A fixed-point number security multiplication calculation method based on vector space secret sharing

Abstract

The present application belongs to the technical field of data security, and particularly relates to a fixed-point number security multiplication calculation method based on vector space secret sharing. The basic steps of the present application are as follows: a participant precalculates a vector triple required for security multiplication in an offline stage; in an online stage, data in the form of vector space secret sharing is taken as input, and security multiplication calculation is performed through interaction; and the result of the security multiplication calculation is subjected to truncation processing. The present application has the advantage that the vector space secret sharing technology supports security multiplication operation, so that it can be better applied to the field of privacy protection machine learning to cope with more complex practical application scenarios.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a fixed-point number security multiplication calculation method based on vector space secret sharing. BACKGROUND

[0002] In the era of big data, almost all activities are driven by data. These data are usually scattered among multiple data controllers and contain a lot of sensitive or private information, which is protected by laws and regulations, such as the General Data Protection Regulation of the European Union, the Network Security Law, the Data Security Law, and the Personal Information Protection Law of China. Therefore, directly collecting, merging and sharing data containing user information will be severely punished by law, thus exacerbating the phenomenon of data silos. In 1982, Mr. Yao Qizhi proposed secure multi-party computation technology [1] to solve the problem of millionaires, that is, two millionaires want to compare who is richer, but neither wants the other to know how much wealth he has. Then, the secure multi-party computation technology is extended to the general definition of securely computing any polynomial computable function. Secure multi-party computation technology can enable a group of mutually distrustful participants to securely compute a predetermined function without relying on a trusted third party, and not to leak original sensitive information except the result. Therefore, this technology can make data usable and invisible, and better utilize the value of data under the premise of compliance. There are many underlying technologies for secure multi-party computation, such as secret sharing, garbled circuit and oblivious transfer.

[0003] Space vector secret sharing [2] is a common secret sharing technology in secure multi-party computation. Let be a set of participants, be an access structure on j , where B i is an authorized subset. Only participants in the authorized set can recover the secret value by cooperating with each other. p is a large prime number, and d is a positive integer greater than or equal to 2, be a vector space on . Suppose there is a function Φ: satisfying the following properties: (1,0,0) can be linearly represented by elements in the set {Φ(P i )|P j ∈B m-1}

[0004]

[0005] Then there is a set of constants c0,c1,…,c j ,m, the number of participants in B i , such that:

[0006]

[0007] Secret distribution phase: the participant holding the secret value x first generates d-1 random numbers, and constructs the vector Then calculate Send to the corresponding participant P i .

[0008] Secret recovery phase: when an authorized subset B j Want to recover the secret value x. From the above secret distribution phase Then

[0009] Summary

[0010] The purpose of the application is to provide a general secure multiplication calculation method for fixed-point numbers based on vector space secret sharing, which can be used for privacy protection machine learning training.

[0011] The fixed-point number secure multiplication calculation method based on vector space secret sharing provided by the application can be used under the premise that data is available and invisible, and for fixed-point numbers x and y, the value after vector space secret sharing is given <x>and <y>, get secure multiply <z>result of <x * y>. In order to keep the representation of the fixed-point number consistent, the result after the secure multiplication needs to be truncated. Since the following equation holds:

[0012] x * y = x * (y + v) - x * v = x * (y + v) - v * (x + u - u)

[0013] = x * (y + v) - v * (x + u) + u * v

[0014] Then:

[0015] <z> ＝ <x>(y + v) <v>(x + u) + <u * v>

[0016] Inspired by the idea of multiplication triplets in additive secret sharing, we assume that the participants have generated vector triplets in the form of vector secret sharing in the offline phase ( , <v> , <h>), after which each participant separately uses , <v>to mask <x> , <y>to perform a secure multiplication. Let k denote the number of bits of a fixed-point number, where the number of fractional bits is f bits. Then after one multiplication of two fixed-point numbers, the number of fractional bits becomes 2f bits. In order to ensure that the representation of the result of the secure multiplication is consistent with its input, the result of the secure multiplication needs to be rounded to k bits <z>The truncation processing is performed to obtain <z'>.

[0017] The specific steps of the application are:

[0018] (I) Participants pre-generate vector triplets required for secure multiplication in the offline stage;

[0019] (II) In the online stage, interactive secure multiplication calculation is performed with data in the form of vector space secret sharing as input;

[0020] (III) The result of the secure multiplication calculation is subjected to truncation processing.

[0021] In step (I), participants pre-generate vector triplets required for secure multiplication in the offline stage. , <v> , <h>), where u, v are random numbers, h = u * v, and the specific process is as follows:

[0022] (1) Generation and <v>: First, each participant P i (i = 1, 2,..., n) generates a random number u i and v i , and shares u i and v i to other participants respectively by using vector space secret sharing technique; after sharing, each participant P i holds n shares of u <u1> i , <u2> i n i and n shares of a value <v1> i , <v2> i ,…, v n > i ; finally each participant P i locally adds these shared values to obtain i ＝ <u1> i + <u2> i +…+<u n > i , <v> i ＝ <v1> i + <v2> i +... + <v n > i i.e. the required and <v>;

[0023] (2) generate <h>: generated from the above and <v>From the process, we know that u = u1 + u2 + ... + u n v = v1 + v2 + ... + v n ,but:

[0024] h = u * v = (u1 + u2 + ... + u) n )*(v1+v2+…+v n )

[0025] = u1*v1 + u1*v2 + ... + u1*v n +…+u n *v1+u n *v2+…+u n *v n

[0026] Each participating party P i (i = 1, 2, ..., n), first calculate h. i =u i *v i +[u i *v j +u j *v i ](j=1,2,....,n;j≠i),

[0027] Among them, u i *v i It can be determined by each participating party P i (i = 1, 2, ..., n) are calculated locally, while u i *v j +u j *v i The addition secret shared value [u i *v j +u j *v i [Requires participation from party P] i and P j (i, j = 1, 2, ..., n; i ≠ j) This is obtained through interactive secure computation, and commonly used techniques include blind transmission. Then, each participating party P... i (i = 1, 2, ..., n) uses the vector space secret sharing technique to share h i Shared with other participants; after sharing, each participant holds n copies of the shared value. <h1> i ，< / h1> <h2> i ..., <h n > i ; finally each participant P i locally adds the n shares to obtain <h> i ＝ <h1> i +< / h1> <h2> i +... + <h n i i.e. the required <h>.

[0028] In step (ii), each participant uses secretly shared data as input during the online phase, utilizing vector triples pre-generated during the offline phase. ， <v> ， <h>) interactive secure multiplication computation; the specific flow is as follows:

[0029] First, each participant P i (i = 1, 2,..., n) local computation <x> i + i with <y> i + <v> i i.e. the three sets of vectors respectively i ， <v> i to mask <x> i ， <y> i ;

[0030] Then, each participant P i sends to each other the <x> i + i ， <y> i + <v> i to the other participants to recover the plaintexts x+u and y+v; since x and y have been masked by the random numbers u and v, no privacy information about the plaintexts x and y is leaked;

[0031] Finally, each participant P i Local computation <z> i ＝ <x> i (y + v) - (x + u) <v> i (x + u) + (y + v) <h> i the shared value of the result of the secure multiplication calculation of x and y. In the process of the secure multiplication calculation, no privacy information is leaked, and at the present stage, each participant only needs 1 round of communication, that is, only needs to communicate when recovering the plaintext x+u and y+v, and the recovery of x+u and y+v can be processed in parallel.

[0032] In step (three), the result obtained by the secure multiplication calculation is truncated; the specific description is as follows:

[0033] In the application, k represents the bit number of the fixed-point number, wherein the decimal place occupies f bits. After one multiplication is completed on two fixed-point numbers, the number of decimal places becomes 2f, and in order to ensure the consistency of the representation of the fixed-point number, the result obtained by the secure multiplication calculation needs to be truncated to k bits. <z>Truncate f bits. According to the principle of vector space secret sharing technology can be known:

[0034] z = c1* <z> 1+c2* <z> 2+…+c n * <z> n ,

[0035] where c1, c2,..., c n are constants, then:

[0036]

[0037]

[0038] Thus, for <z>Security truncation is performed, and the specific procedure is as follows:

[0039] First, each participant needs to pre-generate <r>and <r'>, where r is a random number and r' = r / 2 f ;

[0040] Then, each participant P i (i = 1, 2,..., n) locally computes <z> i - <r> i , and sends to other participants to recover the plaintext z-r. Since r is random, the plaintext z-r does not leak any privacy information about z;

[0041] Finally, one of the participants P i (i∈{1,2,…,n}) locally computes While the other participants P j (j=1,2,…,n;j≠i) only need to set j j <z′> is the result of <z>The result after the security truncation of f bits. No privacy information is leaked in the whole process of security truncation; and only 1 round of communication is required for each participant at the present stage, i.e. only communication is required when the plaintext z-r is recovered. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 The flowchart of the fixed-point number security multiplication calculation method based on the vector space secret sharing. DETAILED DESCRIPTION

[0043] The present application will be described in detail below with reference to the drawings.

[0044] In Figure 1 The left half of n participants P1, P2, …, P n The fixed-point number in the form of vector space secret sharing in the hand of the participant <x>and <y>As input, the multiplication is performed securely. Where a fixed-point number is represented by k bits, f represents the number of bits of the fractional part. During the entire operation, no privacy information is leaked except for the final result.

[0045] (1) The participants pre-generate the vector triplets needed for secure multiplication in the offline phase , <v> , <h>), where u, v are random numbers, h = u * v;

[0046] (2) Each participant will secret share a fixed point number in the form of a vector space secret share <x>and <y>As input, pre-generated vector triples (v, w, c) are utilized , <v> , <h>), with , <v>masking <x>and <y>Then each party interacts with the recovered plaintexts x+u and y+v, and finally locally computes <z> i ＝ <x> i (y + v) - (x + u) <v> i (x + u) + (y + v) <h> i ;

[0047] (3) Since one multiplication is done after <z>The decimal point number will become 2f bits, in order to make the representation of the result of the secure multiplication calculation the same as its input, it is necessary to perform the following operations on the result of the secure multiplication calculation <z>Truncate f bits to get <z'>. Any one participant P i Local computation (i∈{0,1,…,n}) The rest of the participants P j Hold <z'> (j=0,1,…,n;j≠i) j = <r'> j .

[0048] Example: Here take three-party multiplication as an example, assuming x=2.01, y=3.02, public matrix c1=-1 / 2, c2=1 / 2, c3=1 / 2 decimal part is two bits. (Here for the convenience of understanding, take decimal as an example, binary is the same.)

[0049] Input: three participants P1, P2, P3 respectively take the shared value of x, y (as shown in the table below) held as input

[0050]

[0051] Output: the shared value of x*y held by each party <x*y>

[0052] (1) Three participants pre-generate the vector triplets needed for secure multiplication in the offline stage ， <v> ， <h>), where u, v are random numbers, h = u * v.

[0053] (1.1) generating ， <v>Participant P i Generate random numbers u respectively i v i And using vector space secret sharing technology to respectively... i and v i Shared with other participants; each participant P i Each will hold 3 shares of the shared value <u1> i ， <u2> i ， <u3> i and 3 shares of the value <v1> i ， <v2> i ， <v3> i addition i ＝ <u1> i + <u2> i + <u3> i ， <v> i ＝ <v1> i + <v2> i + <v3> i i.e. the required and <v>, the specific values are shown in the following table:

[0054]

[0055] (1.2) generating <h>P1 and P2 cooperate to securely generate [u1*v2+u2*v1], P1 and P3 cooperate to securely generate [u1*v3+u3*v1], P2 and P3 cooperate to securely generate [u2*v3+u3*v2], P1 locally computes h1=u1*v1+[u1*v2+u2*v1]1+[u1*v3+u3*v1]1, P2 locally computes h2=u2*v2+[u1*v2+u2*v1]2+[u2*v3+u3*v2]2, P3 locally computes h3=u3*v3+[u1*v3+u3*v1]3+[u2*v3+u3*v2]3. Then each participant P i (i=1,2,3) shares his / her h i to the other participants by using vector space secret sharing technique; finally each participant P i locally adds the three shares he / she holds to obtain <h> i ＝ <h1> i +< / h1> <h2> i +< / h2> <h3> i i.e. the required <h>Specific values are shown in the following table:

[0056]

[0057]

[0058] (2) Each participant P i with the generated ， <v>masking <x>and <y>then the cleartext x+u and y+v are recovered, and finally the calculation is done locally to obtain <z> i ＝ <x> i (y + v) - (x + u) <v> i (x + u) + (y + v) <h> i The specific values are shown in the following table:

[0059]

[0060] (3) The obtained <z> i The decimal point becomes 4 digits, so the last two digits after the decimal point need to be truncated. First, each party needs to pre-generate <r>and r', where r is a random number and r' is the value of r truncated to keep only the two digits after the decimal point (equivalent to r' = r / 2 in binary) f ) ; then, each participant P i (i = 1, 2, 3) locally computes <z> i - <r> i and the plaintext z - r is recovered. Finally, one of the participants P i (i e {1,2,3}) (here, take P1 as an example) calculates (z - r) / cl and truncates the result to keep the last two digits after the decimal point to obtain (z - r)' and then calculates <z'>1 = (z - r)' + <r'>1, while the other participants P j (j = 2,3; j ≠ i) only need to set <z'>j = <r'>j j = <r'> j and so on. The specific values are shown in the following table:

[0061]

[0062] References

[0063] [1] A. C. Yao, "Protocols for secure computations," 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982), 1982, pp. 160-164.

[0064] [2] Brickell E F. Some ideal secret sharing schemes [C] / / Workshop on the Theory and Application of of Cryptographic Techniques. Springer, Berlin, Heidelberg, 1989: 468-475.< / r> < / z> < / r> < / z> < / h> < / v> < / x> < / z> < / y> < / x> < / v> < / h> < / h3> < / h> < / h> < / v> < / v2> < / v1> < / v> < / u3> < / u2> < / u1> < / v2> < / v1> < / u2> < / u1> < / v> < / h> < / v> < / z> < / z> < / h> < / v> < / x> < / z> < / y> < / x> < / v> < / h> < / v> < / y> < / x> < / h> < / v> < / y> < / x> < / z> ​< / r> < / z> < / r> < / z> < / z> < / z> < / z> < / z> < / h> < / v> < / x> < / z> < / v> < / y> < / x> < / y> < / x> < / v> < / v> < / y> < / x> < / h> < / v> < / h> ​< / h2> < / h> < / h2> < / v> < / h> < / v> < / v1> < / v> < / u2> < / u1> < / v1> ​​ < / u1> < / v> < / h> < / v> < / z> < / y> < / x> < / v> < / h> < / v> < / v> < / x> < / z> < / z> < / y> < / x>

Claims

1. A method for secure fixed-point multiplication based on secret sharing of vector space, characterized in that, Under the premise that data is available but not visible, for fixed-point numbers x and y, the value after secret sharing in a given vector space. <x>and <y>, get secure multiply <z>=<x*y> The result; to maintain consistency in the representation of fixed-point numbers, the result after safe multiplication is truncated; because the following equation holds:< / z> < / y> < / x> x*y=x*(y+v)-x*v=x*(y+v)-v*(x+uu) = x*(y+v)-vx(x+u)+u*v but: <z> ＝ <x>(y + v) <v> *(x+u)+<u*v>< / v> < / x> < / z> Suppose that the participants have already generated vector triples in the form of a secret sharing of vector space during the offline phase. , <v> , <h>), and then each participant used , <v>To cover up <x> , <y>to perform a secure multiplication; k represents the number of bits of a fixed-point number, wherein the number of decimal places is f bits; after one multiplication of two fixed-point numbers is completed, the number of decimal places becomes 2f bits; to ensure that the representation of the result of the secure multiplication calculation is consistent with the input, the result of the secure multiplication calculation is rounded to k bits <z> Perform truncation to obtain<z′> ;< / z> < / y> < / x> < / v> < / h> < / v> The specific steps are as follows: (i) The participants pre-generate the vector triples required for secure multiplication during the offline phase; (ii) In the online phase, data in the form of secret sharing in vector space is used as input to perform secure multiplication calculations interactively; (iii) Truncate the result obtained from safe multiplication; In step (i), the participating parties pre-generate the vector triples required for secure multiplication during the offline phase. , <v> , <h> ), where u and v are random numbers, h = u * v, and the specific process is as follows:< / h> < / v> (1) Generation and <v>First, each participant P i Generate random number u i and v i P i In the array, i = 1, 2, ..., n, and using the vector space secret sharing technique, u is respectively... i and v i Share with other participants;< / v> After sharing, each participating party P i Each holds n copies of the shared value <u1> i , <u2> i ,…, n > i and n shared values <v1> i , <v2> i ,…, <v n > i Finally, each participant P i Locally, these shared values ​​are added together to obtain i ＝ <u1> i + <u2> i +…+<u n > i , <v> i ＝ <v1> i + <v2> i +…+ <v n > i That is, the vector triplet required and <v> ；< / v> < / v1> < / v> < / u2> < / u1> < / v1> ​ < / u1> (2) Generation <h>: generated from the above and <v>The process of u = u1+ u2+... + u n v = v1+ v2+... + v n then:< / v> < / h> h = u * v = (u1+ u2+... + u n )*(v1+ v2+... + v n ) = u1*v1+ u1*v2+... + u1*v n +... + u n *v1+ u n *v2+... + u n *v n Each participant P i where i = 1, 2,..., n, first calculates h i = u i *v i + u i *v j + u j *v i ], j = 1, 2,..., n; j ≠ i, where u i *v i are calculated locally by each participant P i , while the addition secret sharing values of u i *v j + u j *v i are calculated by the dealer [u i *v j +u j *v i By participant P i and P j The interactive security calculation yields the result, where i,j=1,2,…,n; i≠j; subsequently, each participating party P i Using vector space secret sharing technology to h i Shared with other participants; after sharing, each participant holds n copies of the shared value. <h1> i ,< / h1> <h2> i ,…, <h n > i Finally, each participant P i The local machine adds up these n shared values ​​to obtain <h> i ＝ <h1> i +< / h1> <h2> i +…+ <h n > i That is, the vector triplet required <h> ；< / h> < / h2> < / h> < / h2> In step (ii), each participant uses secretly shared data as input during the online phase, utilizing vector triples pre-generated during the offline phase. , <v> , <h> Interactive safe multiplication calculations are performed; the specific process is as follows:< / h> < / v> First, each participating party P i (i = 1, 2, ..., n) Local computation <x> i + i and <y> i + <v> i That is, using the three groups of vectors respectively i , <v> i To cover up <x> i , <y> i ；< / y> < / x> < / v> < / v> < / y> < / x> Then, each participating party P i Send each other the data they hold. <x> i + i , <y> i + <v> i to the other parties to recover the plaintext x+u and y+v;< / v> < / y> < / x> Finally, each participating party P i Local computing <z> i ＝ <x> i *(y+v)- <v> i *(x+u)+ <h> i i.e. the shared value of the secure multiplication result of x and y.< / h> < / v> < / x> < / z> 2. The fixed-point safe multiplication calculation method according to claim 1, characterized in that, Step (iii) involves truncating the result of the secure multiplication calculation; based on the principle of vector space secret sharing technology: z=c1* <z> 1+c2* <z> 2+…+c n * <z> n ，< / z> < / z> < / z> where c1, c2,..., c n are constants, then: Therefore, to <z> The specific procedure for performing a safe cutoff is as follows:< / z> First, each participating party needs to pre-generate <r>and <r'>, where r is a random number and r' = r / 2 f ;< / r> Then, each participating party P i Local computing <z> i - <r> i , and sends z-r to other participants to recover the plaintext.< / r> < / z> Finally, one of the participants, P i Local calculation The other participating party P j Just set<z′> j =<r′> j Where j = 1, 2, ..., n; j ≠ i;<z′> That is to <z> The result after safely truncating f bits.< / z>

Images