space.

[0067] Then, in step 22, each bit of the own slice is accumulated to obtain a first summation result. It can be understood that since the own slice is in the modulo 2 space, the above-mentioned accumulation calculation is also performed in the modulo 2 space, and any bit of the own slice has two values, 0 or 1, and the first summation result also has two values, 0 or 1.

[0068] For example, any party holds a shard of the privacy vector p j , a slice of the i-th element of the privacy vector p is denoted as<p[i]> j , where j is the index corresponding to the square, i is the index of the element, the first summation result can be expressed as

[0069] Next, in step 23, the first sign bit for identifying a positive number or a negative number is determined according to the index corresponding to the party. It can be understood that the first party and the second party have different indexes, and their first sign bits are also different.

[0070] In one example, determining the first sign bit for identifying a positive number or a negative number according to the index corresponding to the party includes:

[0071] If the index corresponding to the party is an even number, the first sign bit is determined to be 1;

[0072] If the index corresponding to the party is an odd number, the first sign bit is determined to be -1.

[0073] For example, j is the index corresponding to this side, and the first sign bit can be represented as (-1) j .

[0074] It can be understood that the status of the first party and the second party is equal, so the opposite method of determining the first sign bit can also be adopted. For example, if the index corresponding to the party is an odd number, the first sign bit is determined to be 1; if the index corresponding to the party is an even number, the first sign bit is determined to be -1. For example, j is the index corresponding to the party, and the first sign bit can be expressed as (-1) j+1 .

[0075] Then, in step 24, a first slice of the first scalar is determined according to the first summation result and the first sign bit. It can be understood that the manner of determining the first slice of the first scalar is related to the desired value of the first scalar.

[0076] In one example, determining a first slice of a first scalar according to the first summation result and the first sign bit includes:

[0077] After adding the first sign bit to the first summation result, modulo the first constant is taken to obtain a first slice of the first scalar.

[0078] For example, any party holds a shard of the privacy vector p j , a slice of the i-th element of the privacy vector p is denoted as<p[i]> j , where j is the index corresponding to the square, i is the index of the element, and the first summation result is The first sign bit is (-1) j , the first constant is d, the first scalar is b, then the first slice of the first scalar can be expressed as

[0079] Furthermore, the selection of the first constant needs to make the following conditions hold:

[0080] The sum of the least significant bit of the first slice of the first scalar and the least significant bit of the second slice of the first scalar is 1, and there is no carry;

[0081] When the first scalar is 1 or -1, the value of the second lowest bit of the first scalar is different.

[0082] For example, j is the index corresponding to the party, j = 0 or 1, and the first scalar is b, then the above condition can be expressed as 0[0]+ 1[0]=1 and there will be no carry; when b is 1 and -1, the value of b[1] is different.

[0083] Furthermore, the first constant is a power of 2 and is not less than 4.

[0084] It can be understood that the specific value of the first constant satisfies the above conditions, but the first constant that satisfies the above conditions does not necessarily have to be the specific value.

[0085] Then, in step 25, the inner product of the local slice and the plaintext vector is calculated locally to obtain a second summation result. It can be understood that the value of the second summation result depends not only on the value of each bit of the local slice, but also on the value of each element of the plaintext vector. The value of any bit of the local slice has only two values, 0 and 1, while the value of any element of the plaintext vector is in the moduli space where it is located.

[0086] For example, any party holds a shard of the privacy vector p j , a slice of the i-th element of the privacy vector p is denoted as<p[i]> j , the plaintext vector is represented by T, the i-th element of the plaintext vector T is recorded as T[i], where j is the corresponding index of the party, and i is the index of the element. The second summation result can be expressed as

[0087] Then in step 26, a first slice of the second scalar is determined according to the second summation result and the first sign bit. It can be understood that the manner of determining the first slice of the second scalar is related to the desired value of the second scalar.

[0088] In one example, determining a first slice of a second scalar according to the second summation result and the first sign bit includes:

[0089] After adding the first sign bit to the second summation result, a first slice of a second scalar is obtained.

[0090] For example, any party holds a shard of the privacy vector p j , a slice of the i-th element of the privacy vector p is denoted as<p[i]> j , the plaintext vector is represented by T, the i-th element of the plaintext vector T is recorded as T[i], where j is the corresponding index of the party, i is the index of the element, and the second summation result is The first sign bit is (-1) j , the second scalar is c, then the first slice of the second scalar can be expressed as

[0091] Finally, in step 27, a secure multiplication operation is performed on the first slice of the first scalar and the first slice of the second scalar owned by the party, and the second slice of the first scalar and the second slice of the second scalar provided by the other party to obtain the first slice of the vector inner product result, which corresponds to the product of the first scalar and the second scalar. It can be understood that the vector inner product result of the privacy vector and the plaintext vector can be obtained by calculating the product of the first scalar and the second scalar.

[0092] For example, the privacy vector p is an n-dimensional one-hot encoding vector, the k-th dimension element is 1, and the other dimension elements are all 0. The plaintext vector T is an n-dimensional vector. The vector inner product result of the privacy vector p and the plaintext vector T is recorded as h=<p,T> =T[k], the first scalar is represented by b, the second scalar is represented by c, and it is necessary to verify that h=b×c. A simple proof process is given below.

[0093] Assume the first scalar is sliced Slice of the second scalar Wherein, j = 0 or 1; <x> j represents the sharding state of x in the jth party; <r> j for j The second lowest position, that is j The first digit of <r> 0+ <r>1.

[0094] If p[i] is 0, then the two slices of p[i]<p[i]> 0 and<p[i]> 1 has two possible value combinations,<p[i]> 0 and<p[i]> 1 are all 0, or<p[i]> 0 and<p[i]> 1 is 1, then (-1) 0<p[i]> 0+(-1) 1 <p[i]> 1=0.

[0095] If the kth dimension of p is 1 and the other dimensions are all 0, then b =<p[k]> 0-<p[k]> 1=(-1) r , c=(-1) r ×T[k], where r=1 or 0.

[0096] Obviously, b×c=T[k], that is, h=b×c.

[0097] In addition, the conditions that need to be satisfied for selecting the constant d are described.

[0098] Assuming d is 4, the binary digit of b is 01 or 11, then 0[0]+ 1[0]=1 and will not carry; That is to say, when b is 1 and -1, the value of b[1] is different.

[0099] From the above proof process, we can see that the slicing of the vector inner product result can be obtained through the safe multiplication operation of two scalars.

[0100] In one example, the secure multiplication operation includes:

[0101] The first shard of the first random number, the first shard of the second random number, and the first shard of the random multiplication result are obtained from the third party; the second shard of the first random number, the second shard of the second random number, and the second shard of the random multiplication result are obtained by the other party; wherein the random multiplication result is the product of the first random number and the second random number;

[0102] Locally calculating the difference between the first slice of the first scalar and the first slice of the first random number to obtain the first slice of the first difference;

[0103] Locally calculating the difference between the first slice of the second scalar and the first slice of the second random number to obtain the first slice of the second difference;

[0104] receiving from the other party a second slice of the first difference and a second slice of the second difference; the second slice of the first difference is a difference between the second slice of the first scalar and the second slice of the first random number; the second slice of the second difference is a difference between the second slice of the second scalar and the second slice of the second random number;

[0105] Summing the first slice of the first difference and the second slice of the first difference to obtain the first difference; summing the first slice of the second difference and the second slice of the second difference to obtain the second difference;

[0106] According to local calculation among the first difference, the second difference, the first slice of the first random number, the first slice of the second random number, and the first slice of the random multiplication result, a first slice of the product of the first scalar and the second scalar is obtained; the other party obtains a second slice of the product.

[0107] Figure 3 FIG. 4 is a schematic diagram of secure multiplication in a sharded state according to an embodiment. Figure 3 , the third party sends u0, v0, z0 to the first party, and sends u1, v1, z1 to the second party, where (u0+u1)×(v0+v1)=(z0+z1); the first party locally calculates e0=b0-u0 based on b0, a shard of b held by itself, and u0, a shard of u received from the third party; the first party locally calculates f0=c0-v0 based on c0, a shard of c held by itself, and v0, a shard of v received from the third party; the first party sends e0 and f0 to the second party; the second party calculates f0=c0-v0 based on c0, a shard of v held by itself, and v0, a shard of v received from the third party A shard b1 of b and a shard u1 of u received from a third party, locally calculate e1=b1-u1; the second party locally calculates f1=c1-v1 based on a shard c1 of c it holds and a shard v1 of v received from a third party; the second party sends e1 and f1 to the first party; the first and second parties locally calculate e=bu, f=cv respectively; the first party locally calculates h0=ef+u0f+ev0+z0, and uses h0 as a shard of the multiplication result of bc; the second party locally calculates h1=u1 f+ev1+z1, and uses h1 as a shard of the multiplication result of bc. It can be proved that h0+h1=ef+uf+ev+uv=(e+u)(f+v)=bc.

[0108] It can be understood that u corresponds to the aforementioned first random number, u0 corresponds to the first shard of the aforementioned first random number, v corresponds to the aforementioned second random number, v0 corresponds to the first shard of the aforementioned second random number, z0 corresponds to the first shard of the random multiplication result, u1 corresponds to the second shard of the first random number, v1 corresponds to the second shard of the second random number, z1 corresponds to the second shard of the random multiplication result, b corresponds to the first scalar, and c corresponds to the second scalar.

[0109] In addition, it should be noted that if it is necessary to obtain a slice of the vector inner product result in the modulo q2 space, q2>2, then the result can be modulo converted after the safe multiplication operation, or the slice of the first scalar and the slice of the second scalar can be modulo converted before the safe multiplication operation, so that the result obtained is a slice in the modulo q2 space.

[0110] For example, the slices of b and c are both set to the slices of the modulo q2 space, and h=bc is directly calculated, and the result is the slice in the modulo q2 space.

[0111] Through the method provided in the embodiments of this specification, first, the own slice of the privacy vector in the modulo 2 space is obtained; then, each bit of the own slice is accumulated to obtain a first sum result; then, according to the corresponding index of the own side, the first sign bit for identifying positive or negative numbers is determined; then, according to the first sum result and the first sign bit, the first slice of the first scalar is determined; then, the inner product of the own slice and the plaintext vector is locally calculated to obtain a second sum result; then, according to the second sum result and the first sign bit, the first slice of the second scalar is determined; finally, a secure multiplication operation is performed jointly based on the first slice of the first scalar and the first slice of the second scalar owned by the own side, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the product of the first scalar and the second scalar. As can be seen from the above, the embodiments of this specification only involve local calculations and secure multiplication operations of scalars. No communication is required in local calculations, and the communication volume of secure multiplication operations of scalars is very small. By converting the secure inner product of two vectors into the secure multiplication of two scalars, the communication volume can be reduced in the secure processing of privacy vectors.

[0112] According to another embodiment, a secure processing device for a privacy vector is also provided, wherein the privacy vector is a one-hot encoded vector, which is distributed to the first party and the second party in the form of a sum and a sharing, and the device is used to obtain the vector inner product result of the privacy vector and the plaintext vector, and is set on any one party, and the device is used to execute the present specification Figure 2 The illustrated embodiments provide actions performed by any one of the methods. Figure 4 FIG. 1 is a schematic block diagram of a secure processing device for a privacy vector according to an embodiment. Figure 4 As shown, the device 400 includes:

[0113] An acquisition unit 41 is used to acquire a local slice of the privacy vector in the modulo 2 space;

[0114] An accumulation calculation unit 42 is used to accumulate each bit of the local slice obtained by the obtaining unit 41 to obtain a first summation result;

[0115] A sign determination unit 43, configured to determine a first sign bit for identifying a positive number or a negative number according to the corresponding index of the party;

[0116] A first scalar determination unit 44, configured to determine a first slice of a first scalar according to a first summation result obtained by the accumulation calculation unit 42 and a first sign bit obtained by the sign determination unit;

[0117] An inner product calculation unit 45, configured to locally calculate the inner product of the local fragment and the plaintext vector to obtain a second summation result;

[0118] A second scalar determination unit 46, configured to determine a first slice of a second scalar according to a second summation result obtained by the inner product calculation unit 45 and the first sign bit;

[0119] The joint operation unit 47 is used to perform a secure multiplication operation on the first slice of the first scalar obtained by the first scalar determination unit 44 of the party, the first slice of the second scalar obtained by the second scalar determination unit 46, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, so as to obtain a first slice of a vector inner product result, wherein the vector inner product result corresponds to the product of the first scalar and the second scalar.

[0120] Optionally, as an embodiment, the acquisition unit 41 is specifically configured to convert the slice of the modulo q1 space of the privacy vector held by the party into the slice of the modulo 2 space of the party through a local secure modulo conversion operation.

[0121] Optionally, as an embodiment, the symbol determination unit 43 is specifically used to determine that the first symbol bit is 1 if the index corresponding to the party is an even number; if the index corresponding to the party is an odd number, determine that the first symbol bit is -1.

[0122] Optionally, as an embodiment, the first scalar determination unit 44 is specifically configured to add the first sign bit to the first sum result, and then perform modulo operation on a first constant to obtain a first slice of the first scalar.

[0123] Furthermore, the selection of the first constant needs to make the following conditions hold:

[0124] The sum of the least significant bit of the first slice of the first scalar and the least significant bit of the second slice of the first scalar is 1, and there is no carry;

[0125] When the first scalar is 1 or -1, the value of the second lowest bit of the first scalar is different.

[0126] Furthermore, the first constant is a power of 2 and is not less than 4.

[0127] Optionally, as an embodiment, the second scalar determination unit 46 is specifically configured to add the first sign bit to the second sum result to obtain a first slice of the second scalar.

[0128] Optionally, as an embodiment, the joint operation unit 47 is specifically used to:

[0129] The first shard of the first random number, the first shard of the second random number, and the first shard of the random multiplication result are obtained from the third party; the second shard of the first random number, the second shard of the second random number, and the second shard of the random multiplication result are obtained by the other party; wherein the random multiplication result is the product of the first random number and the second random number;

[0130] Locally calculating the difference between the first slice of the first scalar and the first slice of the first random number to obtain the first slice of the first difference;

[0131] Locally calculating the difference between the first slice of the second scalar and the first slice of the second random number to obtain the first slice of the second difference;

[0132] receiving from the other party a second slice of the first difference and a second slice of the second difference; the second slice of the first difference is a difference between the second slice of the first scalar and the second slice of the first random number; the second slice of the second difference is a difference between the second slice of the second scalar and the second slice of the second random number;

[0133] Summing the first slice of the first difference and the second slice of the first difference to obtain the first difference; summing the first slice of the second difference and the second slice of the second difference to obtain the second difference;

[0134] According to local calculation among the first difference, the second difference, the first slice of the first random number, the first slice of the second random number, and the first slice of the random multiplication result, a first slice of the product of the first scalar and the second scalar is obtained; the other party obtains a second slice of the product.

[0135] Through the device provided by the embodiment of this specification, first, the acquisition unit 41 acquires the own slice of the privacy vector in the modulo 2 space; then the accumulation calculation unit 42 accumulates the bits of the own slice to obtain a first summation result; then the sign determination unit 43 determines the first sign bit for identifying a positive number or a negative number according to the corresponding index of the own side; the first scalar determination unit 44 determines the first slice of the first scalar according to the first summation result and the first sign bit; then the inner product calculation unit 45 locally calculates the inner product of the own slice and the plaintext vector to obtain a second summation result; the second scalar determination unit 46 determines the first slice of the second scalar according to the second summation result and the first sign bit; finally, the joint operation unit 47 performs a secure multiplication operation based on the first slice of the first scalar and the first slice of the second scalar owned by the own side, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the product of the first scalar and the second scalar. As can be seen from the above, the embodiments of this specification only involve local calculations and secure multiplication operations of scalars. No communication is required in local calculations, and the communication volume of secure multiplication operations of scalars is very small. By converting the secure inner product of two vectors into the secure multiplication of two scalars, the communication volume can be reduced in the secure processing of privacy vectors.

[0136] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0137] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described.

[0138] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0139] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention. < / r> < / r> < / r> < / x>

Claims

1. A security processing method for a private vector, wherein the private vector is a one-hot encoded vector, which is distributed to a first party and a second party in the form of a sum and sharing, and the method is used to obtain a vector inner product result of the private vector and a plaintext vector, and is performed by either party, comprising: Obtaining the local slice of the privacy vector in the modulo 2 space; Accumulate each bit of the local fragment to obtain a first sum result; Determine the first sign bit for identifying a positive or negative number according to the corresponding index of the party; Determine a first slice of a first scalar according to the first summation result and the first sign bit; Locally calculating the inner product of the local fragment and the plaintext vector to obtain a second summation result; determining a first slice of a second scalar according to the second summation result and the first sign bit; Performing a secure multiplication operation on the first slice of the first scalar and the first slice of the second scalar owned by the party, and the second slice of the first scalar and the second slice of the second scalar provided by the other party, to obtain a first slice of a vector inner product result, where the vector inner product result corresponds to the product of the first scalar and the second scalar; Wherein, the secure multiplication operation includes: The first shard of the first random number, the first shard of the second random number, and the first shard of the random multiplication result are obtained from the third party; the second shard of the first random number, the second shard of the second random number, and the second shard of the random multiplication result are obtained by the other party; wherein the random multiplication result is the product of the first random number and the second random number; Locally calculating the difference between the first slice of the first scalar and the first slice of the first random number to obtain the first slice of the first difference; Locally calculating the difference between the first slice of the second scalar and the first slice of the second random number to obtain the first slice of the second difference; receiving from the other party a second slice of the first difference and a second slice of the second difference; the second slice of the first difference is a difference between the second slice of the first scalar and the second slice of the first random number; the second slice of the second difference is a difference between the second slice of the second scalar and the second slice of the second random number; Summing the first slice of the first difference and the second slice of the first difference to obtain the first difference; summing the first slice of the second difference and the second slice of the second difference to obtain the second difference; According to local calculation among the first difference, the second difference, the first slice of the first random number, the first slice of the second random number, and the first slice of the random multiplication result, a first slice of the product of the first scalar and the second scalar is obtained; the other party obtains a second slice of the product.

2. The method of claim 1, wherein: The obtaining of the local slice of the privacy vector in the modulo 2 space includes: Through the local secure module conversion operation, the slice of the module q1 space of the privacy vector held by the party is converted into the slice of the module 2 space of the party.

3. The method of claim 1, wherein: The determining, according to the index corresponding to the party, a first sign bit for identifying a positive number or a negative number comprises: If the index corresponding to the party is an even number, the first sign bit is determined to be 1; If the index corresponding to the party is an odd number, the first sign bit is determined to be -1.

4. The method of claim 1, wherein: The determining a first slice of a first scalar according to the first summation result and the first sign bit includes: After adding the first sign bit to the first summation result, modulo the first constant is taken to obtain a first slice of the first scalar.

5. The method of claim 4, wherein: The selection of the first constant needs to make the following conditions hold: The sum of the least significant bit of the first slice of the first scalar and the least significant bit of the second slice of the first scalar is 1, and there is no carry; When the first scalar is 1 or -1, the value of the second lowest bit of the first scalar is different.

6. The method of claim 5, wherein: The first constant is a power of 2 and is not less than 4.

7. The method of claim 1, wherein: The determining a first slice of a second scalar according to the second summation result and the first sign bit includes: After adding the first sign bit to the second summation result, a first slice of a second scalar is obtained.

8. A secure processing device for a privacy vector, wherein the privacy vector is a one-hot encoded vector, which is distributed to a first party and a second party in a shared form, and the device is used to obtain a vector inner product result of the privacy vector and a plaintext vector, and is set on any one party, comprising: An acquisition unit, used for acquiring a local slice of the privacy vector in the modulo 2 space; An accumulation calculation unit, used for accumulating each bit of the local slice acquired by the acquisition unit to obtain a first sum result; A sign determination unit, used to determine a first sign bit for identifying a positive number or a negative number according to the corresponding index of the party; A first scalar determination unit, configured to determine a first slice of a first scalar according to a first summation result obtained by the accumulation calculation unit and a first sign bit obtained by the sign determination unit; An inner product calculation unit, used to locally calculate the inner product of the local fragment and the plaintext vector to obtain a second summation result; a second scalar determination unit, configured to determine a first slice of a second scalar according to a second summation result obtained by the inner product calculation unit and the first sign bit; a joint operation unit, configured to jointly perform a secure multiplication operation on a first slice of the first scalar obtained by the first scalar determination unit of the party, a first slice of the second scalar obtained by the second scalar determination unit, and a second slice of the first scalar and a second slice of the second scalar provided by the other party, to obtain a first slice of a vector inner product result, wherein the vector inner product result corresponds to a product of the first scalar and the second scalar; Wherein, the joint operation unit is specifically used for: The first shard of the first random number, the first shard of the second random number, and the first shard of the random multiplication result are obtained from the third party; the second shard of the first random number, the second shard of the second random number, and the second shard of the random multiplication result are obtained by the other party; wherein the random multiplication result is the product of the first random number and the second random number; Locally calculating the difference between the first slice of the first scalar and the first slice of the first random number to obtain the first slice of the first difference; Locally calculating the difference between the first slice of the second scalar and the first slice of the second random number to obtain the first slice of the second difference; receiving from the other party a second slice of the first difference and a second slice of the second difference; the second slice of the first difference is a difference between the second slice of the first scalar and the second slice of the first random number; the second slice of the second difference is a difference between the second slice of the second scalar and the second slice of the second random number; Summing the first slice of the first difference and the second slice of the first difference to obtain the first difference; summing the first slice of the second difference and the second slice of the second difference to obtain the second difference; According to local calculation among the first difference, the second difference, the first slice of the first random number, the first slice of the second random number, and the first slice of the random multiplication result, a first slice of the product of the first scalar and the second scalar is obtained; the other party obtains a second slice of the product.

9. The device of claim 8, wherein: The acquisition unit is specifically used to convert the slice of the modulo q1 space of the privacy vector held by the party into the slice of the modulo 2 space of the party through a local secure modulo conversion operation.

10. The device of claim 8, wherein: The symbol determination unit is specifically used to determine that the first symbol bit is 1 if the index corresponding to the party is an even number; if the index corresponding to the party is an odd number, determine that the first symbol bit is -1.

11. The device of claim 8, wherein: The first scalar determination unit is specifically configured to add the first sign bit to the first sum result, and then perform modulo operation on a first constant to obtain a first slice of the first scalar.

12. The device of claim 11, wherein: The selection of the first constant needs to make the following conditions hold: The sum of the least significant bit of the first slice of the first scalar and the least significant bit of the second slice of the first scalar is 1, and there is no carry; When the first scalar is 1 or -1, the value of the second lowest bit of the first scalar is different.

13. The device of claim 12, wherein: The first constant is a power of 2 and is not less than 4.

14. The device of claim 8, wherein: The second scalar determination unit is specifically configured to add the first sign bit to the second summation result to obtain a first slice of the second scalar.

15. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

16. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images