A method, system and apparatus for privacy-preserving multi-party data processing

Abstract

A privacy-preserving multi-party data processing method, system, and device are disclosed. The method includes: a first-party device converting a real-valued vector into an N / 2-dimensional complex vector, generating a first ciphertext of the complex vector based on a public key using a homomorphic encryption algorithm, and sending the first ciphertext to a second-party device, where N is the parameter value of the homomorphic encryption algorithm; the second-party device converting the inner product of a first matrix and a real-valued vector into a calculation formula for an N / 2-dimensional parameter vector and an N / 2-dimensional complex vector, where the N / 2-dimensional parameter vector is determined based on the first matrix; performing a homomorphic calculation on the first ciphertext based on the calculation formula to generate a second ciphertext containing the inner product of the first matrix and the real-valued vector, and sending the second ciphertext to the first-party device; and the first-party device processing the second ciphertext using a private key corresponding to the public key according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real-valued vector.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of data processing technology, and in particular relate to a method, system and device for multi-party data processing that protects privacy. Background Technology

[0002] In multi-party data processing scenarios, there are typically matrix holders and vector holders. These holders need to calculate the inner product of the matrix and vector while protecting the privacy of all parties. In related technologies, this calculation can be achieved using fully homomorphic encryption algorithms. Fully homomorphic encryption algorithms are generally suitable for processing N / 2-dimensional vectors. In practice, vector holders typically hold N-dimensional real vectors, and matrix holders hold, for example, N-order square matrices. To make them suitable for homomorphic encryption, the matrix holder and vector holder need to decompose the matrix and vector into N / 2-order matrices and N / 2-dimensional vectors respectively, which increases the computational load and requires significant computational resources. Summary of the Invention

[0003] The purpose of this invention is to provide a multi-party data processing scheme that can save computing resources and improve computing efficiency.

[0004] This specification provides a privacy-preserving method for processing multi-party data, wherein the multi-party includes a first party and a second party, the first party having a real-valued vector, and the second party having a first matrix for performing an inner product with the real-valued vector, the method comprising:

[0005] The first device converts the real vector into an N / 2-dimensional complex vector, generates a first ciphertext of the complex vector based on a public key using a homomorphic encryption algorithm, and sends the first ciphertext to the second device, where N is a preset parameter value corresponding to the homomorphic encryption algorithm;

[0006] The second-party device converts the inner product of the first matrix and the real vector into a calculation formula for an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix; it performs homomorphic computation on the first ciphertext based on the calculation formula to generate a second ciphertext containing the inner product of the first matrix and the real vector, and sends the second ciphertext to the first-party device.

[0007] The first party's device processes the second ciphertext using the private key corresponding to the public key according to the homomorphic encryption algorithm, to obtain the inner product of the first matrix and the real number vector.

[0008] A second aspect of this specification provides a privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party having a real number vector, and the second party having a first matrix for performing an inner product with the real number vector, the method being executed by a first party device, comprising:

[0009] Convert the real number vector into an N / 2-dimensional complex vector;

[0010] The first ciphertext of the complex vector is generated based on the public key using a homomorphic encryption algorithm, where N is a preset parameter value corresponding to the homomorphic encryption algorithm;

[0011] Send the first ciphertext to the second party's device;

[0012] The device receives a second ciphertext containing the inner product of the first matrix and the real vector. The second ciphertext is obtained by performing a homomorphic computation on the first ciphertext based on a calculation formula of an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector. The N / 2-dimensional parameter vector is determined based on the first matrix.

[0013] According to the homomorphic encryption algorithm, the second ciphertext is processed using the private key corresponding to the public key to obtain the inner product of the first matrix and the real number vector.

[0014] A third aspect of this specification provides a privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing a real number vector, and the second party possessing a first matrix for performing an inner product with the real number vector, the method being executed by a second-party device, comprising:

[0015] The device of the first party receives a first ciphertext, which is an N / 2-dimensional complex vector generated by a homomorphic encryption algorithm based on a public key. The N / 2-dimensional complex vector is generated based on the real number vector, and N is a preset parameter value corresponding to the homomorphic encryption algorithm.

[0016] The inner product of the first matrix and the real vector is converted into a formula for calculating the N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix;

[0017] Based on the calculation formula, a homomorphic computation is performed on the first ciphertext to generate a second ciphertext containing the inner product of the first matrix and the real number vector;

[0018] The second ciphertext is sent to the first party's device.

[0019] A fourth aspect of this specification provides a privacy-preserving multi-party data processing system, wherein the multi-party includes a first party and a second party, the first party having a real number vector, and the second party having a first matrix for performing an inner product with the real number vector.

[0020] The first-party device is used to: convert the real number vector into an N / 2-dimensional complex vector, generate a first ciphertext of the complex vector based on a public key using a homomorphic encryption algorithm, and send the first ciphertext to the second-party device, where N is a preset parameter value corresponding to the homomorphic encryption algorithm;

[0021] The second-party device is configured to: convert the inner product of the first matrix and the real vector into a calculation formula of an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix; perform homomorphic computation on the first ciphertext based on the calculation formula to generate a second ciphertext containing the inner product of the first matrix and the real vector; and send the second ciphertext to the first-party device.

[0022] The device of the first party is further configured to: process the second ciphertext using a private key corresponding to the public key according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real number vector.

[0023] A fifth aspect of this specification provides a first-party device in a multi-party data processing system, wherein the multi-party includes a first party and a second party, the first party having a real vector, and the second party having a first matrix for performing an inner product with the real vector, the first-party device comprising:

[0024] A conversion unit is used to convert the real number vector into an N / 2-dimensional complex vector;

[0025] The generation unit is used to generate the first ciphertext of the complex vector based on the public key using a homomorphic encryption algorithm, wherein N is a preset parameter value corresponding to the homomorphic encryption algorithm;

[0026] A sending unit is configured to send the first ciphertext to the device of the second party;

[0027] The receiving unit is configured to receive from the second party's device a second ciphertext containing the inner product of the first matrix and the real vector, wherein the second ciphertext is obtained by performing a homomorphic computation on the first ciphertext based on a calculation formula of an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix;

[0028] The processing unit is configured to process the second ciphertext using the private key corresponding to the public key according to the homomorphic encryption algorithm, to obtain the inner product of the first matrix and the real number vector.

[0029] A sixth aspect of this specification provides a second-party device in a multi-party data processing system, wherein the multi-party includes a first party and a second party, the first party having a real number vector, and the second party having a first matrix for performing an inner product with the real number vector, the second device comprising:

[0030] The receiving unit is configured to receive first ciphertext from the first party's device. The first ciphertext is an N / 2-dimensional complex vector generated based on a public key using a homomorphic encryption algorithm. The N / 2-dimensional complex vector is generated based on the real number vector, and N is a preset parameter value corresponding to the homomorphic encryption algorithm.

[0031] A conversion unit is used to convert the inner product of the first matrix and the real vector into a calculation formula for an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix;

[0032] A computing unit is configured to perform homomorphic computation on the first ciphertext based on the computation formula to generate a second ciphertext containing the inner product of the first matrix and the real vector.

[0033] A sending unit is used to send the second ciphertext to the device of the first party.

[0034] The seventh aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in the second or third aspect.

[0035] This specification provides a computing device in an eighth aspect, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in the second or third aspect.

[0036] This specification provides a scheme for calculating the inner product of a matrix and a vector among multiple parties. By having the vector holder convert the real vector into an N / 2-dimensional complex vector, the vector holder only needs to encrypt the N / 2-dimensional complex vector once to obtain the vector ciphertext, and then send the vector ciphertext to the matrix holder. Based on the matrix and vector ciphertext, the matrix holder can obtain the ciphertext of the inner product of the matrix and the vector through fewer homomorphic computations, saving computational resources and improving computational efficiency. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a system architecture diagram in one embodiment;

[0039] Figure 2 This is a flowchart of the multi-party data processing method in the embodiments of this specification;

[0040] Figure 3 This is a schematic diagram illustrating the method for calculating the inner product of a 4th-order square matrix and a 4-dimensional complex vector in the embodiments of this specification;

[0041] Figure 4 This is a schematic diagram illustrating the transformation of a matrix in one embodiment of this specification;

[0042] Figure 5 This is a schematic diagram illustrating the transformation of a matrix in one embodiment of this specification;

[0043] Figure 6 This is a structural diagram of a first-party device in a multi-party data processing system according to an embodiment of this specification;

[0044] Figure 7 This is a structural diagram of a second-party device in a multi-party data processing system according to an embodiment of this specification. Detailed Implementation

[0045] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0046] The schemes in the embodiments of this specification are based on homomorphic encryption algorithms. Homomorphic encryption algorithms include the following six algorithms: (1) a key generation algorithm (KeyGen), which is used to generate a private key sk and a public key pk; (2) an encoding algorithm (Encode), which is used to convert a plaintext vector m into a plaintext polynomial p. mSince the ciphertext polynomial space of this homomorphic encryption algorithm is an N-order polynomial space, it is suitable for encrypting an N / 2-dimensional vector m, where m can be a real vector or a complex vector. The plaintext polynomial p obtained by encoding vector m using the encoding algorithm is... m (3) Encryption algorithm, which uses the public key pk to encrypt the plaintext polynomial p m (3) Encryption into a ciphertext polynomial; (4) Decryption algorithm, which is used to decrypt the ciphertext polynomial into a plaintext polynomial; (5) Decode algorithm, which is used to convert the plaintext polynomial into a plaintext vector, specifically converting an N-order plaintext polynomial into an N / 2-dimensional vector (a real vector or a complex vector); (6) Homomorphic computation, including homomorphic addition, homomorphic multiplication, constant vector multiplication, rotation transformation, and conjugate transformation.

[0047] Specifically, in homomorphic addition, for vectors m and t, E(m+t) = E(m) + E(t), where vectors m and t are vectors of the same dimension, and E(t) represents the ciphertext (i.e., the ciphertext polynomial) obtained by homomorphically encrypting the vectors. Here, m+t refers to the addition of corresponding components of vectors m and t. In homomorphic multiplication, E(m°t) = E(m) × E(t), where m°t refers to the multiplication of corresponding components of vector m and vector t. In constant vector multiplication, E(m°C) = E(m) × Encode(C), where C is the plaintext vector, and Encode(C) represents the plaintext polynomial obtained after encoding the plaintext vector C. In rotation transformation... In the ciphertext polynomial E(m), we have E(ρ(m,i)) = ρ2(E(m),i), where ρ(m,i) represents the cyclic left shift of each element in vector m by i positions, and ρ2(E(m),i) represents the rotation transformation of the ciphertext polynomial E(m). In the conjugate transformation, we have E(conj(m)) = conj2(E(M)), where each component of vector m can be a complex number. For example, if a component of vector m is a + ib, where a and b are both real numbers, then after taking the conjugate of vector m, the component a + ib becomes a - ib. conj2(E(M)) refers to the conjugate transformation of the ciphertext polynomial. For instance, if the exponent of x is 1 to N, after taking the conjugate, x in E(M) becomes... i Convert to x N-i .

[0048] Figure 1 This is a system architecture diagram in one embodiment. For example... Figure 1As shown, the system may include device 101, which holds a matrix P0, and device 102, which holds a vector P1. Device 101 stores an m x n matrix owned by matrix holder P0, and device 102 stores an n-dimensional vector owned by vector holder P1. To protect the privacy data of matrix holder P0 and vector holder P1 respectively, device 102 can perform homomorphic encryption on the vectors to generate ciphertext containing the vectors (i.e., ciphertext of the plaintext polynomial corresponding to the vectors), and send this ciphertext to device 101. Device 101 can calculate the ciphertext containing the inner product result based on the matrix and the ciphertext containing the vectors, and send the ciphertext containing the inner product result to device 102. Device 102 can then obtain the inner product result of the matrix and the vector by homomorphically decrypting the ciphertext containing the inner product result.

[0049] The embodiments described in this specification can be applied to scenarios such as multi-party collaborative modeling. In this scenario, the matrix holder P1 is, for example, a model provider offering the model, and the matrix held by the model is, for example, the parameter matrix in the model. The vector holder is, for example, a data provider offering feature data. After the data provider sends ciphertext containing the vectors to the model provider, the model provider can input the ciphertext into the model, thereby outputting ciphertext containing the inner product result from the model.

[0050] The embodiments in this specification can also be used in scenarios involving privacy information retrieval. In this scenario, device 101, the matrix holder P1, is, for example, a server storing a database containing matrix-style data, and device 102 is a user device. When the user device needs to query the i-th row of the matrix, it can construct a vector for querying the data, where the i-th component of the vector is 1 and the other components are 0. The user device can homomorphically encrypt this vector to obtain ciphertext containing the vector; that is, the user device can obtain the vector based on the ciphertext. Then, the user device can send the ciphertext containing the vector to the server. The server can calculate the ciphertext vector based on the matrix to obtain ciphertext containing the inner product result and return the ciphertext containing the inner product result to the user device. After homomorphically decrypting and decoding the ciphertext, the user device can obtain the query result, i.e., the i-th row of the matrix. In this way, during the data query process, the server cannot know the specific data queried by the user, thus protecting user privacy.

[0051] In related technologies, it is assumed that... Figure 1 As shown, the matrix W actually processed is an M-row, N-column matrix, and the vector... Given an N-dimensional real vector, since homomorphic encryption algorithms are suitable for processing N / 2-dimensional vectors, it is usually necessary to divide the matrix into blocks as shown in formula (1) and the vector into blocks as shown in formula (2):

[0052]

[0053]

[0054] That is, divide matrix W into a 4-matrix with M / 2 rows and N / 2 columns: W 00 W 01 W 10 W 11 , will vector Divided into two N / 2 dimensional vectors and

[0055] Based on formulas (1) and (2), we can obtain the following formula (3):

[0056]

[0057] That is, in formula (3), the inner product of an M-row N-column matrix and an N-dimensional vector is transformed into the inner product of four M / 2-row N / 2-column matrices and an N / 2-dimensional vector. Therefore, in the device 102 of the vector holder P1, the encrypted vector... At that time, it is necessary to process the vectors separately. sum vector Encrypt to obtain and And and The data is sent to device 101, the matrix holder P0. Device 101 needs to calculate separately. and Four items, calculated by For example, since the dot product "·" is not a homomorphic computation, it needs to be... Only after conversion to include at least one of the above homomorphic computations can it be based on Perform the calculation to obtain Therefore, for The computational workload is relatively large. In this related technology, it is necessary to calculate the inner product of four M / 2 row N / 2 column matrices and an N / 2 dimension vector, which is computationally intensive, consumes a lot of computing resources, and takes a lot of time.

[0058] This specification provides a scheme for calculating the inner product of a matrix and a vector among multiple parties. By having the vector holder convert the real vector into an N / 2-dimensional complex vector, the vector holder only needs to encrypt the N / 2-dimensional complex vector once to obtain the vector ciphertext, which is then sent to the matrix holder. Based on the matrix and vector ciphertext, the matrix holder can obtain the ciphertext of the inner product of the matrix and the vector through fewer homomorphic computations, saving computational resources and improving computational efficiency.

[0059] Figure 2This is a flowchart of a method for multi-party data processing in an embodiment of this specification. This method can be executed by a matrix holder device (hereinafter simply referred to as the matrix holder) and a vector holder device (hereinafter simply referred to as the vector holder).

[0060] As shown in Figure 2 In step S201, the vector holder first converts the real vector into an N / 2-dimensional complex vector.

[0061] Here, N is a parameter in the homomorphic encryption algorithm. As described above, the ciphertext polynomial space of the homomorphic encryption algorithm is an N-order polynomial space. Therefore, this homomorphic encryption algorithm is applicable to encrypting a vector of N / 2 dimensions, and obviously N is an even number. For the convenience of homomorphic calculation, the vector holder usually needs to convert the vector it holds into a vector of N / 2 dimensions and then encrypt it based on the homomorphic encryption algorithm. In the embodiment of this specification, the real vector is converted into an N / 2-dimensional complex vector and then encrypted based on the homomorphic encryption algorithm.

[0062] Specifically, in the first case, Figure 1 the matrix W in is an N-order square matrix, that is, m = n = N. In the second case, Figure 1 the matrix W in is an M×N matrix, where M < N. In either the first case or the second case, the vector holder can convert N / 2 real components in the N-dimensional real vector into the imaginary parts of the complex components in the N / 2-dimensional complex vector, thereby forming an N / 2-dimensional complex vector. For example, for the vector in formula (2), the corresponding complex vector X can be obtained through the following formula (4): That is, the latter N / 2 components in the vector

[0063]

[0064] are converted into the imaginary part in the complex vector X. It can be understood that the embodiment of this specification is not limited to obtaining the complex vector X as shown in formula (4). For example, the vector can be used as the imaginary part of the complex vector X, and the vector can be used as the real part of the complex vector X.

[0065]

[0066]

[0067]

[0068] That is, according to formula (5), it can be obtained that:

[0069] ​

[0070] Assume

[0071] Substituting Formula (6) and Formula (7) into Formula (8) gives the following Formula (9):

[0072]

[0073] Since

[0074] Substituting Formula (10) into Formula (9) gives Formula (11):

[0075]

[0076] Let Formula (12) can be obtained:

[0077]

[0078] Among them, in the first case, since matrices W 00 、W 01 、W 10 、W 11 are all square matrices of order N / 2, so matrices W0 and W1 are also square matrices of order N / 2. In the second case, since matrices W 00 、W 01 、W 10 、W[[ID=4.)]] 11 are all matrices of M / 2 rows and N / 2 columns, so matrices W0 and W1 are also matrices of M / 2 rows and N / 2 columns.

[0079] After obtaining Formula (12), by calculating the complex vector Y based on Formula (12), the vector and the vector are obtained, and the inner product of matrix W and vector is obtained Therefore, the matrix holder can calculate the inner product of matrix W and vector through Formula (12). Thus, since vector X is a complex vector of dimension N / 2, when the matrix holder calculates through Formula (12), only E(W0·X) and two terms need to be calculated to obtain E(Y), which greatly reduces the amount of calculation compared to the previous calculation method.

[0080] In the third case, Figure 1 the matrix W in is a matrix of N rows and M columns, where M < N and M divides N. In this case, for example, when N = 16 and M = 4, a complex vector of dimension M / 2 = 2 can be obtained first in a similar way to the above Formula (4), where x1 and x2 are based on the vector The complex components generated from the components in the matrix. Then, the N / M = 4 complex vectors X can be concatenated in the column direction to obtain an N / 2-dimensional complex vector Z: where Z is as shown in formula (13) for example:

[0081]

[0082] In this case, by using vector-based A complex vector is generated, and then the generated complex vectors are concatenated into an N / 2-dimensional complex vector to participate in the homomorphic encryption calculation. This reduces the inner product during subsequent homomorphic calculations. The number of terms to be calculated in the corresponding homomorphic computation formula (which will be described in detail below) can also reduce the amount of computation.

[0083] It is understood that the matrix in the matrix holding device in the embodiments of this specification is not limited to the three cases mentioned above. The number of rows m and the number of columns n of the matrix can be greater than N or less than N, respectively. Where the maximum value of m and n is greater than N, the vector can be divided into multiple matrices of any of the three cases mentioned above. Perform the appropriate partitioning (if necessary) to obtain the inner product. This is converted to an operation that includes at least one of the three cases mentioned above. In the case where the maximum value of m and n is less than N, this can be achieved by applying matrices W and / or vectors... Fill or splice to increase the inner volume Convert the operation to include at least one of the three cases mentioned above.

[0084] In step S203, the vector holder generates the ciphertext of the N / 2-dimensional complex vector.

[0085] The vector holder can pre-generate a public key pk and a private key sk for homomorphic encryption using the aforementioned key generation algorithm, store the public key pk and the private key sk, and provide the public key pk to the matrix holder.

[0086] After generating an N / 2-dimensional complex vector, the vector holder can first encode the complex vector using the aforementioned encoding algorithm to obtain an N-order plaintext polynomial. Then, using the aforementioned encryption algorithm and the public key pk, the plaintext polynomial is encrypted to obtain the corresponding ciphertext polynomial. This ciphertext polynomial also corresponds to the N / 2-dimensional complex vector and can therefore also be called the ciphertext of the N / 2-dimensional complex vector.

[0087] In step S205, the vector holder sends the ciphertext of the N / 2-dimensional complex vector to the matrix holder.

[0088] The vector holder protects the privacy data contained in the vector X held by the vector holder by sending the ciphertext of the complex vector to the matrix holder. Since the matrix holder does not have the private key sk, it cannot obtain the complex vector corresponding to the ciphertext.

[0089] In step S207, the matrix holder converts the inner product of the matrix and the vector into a calculation formula for an N / 2 parameter vector and an N / 2-dimensional complex vector.

[0090] For the first and second cases above, the matrix holder can obtain formula (12) through the same process as above. According to formula (12) and homomorphic addition, the matrix holder needs to calculate That is to say, the matrix holder needs to calculate E(W0·X) and two terms.

[0091] In the following, the inner product calculation method in the embodiments of this specification is described by taking the calculation of E(W0·X) as an example. It can be understood that can be calculated in the same way as the calculation of E(W0·X)

[0092] In the first case, assume N = 8, W0 is an N / 2-order square matrix, for example, a 4-order square matrix, and X is a 4-dimensional complex vector. Figure 3 Schematic diagram of the inner product calculation method for a 4-order square matrix and a 4-dimensional complex vector in the embodiments of this specification.

[0093] As Figure 3 shown, the matrix holder can split the matrix W0 into 4 parameter vectors along the diagonal direction of the matrix and

[0094] Among them, After this splitting, referring to the vector on the right side of the upper formula in Figure 3 , the calculation formula between the N / 2-dimensional parameter vector obtained by converting W0·X and the N / 2-dimensional complex vector X can be obtained as shown in formula (14):

[0095]

[0096] In the second case above, for the matrix W0 with M / 2 rows and N / 2 columns, M < N and M divides N. For example, M / 2 = 2, N / 2 = 8, that is, as shown in formula (15) and formula (16), W0 is a 2-row 8-column matrix and X is an 8-dimensional complex vector:

[0097]

[0098]

[0099] Can be as Figure 4The transformation shown is used to convert W0·X into a form suitable for homomorphic computation. Specifically, N / M (i.e., 8 / 2 = 4) matrices W0 are concatenated along their vertical direction (i.e., the column direction) to obtain an N-order square matrix. After such concatenation, it is possible to... Figure 4 The parameter vector is obtained from the diagonal direction of the N-order square matrix shown. and in,

[0100]

[0101] Then, W0·X can be transformed as follows:

[0102] First, based on vectors, formula (17) is used. and We obtain vector I:

[0103]

[0104] Then, vector J is obtained based on vector I using formula (18):

[0105] J=I+ρ(I;2)+ρ(I;4)+ρ(I;6) (18)

[0106] It can be easily verified that the first two components of vector J are exactly the inner product of W0·X. Therefore, W0·X can be calculated based on formulas (17) and (18).

[0107] In the third case above, for a matrix W0 with N / 2 rows and M / 2 columns, N > M, and M divides N. For example, N / 2 = 8, M / 2 = 2, that is, as shown in formulas (19) and (20), W0 is an 8-row, 2-column matrix, and X is a 2-dimensional complex vector:

[0108]

[0109]

[0110] Can Figure 5 The transformation shown is used to convert W0·X into a form involving homomorphic computation. Specifically, M / N (i.e., 8 / 2 = 4) matrices W0 are concatenated in their horizontal direction (i.e., the row direction) to obtain an N-order square matrix. After such concatenation, it is possible to... Figure 5 The parameter vector is obtained from the diagonal direction of the N-order square matrix shown. and in,

[0111]

[0112] Meanwhile, as mentioned earlier, concatenating the four vectors X along their column directions yields vector Z:

[0113]

[0114] After the above transformation, the calculation formula between the N / 2-dimensional parameter vector and the N / 2-dimensional complex vector Z can be obtained as shown in formula (21):

[0115]

[0116] In step S209, the matrix holder performs a homomorphic computation on the ciphertext of the complex vector based on the computation formula to generate ciphertext containing the inner product of the matrix and the vector.

[0117] Specifically, in the first case above, by performing homomorphic calculation based on formula (14), the following formula (22) can be obtained:

[0118]

[0119] Here, En() encodes the vector to obtain an Nth-order plaintext polynomial, and "*" represents multiplication between Nth-order polynomials. The matrix holder obtains the received E(X), the matrix, and the encoding algorithm... and Substituting into formula (22), we can calculate E(W0·X).

[0120] After receiving E(X), the matrix holder can obtain, according to the conjugate transformation, the following: The matrix holder can use matrix W and the above calculations to... The calculation is similar to the calculation of E(W0·X) above. Therefore, the ciphertext E(Y) containing the inner product of matrix W and vector X can be calculated.

[0121] In the second case described above, by performing homomorphic computation based on formulas (17) and (18), similarly to the above, after receiving E(X) from the vector holder, the matrix holder can calculate the ciphertext E(J) based on formulas (17), (18), and E(X). The ciphertext E(J) contains the inner product result of W0·X. The matrix holder can similarly calculate the inner product result of W0·X. The ciphertext E(K) can then be calculated, which contains the inner product of matrix W and vector X.

[0122] In the third scenario described above, after receiving E(Z) from the vector holder, the matrix holder can similarly calculate the ciphertext E(W0·X) based on formula (21) and E(Z). The matrix holder can similarly calculate the ciphertext... Therefore, the ciphertext E(Y) containing the inner product of matrix W and vector X can be calculated.

[0123] In step S209, the matrix holding direction vector holder sends the implied... The encrypted text.

[0124] In the first and third cases mentioned above, the matrix holder will calculate the inner product. The ciphertext E(Y) is sent to the vector holder. In the second case above, the matrix holder calculates the ciphertext E(Y) and sends it to the vector holder. The corresponding ciphertext E(J)+E(K) is sent to the vector holder.

[0125] In step S213, the vector holder processes the ciphertext containing the inner product using a homomorphic encryption algorithm to obtain the inner product.

[0126] Specifically, for the first and third scenarios mentioned above, the vector holder first decrypts the ciphertext (i.e., the Nth-order ciphertext polynomial) E(Y) to obtain the Nth-order plaintext polynomial. Then, the Nth-order plaintext polynomial is decoded using a decoding algorithm to obtain an N / 2-dimensional complex vector Y. The vectors in the complex vector Y are then... sum vector Substituting into formula (5), we can obtain the matrix W and the vector. inner product

[0127] In the second scenario described above, the vector holder first decrypts the ciphertext (i.e., the Nth-order ciphertext polynomial) E(J) + E(K) to obtain the Nth-order plaintext polynomial. Then, the Nth-order plaintext polynomial is decoded using a decoding algorithm to obtain an N / 2-dimensional complex vector. The first M / 2 dimensions of this N / 2-dimensional complex vector are then taken to obtain an M / 2-dimensional complex vector Y. The vectors in the complex vector Y are then... sum vector Substituting into formula (5), we can obtain the matrix W and the vector. inner product

[0128] Figure 6 This is a structural diagram of a first-party device in a multi-party data processing system according to an embodiment of this specification. The multi-party system includes a first party and a second party. The first party has a real number vector, and the second party has a first matrix for performing an inner product with the real number vector. The first device includes:

[0129] Conversion unit 61 is used to convert the real number vector into an N / 2-dimensional complex vector;

[0130] The generation unit 62 is used to generate the first ciphertext of the complex vector based on the public key using a homomorphic encryption algorithm, wherein N is a preset parameter value corresponding to the homomorphic encryption algorithm;

[0131] Sending unit 63 is used to send the first ciphertext to the device of the second party;

[0132] The receiving unit 64 is configured to receive from the second party's device a second ciphertext containing the inner product of the first matrix and the real vector. The second ciphertext is obtained by performing a homomorphic computation on the first ciphertext based on a calculation formula of an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector. The N / 2-dimensional parameter vector is determined based on the first matrix.

[0133] The processing unit 65 is configured to process the second ciphertext using the private key corresponding to the public key according to the homomorphic encryption algorithm, so as to obtain the inner product of the first matrix and the real number vector.

[0134] Figure 7 This is a structural diagram of a second-party device in a multi-party data processing system according to an embodiment of this specification. The multi-party system includes a first party and a second party. The first party has a real number vector, and the second party has a first matrix for performing an inner product with the real number vector. The second-party device includes:

[0135] The receiving unit 71 is configured to receive a first ciphertext from the first party's device. The first ciphertext is an N / 2-dimensional complex vector generated based on a public key using a homomorphic encryption algorithm. The N / 2-dimensional complex vector is generated based on the real number vector, and N is a preset parameter value corresponding to the homomorphic encryption algorithm.

[0136] The conversion unit 72 is used to convert the inner product of the first matrix and the real vector into a calculation formula for an N / 2-dimensional parameter vector and the N / 2-dimensional complex vector, wherein the N / 2-dimensional parameter vector is determined based on the first matrix;

[0137] The calculation unit 73 is used to perform homomorphic computation on the first ciphertext based on the calculation formula to generate a second ciphertext containing the inner product of the first matrix and the real number vector.

[0138] The sending unit 74 is used to send the second ciphertext to the device of the first party.

[0139] This specification also provides a computer-readable storage medium storing a computer program thereon, which, when executed in a computer, causes the computer to perform actions such as... Figure 2 The method shown.

[0140] This specification also provides a computing device in its embodiments, including a memory and a processor. The memory stores executable code, and when the processor executes the executable code, it implements, as described above. Figure 2 The method shown.

[0141] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0142] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0143] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0144] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0145] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0146] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0147] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0148] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0149] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0150] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0151] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0152] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0154] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0155] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing a real number vector, and the second party possessing a first matrix for performing an inner product with the real number vector, the method comprising: The first device converts the real vector into an N / 2-dimensional complex vector, generates the first ciphertext of the complex vector using a homomorphic encryption algorithm, and sends the first ciphertext to the second device, where N is a preset parameter value corresponding to the homomorphic encryption algorithm; The second-party device converts the inner product of the first matrix and the real vector into a first formula, which includes the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector. Based on the second matrix and the third matrix, the N / 2-dimensional parameter vector is determined. The first formula is then converted into a calculation formula for the N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector. Based on the calculation formula, a homomorphic computation is performed on the first ciphertext to generate a second ciphertext containing the inner product of the first matrix and the real vector. The second ciphertext is then sent to the first-party device. The first party's device processes the second ciphertext according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real number vector.

2. The method according to claim 1, wherein the real vector is an N-dimensional vector, and the device of the first party converts the real vector into an N / 2-dimensional complex vector, comprising: The first device converts either the first half or the second half of the real vector into the imaginary part of the N / 2-dimensional complex vector.

3. The method according to claim 1, wherein the real number vector is an M-dimensional vector, M is less than N, and M divides N, and the device of the first party converts the real number vector into an N / 2-dimensional complex vector, comprising: The first party's device converts the first half or the second half of the real vector into the imaginary part of the M / 2-dimensional complex vector, and concatenates N / M M / 2-dimensional complex vectors into an N / 2-dimensional complex vector.

4. The method according to claim 1, wherein the calculation formula includes at least one of vector multiplication, vector addition, constant vector multiplication, conjugate transformation and rotation transformation.

5. The method of claim 2, wherein the second matrix and the third matrix are N / 2- order square matrices, and wherein determining the N / 2-dimensional parameter vector based on the second matrix and the third matrix comprises: The N / 2-dimensional parameter vector is determined from the diagonal directions of the second and third matrices.

6. The method of claim 2, said second matrix being a M / 2 by N / 2 matrix, where, If M is less than N and M divides N, the step of determining the N / 2-dimensional parameter vector based on the second matrix and the third matrix includes: concatenating N / M of the second matrices in their vertical direction to obtain an N / 2-order square matrix, and determining the N / 2-dimensional parameter vector from the diagonal direction of the N / 2-order square matrix.

7. The method of claim 3, said second matrix being an N / 2 by M / 2 matrix, where, If M is less than N and M divides N, the step of determining the N / 2-dimensional parameter vector based on the second matrix and the third matrix includes: concatenating N / M of the second matrices in their horizontal direction to obtain an N / 2-order square matrix, and determining the N / 2-dimensional parameter vector from the diagonal direction of the N / 2-order square matrix.

8. The method of claim 1, wherein, The first party is the database holder, the second party is the data querying party, and the real number vector is used to indicate the data to be queried in the first matrix.

9. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing a real number vector, the second party possessing a first matrix for performing an inner product with the real number vector, the method being executed by a first party device, comprising: Convert the real number vector into an N / 2-dimensional complex vector; The first ciphertext of the complex vector is generated by a homomorphic encryption algorithm, where N is a preset parameter value corresponding to the homomorphic encryption algorithm; Send the first ciphertext to the second party's device; The device receives a second ciphertext containing the inner product of the first matrix and the real vector. The second ciphertext is obtained by performing a homomorphic computation on the first ciphertext using a formula based on an N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector. The formula is obtained by a first formula transformation, which is obtained by a transformation of the inner product of the first matrix and the real vector. The first formula includes the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector. The N / 2-dimensional parameter vector is determined based on the second matrix and the third matrix. The second ciphertext is processed according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real number vector.

10. A privacy-preserving multi-party data processing method, wherein the multi-party includes a first party and a second party, the first party possessing a real number vector, the second party possessing a first matrix for performing an inner product with the real number vector, the method being executed by a second-party device, comprising: The device of the first party receives a first ciphertext, which is the ciphertext of an N / 2-dimensional complex vector generated by a homomorphic encryption algorithm. The N / 2-dimensional complex vector is generated based on the real number vector, and N is a preset parameter value corresponding to the homomorphic encryption algorithm. The inner product of the first matrix and the real vector is converted into a first formula, which includes the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector. The N / 2-dimensional parameter vector is determined based on the second matrix and the third matrix. The first formula is then converted into a calculation formula for the N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector. Based on the calculation formula, a homomorphic computation is performed on the first ciphertext to generate a second ciphertext containing the inner product of the first matrix and the real number vector; The second ciphertext is sent to the first party's device.

11. A privacy-preserving multi-party data processing system, wherein the multi-party includes a first party and a second party, the first party possessing a real-valued vector, and the second party possessing a first matrix for performing an inner product with the real-valued vector. The first device is used to: convert the real number vector into an N / 2-dimensional complex vector, generate a first ciphertext of the complex vector using a homomorphic encryption algorithm, and send the first ciphertext to the second device, wherein N is a preset parameter value corresponding to the homomorphic encryption algorithm; The second-party device is configured to: convert the inner product of the first matrix and the real vector into a first formula, the first formula including the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector; determine the N / 2-dimensional parameter vector based on the second matrix and the third matrix; convert the first formula into a calculation expression for the N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector; perform homomorphic computation on the first ciphertext based on the calculation expression to generate a second ciphertext containing the inner product of the first matrix and the real vector; and send the second ciphertext to the first-party device. The device of the first party is further configured to: process the second ciphertext according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real number vector.

12. A first-party device in a multi-party data processing system, the multi-party comprising a first party and a second party, the first party having a real-valued vector, and the second party having a first matrix for performing an inner product with the real-valued vector, the first-party device comprising: A conversion unit is used to convert the real number vector into an N / 2-dimensional complex vector; The generation unit is used to generate the first ciphertext of the complex vector using a homomorphic encryption algorithm, where N is a preset parameter value corresponding to the homomorphic encryption algorithm. A sending unit is configured to send the first ciphertext to the device of the second party; The receiving unit is configured to receive from the second party's device a second ciphertext containing the inner product of the first matrix and the real vector. The second ciphertext is obtained by performing a homomorphic calculation on the first ciphertext using a formula based on an N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector. The formula is obtained by a first formula transformation, which is obtained by a transformation of the inner product of the first matrix and the real vector. The first formula includes the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector. The N / 2-dimensional parameter vector is determined based on the second matrix and the third matrix. The processing unit is configured to process the second ciphertext according to the homomorphic encryption algorithm to obtain the inner product of the first matrix and the real number vector.

13. A second-party device in a multi-party data processing system, the multi-party comprising a first party and a second party, the first party having a real vector, the second party having a first matrix for performing an inner product with the real vector, the second-party device comprising: The receiving unit is configured to receive first ciphertext from the first party's device. The first ciphertext is the ciphertext of an N / 2-dimensional complex vector generated by a homomorphic encryption algorithm. The N / 2-dimensional complex vector is generated based on the real number vector, and N is a preset parameter value corresponding to the homomorphic encryption algorithm. The conversion unit is used to convert the inner product of the first matrix and the real vector into a first formula, wherein the first formula includes the inner product of the second matrix and the complex vector, and the inner product of the third matrix and the conjugate vector of the complex vector; the N / 2-dimensional parameter vector is determined based on the second matrix and the third matrix; and the first formula is converted into a calculation formula for the N / 2-dimensional parameter vector, the N / 2-dimensional complex vector, and the conjugate vector of the N / 2-dimensional complex vector. A computing unit is configured to perform homomorphic computation on the first ciphertext based on the computation formula to generate a second ciphertext containing the inner product of the first matrix and the real vector. A sending unit is used to send the second ciphertext to the device of the first party.

14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of claim 9 or 10.

15. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of claim 9 or 10.

Images