Method and apparatus for constructing a secure tree model based on secret sharing and homomorphic encryption

Abstract

The embodiment of the application discloses a method for constructing a secure tree model based on secret sharing and homomorphic encryption, which comprises the following steps: in response to a received model construction instruction, obtaining a predicted value obtained by predicting feature data of all participants by using an initial secure tree model and a label value of a first participant sample; calculating gradient information of the label value and the predicted value, and sending encrypted gradient information obtained by homomorphic encryption of the gradient information to a second participant; receiving a ciphertext fragment sent by the second participant according to the encrypted gradient information; updating a split index of the initial secure tree model based on the label value, the predicted value and the ciphertext fragment; and recursively building a tree for the initial secure tree by using the updated split index to obtain a target secure tree model. The method realizes the balance between the construction efficiency and the security of the secure tree model based on secret sharing and homomorphic encryption.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to a method and apparatus for constructing a security tree model based on secret sharing and homomorphic encryption. Background Technology

[0002] Privacy-preserving computation technology aims to achieve data usability without visibility by collaborating multiple parties without disclosing sensitive information of the participants, thereby maximizing the value of data while satisfying data privacy protection. Research and application in the field of privacy-preserving computation has gradually become a research focus in academia and industry, with federated learning being the most important implementation direction of privacy-preserving computation.

[0003] Cross-feature federated secure tree algorithms are an important foundational algorithm in federated learning. They can combine features from multiple parties to construct a secure tree model without revealing the label owner or the features of each party. However, current secure tree models mainly ensure that participating parties do not disclose their own information by introducing homomorphic encryption. But during the secure tree construction process, there is still a possibility of intermediate information leakage during the overall data transmission, which makes homomorphic encryption secure tree construction a certain security risk.

[0004] Furthermore, storing and processing information such as labels and features in fragmented form through secret sharing is also a major construction method for federated security trees. However, secret sharing-based computation comes at the cost of frequent communication among multiple parties, and the communication and computation costs gradually increase with the amount of data, resulting in inefficient training of security tree models. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a method for constructing a secure tree model based on secret sharing and homomorphic encryption.

[0006] This application discloses a method for constructing a secure tree model based on secret sharing and homomorphic encryption, applied to a first participating party. The method includes:

[0007] In response to the received model building instruction, the predicted value obtained by using the initial safety tree model to predict the feature data of all participants and the label value of the first participant sample are obtained.

[0008] Calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant;

[0009] Receive ciphertext fragments sent by the second participant according to the encryption gradient information; wherein, the ciphertext fragments are obtained by the second participant calculating the corresponding encryption bin gradient accumulation information according to the characteristics of the second participant and the encryption gradient information, and converting the encryption bin gradient accumulation information from the homomorphic encryption state to the secret sharing state;

[0010] The split index of the initial secure tree model is updated based on the label value, the predicted value, and the ciphertext fragment;

[0011] The initial security tree is recursively constructed using the updated split index to obtain the target security tree model.

[0012] Optionally, updating the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment includes:

[0013] The ciphertext fragment is homomorphically decrypted to obtain the decrypted fragment;

[0014] Based on the decrypted fragments and the first bin gradient accumulation, the total bin gradient accumulation of each participating device is obtained;

[0015] The split index of the initial safe tree model is updated based on the total and sub-bin gradient accumulation.

[0016] Optionally, updating the split index of the initial safe tree model based on the total bin gradient accumulation includes:

[0017] Based on the cumulative gradient of the total and sub-bins, the splitting gain, the optimal splitting method, and the corresponding features are found.

[0018] Based on the splitting gain, the optimal splitting method, and the corresponding features, the nodes are split to obtain the first splitting index, and the first splitting index is secretly shared with the second participant.

[0019] Receive the second split index sent by the second participant;

[0020] The split index of the initial security tree model is updated using the histogram difference algorithm, based on the first split index and the second split index.

[0021] Optionally, updating the split index of the initial security tree model using the histogram difference algorithm based on the first split index and the second split index includes:

[0022] Obtain the optimal split index of the optimal participant from the first split index and the second split index;

[0023] Based on the optimal split index, obtain the first bin gradient accumulation with the minimum split gain of the current split node;

[0024] Based on the first bin gradient accumulation and the current gradient accumulation of the current split node, calculate the second bin gradient accumulation with the largest split gain of the current split node;

[0025] The split index is updated based on the second bin gradient accumulation and the first bin gradient accumulation.

[0026] Optionally, the step of recursively building the initial security tree using the updated split index to obtain the target security tree model includes:

[0027] The initial security tree model is recursively constructed based on the updated split index. When the depth of the initial security tree model reaches the target depth, the tree construction is completed, and the target security tree model is obtained.

[0028] Optionally, before obtaining the predicted values ​​obtained by predicting all participant feature data using the initial safety tree model and the label values ​​of the first participant sample in response to the received model building instruction, the method further includes:

[0029] Generate a public key and a private key for homomorphic encryption, and send the public key to the second participant, wherein the private key is used to decrypt the encryption gradient information;

[0030] The step of sending the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant includes:

[0031] The gradient information is homomorphically encrypted using the public key to obtain encrypted gradient information, which is then sent to the second participant.

[0032] Optionally, calculating the gradient information of the label value and the predicted value includes:

[0033] Calculate the first and second gradients of the label value and the predicted value, and initialize the indicator vector, which describes whether the first participant sample is at the current split node of the initial security tree model.

[0034] This application provides an apparatus for constructing a secure tree model based on secret sharing and homomorphic encryption, the apparatus comprising:

[0035] The acquisition module is configured to, in response to a received model building instruction, acquire the predicted values ​​obtained by predicting the feature data of all participants using the initial secure tree model and the label values ​​of the first participant samples; and receive ciphertext fragments sent by the second participant based on the encryption gradient information; wherein, the ciphertext fragments are obtained by the second participant calculating the corresponding encrypted bin gradient accumulation information based on the second participant features and the encryption gradient information, and converting the encrypted bin gradient accumulation information from a homomorphic encrypted state to a secret sharing state;

[0036] An interaction module is used to calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant.

[0037] A construction module is used to update the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment; and to recursively build the initial secure tree using the updated split index to obtain the target secure tree model.

[0038] Optionally, the building module is further configured to:

[0039] The ciphertext fragment is homomorphically decrypted to obtain the decrypted fragment;

[0040] Based on the decrypted fragments and the first bin gradient accumulation, the total bin gradient accumulation of each participating device is obtained;

[0041] The split index of the initial safe tree model is updated based on the total and sub-bin gradient accumulation.

[0042] Optionally, the building module is further configured to:

[0043] Based on the cumulative gradient of the total and sub-bins, the splitting gain, the optimal splitting method, and the corresponding features are found.

[0044] Based on the splitting gain, the optimal splitting method, and the corresponding features, the nodes are split to obtain the first splitting index, and the first splitting index is secretly shared with the second participant.

[0045] Receive the second split index sent by the second participant;

[0046] The split index of the initial security tree model is updated using the histogram difference algorithm, based on the first split index and the second split index.

[0047] Optionally, the building module is further configured to:

[0048] Obtain the optimal split index of the optimal participant from the first split index and the second split index;

[0049] Based on the optimal split index, obtain the first bin gradient accumulation with the minimum split gain of the current split node;

[0050] Based on the first bin gradient accumulation and the current gradient accumulation of the current split node, calculate the second bin gradient accumulation with the largest split gain of the current split node;

[0051] The split index is updated based on the second bin gradient accumulation and the first bin gradient accumulation.

[0052] Optionally, the building module is further configured to:

[0053] The initial security tree model is recursively constructed based on the updated split index. When the depth of the initial security tree model reaches the target depth, the tree construction is completed, and the target security tree model is obtained.

[0054] Optionally, the acquisition module is further configured to:

[0055] Generate a public key and a private key for homomorphic encryption, and send the public key to the second participant, wherein the private key is used to decrypt the encryption gradient information;

[0056] The step of sending the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant includes:

[0057] The gradient information is homomorphically encrypted using the public key to obtain encrypted gradient information, which is then sent to the second participant.

[0058] Optionally, the acquisition module is further configured to:

[0059] Calculate the first and second gradients of the label value and the predicted value, and initialize the indicator vector, which describes whether the first participant sample is at the current split node of the initial security tree model.

[0060] This application provides an electronic device, including:

[0061] Memory containing computer-readable code;

[0062] One or more processors, when the computer-readable code is executed by the one or more processors, the electronic device performs a secure tree model construction method based on secret sharing and homomorphic encryption as described above.

[0063] This application provides a computer program including computer-readable code. When the computer-readable code is run on an electronic device, it causes the electronic device to execute a secure tree model construction method based on secret sharing and homomorphic encryption as described above.

[0064] This application provides a storage medium storing a secure tree model construction method based on secret sharing and homomorphic encryption as described above.

[0065] This application provides a method and apparatus for constructing a secure tree model based on secret sharing and homomorphic encryption. The method involves sending the gradient information of the feature data of a first participant to a second participant via homomorphic encryption. The second participant uses this homomorphically encrypted gradient information and its own features to calculate the cumulative gradient of encrypted bins. Then, based on the cumulative gradient of the encrypted bins, it obtains ciphertext fragments and secretly shares them with the first participant. This ensures that the data transmitted via homomorphic encryption does not require the overall data of each participant, guaranteeing the security of the homomorphic encryption transmission. Furthermore, since the first participant uniformly updates the split index of the secure tree model based on the ciphertext fragments of each participant to construct the secure tree, frequent communication between the second participant and the second participant is unnecessary, which also helps improve the training efficiency of the secure tree model. Attached Figure Description

[0066] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is a flowchart illustrating a method for constructing a secure tree model based on secret sharing and homomorphic encryption, as provided in an embodiment of this application.

[0068] Figure 2 This is a logical schematic diagram of a security tree construction method based on secret sharing and homomorphic encryption provided in an embodiment of this application;

[0069] Figure 3 This is a logical schematic diagram of another security tree construction method based on secret sharing and homomorphic encryption provided in the embodiments of this application;

[0070] Figure 4 This is a schematic diagram illustrating the principle of a method for converting a homomorphic encryption state to a secret-sharing state, as provided in an embodiment of this application.

[0071] Figure 5 This is a schematic diagram of a secure tree model construction device based on secret sharing and homomorphic encryption provided in an embodiment of this application;

[0072] Figure 6 A block diagram schematically illustrates a computing processing apparatus for performing a method according to an embodiment of this application;

[0073] Figure 7A storage unit for holding or carrying program code that implements the method according to an embodiment of the present application is illustrated schematically. Detailed Implementation

[0074] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate several embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0076] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein in the specification of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0077] Please see Figure 1 The flowchart of the secure tree model construction method based on secret sharing and homomorphic encryption in this application embodiment is shown. This construction method is applied to the first participant and includes the following steps:

[0078] Step 101: In response to the received model building instruction, obtain the predicted value obtained by predicting the feature data of all participants using the initial safety tree model and the label value of the first participant sample.

[0079] It should be noted that the label value is the target and category or content of the thing we want to predict, i.e., the y variable in simple linear regression. Labels can be the future price of wheat, animal breeds, the meaning of an audio clip, or any descriptive information about something. The predicted value is the prediction result obtained through prediction. The gradient information is calculated by comparing the predicted value of the labeled sample with the actual value of the label. The gradient is essentially a vector representing the maximum value of the directional derivative of a function at a given point along that direction; that is, the function changes the fastest and has the largest rate of change (the magnitude of the gradient) along that direction at that point. The gradient is used to find the minimum value of the loss function, which maps the values ​​of a random event or its related random variables to non-negative real numbers to represent the "risk" or "loss" of that random event. The first-order gradient indicates that the function changes the fastest along that direction at that point, but when the function changes continuously, using only the first-order gradient may not be sufficient to determine the optimization direction. Therefore, the second-order gradient is used to reflect the change in the first-order gradient and further determine the optimization direction.

[0080] In this embodiment of the application, after receiving the model building instruction, the first participant will obtain the predicted value obtained by using the initial safety tree model to predict the first participant feature data it possesses and the label value of the first participant sample for the next step of calculation.

[0081] Step 102: Calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant.

[0082] In this embodiment, the first participant calculates gradient information based on the label and the predicted value. The gradient information may include a first-order gradient and a second-order gradient. The first-order gradient is used to find the minimum value of the loss function, while the second-order gradient is used to optimize the error of the first-order gradient. During homomorphic encryption, a public key and a private key are generated. The first participant uses the public key to encrypt the gradient information and sends the private key to the second participant, so that the second participant can use the private key to homomorphically decrypt the gradient information sent by the first participant.

[0083] Step 103: Receive the ciphertext fragment sent by the second participant according to the encryption gradient information; wherein, the ciphertext fragment is obtained by the second participant calculating the corresponding encryption bin gradient accumulation information according to the characteristics of the second participant and the encryption gradient information, and converting the encryption bin gradient accumulation information from the homomorphic encryption state to the secret sharing state.

[0084] It's important to note that secret sharing is a cryptographic technique that divides and stores secrets. The idea is to split the secret in an appropriate way, with each share managed by different participants. A single participant cannot recover the secret information; only through the collaboration of several participants can the secret message be recovered. More importantly, if any participant within a given group fails, the secret can still be fully recovered. Its purpose is to prevent secrets from becoming too centralized, thereby distributing risk and tolerating intrusion, making it a crucial means of information security and data confidentiality.

[0085] In this embodiment, the second participant receives the encrypted gradient information sent by the first participant, bins its own features to obtain a second mask, and then calculates the encrypted gradient information and the second mask. If the feature data is not in the bin, it is multiplied by 0 and not included in the gradient accumulation; if it is in the bin, it is multiplied by 1 and included in the gradient accumulation, thus obtaining the second bin gradient accumulation. The second participant then initializes a random number and subtracts the random number from the encrypted bin gradient accumulation as a ciphertext fragment, which is secretly shared with the first participant. The first participant then decrypts the ciphertext fragment to obtain a decrypted fragment.

[0086] Step 104: Update the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment.

[0087] In this embodiment of the application, the first participant will also bin its own feature data and obtain the corresponding first mask. Based on the first mask and gradient information, the first bin gradient accumulation will be calculated. Then, the first bin gradient accumulation will be secretly shared with the second participant. Finally, the total bin gradient accumulation will be calculated by combining the decryption fragments owned by the first participant, the first bin gradient accumulation under the secret sharing state, the random number owned by the second participant, and the first bin gradient accumulation under the secret sharing state.

[0088] It's important to note that there are two ways to update the index: the first is to leak the split index to all participants, and the second is for the optimal splitter to directly transmit the encrypted index ciphertext. The first method is more efficient because it distributes the computational task among the participants, while the second method increases communication costs due to the need for frequent communication between participants to transmit the index ciphertext. Regarding subsequent node splits, unlike the secret sharing scheme where each node split uses the full data, the optimal splitter, based on the split index, first calculates the smaller of the first and second bin gradient accumulations. It's important to note that the specific values ​​of the first and second bin gradient accumulations are not known at this stage. The method for comparing their magnitudes is to first derive their expressions based on typical calculation formulas, then subtract the second bin gradient from the first bin gradient, simplifying the result into a numerator and denominator expression. This transforms the size comparison into a sign comparison of the numerator and denominator. If the subtraction result is negative, the former is less than the latter; if the result is positive, the former is greater than the latter. Finally, the smaller bin gradient accumulation is calculated, and the other party's bin gradient accumulation is obtained by combining the total bin gradient accumulation and the smaller bin gradient accumulation. Therefore, the amount of data required for node splitting can be reduced, and the participants do not need to transmit the full amount of data, thus improving the efficiency of safe tree construction.

[0089] Furthermore, in the secret-sharing state, the calculated total bin gradient is divided into left and right sides, and the typical gain calculation formula is improved: to eliminate the inefficient division operation in the secret-sharing state and better support multiple sides, the typical gain calculation formula is adopted, transforming the comparison formula into a subtraction of the two, and then merging and simplifying to obtain a calculation formula in the form of numerator and denominator. At this point, comparing the signs of the numerator and denominator can determine whether the subtraction result is negative or positive, thus knowing the size of the minuend and subtrahend. Finally, in the secret-sharing state, the side with the larger gain is obtained through calculation, thereby obtaining the optimal splitting side, split gain, and corresponding features.

[0090] Step 105: Recursively build the initial security tree using the updated split index to obtain the target security tree model.

[0091] In this embodiment of the application, after finding the optimal segmentation method, the first participant finds the corresponding feature to be segmented. If the node cannot be further segmented, the node is stored as a leaf node. If it can be segmented, a binary segmentation is performed. The tree construction method is called in the right subtree and the tree construction method is called in the left subtree. The process is repeated recursively until the safe tree model meets the maximum set depth, at which point the tree construction process stops.

[0092] Furthermore, the difference between the first participant and the second participant in this embodiment is that the first participant is the initiator of the secure tree model construction process, while the second participant assists the first participant in constructing the secure tree model. Similarly, when the second participant is the initiator of the secure tree model construction, its execution logic can be replaced with that of the first participant. Thus, the second participant can execute the steps of the secure tree model construction method based on secret sharing and homomorphic encryption provided in this embodiment to construct the secure tree model. In this case, the first participant replaces the second participant in executing the steps executed when the first participant is the initiator. The execution steps of the second participant as the initiator of the secure tree model construction process are the same as those of the first participant as the initiator, as detailed above in the description of the execution steps when the first participant is the initiator; they will not be repeated here.

[0093] In this embodiment, the gradient information of the feature data of the first participant is sent to the second participant through homomorphic encryption. The second participant uses the homomorphically encrypted gradient information and its own features to calculate the encrypted bin gradient accumulation. Then, based on the encrypted bin gradient accumulation, the encrypted fragments are obtained and secretly shared with the first participant. This ensures that the data transmitted by homomorphic encryption does not require the overall data of each participant, thus guaranteeing the security of homomorphic encrypted transmission. Furthermore, since the first participant uniformly updates the split index of the secure tree model based on the encrypted fragments of each participant to construct the secure tree, there is no need for frequent communication between the second participant and the second participant, which also helps to improve the training efficiency of the secure tree model.

[0094] Optionally, step 104 includes:

[0095] A1. Perform homomorphic decryption on the ciphertext fragment to obtain the decrypted fragment;

[0096] A2. Based on the decryption fragments and the first bin gradient accumulation, obtain the total bin gradient accumulation of each participating device;

[0097] A3. Update the split index of the initial safe tree model based on the total bin gradient accumulation.

[0098] In this embodiment of the application, the ciphertext fragment is the result of subtracting a random number from the encrypted gradient information of the second participant. After the first participant decrypts the fragment, it collaborates with the second participant to calculate the total bin gradient accumulation.

[0099] It should be noted that binning has the following five benefits: improving the stability and robustness of the model, preventing overfitting, speeding up model training, handling null and missing values ​​well, and enhancing the fitting power of logistic regression. Therefore, feature data is binned, and the mask value is 0 or 1 to indicate whether it is in the bin.

[0100] In this embodiment, binning improves the stability and robustness of the model, prevents overfitting, speeds up model training, effectively handles null and missing values, enhances the fitting power of logistic regression, and conveniently obtains the accumulated gradient of encrypted binning through masking and encrypted gradient information calculation.

[0101] In this embodiment, the first participant will bin its own feature data and obtain a corresponding first mask. Based on the first mask and the first gradient, the first bin gradient accumulation will be calculated using secret sharing multiplication. Then, the first bin gradient accumulation will be secretly shared with the first participant and the second participant. Finally, the decryption fragments owned by the first participant, the first bin gradient accumulation under the secret sharing state, and the random number owned by the second participant, as well as the first bin gradient accumulation under the secret sharing state, will be combined to collaboratively calculate the total bin gradient accumulation using secret sharing operation.

[0102] In this embodiment, the first participant secretly shares the first bin gradient accumulation with all parties, and the first participant and the second participant respectively hold the decryption fragment and the random number, making the data available but invisible, thus fulfilling the user's requirements.

[0103] In this embodiment, the second participant initializes a random number and subtracts the random number from the encrypted bin gradient to obtain ciphertext fragments, thus completing the transformation from the homomorphic encrypted state to the secret-sharing state. This prevents the first participant from obtaining the direct encrypted bin gradient and necessitates collaborative computation with the second participant, effectively protecting data privacy.

[0104] Optionally, step A3 includes:

[0105] A31, based on the total bin gradient accumulation, find the splitting gain, the optimal splitting method, and the corresponding features;

[0106] A32, perform node splitting based on the splitting gain, optimal splitting method and corresponding features to obtain a first splitting index, and secretly share the first splitting index with the second participant;

[0107] A33, receive the second split index sent by the second participant;

[0108] A34, using the histogram difference algorithm, update the split index of the initial security tree model based on the first split index and the second split index.

[0109] In this embodiment, the histogram difference method is used, so that each node split does not need to use the full data. Only a small gradient accumulation needs to be calculated and then the gradient accumulation of the total bin is calculated to obtain the gradient accumulation of the other side, which effectively improves the construction efficiency of the safety tree model.

[0110] Optionally, step A34 includes:

[0111] A341, Obtain the optimal split index of the optimal participant from the first split index and the second split index;

[0112] A341, based on the optimal split index, obtain the first bin gradient accumulation with the minimum split gain of the current split node;

[0113] A341, based on the first bin gradient accumulation and the current gradient accumulation of the current split node, calculate the second bin gradient accumulation with the largest split gain of the current split node;

[0114] A341, update the split index based on the second bin gradient accumulation and the first bin gradient accumulation.

[0115] In this embodiment, by obtaining the first bin gradient accumulation with the smallest split gain, and subtracting the first bin gradient accumulation from the total bin gradient accumulation to obtain the second bin gradient accumulation with the largest split gain, the construction efficiency of the safety tree model is improved.

[0116] Optionally, step 105 includes: recursively building the initial security tree model based on the updated split index, and completing the tree building when the depth of the initial security tree model reaches the target depth, thereby obtaining the target security tree model.

[0117] In this embodiment of the application, the safe tree is recursively built according to the updated split index. When the node is indivisible, the splitting stops. When the node is divisible, the left subtree calls the tree building method and the right subtree calls the tree building method, until it is no longer divisible.

[0118] Optionally, before step 101, the method further includes: generating a public key and a private key for homomorphic encryption, and sending the public key to the second participant, wherein the private key is used to decrypt the encryption gradient information;

[0119] Step 102 includes: using the public key to homomorphically encrypt the gradient information to obtain encrypted gradient information, and sending the encrypted gradient information to the second participant.

[0120] In this embodiment of the application, by using a public key and a private key for homomorphic encryption, and encrypting with the public key and decrypting with the private key, the second participant can process the data without knowing the specific data, and the first participant can also obtain the processed plaintext data, thus ensuring that the data is available but not visible.

[0121] Optionally, step 102 includes: calculating the first-order gradient and the second-order gradient of the label value and the predicted value, and initializing an indicator vector, the indicator vector being used to describe whether the first participant sample is at the current split node of the initial security tree model.

[0122] It should be noted that no splitting has occurred initially, so the value of the indicator vector is 1.

[0123] In this embodiment of the application, by initializing the indicator vector and setting its value to either 0 or 1, users can easily and clearly determine whether they are in the current tree node by using the value of the indicator vector.

[0124] Optionally, refer to Figure 2 As one embodiment of this application, it includes:

[0125] The tag owner (guest) is the first participant, and the host is the second participant. The guest's data includes the tag y and its own feature data X. g The participating host contains its own characteristic data X. h ;

[0126] It should be noted that the basic operation definition for secret sharing is:

[0127] ss_share: This indicates that the fragments are distributed to various participants through splitting, and the state at this time can be defined as the secret sharing state;

[0128] SS_ADD: Secretly share the addition result. Each party obtains a fragment of the addition result. After the fragment is restored, the result is the result of normal addition.

[0129] SS_SUM: Based on SS_ADD, the result of array summation is obtained. Each party obtains a fragment of the summation result. After the fragment is restored, the result is the result of normal array summation.

[0130] SS_MUL: Secretly share multiplication. Each party obtains a fragment of the multiplication result. Once the fragment is restored, the result is the result of normal multiplication.

[0131] In this embodiment of the application, the guest party will determine the value based on the label y and the predicted value y. predCalculate the first-order gradient g and the second-order gradient h, and initialize the indicator vector index to indicate whether the sample is in the current tree node. Initially, both are 1. Then, g, h, and index are secretly shared with each participant. Each participant receives secret sharing fragments SS_g, SS_h, and SS_index, where each participant refers to the guest and the host.

[0132] Furthermore, each party bins its own feature data to obtain corresponding bin mask data, where the mask is represented by a 0 / 1 matrix, where 0 indicates not being in the bin and 1 indicates being in the bin. The mask is then secretly shared among the parties to obtain SS_mask. SS_mask includes each party's corresponding SS_guest_mask and SS_host_mask.

[0133] Furthermore, in the secret-sharing state, the binning gradient accumulation corresponding to each feature is calculated, and the secret-sharing operations SS_SUM and SS_MUL are used to complete the above-mentioned secret-sharing state operations. That is, the binning gradient accumulation SS_SUM of the corresponding secret-sharing state is obtained by using formulas (1) and (2) respectively. G ,SS H :

[0134] SS G =SS_SUM(SS_MUL(SS) mask ,SS_g)) (1)

[0135] SS H =SS_SUM(SS_MUL(SS) mask ,SS_h)) (2)

[0136] Among them, SS G ,SS H This corresponds to the binning gradient accumulation of the secret-sharing state; SS_SUM and SS_MUL are the secret-sharing operations mentioned above; SS mask Masked data shared in secret.

[0137] Furthermore, splitting requires determining whether the current tree node is a leaf node. That is, it is determined whether the current node meets the requirements for splitting based on the maximum depth and the minimum number of leaf nodes. If it does not meet the requirements, the leaf weight needs to be calculated. The typical weight calculation formula (3) is as follows:

[0138]

[0139] Where w represents the weight, G represents the cumulative first-order gradient of the corresponding leaf node, H represents the cumulative second-order gradient of the corresponding leaf node, and λ represents the regularization coefficient.

[0140] In the calculation of the secure tree model, it is necessary to ensure that the operation is in a secret sharing state. Therefore, the weights should also be in a secret sharing state. Since the operation of secret sharing does not support division and the operation of approximating division by addition and multiplication using secret sharing is not very efficient, the problem is transformed into the following formula (4):

[0141] It should be noted that w represents the weight, P represents the number of participants, p represents the participant identifier, and <> represents the fragment in the secret sharing state. Solving the quadratic optimization problem, the corresponding weight value is obtained through a finite number of iterations, i.e., formula (5):

[0142]

[0143] in, The learning rate is determined by... The decision to use δ as a random value is primarily to prevent potential data leaks.

[0144] Furthermore, when the current samples satisfy the splitting condition, it is necessary to calculate the optimal splitting method, splitting gain, and corresponding features in the secret sharing state. In the secret sharing state, the calculated binning gradients under the secret sharing state are accumulated as SS. G ,SS H Divided into left and right sides, the left and right sides are represented by L and R, and the typical gain calculation formula (6) is as follows:

[0145]

[0146] It should be noted that, in order to eliminate the inefficient operation of division in the secret sharing state and better support multiple parties, the comparison method for obtaining the maximum gain is changed to comparing the signs of the numerator and denominator. That is, for two different left and right partitions s1 and s2, and gains g1 and g2, the operation formula (7) for comparing their size is:

[0147]

[0148] Combining the numerator and denominator, we get formula (8):

[0149]

[0150] Therefore, by using formula (8), the division operation is transformed into comparing the signs of the numerator and denominator. Thus, in the secret sharing state, the side with greater gain is obtained by calculating the fragments of the signs and restoring them, thereby obtaining the optimal splitting side, splitting gain and corresponding features.

[0151] Furthermore, based on the optimal splitting method, splitting gain, and the corresponding feature node splitting, the splitting index is secretly shared with each party, the current index is updated, and then the tree is recursively built left and right until the set maximum depth is met, thus completing the tree construction.

[0152] The secure tree scheme based on secret sharing ensures a certain level of security because all operations are performed in a secret sharing state, thus minimizing the leakage of intermediate information. However, it can be noted that during the secure tree construction process, the use of indicator indexes to represent node splits means that the cost of splitting at each node is always calculated based on the full amount of data. This severely impacts the efficiency of building a secure tree based on secret sharing, and the model training speed becomes particularly slow as the amount of data increases.

[0153] Optionally, refer to Figure 3 ,include:

[0154] The tag owner (guest) is the first participant, and the host is the second participant. The guest's data includes the tag y and its own feature data X. g The participating host, containing its own characteristic X h ;

[0155] In this embodiment of the application, guest generates a homomorphic encryption public key pk. a and private key sk a PK the public key a Send to the host;

[0156] Furthermore, the guest calculates the first-order gradient g and the second-order gradient h based on the sample's label y and the predicted value y_pred. It also initializes the indicator vector index to indicate whether the sample is in the current tree node; initially, all values ​​are 1. g, h, and index are then secretly shared with each participant, and each participant receives secret sharing fragments SS_g, SS_h, and SS_index.

[0157] Furthermore, the guest party bins its own feature data to obtain the corresponding bin mask data `guest_mask`, represented using a 0 / 1 matrix, where 0 indicates not being in the bin and 1 indicates being in the bin. This mask is then secretly shared with all parties using `ss_share` to obtain `ss_guest_mask`. Similarly, the host party bins its own feature data to obtain the corresponding bin mask data `host_mask`, which is also secretly shared with all parties using `ss_share` to obtain `ss_host_mask`.

[0158] Furthermore, the guest encrypts the first-order gradient g and the second-order gradient h in batches, and sends the encrypted shards shard_g and shard_h to the host. Simultaneously, after completing the encryption, the guest calculates the first-bin gradient accumulation guest_SS using its own mask and the plaintext state of the gradient information. G guest_SS H After receiving the encrypted fragment, the host calculates the cumulative encrypted bin gradient for each feature, host_en_SS, based on the encrypted fragment and the local feature mask. G host_en_SS H In this process, the guest encrypts the data while sending it, and the host receives the data while performing calculations in an encrypted state.

[0159] After the calculation is complete, the encrypted bin gradient accumulation can be obtained. At this point, the conversion from the homomorphic encrypted state to the secret-sharing state is performed, referring to... Figure 4 ,include:

[0160] The host will initialize a random number as a secret shared state fragment. <d2>Then, use the public key of homomorphic encryption to ﹣ <d2>Encryption yields ciphertext [﹣] <d2>] a ;

[0161] Furthermore, calculate [D]. a +[﹣<D2>] a To obtain the ciphertext fragment [ <d1>] a , of which, [D] a It is the cumulative encrypted binning gradient on the host side;

[0162] Furthermore, the host will send the encrypted fragment [<D1>]. a The secret is shared to the guest, who uses the homomorphic encryption private key to decrypt the ciphertext fragment to obtain the decrypted fragment. <d1>This completes the conversion operation from the homomorphic encrypted state to the secret-sharing state.

[0163] Furthermore, the guest side accumulates guest_SS based on its own binning gradient. G guest_SS H and decryption fragments <d1>The host shards based on its own random number pool. <d2>The two are used in a collaborative operation to obtain the total bin gradient cumulative SS. G ,SS H .

[0164] Furthermore, splitting requires determining whether the current tree node is a leaf node. That is, it is determined whether the current node meets the requirements for splitting based on the maximum depth and the minimum number of leaf nodes. If it does not meet the requirements, the leaf weight needs to be calculated. The typical weight calculation formula is shown in formula (3).

[0165] In the calculation of the secure tree model, it is necessary to ensure that the operation is in a secret sharing state. Therefore, the weights should also be in a secret sharing state. Since the operation of secret sharing does not support division and the operation of approximating division by addition and multiplication using secret sharing is not very efficient, the problem is transformed into formula (4).

[0166] To solve the quadratic optimization problem, the corresponding weight values ​​are obtained through a finite number of iterations using formula (5).

[0167] Furthermore, when the current samples meet the splitting condition, it is necessary to calculate the optimal splitting method, splitting gain, and corresponding features in the secret sharing state. In the secret sharing state, the total bin gradient calculated under the secret sharing state is cumulatively divided into left and right SS bins. G ,SS H Left and right are represented by L and R, and typical gain calculation is performed using formula (6).

[0168] It should be noted that, in order to eliminate the inefficient operation of division in the secret sharing state and better support the multi-party operation, the comparison method for obtaining the maximum gain is changed to comparing the signs of the numerator and denominator. That is, after dividing the total bin gradient accumulation, two different left and right partitions s1 and s2, and gains g1 and g2 are obtained, and their relative sizes are compared using formula (7).

[0169] By further combining the numerator and denominator, we can obtain formula (8).

[0170] Therefore, the division operation is transformed into comparing the signs of the numerator and denominator. In the secret sharing state, by calculating the fragments of the signs and restoring them, the side with the greater gain is obtained, thus obtaining the optimal splitting side, the splitting gain, and the corresponding features.

[0171] Furthermore, based on the optimal splitter, the split gain, and the corresponding feature node splits, the split index is secretly shared with each party, and the current index is updated.

[0172] After obtaining the split index, the index position needs to be updated. There are two ways to do this: the first is to leak the split index to all participants, and the second is for the optimal feature party to directly transmit the encrypted index ciphertext. The former is more efficient, while the latter will increase the communication cost.

[0173] Then, the tree is built recursively to the left and right until the set maximum depth is met, thus completing the tree construction.

[0174] Figure 5 The schematic diagram illustrates the structure of a secure tree model construction device 20 based on secret sharing and homomorphic encryption provided in this application, applied to a first participant. The device includes:

[0175] The acquisition module 201 is used to respond to the received model building instruction, acquire the predicted value obtained by predicting the feature data of all participants using the initial secure tree model and the label value of the first participant sample; receive the ciphertext fragment sent by the second participant according to the encryption gradient information; wherein, the ciphertext fragment is obtained by the second participant calculating the corresponding encryption bin gradient accumulation information according to the second participant features and the encryption gradient information, and converting the encryption bin gradient accumulation information from the homomorphic encryption state to the secret sharing state;

[0176] Interaction module 202 is used to calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant;

[0177] The construction module 203 is used to update the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment; and to recursively build the initial secure tree using the updated split index to obtain the target secure tree model.

[0178] Optionally, the building module 203 is further configured to:

[0179] The ciphertext fragment is homomorphically decrypted to obtain the decrypted fragment;

[0180] Based on the decrypted fragments and the first bin gradient accumulation, the total bin gradient accumulation of each participating device is obtained;

[0181] The split index of the initial safe tree model is updated based on the total and sub-bin gradient accumulation.

[0182] Optionally, the building module 203 is further configured to:

[0183] Based on the cumulative gradient of the total and sub-bins, the splitting gain, the optimal splitting method, and the corresponding features are found.

[0184] Based on the splitting gain, the optimal splitting method, and the corresponding features, the nodes are split to obtain the first splitting index, and the first splitting index is secretly shared with the second participant.

[0185] Receive the second split index sent by the second participant;

[0186] The split index of the initial security tree model is updated using the histogram difference algorithm, based on the first split index and the second split index.

[0187] Optionally, the building module 203 is further configured to:

[0188] Obtain the optimal split index of the optimal participant from the first split index and the second split index;

[0189] Based on the optimal split index, obtain the first bin gradient accumulation with the minimum split gain of the current split node;

[0190] Based on the first bin gradient accumulation and the current gradient accumulation of the current split node, calculate the second bin gradient accumulation with the largest split gain of the current split node;

[0191] The split index is updated based on the second bin gradient accumulation and the first bin gradient accumulation.

[0192] Optionally, the building module 203 is further configured to:

[0193] The initial security tree model is recursively constructed based on the updated split index. When the depth of the initial security tree model reaches the target depth, the tree construction is completed, and the target security tree model is obtained.

[0194] Optionally, the acquisition module 201 is further configured to:

[0195] Generate a public key and a private key for homomorphic encryption, and send the public key to the second participant, wherein the private key is used to decrypt the encryption gradient information;

[0196] The step of sending the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant includes:

[0197] The gradient information is homomorphically encrypted using the public key to obtain encrypted gradient information, which is then sent to the second participant.

[0198] Optionally, the acquisition module 201 is further configured to:

[0199] Calculate the first and second gradients of the label value and the predicted value, and initialize the indicator vector, which describes whether the first participant sample is at the current split node of the initial security tree model.

[0200] In this embodiment, the gradient information of the feature data of the first participant is sent to the second participant through homomorphic encryption. The second participant uses the homomorphically encrypted gradient information and its own features to calculate the encrypted bin gradient accumulation. Then, based on the encrypted bin gradient accumulation, the encrypted fragments are obtained and secretly shared with the first participant. This ensures that the data transmitted by homomorphic encryption does not require the overall data of each participant, thus guaranteeing the security of homomorphic encrypted transmission. Furthermore, since the first participant uniformly updates the split index of the secure tree model based on the encrypted fragments of each participant to construct the secure tree, there is no need for frequent communication between the second participant and the second participant, which also helps to improve the training efficiency of the secure tree model.

[0201] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0202] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing device according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a non-transient computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0203] For example, Figure 6 A block diagram schematically illustrates a computing processing apparatus for performing a method according to an embodiment of this application. The computing processing apparatus conventionally includes a processor 310 and a computer program product or non-transitory computer-readable medium in the form of a memory 320. The memory 320 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. The memory 320 has storage space 330 for program code 331 for performing any of the method steps described above. For example, the storage space 330 for program code may include various program codes 331 respectively for implementing the various steps in the methods described above. This program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically as shown in the reference. Figure 7 The portable or fixed storage unit. This storage unit may have the same characteristics as... Figure 6 The memory 320 in the computing processing device is arranged similarly to storage segments, storage spaces, etc. Program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer-readable code 331', that is, code that can be read by a processor such as 310, which, when run by the computing processing device, causes the computing processing device to perform the various steps in the methods described above.

[0204] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0205] The terms "one embodiment," "embodiment," or "one or more embodiments" as used herein mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of this application. Furthermore, please note that the examples of the phrase "in one embodiment" do not necessarily all refer to the same embodiment.

[0206] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0207] In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0208] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for constructing a secure tree model based on secret sharing and homomorphic encryption, characterized in that, Applied to the first participant, the method includes: In response to the received model building instruction, the predicted value obtained by using the initial safety tree model to predict the feature data of all participants and the label value of the first participant sample are obtained. Calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant; Receive ciphertext fragments sent by the second participant according to the encryption gradient information; wherein, the ciphertext fragments are obtained by the second participant calculating the corresponding encryption bin gradient accumulation information according to the characteristics of the second participant and the encryption gradient information, and converting the encryption bin gradient accumulation information from the homomorphic encryption state to the secret sharing state; The split index of the initial secure tree model is updated based on the label value, the predicted value, and the ciphertext fragment; The initial security tree is recursively constructed using the updated split index to obtain the target security tree model; The step of updating the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment includes: The ciphertext fragment is homomorphically decrypted to obtain the decrypted fragment; Based on the decryption fragments and the first bin gradient accumulation, the total bin gradient accumulation of each participant is obtained; wherein, the first bin gradient accumulation is calculated by the first participant based on its own characteristics; The split index of the initial safe tree model is updated based on the total and sub-bin gradient accumulation.

2. The method according to claim 1, characterized in that, The step of updating the split index of the initial safe tree model based on the total bin gradient accumulation includes: Based on the cumulative gradient of the total and sub-bins, the splitting gain, the optimal splitting method, and the corresponding features are found. Based on the splitting gain, the optimal splitting method, and the corresponding features, the nodes are split to obtain a first splitting index, and the first splitting index is secretly shared with the second participant. Receive the second split index sent by the second participant; The split index of the initial security tree model is updated using the histogram difference algorithm, based on the first split index and the second split index.

3. The method according to claim 2, characterized in that, The step of updating the split index of the initial security tree model using the histogram difference algorithm based on the first split index and the second split index includes: Obtain the optimal split index of the optimal participant from the first split index and the second split index; Based on the optimal split index, obtain the first bin gradient accumulation with the minimum split gain of the current split node; Based on the first bin gradient accumulation and the current gradient accumulation of the current split node, calculate the second bin gradient accumulation with the largest split gain of the current split node; The split index is updated based on the second bin gradient accumulation and the first bin gradient accumulation.

4. The method according to claim 1, characterized in that, The step of recursively building the initial security tree using the updated split index to obtain the target security tree model includes: The initial security tree model is recursively constructed based on the updated split index. When the depth of the initial security tree model reaches the target depth, the tree construction is completed, and the target security tree model is obtained.

5. The method according to claim 1, characterized in that, Before obtaining the predicted values ​​obtained by predicting all participant feature data using the initial safety tree model and the label values ​​of the first participant sample in response to the received model building instruction, the method further includes: Generate a public key and a private key for homomorphic encryption, and send the public key to the second participant, wherein the private key is used to decrypt the encryption gradient information; The step of sending the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant includes: The gradient information is homomorphically encrypted using the public key to obtain encrypted gradient information, which is then sent to the second participant.

6. The method according to any one of claims 1-5, characterized in that, The calculation of gradient information for the label value and the predicted value includes: Calculate the first and second gradients of the label value and the predicted value, and initialize the indicator vector, which describes whether the participant sample is at the current split node of the initial security tree model.

7. A secure tree model construction device based on secret sharing and homomorphic encryption, characterized in that, Applied to the first participant, the device includes: The acquisition module is used to, in response to the received model building instruction, acquire the predicted value obtained by predicting the feature data of all participants using the initial secure tree model and the label value of the first participant sample; and receive the ciphertext fragment sent by the second participant according to the encryption gradient information; wherein, the ciphertext fragment is obtained by the second participant calculating the corresponding encrypted bin gradient accumulation information according to the second participant's features and the encryption gradient information, and converting the encrypted bin gradient accumulation information from the homomorphic encrypted state to the secret sharing state; An interaction module is used to calculate the gradient information of the label value and the predicted value, and send the encrypted gradient information obtained by homomorphically encrypting the gradient information to the second participant. The module is used to update the split index of the initial secure tree model based on the label value, the predicted value, and the ciphertext fragment; and to recursively build the initial secure tree using the updated split index to obtain the target secure tree model. The building module is also used for: The ciphertext fragment is homomorphically decrypted to obtain the decrypted fragment; Based on the decrypted fragments and the first bin gradient accumulation, the total bin gradient accumulation of each participating device is obtained; The split index of the initial safe tree model is updated based on the total and sub-bin gradient accumulation.

8. An electronic device, characterized in that, The device includes a processor and a memory: The memory is used to store computer programs; The processor is configured to execute, according to the computer program, the secure tree model construction method based on secret sharing and homomorphic encryption as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for executing the secure tree model construction method based on secret sharing and homomorphic encryption as described in any one of claims 1-6.

Images