A privacy-preserving computation method and a privacy-preserving computation system

Abstract

This invention discloses a privacy-preserving computation method, comprising the following steps: S1, recruiting at least two participants; S2, simultaneously performing computation directly on multiple encrypted ciphertexts; S3, the message sender sending one message from the pending messages to the receiver; S4, performing zero-knowledge proof on the acquired content information; S5, building a model using a federated learning system; S6, training a machine learning model using these data; and S7, training locally using their respective datasets. This invention ensures that basic data and information are not leaked, while achieving high computational accuracy and supporting programmable general-purpose computation. For each participating party, this method avoids directly leaking privacy data and can be used independently for privacy computation or combined with other technologies to protect privacy. It is an important technical means, especially for scenarios such as secure and trusted cloud computing, large-scale data confidentiality collaboration, high performance, and general-purpose privacy computation.

Description

Technical Field

[0001] This invention belongs to the field of privacy computing technology, and more specifically, relates to a privacy computing method. This invention also relates to a privacy computing system. Background Technology

[0002] Privacy-preserving computation refers to a set of technologies that enable data analysis and computation while protecting the data itself from external disclosure. Current privacy-preserving computation involves the joint innovation of three major technological systems: artificial intelligence algorithms, distributed systems and underlying hardware, and cryptographic protocol design. Compared to traditional data usage methods, the encryption mechanisms of privacy-preserving computation can enhance data protection and reduce the risk of data leakage.

[0003] A search revealed a patent application (application number 202111022108.7) disclosing a privacy computation method, comprising the following steps: Participants each decompose their individual privacy number into N addends, retaining one addend and distributing the remaining addends to other participants for storage; a neural network model is established to fit the objective function, and the 0th and 1st layers of the neural network model are disclosed to all participants; each participant obtains the input number calculation formula for the neurons in the 1st layer; each participant substitutes the addends corresponding to their stored privacy number into the input number calculation formula for the neurons in the 1st layer, and broadcasts the calculation results; the results of all broadcasts are summed to obtain the input number of the neurons; after obtaining the outputs of all neurons in the 1st layer, the neural network model is further calculated to obtain the output of the neural network model, which is the result of the objective function. The substantial advantages of this invention are: high computational efficiency, low communication bandwidth requirements, and wide applicability.

[0004] While the above scheme improves the computational efficiency of privacy computing and has low requirements for communication bandwidth, the data security of this scheme is not high, and there is a risk of data and information leakage. In addition, the computing method is not very universal and is not easy to combine with other technologies to protect privacy. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies. Based on cryptographic security, its security is rigorously proven by cryptographic theory. It does not rely on trust in any participant, operator, system, hardware, or software. Each participant has absolute control over the data they possess, ensuring that basic data and information are not leaked. At the same time, it has high computational accuracy and supports programmable general-purpose computing. For each participant, this approach neither directly leaks private data nor increases the amount of training data. It can be used independently for privacy computing or combined with other technologies to protect privacy. It is an important technical means, especially for scenarios involving big data, high performance, and general-purpose privacy computing, such as secure and trusted cloud computing, large-scale data confidential collaboration, and privacy-preserving deep learning. This invention proposes a privacy computing method and a privacy computing system.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a privacy computing method, comprising the following steps:

[0007] S1. Recruit at least two participants and split each participant's secret into N parts. Each participant keeps one part, and the remaining parts are managed by different participants. The secret is then encrypted to form ciphertext.

[0008] S2. Simultaneously, calculations are performed directly on multiple encrypted ciphertexts. Each gate in the calculation circuit is encrypted and scrambled to ensure that the original and intermediate data of the calculation are not leaked during the encryption calculation process. Both parties perform calculations in sequence according to their respective inputs. The decryptor can obtain the final correct result and compare the decrypted result with the plaintext so that the decryptor can know the final decryption result.

[0009] S3. Then the message sender sends one of the messages to be sent to the receiver, but the receiver cannot get the remaining data except for the content it has received, and the sender does not know the content that has been selected.

[0010] S4. Perform zero-knowledge proofs on the acquired information, so that the prover can convince the verifier that a certain statement is correct without providing the verifier with any useful information.

[0011] S5. Use a federated learning system to build a model. Utilize encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and without exposing non-overlapping users, so as to jointly model the features of these users.

[0012] S6. After identifying the common user group, the data can be used to train the machine learning model. In order to ensure the confidentiality of the data during the training process, it is necessary to use a third-party collaborator C for encrypted training.

[0013] S7. Training is performed locally using each participant's own dataset. Throughout the training process, the data of each participant remains on their local machine. The gradient and weight information of the model are uploaded to the central server for aggregation and segmentation. This does not directly leak private data, nor does it increase the amount of training data, thus completing the training task.

[0014] Preferably, in S2, homomorphic encryption technology can be used to calculate multiple ciphertexts before decryption, avoiding the high computational cost of decrypting each ciphertext individually. Homomorphic encryption technology can also be used to calculate ciphertexts without a key party, as the ciphertext calculation does not need to go through the key party. This reduces communication costs and transfers computational tasks, thereby balancing the computational costs for all parties.

[0015] Preferably, in S3, message sending includes the following steps: 1) The sender generates two pairs of public and private keys and sends the two public keys puk0 and puk1 to the receiver; 2) The receiver generates a random number, encrypts the random number with one of the two received public keys, and sends the ciphertext result to the sender; 3) The sender decrypts the received random number ciphertext with its two private keys respectively, and obtains two decryption results k0 and k1. The sender then XORs the two results with the two messages to be sent, and sends the two results e0 and e1 to the receiver; 4) The receiver XORs its own real random number with the received e0 and e1 respectively. Of the two results obtained, only one is real data, and the other is a random number.

[0016] Preferably, in S6, the encrypted training process includes the following steps: a) Collaborator C distributes the public key to A and B to encrypt the data that needs to be exchanged during the training process; b) A and B exchange intermediate results for gradient calculation in encrypted form; c) A and B calculate their respective gradient values ​​based on the decrypted intermediate information, and then A and B upload the calculated gradient values ​​of X1, X2, X3, and X4 to C, and C calculates the new parameters of the model based on the gradient values; d) C sends the four new parameters back to A and B, that is, updates the models of A and B for a new round of iteration.

[0017] This invention also provides a privacy-preserving computing system, including a multi-party secure computing module, a federated learning module, a confidential computing module, and a differential privacy module. The multi-party secure computing module allows participants to use their private data to participate in confidential computing and jointly complete a computational task without disclosing their own private data. The federated learning module uses a central server as a central node and exchanges network information with multiple local servers participating in training to update and iterate the artificial intelligence model. The confidential computing module is a hardware-based technology that isolates data, specific functions, and applications from the operating system, system administrators or virtual machine managers, and other specific processes, storing data in a trusted execution environment. Even with a debugger, the data cannot be viewed or operations performed externally. The differential privacy module removes individual characteristics while preserving statistical features to ensure user privacy.

[0018] The multi-party secure computation module includes a secret sharing unit, a homomorphic encryption unit, an unintended transmission unit, a zero-knowledge proof unit, and a confusion circuit; the federated learning module includes an encrypted sample alignment unit, an encrypted model training unit, and an effect incentive unit; the core functions of the confidential computation module are to protect the confidentiality of data, the integrity of data, and the security of data.

[0019] Preferably, the secret-sharing unit divides the secret in an appropriate manner, with each share managed by a different participant. A single participant cannot recover the secret information; only through the collaboration of several participants can the secret message be recovered. Furthermore, the secret remains intact even if any participant within a certain range encounters a problem. The homomorphic encryption unit allows direct computation on the encrypted ciphertext, and the decrypted result is consistent with the plaintext calculation result. Using the homomorphic encryption unit, multiple ciphertexts can be computed before decryption, avoiding the high computational cost of decrypting each ciphertext individually. The unintentional transmission unit is a privacy-protecting two-way communication protocol where the message sender sends one message from the pending messages to the receiver, and the receiver cannot determine the information sent.

[0020] Preferably, the zero-knowledge proof unit refers to the ability of the prover to convince the verifier that a certain statement is correct without providing the verifier with any useful information; the obfuscated circuit is a Boolean circuit for secure computation between the two parties, which encrypts and scrambles each gate in the computation circuit to ensure that the original and intermediate data of the computation are not leaked during the encrypted computation process.

[0021] Preferably, assuming two data owners, A and B, the encrypted sample alignment unit utilizes encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and without exposing non-overlapping users, so as to combine the features of these users for modeling; the encrypted model training unit can use this data to train a machine learning model after identifying the shared user group; to ensure the confidentiality of the data during training, encrypted training is required with the help of a third-party collaborator, C; the effect incentive unit is used to continue to incentivize more organizations to join the data federation.

[0022] The technical effects and advantages of this invention are as follows:

[0023] This invention is based on cryptographic security, which is rigorously proven by cryptographic theory. It does not rely on trust in any participant, operator, system, hardware, or software. Each participant has absolute control over the data they possess, ensuring that basic data and information are not leaked. At the same time, it has high computational accuracy and supports programmable general-purpose computing. For each participant, this approach neither directly leaks private data nor increases the amount of training data. It can be used independently for privacy computing or combined with other technologies to protect privacy. It is an important technical means, especially for scenarios involving big data, high performance, and general-purpose privacy computing, such as secure and trusted cloud computing, large-scale data confidentiality collaboration, and privacy-preserving deep learning. Attached Figure Description

[0024] Figure 1 This is a flowchart of the present invention;

[0025] Figure 2 This is a system block diagram of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0027] Please see Figure 1-2 This invention provides a privacy computing method, comprising the following steps:

[0028] S1. Recruit at least two participants and split each participant's secret into N parts. Each participant keeps one part, and the remaining parts are managed by different participants. The secret is then encrypted to form ciphertext.

[0029] S2. Simultaneously, calculations are performed directly on multiple encrypted ciphertexts. Each gate in the calculation circuit is encrypted and scrambled to ensure that the original and intermediate data of the calculation are not leaked during the encryption calculation process. Both parties perform calculations in sequence according to their respective inputs. The decryptor can obtain the final correct result and compare the decrypted result with the plaintext so that the decryptor can know the final decryption result.

[0030] When the receiver receives the encrypted message, the sender sends the key corresponding to their input to the receiver. For example, if Alice's input is 0, K0x is sent; if the input is 1, K1x is sent. At the same time, the sender also sends the keys related to the receiver, namely K0y and K1y, through an unintentional transmission module. The receiver then selects the relevant key based on their input, but the sender does not know which key the receiver has selected. Based on the received Kx and their own Ky, the receiver attempts to decrypt each line of the encrypted message. Ultimately, only one line can be successfully decrypted, and the corresponding Kz is extracted. The receiver sends Kz to the sender, who then compares whether it is K0z or K1z to determine whether the result is 0 or 1.

[0031] Homomorphic encryption allows for the computation of multiple ciphertexts before decryption, eliminating the need for the high computational cost of decrypting each ciphertext individually. Furthermore, it enables ciphertext computation without a key party, reducing communication costs and shifting computational tasks, thus balancing the computational costs for all parties involved.

[0032] S3. Then the message sender sends one of the messages to be sent to the receiver, but the receiver cannot get the remaining data except for the content it has received, and the sender does not know the content that has been selected.

[0033] The message sending process includes the following steps: 1) The sender generates two pairs of public and private keys and sends the two public keys puk0 and puk1 to the receiver; 2) The receiver generates a random number and encrypts the random number using one of the two received public keys, and sends the ciphertext result to the sender; 3) The sender decrypts the received random number ciphertext using its two private keys, obtaining two decryption results k0 and k1, and XORs the two results with the two messages to be sent, and sends the two results e0 and e1 to the receiver; 4) The receiver XORs its own real random number with the received e0 and e1, and only one of the two results is the real data, while the other is a random number.

[0034] S4. Perform zero-knowledge proofs on the acquired information, so that the prover can convince the verifier that a certain statement is correct without providing the verifier with any useful information.

[0035] S5. Use a federated learning system to build a model. Utilize encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and without exposing non-overlapping users, so as to jointly model the features of these users.

[0036] S6. After identifying the common user group, the data can be used to train the machine learning model. In order to ensure the confidentiality of the data during the training process, it is necessary to use a third-party collaborator C for encrypted training.

[0037] The encrypted training process includes the following steps: a) Collaborator C distributes the public key to A and B to encrypt the data that needs to be exchanged during the training process; b) A and B exchange intermediate results for gradient calculation in encrypted form; c) A and B calculate their respective gradient values ​​based on the decrypted intermediate information, and then A and B upload the calculated gradient values ​​of X1, X2, X3, and X4 to C, and C calculates the new parameters of the model based on the gradient values; d) C sends the four new parameters back to A and B, that is, updates the models of A and B for the new round of iteration.

[0038] S7. Training is performed locally using each participant's own dataset. Throughout the training process, the data of each participant remains on their local machine. The gradient and weight information of the model are uploaded to the central server for aggregation and segmentation. This does not directly leak private data, nor does it increase the amount of training data, thus completing the training task.

[0039] This invention also provides a privacy-preserving computing system, including a multi-party secure computing module, a federated learning module, a confidential computing module, and a differential privacy module. The multi-party secure computing module allows participants to use their private data to participate in confidential computing and jointly complete a computational task without disclosing their own private data. The federated learning module uses a central server as a central node and exchanges network information with multiple local servers participating in training to update and iterate the artificial intelligence model. The confidential computing module is a hardware-based technology that isolates data, specific functions, and applications from the operating system, system administrators or virtual machine managers, and other specific processes, storing data in a trusted execution environment. Even with a debugger, the data cannot be viewed or operations performed externally. The differential privacy module removes individual characteristics while preserving statistical features to ensure user privacy.

[0040] The multi-party secure computation module includes a secret sharing unit, a homomorphic encryption unit, an unintended transmission unit, a zero-knowledge proof unit, and a confusion circuit; the federated learning module includes an encrypted sample alignment unit, an encrypted model training unit, and an effect incentive unit; the core functions of the confidential computation module are to protect the confidentiality of data, the integrity of data, and the security of data.

[0041] Protecting data confidentiality: Data in memory is encrypted, so even if an attacker steals the memory data, the data will not be leaked;

[0042] Protecting data integrity: Metrics ensure the integrity of data and code; any changes to data or code during use will cause changes to the metrics.

[0043] Protecting data security: Compared to ordinary applications, confidential computing modules have a smaller TCB, which means a smaller attack surface and thus greater security.

[0044] The secret-sharing unit divides the secret into appropriate parts, each managed by a different participant. A single participant cannot recover the secret information; only through the collaboration of several participants can the secret message be recovered. Furthermore, the secret remains intact even if any participant within a given range encounters a problem. The homomorphic encryption unit allows direct computation on the encrypted ciphertext, and the decrypted result is identical to the plaintext result. Using the homomorphic encryption unit, multiple ciphertexts can be computed before decryption, avoiding the high computational cost of decrypting each ciphertext individually. The unintentional transmission unit is a privacy-protecting two-way communication protocol where the sender sends one message from the pending messages to the receiver, and the receiver cannot determine the information sent.

[0045] The zero-knowledge proof unit refers to the ability of the prover to convince the verifier that a certain statement is correct without providing the verifier with any useful information; the obfuscated circuit is a Boolean circuit for secure computation between the two parties, which encrypts and scrambles each gate in the computation circuit to ensure that the original and intermediate data of the computation are not leaked during the encrypted computation process.

[0046] Assuming two data owners, A and B, the encrypted sample alignment unit utilizes encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and without exposing non-overlapping users, so as to combine the features of these users for modeling; the encrypted model training unit allows the use of this data to train a machine learning model after identifying the shared user group; to ensure the confidentiality of the data during training, encrypted training is required with the help of a third-party collaborator, C; the performance incentive unit is used to further incentivize more organizations to join the data federation.

[0047] In summary, this invention is based on cryptographic security, the security of which is rigorously proven by cryptographic theory. It does not rely on trust in any participant, operator, system, hardware, or software. Each participant has absolute control over the data they possess, ensuring that basic data and information are not leaked. At the same time, it has high computational accuracy and supports programmable general-purpose computing. For each participant, this approach neither directly leaks private data nor increases the amount of training data. It can be used independently for privacy computing or combined with other technologies to protect privacy. It is an important technical means, especially for scenarios involving big data, high performance, and general-purpose privacy computing, such as secure and trusted cloud computing, large-scale data confidentiality collaboration, and privacy-preserving deep learning.

[0048] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A privacy-preserving computation method, characterized in that, Includes the following steps: S1. Recruit at least two participants and split each participant's secret into N parts. Each participant keeps one part, and the remaining parts are managed by different participants. The secret is then encrypted to form ciphertext. S2. Simultaneously, calculations are performed directly on multiple encrypted ciphertexts. Each gate in the calculation circuit is encrypted and scrambled to ensure that the original and intermediate data of the calculation are not leaked during the encryption calculation process. Both parties perform calculations in sequence according to their respective inputs. The decrypting party obtains the final correct result and compares the decrypted result with the plaintext to let the decrypting party know the final decryption result. S3. Then the message sender sends one of the messages to be sent to the receiver, but the receiver cannot get the remaining data except for the content it has received, and the sender does not know the content that has been selected. S4. Perform zero-knowledge proofs on the acquired information, so that the prover can convince the verifier that a certain statement is correct without providing the verifier with any useful information. S5. Use a federated learning system to build a model. Utilize encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and without exposing non-overlapping users, so as to jointly model the features of these users. S6. After identifying the common user group, use this data to train a machine learning model. In order to ensure the confidentiality of the data during the training process, it is necessary to use a third-party collaborator C for encrypted training. S7. Training is performed locally using each participant's own dataset. Throughout the training process, the data of each participant remains on their local machine. The gradient and weight information of the model are uploaded to the central server for aggregation and segmentation. This does not directly leak private data, nor does it increase the amount of training data, thus completing the training task.

2. The privacy computation method according to claim 1, characterized in that: In S2, homomorphic encryption is used to compute multiple ciphertexts before decryption, eliminating the need to decrypt each ciphertext individually and incurring high computational costs. Homomorphic encryption enables ciphertext computation without a key party, reducing communication costs and shifting computational tasks, thus balancing the computational costs for all parties.

3. The privacy computation method according to claim 1, characterized in that: In S3, message sending includes the following steps: 1) The sender generates two pairs of public and private keys and sends the two public keys puk0 and puk1 to the receiver; 2) The receiver generates a random number, encrypts the random number with one of the two public keys received, and sends the ciphertext result to the sender. 3) The sender uses his two private keys to decrypt the received random number ciphertext and obtains two decryption results k0 and k1. The sender then XORs the two results with the two messages to be sent and sends the two results e0 and e1 to the receiver. 4) The receiver performs an XOR operation between its own real random number and the received e0 and e1 respectively. Of the two results, only one is real data and the other is a random number.

4. The privacy computation method according to claim 1, characterized in that: In S6, the encrypted training process includes the following steps: a) Collaborator C distributes the public key to A and B to encrypt the data that needs to be exchanged during training; b) A and B exchange intermediate results for gradient calculation in encrypted form; c) A and B calculate their respective gradient values ​​based on the decrypted intermediate information, and then A and B upload the calculated gradient values ​​of X1, X2, X3, and X4 to C, and C calculates the new parameters of the model based on the gradient values; d) C sends the four new parameters back to A and B, that is, updates the models of A and B for the new round of iteration.

5. A privacy computing system, based on the privacy computing method according to any one of claims 1-4, characterized in that: The system includes a multi-party secure computation module, a federated learning module, a confidential computation module, and a differential privacy module. The multi-party secure computation module allows participants to use their private data to participate in confidential computation and jointly complete a computational task without disclosing their own private data. The federated learning module uses a central server as a central node and exchanges network information with multiple local servers participating in training to update and iterate the artificial intelligence model. The confidential computation module is a hardware-based technology that isolates data, specific functions, and applications from the operating system, system administrators, virtual machine managers, and other specific processes, storing data in a trusted execution environment so that even with a debugger, data cannot be viewed or operations performed externally. The differential privacy module removes individual characteristics while preserving statistical features to ensure user privacy. The multi-party secure computation module includes a secret sharing unit, a homomorphic encryption unit, an unintentional transmission unit, a zero-knowledge proof unit, and a confusion circuit; the federated learning module includes an encrypted sample alignment unit, an encrypted model training unit, and an effect incentive unit. The core functions of the confidential computing module are to protect the confidentiality of data, the integrity of data, and the security of data.

6. A privacy computing system according to claim 5, characterized in that: The secret-sharing unit divides the secret into appropriate parts, each managed by a different participant. A single participant cannot recover the secret information; only through the collaboration of several participants can the secret message be recovered. Furthermore, the secret remains intact even if any participant within a given range encounters a problem. The homomorphic encryption unit allows direct computation on the encrypted ciphertext, and the decrypted result is identical to the plaintext result. By using the homomorphic encryption unit to perform computations on multiple ciphertexts before decryption, the high computational cost of decrypting each ciphertext individually is avoided. The unintentional transmission unit is a privacy-protecting two-way communication protocol where the message sender sends one message from the pending messages to the receiver, and the receiver cannot determine the information sent.

7. A privacy computing system according to claim 5, characterized in that: The zero-knowledge proof unit refers to the ability of the prover to convince the verifier that a certain statement is correct without providing the verifier with any useful information; the obfuscated circuit is a Boolean circuit for secure computation between the two parties, which encrypts and scrambles each gate in the computation circuit to ensure that the original and intermediate data of the computation are not leaked during the encrypted computation process.

8. A privacy computing system according to claim 5, characterized in that: Assuming two data owners, A and B, the encrypted sample alignment unit uses encrypted user sample alignment technology to identify shared users between A and B without disclosing their respective data, and does not expose non-overlapping users, so as to model the features of these users together. The encrypted model training unit trains a machine learning model using the data after identifying the shared user group; to ensure the confidentiality of the data during training, encrypted training is conducted with the help of a third-party collaborator C; the performance incentive unit is used to continue to incentivize more organizations to join the data federation.

Images