A verifiable, privacy-preserving machine learning classifier system

Abstract

This invention provides a verifiable, privacy-preserving machine learning classifier system. It utilizes a given, pre-trained machine learning classifier on privacy-preserving data, employing either one of two privately delegated schemes or a publicly delegated scheme. This invention provides a verifiable, privacy-preserving machine learning classifier system that simultaneously achieves data privacy and verifiability, and offers multiple schemes to meet the needs of different application scenarios, thus possessing significant application value.

Description

Technical Field

[0001] This invention relates to a verifiable, privacy-preserving machine learning classifier system. Background Technology

[0002] Machine learning classifiers have been widely applied in fields such as disease diagnosis, facial recognition, and banking lending, which often involve massive amounts of data. Storing data locally and performing calculations on it requires significant computing and storage resources. With the increasing sophistication and maturity of cloud service technology, and the decreasing cost of cloud services, many hospitals, banks, and other institutions are inclined to entrust their data storage and maintenance to cloud servers. However, this has also brought about some security issues.

[0003] First, the data entrusted by institutions such as banks and hospitals may be highly private, such as patients' vital signs data or bank customers' financial data. This entrusted private data could be accessed by cloud servers or attackers from outside the cloud server, posing a significant risk of data leakage. While encrypting data into ciphertext using traditional encryption methods such as RSA and AES can protect data privacy, machine learning classifiers cannot be applied to RSA or AES encrypted ciphertext.

[0004] Furthermore, when institutions request cloud servers to apply machine learning classifiers to large amounts of data, the cloud servers may return incorrect calculation results in order to reduce workload or if they are hijacked by malicious attackers. Existing technical solutions cannot simultaneously solve the above security problems, namely, providing the following important characteristics: 1) Data privacy: achieving semantic security in protecting private data; 2) Verifiability: the correctness of the cloud server's calculation results can be verified. Depending on the application scenario, it is divided into private delegation and public delegation. Private delegation only allows one institution holding the private key to delegate data. For example, a hospital delegates patients' individual vital sign data to a server, then requests the server to apply a machine learning classifier to this data and use the classification results to help determine the patient's condition. Public delegation allows any institution holding the public key to delegate data. For example, multiple banks delegate customers' financial data to a server, then request the server to apply a machine learning classifier to this data and use the classification results to decide whether to grant loans to customers. Summary of the Invention

[0005] The purpose of this invention is to provide a machine learning classifier system that can simultaneously satisfy data privacy and verifiability, and can provide corresponding delegation methods according to different use scenarios.

[0006] To achieve the above objectives, one technical solution of the present invention provides a verifiable privacy-preserving machine learning classifier system that uses a given, pre-trained machine learning classifier on privacy data. The system is characterized by including a client that provides data and wants to obtain the computation results, and m cloud servers that do not need to communicate. It employs either of two private delegated schemes, wherein the operation of one of the private delegated schemes includes the following steps:

[0007] Step 101: Generate a public key pk, a private key sk, and a verification key vk = (vk1, ..., vk) based on the security parameter λ. m In this process, the public key pk is sent to the client and all m cloud servers, while the private key sk and the verification key vk are sent only to the client.

[0008] Step 102: The client uses the private key sk to transfer the private data x i Encrypt into m ciphertexts s i,1 ,…, i,m Among them, the j-th ciphertext s i,j It is sent to the j-th cloud server, j = 1, ..., m;

[0009] Step 103: The j-th cloud server uses the public key pk and the ciphertext s 1,j ,…, b,j The function f calculates and sends a partial result y. j and y j The tag τ j For the client;

[0010] Step 104: The client uses vk = (vk1, ... vk) m The verification key vk in ) j and tag τ j Verify the calculated result y j Correctness: If the result y1,…, is calculated for all parts m If the verification is successful, the client uses the private key sk and y1,…, m Reconstruct the calculation result y; otherwise, the client assumes that part of the calculation returned by the server contains an error.

[0011] Another privately delegated scheme involves the following steps:

[0012] Step 201: Generate the public key pk and private key sk of the homomorphic encryption algorithm based on the security parameter λ, and generate the verification key vk. The public key pk is sent to the client and all m servers, while the private key sk and verification key vk are only sent to the client.

[0013] Step 202: The client uses the public key pk and the verification key vk to transfer the private data x.i Encrypt into m ciphertexts s i,1 ,…,s i,m Among them, the j-th ciphertext s i,j It is sent to the j-th cloud server, j = 1, ..., m;

[0014] Step 203: The j-th cloud server uses the public key pk and the ciphertext s 1,j ,…, n,j The function f calculates and sends a partial result y. j The ciphertext and the calculation result y j The tag τ j The encrypted message is sent to the client;

[0015] Step 204: The client calculates based on partial results y1,… m The ciphertext, tag τ1,..., m The ciphertext is used to calculate the ciphertext of the calculation result y and the ciphertext of the tag τ;

[0016] Step 205: The client uses the private key sk to decrypt the ciphertext of the calculation result y and the ciphertext of the tag τ to obtain the calculation result y and the tag τ;

[0017] Step 206: The client uses the private verification key vk to check whether vk·y is equal to τ: if they are equal, the client considers the calculation result y to be correct; otherwise, the client considers the calculation result y to be incorrect.

[0018] Another technical solution of the present invention is to provide a verifiable privacy-preserving machine learning classifier system, which uses a given pre-trained machine learning classifier on privacy data. The system is characterized by comprising several clients providing data, one client wanting to obtain the computation results, and m cloud servers that do not require communication. It employs a publicly delegated scheme, the operation of which includes the following steps:

[0019] Step 301: Generate the public key pk and private key sk of the homomorphic encryption algorithm based on the security parameter λ, and generate the verification key vk. The public key pk is sent to all clients that provide data and all m servers, while the private key sk and verification key vk are only sent to the clients that want to obtain the calculation results.

[0020] Step 302: All clients providing data use the public key pk to transfer the private data x i Encrypt into m ciphertexts s i,1 ,…, i,m Among them, the j-th ciphertext s i,j It is sent to the j-th cloud server, j = 1, ..., m;

[0021] Step 303: The j-th cloud server uses the public key pk and the ciphertext s 1,j ,…, n,j The function f calculates and sends a partial result y. j ciphertext, y j The tag τ j The encrypted message is given to the client holding the private key sk and the verification key vk;

[0022] Step 304: The client holding the private key sk and the verification key vk calculates the results y1,…, m The ciphertext, tag τ1,..., m The ciphertext is used to calculate the ciphertext of the calculation result y and the ciphertext of the tag τ;

[0023] Step 305: The client that wants to obtain the calculation result uses the private key sk to decrypt the ciphertext of the calculation result y and the ciphertext of the tag τ to obtain the calculation result y and the tag τ.

[0024] Step 306: The client that wants to obtain the calculation result uses the private verification key vk to check whether vk·y is equal to τ: if the two are equal, the current client believes that the calculation result y is correct; otherwise, the current client believes that the calculation result y is incorrect.

[0025] This invention provides a verifiable and privacy-preserving machine learning classifier system that achieves both data privacy and verifiability, and offers multiple solutions to meet the needs of different application scenarios, thus possessing strong application value. Attached Figure Description

[0026] Figure 1 The principle of the present invention is illustrated. Detailed Implementation

[0027] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0028] In verifiable, privacy-preserving machine learning classifier systems, the machine learning classifier has already been trained. This invention only discusses how to use a given machine learning classifier on privacy-preserving data. A machine learning classifier can be transformed into a multivariate polynomial function f(x1,…, n ), where x i This is private data, i = 1, ..., n.

[0029] like Figure 1As shown, this embodiment discloses a verifiable, privacy-preserving machine learning classifier system employing three schemes to meet the needs of different application scenarios. All three schemes achieve data privacy and verifiability. Schemes 1 and 2 are both private, delegated schemes. Both schemes include a client providing data and wanting to obtain the computation result, and several cloud servers that do not need to communicate. The differences between these two schemes are as follows: the computational load on the cloud server side in Scheme 1 is much smaller than that in Scheme 2; the computational load on the client side in Scheme 2 is much smaller than that on the client side in Scheme 1. Therefore, Scheme 1 is suitable for scenarios where the client has certain computing resources and needs to obtain the computation result from the cloud server in the shortest possible time. Scheme 2 is suitable for scenarios where the client lacks computing resources and does not need the cloud server to quickly return the computation result. Scheme 3 is a publicly delegated scheme, which includes several clients providing data, a client wanting to obtain the computation result, and several cloud servers that do not need to communicate. Scheme 3 is suitable for scenarios where multiple clients need to delegate data.

[0030] The operation process of Option 1 is as follows:

[0031] Step 1: Generate a public key pk, a private key sk, and a verification key vk = (vk1, ... vk) based on the security parameter λ. m ), where: the public key pk will be sent to the client and all m servers, while the private key sk and the verification key vk will only be sent to the client.

[0032] Step 2: The client uses the private key sk to transfer the private data x i Encrypt into m ciphertexts s i,1 ,…, i,m The j-th ciphertext s i,j It will be sent to the j-th cloud server, where j = 1, ..., m.

[0033] Step 3: The j-th cloud server uses the public key (pk) and ciphertext (s) to perform a key-based authentication process. 1,j ,…, n,j The function f calculates and sends a partial result y. j And the calculation result y j The tag τ j For the client.

[0034] Step 4: The client uses vk = (vk1, ... vk) m vk in ) j and tag τ j Verify the calculated result y j Correctness: If the calculation results y1,…,y are applied to all parts... m If the verification is successful, the client will use the private key sk and y1,…,y mReconstruct the calculation result y; otherwise, the client assumes that part of the calculation returned by the server contains an error.

[0035] The operation process of Option 2 is as follows:

[0036] Step 1: Generate the public key pk and private key sk of the homomorphic encryption algorithm based on the security parameter λ, and generate the verification key vk. The public key pk will be sent to the client and all m servers, while the private key sk and verification key vk will only be sent to the client.

[0037] Step 2: The client uses the public key pk and the verification key vk to transfer the private data x. i Encrypt into m ciphertexts s i,1 ,…,s i,m Among them, the j-th ciphertext s i,j It will be sent to the j-th cloud server, where j = 1, ..., m.

[0038] Step 3: The j-th cloud server uses the public key (pk) and ciphertext (s) to perform a key-based authentication process. 1,j ,…,s n,j The function f calculates and sends a partial result y. j The ciphertext and the calculation result y j The tag τ j The encrypted message is sent to the client.

[0039] Step 4: The client calculates based on partial results y1,…,y m The encrypted text, tags τ1,…,τ m The client uses its private key sk to calculate the ciphertext of the result y and the ciphertext of the tag τ. The client then uses its private verification key svk to check if svk·y equals τ: if they are equal, the client considers the calculated result y to be correct; otherwise, the client considers the calculated result y to be incorrect.

[0040] The operation process of Option 3 is as follows:

[0041] Step 1: Generate the public key pk and private key sk of the homomorphic encryption algorithm based on the security parameter λ, and generate the verification key vk. The public key pk will be sent to all clients and all m servers, while the private key sk and verification key vk will only be sent to a specific client.

[0042] Step 2: All clients use public key PK to transfer private data. i Encrypt into m ciphertexts s i,1 ,…,s i,m Among them, the j-th ciphertext s i,j It will be sent to the j-th cloud server, where j = 1, ..., m.

[0043] Step 3: The j-th cloud server uses the public key (pk) and ciphertext (s) to perform a key-based authentication process. 1,j ,…,s n,j The function f calculates and sends a partial result y. j ciphertext, y j The tag τ j The encrypted message is given to the client holding sk and vk.

[0044] Step 4: The client holding sk and vk calculates the partial results y1,…,y m The encrypted text, tags τ1,…,τ m The client uses its private key sk to calculate the ciphertext of the result y and the ciphertext of the tag τ. The client then uses its private verification key vk to check if vk·y equals τ: if they are equal, the client considers the calculated result y to be correct; otherwise, the client considers the calculated result y to be incorrect.

[0045] The above three solutions will be further explained using image data collected by sensing devices in the Internet of Things, medical data collected by hospitals, and customer financial data from multiple banks as examples.

[0046] IoT sensors (cameras) collect facial information data. A trained machine learning classifier can then be used for facial recognition. In this scenario, a convolutional neural network can be transformed into a multinomial function, with the facial information data serving as the input to this function. The sensor encrypts and sends the multinomial function and the encrypted facial information data to all cloud servers, and uses a private key to verify the partial computation results returned by each cloud server. If all partial computation results pass verification, the sensor uses these partial computation results to recover the computation result y; otherwise, the sensor considers that a cloud server has returned an incorrect result and will not use these partial computation results to recover y.

[0047] The hospital collects patients' medical data. A trained machine learning classifier can then be used for disease diagnosis. In this scenario, the machine learning classifier can be transformed into a polynomial function, with the medical data serving as input. The hospital sends the polynomial function and the encrypted medical data to all cloud servers. After receiving ciphertexts of partial computation results and labels from all cloud servers, the hospital calculates the ciphertext of the computation result y and the ciphertext of the label τ. Then, the hospital uses its private key to decrypt the ciphertexts of y and τ to obtain y and τ. The hospital uses the verification key vk and the label τ to verify the correctness of the computation result y.

[0048] Multiple banks hold customer financial data. A trained machine learning classifier can be used to decide whether to lend to a customer. In this scenario, the machine learning classifier can be transformed into a polynomial function, with the customer's financial data as input. Multiple banks send the polynomial function and encrypted customer financial data to all cloud servers. A particular bank (the lending bank), after receiving ciphertexts of partial computation results and labels from all cloud servers, calculates the ciphertext of the computation result y and the ciphertext of the label τ. Then, the bank uses its private key to decrypt the ciphertext of y and the ciphertext of the label τ to obtain y and τ. The bank uses the verification key vk and the label τ to verify the correctness of the result y.

Claims

1. A verifiable, privacy-preserving machine learning classifier system using a given machine learning classifier that has been trained on private data, characterized in that, The method comprises the following steps of: a client providing data and wanting to obtain a calculation result and m cloud servers without communication, and any one of two private delegable schemes is adopted, and a running process of one of the private delegable schemes comprises the following steps. Step 101, generating a public key pk, a private key sk and a verification key vk=(vk1,...,vk m ), according to a security parameter λ, wherein: the public key pk is sent to the client and all m cloud servers, and the private key sk and the verification key vk are only sent to the client; Step 102, the client uses the private key sk to encrypt the privacy data x i into m ciphertexts s i，1， ... i,m wherein the jth ciphertext s i,j is sent to the jth cloud server, j = 1,..., m; Step 103, the jth cloud server calculates and sends the partial calculation result y 1,j and the label τ n,j of the calculation result y j to the client according to the public key pk, the ciphertext s j and the function f. j ​ Step 104: The client uses vk = (vk1, ... vk) m The verification key vk in ) j and tag τ j Verify the calculated result y j Correctness: If the result y1, ..., y is calculated for all parts... m If the verification is successful, the client uses the private key sk and y1, ..., y m Reconstruct the calculation result y; otherwise, the client assumes that part of the calculation returned by the server contains an error. A running process of another private delegable scheme comprises the following steps. In step 201, a public key pk and a private key sk of a homomorphic encryption algorithm are generated according to a security parameter λ, and a verification key vk is generated, wherein the public key pk is sent to the client and all m servers, and the private key sk and the verification key vk are only sent to the client. Step 202, the client uses the public key pk and the verification key vk to encrypt the privacy data x i into m ciphertexts s i，1 ,..., s i,m , where the jth ciphertext s i,j is sent to the jth cloud server, j = 1,..., m; Step 203, the jth cloud server calculates and sends the ciphertext of the partial calculation result y 1,j and the ciphertext of the label τ n,j of the calculation result y j to the client according to the public key pk, the ciphertext s j and the function f. j ​ Step 204, the client calculates the ciphertext of the calculation result y and the ciphertext of the tag τ according to the partial calculation results y1,..., y m m the ciphertext of the tag τ1,..., τ​ In step 205, the client uses the private key sk to decrypt the ciphertext of the calculation result y and the ciphertext of the label τ to obtain the calculation result y and the label τ. In step 206, the client uses the private verification key vk to check whether vk·y is equal to τ: if the two are equal, the client considers that the calculation result y is correct; otherwise, the client considers that the calculation result y is incorrect.

2. A verifiable, privacy-preserving machine learning classifier system using a given machine learning classifier that has been trained on private data, characterized in that, The method comprises the following steps of: a plurality of clients providing data, a client wanting to obtain a calculation result and m cloud servers without communication, and a public delegable scheme is adopted, and a running process of the public delegable scheme comprises the following steps. In step 301, a public key pk and a private key sk of a homomorphic encryption algorithm are generated according to a security parameter λ, and a verification key vk is generated, wherein the public key pk is sent to all data-providing clients and all m servers, and the private key sk and the verification key vk are only sent to the client wanting to obtain the calculation result. Step 302, all clients providing data use the public key pk to encrypt the privacy data x i into m ciphertexts s i，1 ,..., s i,m , where the jth ciphertext s i,j is sent to the jth cloud server, j = 1,..., m; Step 303: The j-th cloud server uses the public key pk and the ciphertext s 1,j , ..., s n,j The function f calculates and sends a partial result y. j ciphertext, y j The tag τ j The encrypted message is given to the client holding the private key sk and the verification key vk; Step 304, the client holding the private key sk and the verification key vk calculates the ciphertext of the calculation result y, the ciphertext of the tag τ from the partial calculation results y1,..., y m , the ciphertexts of the tags τ1,..., τ m . In step 305, the client wanting to obtain the calculation result uses the private key sk to decrypt the ciphertext of the calculation result y and the ciphertext of the label τ to obtain the calculation result y and the label τ. In step 306, the client wanting to obtain the calculation result uses the private verification key vk to check whether vk·y is equal to τ: if the two are equal, the current client considers that the calculation result y is correct; otherwise, the current client considers that the calculation result y is incorrect.

Images