Fast training and lightweight prediction method of multi-party privacy protection naive bayes model

Abstract

This invention discloses a fast training and lightweight prediction method for Naive Bayes models with multi-party privacy protection. Based on the homomorphic encryption scheme NewPai proposed at the 2021 ACSAC conference, and combined with super-growing vector technology, a multi-directional data statistics scheme supporting high-dimensional data packaging is designed. Furthermore, based on the NewPai scheme, a distributed threshold decryption algorithm and an intermediate result protection method are designed to achieve a fast training protocol for Naive Bayes models with enhanced security. Compared to the prediction protocol designed by CAER, the non-interactive Naive Bayes model prediction protocol designed in this invention reduces the computational and communication overhead on the user end, prevents user data from leaving the local machine, enhances user data security, and improves service efficiency. It provides convenience for users in poor network environments who urgently need model prediction services.

Description

Technical Field

[0001] This invention relates to the field of data encryption, and in particular to a fast training and lightweight prediction method for a multi-party privacy-preserving Naive Bayes model. Background Technology

[0002] The Naive Bayes model is a machine learning algorithm with low computational cost and high model accuracy. Multiple data owners outsource their local data to cloud servers, which can then train Naive Bayes models with higher prediction accuracy based on this data, providing more accurate prediction services to requesting users. This computational model is called cloud outsourced computing.

[0003] In cloud-outsourced computing scenarios, data owners encrypt privacy-sensitive data and outsource its storage to cloud services. To achieve both secure computation of encrypted data and prevent privacy data leakage, Liu et al. proposed an additive homomorphic cryptographic algorithm supporting distributed threshold decryption. Then, based on this distributed threshold decryption algorithm, Wang et al. designed a multi-party privacy-preserving support vector machine scheme, achieving excellent results.

[0004] Homomorphic encryption and threshold decryption techniques have been well-appointed for privacy-preserving multi-party machine learning tasks, offering advantages in both security and model accuracy compared to differential privacy techniques. While these techniques offer security and computational accuracy, they also impose significant overhead on the system. One key reason is that the datasets outsourced by data owners are often high-dimensional. Since encrypting and decrypting each item in high-dimensional data incurs substantial costs for the data owner, a fast privacy-preserving multi-party machine learning protocol should use encryption algorithms that support multi-dimensional data packaging. Furthermore, machine learning algorithms such as support vector machines and logistic regression, which require numerous multiplication operations, are difficult to implement using simple additive homomorphic encryption. According to research by Liu et al., decryption must be performed first, followed by a secure multiplication protocol, which increases the computational overhead on the server.

[0005] To train high-quality classification and prediction models using multi-party privacy data, Wang et al. proposed the CAER scheme, designing a Naive Bayes model training and prediction algorithm that protects multi-party data privacy, and applied it to disease risk prediction scenarios. This scheme uses local pre-statistics, significantly reducing the size of the data to be encrypted compared to the EPDP scheme proposed by Yang et al. Furthermore, the Naive Bayes model training relies only on additive statistics, making it suitable for additive homomorphic encryption, offering advantages in both application and technology.

[0006] However, the CARR scheme still fails to address the problem of data owners needing to encrypt high-dimensional vectors, and the overhead of the Paillier additive homomorphic encryption used in the scheme remains significant. To achieve more efficient additive homomorphic encryption, The DJN scheme, designed by Ma et al., was the first to optimize the overhead of Paillier cryptosystem to a level suitable for commercial deployment. Subsequently, in 2021, Ma et al. proposed the NewPai scheme at the ACSAC conference, further optimizing the encryption and decryption overhead of the Paillier cryptosystem.

[0007] However, while the NewPai scheme features a more efficient Paillier homomorphic cryptography algorithm, its key generation algorithm has excessive overhead, and it does not include a distributed decryption algorithm suitable for cloud outsourced computing scenarios or a packet encryption algorithm suitable for high-dimensional vector data.

[0008] Furthermore, existing prediction protocols are typically interactive, such as the CAER scheme by Wang et al. and the EPDP scheme by Yang et al. While these two schemes have achieved high performance, such interactive protocols impose certain computational and communication overheads on users, and the fact that user data leaves the local device also increases privacy risks.

[0009] Finally, the interactive protocol requires users to have a good network environment, which is difficult to achieve in some application scenarios, resulting in the system being unable to serve users with poor network signals or even disconnection. Summary of the Invention

[0010] To address the aforementioned technical problems, this invention proposes a fast training and lightweight prediction method for a multi-privacy-preserving Naive Bayes model. The objective of this invention is achieved through the following technical solution:

[0011] A non-interactive prediction method based on multi-party high-dimensional privacy data includes the following steps:

[0012] Step 1: Model training;

[0013] Step 1: A trusted authority generates a public key and a private key, and uses a distributed threshold decryption algorithm to obtain several subkeys from the private key. Some of the subkeys are sent to the data service center, and the other part is sent to the model service provider. The trusted authority then distributes the public key to the data service center, the model service provider, and several data owners.

[0014] Step 2: Each data owner preprocesses and pre-statistically analyzes the local training data to obtain d-dimensional statistical data, which is then presented as a binary vector.

[0015] Step 3: Each data owner uses a public key to package and encrypt the d-dimensional statistical data, obtaining the packaged data in ciphertext state, and sends the packaged data as ciphertext to the data service center;

[0016] Step 4: The data service center partially decrypts the ciphertext using a portion of the subkey, adds a mask to the statistical information of the partially decrypted ciphertext to form partial ciphertext 1, and sends both the ciphertext and partial ciphertext to the model service provider.

[0017] Step 5: The model service provider decrypts the encrypted part of the encrypted text, and combines it with the result of the encrypted part of the encrypted text to obtain masked statistical information. Then, the masked statistical information is input into the Naive Bayes model to be trained to obtain the trained model.

[0018] Step 2: Perform data prediction:

[0019] Step 6: The user requests information from the service provider, including the modulus p and τ needed for the service provider to encrypt the model parameters. The service provider then uses symmetric encryption and cryptographic parameters to encrypt the model parameters after training. The service provider generates key parameters σ to protect the privacy of the model, and then encrypts the trained model to obtain encrypted model parameters, which are then sent to the requesting user.

[0020] Step 7: Request the user to input encrypted model parameters into the model locally to obtain the encrypted model, then preprocess the feature vectors that need to be predicted locally, and then input them into the encrypted model to obtain the prediction results and sort them.

[0021] In a further improvement, the method by which the trusted authority generates the public and private keys in the first step is as follows:

[0022] S1.1: Generate two odd numbers p' and q' with a bit length of (n(κ)-l(κ)) / 2-1. If p' = q', then regenerate p' and q' steps. n(κ) represents the plaintext length when the security parameter is k, which is also a security parameter. The size of this parameter changes with k. l(κ) represents the range of random numbers r when the security parameter is k. The size of this parameter changes with k. k represents the security parameter and the security level.

[0023] S1.2: Randomly generate an odd prime number p and calculate P = 2pp' + 1. If P is not a prime number, regenerate p.

[0024] S1.3: Randomly generate an odd prime number q and calculate Q = 2qq' + 1. If Q is not a prime number, or if either q = p or Q = p is true, then regenerate q.

[0025] S1.4 Calculate α=pq, β=p'q', n=PQ, and randomly select... Calculate h = -y 2β modn, hs = h n modn 2 We obtain the public key pk = (n, hs) and the private key sk = (α, p, q, P, Q); Let n represent the set of all positive integers less than n and relatively prime to n; n represents the plaintext modulus, i.e., the plaintext cannot exceed n.

[0026] Further improvements are made in the second step, where the data owner preprocesses and pre-statistically analyzes the local training data as follows: The data owner preprocesses the local training data by classifying floating-point numbers to obtain discretized training data. Then, the CAER scheme is used to binarize and pre-statistically analyze the local discrete medical data to obtain a high-dimensional vector suitable for dense-state training of the Naive Bayes model. If the local training data has U attributes, each attribute has K levels, and there are V labels, according to the CAER scheme, a vector data W with dimensions d = V·U·K + V is pre-statistically analyzed, where W = (w1, w2, ..., w...). V·U·K ,w V·U·K+1 ,...,w V·U·K+V The vector data W = (X, Y) consists of a binarized and pre-statistically processed attribute vector X and a label vector Y.

[0027] Let I be the maximum number of training samples in the vector data W, and let Z be the mask space. MASK Generate a super-growing vector A = (a1,...,a2) d )satisfy:

[0028] a1=1,a i >I·mask·(a1+...+a i-1 (1)

[0029] Calculate the packaged data p:

[0030] p = a1x1 + a2x2 + ... + a E x E ;

[0031] a E Let x represent the E-th super-growth vector. E Let E represent the term of the d-dimensional binary vector.

[0032] In a further improvement, the third step, in which the data owner uses the public key to package and encrypt the d-dimensional binary vector data, is as follows:

[0033] S3.1: p = a1x1 + a2x2 + ... + a Ex E In this context, p represents the packaged data, whose bit length does not exceed the plaintext space Z. n This is to ensure the correctness of the decryption algorithm;

[0034] S3.2: Select a random number r of bit length l(κ) and calculate the ciphertext C(p):

[0035] C(p) = Enc pk (p)=(1+p·n)·hs r modn 2

[0036] hs r This indicates a part of the encryption algorithm; mod represents modulo operation; Enc pk (p) indicates that p

[0037] encryption;

[0038] This completes the packaging and encryption process.

[0039] A further improvement is made to the method used in the first step to obtain several sub-keys from the private key through a distributed threshold decryption algorithm, as follows:

[0040] S1.5: Let the secret to be shared be δ, and let δ satisfy δ≡0 (mod 2α), δ≡1 (mod n). 2 ), which can be understood using the Chinese surplus theorem.

[0041] δ=(2α)·((2α) -1 modn 2 )+k(2α·n 2 (5)

[0042] Randomly select a positive integer k, and calculate δ according to formula (5);

[0043] Then, Shamir's secret sharing is used to ensure that each participant receives a sub-secret (i, sk = q(i)); the method of Shamir's secret sharing is as follows:

[0044] First, a (t-1)th order polynomial q(x) = δ + b1x + ... + b will be randomly generated. t-1 x t-1 Then calculate c sub-secrets (i, sk = q(i));

[0045] i represents the ID of the i-th participant, sk represents the shared private key, i.e., δ, q(i) represents the value of the polynomial at the x-coordinate x = i, represents the split portion of the private key, q(x) represents the polynomial function with x as the independent variable, where x represents the independent variable, b t-1 Let x represent the t-th coefficient, which is a random number. t-1It represents x raised to the power of t-1 and is a component of a polynomial;

[0046] Restoring the secret only requires t sub-secrets, because the polynomial q(x) has only t unknowns, so substituting t points is sufficient to solve for the polynomial; specifically, the Lagrange interpolation formula is used to calculate:

[0047]

[0048] i represents the i-th sub-secret, i.e. the number of the i-th participant; j represents the j-th sub-secret, i.e. the change of the j-th participant; q(0) represents the constant term of the polynomial, which is the secret after the polynomial is recovered.

[0049] S1.6: The i-th participant Part i Calculate the encrypted PC i =PDec i (C), such as Then a portion of the ciphertext is sent to the decryptor; PDec i (C) represents a partial decryption algorithm, and C represents the ciphertext that has not been decrypted; This represents the ciphertext after the i-th partial decryption. Partial decryption does not completely decrypt the text; it remains ciphertext.

[0050] S1.7: The decryptor receives at least t partial ciphertexts, such as {(PC i ,i)},i=1,2,...,t,Calculate:

[0051]

[0052] This indicates that the portion of the ciphertext calculated by the i-th participant is processed, where Δi represents the number of calculations required for the processing. L is a function defined as follows: This represents a processing step after aggregating all parts of the ciphertext. After processing and calculating the L function, the plaintext can be obtained; x represents the independent variable.

[0053] Further improvements are made, and the specific steps for step one, model training, are as follows:

[0054] S1: The data service center and the model service provider each obtain a portion of the private keys sk1 and sk2, and each data owner obtains the public key pk;

[0055] S2: The i-th data owner DO i Local training data (X) i ,y i Expanded into a d-dimensional vector, X i Let y represent the i-th feature data. iLet x represent the i-th label; where x v,u,k v∈[1,V],u∈[1,U],k∈[1,K] indicates that the label of the sample is y. v And the number of samples with the u-th attribute feature belonging to the k-th level; according to DO i Number of samples in the local dataset l i We obtained statistical information for two items, namely... This constitutes d-dimensional statistical data (Nx) v,u,k ,Ny v );in, This represents the amount of data labeled Yv collected locally by the i-th data provider. i Ny represents the number of data entries from the i-th data provider. v This represents the total number of data entries with the label Yv across all data providers.

[0056] S3: Data Owner (DO) i Statistical data for d-dimensional dimensions (Nx) v,u,k ,Ny v Pack and encrypt to obtain ciphertext C i =Enc pk (p i ), where p i This involves packaging the data from the aforementioned d-dimensional data, and then outsourcing the ciphertext and local data volume to DS.

[0057] S4: The data service center performs statistical aggregation on the encrypted data from various data owners, i.e., executes:

[0058] C = Π i∈[m] C i =Π i∈[m] Enc pk (p i ) = Enc pk (∑ i∈[m] p i (8)

[0059] Where Π represents the cumulative multiplication operation, m represents the total number of training data received from m data providers, and C i This represents the ciphertext obtained by the i-th data provider after encrypting its own training data;

[0060] After performing the above statistical aggregation, the ciphertext C actually contains To enhance privacy and protect the privacy of intermediate statistical results, mask∈Z is randomly selected. MASK ,calculate:

[0061] C * =C mask modn 2=Enc pk (mask·p),l * =mask·∑ i∈[m] l i

[0062] Mask stands for mask, which is a random number used to hide the true statistical information. Z MASK This indicates that the mask is randomly selected, within the range of Z_MASK and C_MASK. * This represents the ciphertext after adding a mask, C mask This represents an operation, namely C^mask, which is an exponentiation operation. * This represents the statistical information after multiplying by the mask, i.e.: total number of data entries × mask.

[0063] Then the data service center executes a partial decryption algorithm to obtain... Then All are sent to the model service provider; P stands for Partial, and P indicates a portion; PC is partially encrypted, and PDec indicates partially decrypted. DS represents the data service center, and PC_DS represents the partial ciphertext after partial decryption was performed on DS.

[0064] S5: Model service provider calculations:

[0065]

[0066] Obtain statistical results with a mask. and l * =mask·l;

[0067] This represents a portion of the ciphertext calculated by the service provider SP. This represents the number of data entries with the label Yv out of all data, including the mask. Nx v，u，k This represents the number of samples in the data with label Yv where the u-th attribute represents the k-th attribute value. This represents Nx_{v,u,k}×mask, where the superscript * indicates multiplication by a random mask. Because of the random mask, model service providers cannot obtain any information about the aggregated statistics. Substituting into formulas (10), (11), and (12), we can directly perform division to obtain the parameters of the Naive Bayes model. The calculation process is as follows:

[0068]

[0069]

[0070] Pr(xu,k =0|y v =1)=1-Pr(x u,k =1|y v =1),Pr(x u,k =0|y v =0)=1-Pr(x u,k =1|y v =0) (12)

[0071] Wherein Pr(y v Pr(x) represents the probability of predicting the label as Yv. u，k |y v ) represents the probability that the u-th attribute exhibits the k-th attribute value when the label is Yv, and [V] represents the range from 1 to V, with a closed interval [1, V]. u，k This indicates whether the u-th attribute exhibits the value of the k-th attribute; it is a binary value of 0 or 1. v Indicates whether it is the Yv-th label, which is a binary value of 0 or 1;

[0072] Through the aforementioned agreement, the model service provider was able to train the Naive Bayes model while protecting the privacy of the training data owned by the data owner, as well as the statistical results regarding the training data.

[0073] In a further improvement, in step six, the service provider uses symmetric encryption and cryptographic parameters to perform the encryption process for the model parameters of the trained model as follows:

[0074] S6.1: The model service provider predicts each label y v The required model parameters are discretized.

[0075] Ld v =log(Pr(y) v =1),Lp v,u,k =log(Pr(x) u,k =1|y v =1),Ln v,u,k =log(Pr(x) u,k =0|y v =1))

[0076] Ld' v =log(Pr(y) v =0),Lp' v,u,k =log(Pr(x) u,k =1|y v =0),Ln' v,u,k =log(Pr(x) u,k =0|y v =0))

[0077] Where, d v Let Ld_v represent the logarithm of Pr(y_v=1), L represent the logarithm Log, and d represent the decision, i.e., the logarithm of the probability that the label is Yv, d′ v n represents the logarithm of the probability that the label is not Yv. v，u，k Let n' be the logarithm of the probability that the label is Yv and the u-th attribute does not exhibit the value of the k-th attribute. v，u，k p represents the logarithm of the probability that the label is not Yv and the u-th attribute does not exhibit the k-th attribute value. v，u，k p′ represents the logarithm of the probability that the u-th attribute exhibits the k-th attribute value when the label is Yv. v，u，k This represents the logarithm of the probability that the label is not Yv and the u-th attribute exhibits the k-th attribute value;

[0078] For each type of label y v Each prediction has two 2UK+1 dimension model vectors, representing the model parameters for predicting positive and negative examples, as follows:

[0079] LM v =(Lp v,1,1 ,...,Lp v,U,K ,Ln v,1,1 ,...,Ln v,U,K ,Ld v )

[0080] LM' v =(Lp' v,1,1 ,...,Lp' v,U,K ,Ln' v,1,1 ,...,Ln' v,U,K ,Ld' v )

[0081] Where M v M′ represents the model parameters for determining if the label is Yv. v This indicates the model parameters used to determine if the label is not Yv;

[0082] Then generate UK+1 large random numbers {c j}, combined with the large prime number σ corresponding to this service request, calculate the encryption model;

[0083] CLM v,j =σ·(LM) v,j ·τ+c j )modp

[0084] CLM' v,j =σ·(LM' v,j ·τ+c j)modp

[0085] C represents CLM, which represents the encrypted model parameters; j represents a vector of model parameters, where j represents the j-th term; M represents the model parameters. v，j This indicates the j-th parameter of the model whose label is Yv, τ represents the password parameter shared by the service provider SP and the requesting user RU, and M v，j M′ represents the j-th parameter of the model whose label is Yv. v，j σ represents the j-th parameter of the model whose label is not Yv, and σ represents a private password parameter of the server used to protect the privacy of the model.

[0086] Then, the encrypted Naive Bayes model parameters {CLM} of the encrypted model are... v,j ,CLM' v,j}, v∈[V], j∈[2UK+1] are sent to the requesting user;

[0087] v represents the v-th tag Yv, and V represents the total number of tags V.

[0088] As a further improvement, the steps of the seventh step are as follows:

[0089] After the user receives the encrypted Naive Bayes model parameters from the model service provider, the ciphertext is first divided into Lp segments according to the format: first UK segment, second UK segment, and last segment. v ,Ln v ,Ld v , respectively representing the predicted value as y v Under the given conditions, the probabilities of attributes being positive and negative, and the prediction being y. v The probability is then calculated; subsequently, based on the local attribute feature vector, it is expanded into a binary, UK-dimensional vector, thus obtaining...

[0090]

[0091] x * To expand a multi-valued vector of dimension U into a two-valued vector of dimension UK, denoted as x*, If the U-th attribute exhibits the K-th attribute value, then x*_UK = 1

[0092] Predict whether the label is y v According to {CLM v,j ,CLM' v,j}, calculate intermediate results:

[0093]

[0094] Let M represent the j-th term of the vector x*. v，UK+jM′ represents the probability that when the j-th tag is Yv, the U-th attribute does not exhibit the value of the K-th attribute. v，UK+j This represents the probability that the U-th attribute does not exhibit the value of the K-th attribute when the j-th tag is not Yv;

[0095] Then calculate D. v =∑ j∈[UK] E v,j +CLM v,2UK+1 ,D' v =∑ j∈[UK] E' v,j +CLM' v,2UK+1 Calculate the prediction results:

[0096]

[0097] Finally, all samples y are obtained. v The prediction results are {R1,R'1,R2,R'2,...,R v ,R' v Then sort them;

[0098] Among them, R v R′ represents the result of predicting Yv, which is the probability multiplied by a key σ. v The result of a prediction other than Yv is represented by the probability multiplied by a key σ; D v This represents an intermediate calculation result used to calculate Rv and E. v，j This indicates intermediate calculation results.

[0099] A non-interactive, lightweight prediction system based on multi-party high-dimensional privacy data is provided, wherein the prediction system is used to implement the aforementioned non-interactive prediction method based on multi-party high-dimensional privacy data.

[0100] The beneficial effects of this invention are as follows:

[0101] The non-interactive Naive Bayes model prediction protocol designed in this invention reduces the computational and communication overhead on the user end compared to the prediction protocol designed by CAER, prevents user data from leaving the local machine, enhances user data security, and improves service efficiency. Most importantly, it provides convenience for users with poor network environments who urgently need model prediction services (such as disease risk prediction services in e-health environments). Users only need to register for the service in advance when the network environment is good to obtain encrypted model information, and can then perform prediction queries locally anytime, anywhere without an internet connection. Attached Figure Description

[0102] The invention will be further illustrated with reference to the accompanying drawings, but the contents of the drawings do not constitute any limitation on the invention.

[0103] Figure 1 Architecture diagram of multi-party secure naive Bayes model training and non-interactive prediction system. Detailed Implementation

[0104] To make the purpose, technical solution, and advantages of the invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and examples.

[0105] 1.1 Secure Multi-Party Naive Bayes Model Training and Prediction System Architecture

[0106] Based on multi-party privacy data, this invention designs a system architecture diagram for a Naive Bayes model training and prediction scheme that protects multi-party data privacy under an outsourced computing model. (See diagram below.) Figure 1 The diagram illustrates the relationships between the various entities and the computational tasks they perform at different stages.

[0107] To further understand the system architecture designed in this invention, the entity types and functions involved in this system, the computational tasks performed by the entities at each stage, and some symbols and abbreviations are briefly described here.

[0108] (1) Trust Authority (TA)

[0109] The TA is responsible for generating public and private keys for data encryption and decryption, and splitting the private key into multiple parts. The public key is then distributed to all data owners participating in the system, and the multiple private key parts are distributed to different servers.

[0110] (2) Data Owner (DO)

[0111] The i-th data owner DO i Having privacy-sensitive local high-dimensional vector data D i It needs to be encrypted using the public key distributed by the TA, and the ciphertext should be outsourced to the data service center to reduce DO. i The burden of data management.

[0112] (3) Data Service Center (DS)

[0113] DS is a cloud server with powerful storage and computing capabilities, responsible for receiving and managing encrypted data outsourced from DO. In addition, DS also provides data services to service providers: without compromising data privacy, service providers can use the high-quality encrypted data managed by DS to train more accurate predictive models, such as disease risk prediction models.

[0114] (4) Model Service Provider (SP)

[0115] like Figure 1 As shown, after computation and interaction between SP and DS, SP obtains the plaintext Naive Bayes model, but neither SP nor DS receives any useful information about the dataset or intermediate statistical results. Subsequently, SP can use the Naive Bayes model to provide model prediction services to requesting users, such as disease risk prediction services.

[0116] (5) Request User (RU)

[0117] The RU is a client with limited computing and communication resources, possessing the vector data to be queried locally. To improve efficiency and enhance security, this invention designs a non-exchangeable model request protocol. In this protocol, the RU only needs to initiate a request signal, and the SP encrypts the prediction model and sends it to the RU. The RU only needs to input the data to be queried locally to obtain the corresponding prediction result. For example, inputting a symptom vector will yield a disease risk prediction result.

[0118] This invention, based on the designed secure multi-party Naive Bayes model training and prediction system architecture, designs corresponding security protocols for both multi-party Naive Bayes model training and prediction requirements. Compared with existing work, the advantages of this invention in improving system efficiency and enhancing security functions are analyzed. Before designing the protocols, the symbols used in this invention are defined and explained.

[0119] Table 1. Symbols and definitions used in this invention.

[0120]

[0121]

[0122] 7.2 Naive Bayes Model Training Protocol with Multi-Party Privacy Protection

[0123] Training data held by a single data owner often suffers from insufficient volume and incomplete features, leading to poor-quality trained models. To expand the data volume and obtain more comprehensive data features, multi-party machine learning has been proposed. While multi-party machine learning offers advantages in model quality, it also poses serious security threats to privacy-sensitive data.

[0124] To protect data privacy from attacks by external adversaries and malicious internal actors, this invention, based on the NewPai scheme of Ma et al.'s improved Paillier cryptosystem, designs a multi-party machine learning training protocol that enhances security and improves system efficiency. The key algorithms constituting this protocol and its execution flow are described below.

[0125] 7.2.1 Packaging Algorithm for Multidimensional Data

[0126] The Paillier cryptosystem is a widely used additive homomorphic encryption scheme, meaning that multiplying and decrypting the ciphertext will yield the sum of the plaintext, formally defined as M1 + M2 = Dec. sk (Enc pk (M1)×Enc pk (M2)). Because this invention requires training a Naive Bayes model in encrypted form, and the training algorithm of this model depends on data accumulation operations, a training scheme can be designed using this additive homomorphic encryption.

[0127] Due to its excessive computational cost, Ma et al. proposed the more efficient NewPai scheme at the ACSAC conference in 2021. However, in machine learning applications, training data is typically only 64 bits, while the NewPai scheme can encrypt 2048 bits of plaintext at a time with a 112-bit security level. Clearly, using an algorithm capable of encrypting 2048 bits of plaintext to encrypt only 64 bits of data is inappropriate.

[0128] Previous researchers have proposed bit concatenation-based methods for packaging and encrypting information, but these methods do not support additive homomorphism. Only when both the data packaging and encryption methods satisfy homomorphism can the correctness of the statistical results be guaranteed. Based on this requirement, this invention employs super-growing vector technology to design a high-dimensional data packaging and encryption algorithm and a homomorphism proof, and evaluates the maximum data dimension that can be packaged in one pass at a 112-bit security level.

[0129] First, each Design Analyzer (DO) preprocesses its local training data by classifying floating-point numbers. Taking medical data as an example, data such as body temperature, blood pressure, and blood sugar can be divided into five levels: extremely low, low, normal, high, and extremely high, resulting in discretized training data. Then, based on the CAER scheme proposed by Wang et al., binarization and pre-statistical operations are performed on the local discrete medical data to obtain high-dimensional vectors suitable for dense-state training of Naive Bayes models.

[0130] To more intuitively describe the design of this invention, assume the training dataset has U attributes, each attribute has K levels, and a total of V labels. According to the CAER scheme, a vector of dimensions d = V·U·K + V can be pre-statistically calculated, denoted as W = (w1, w2, ..., w...). V·U·K ,w V·U·K+1 ,...,w V·U·K+V As shown in Table 1, the vector W = (X, Y) is composed of the binarized and pre-statistically processed attribute vector X and label vector Y. Next, we will design a packing and encryption algorithm for W.

[0131] Table 2. Binarization and Prestatistical Results of Training Data

[0132]

[0133]

[0134] Let I be the maximum number of training samples, and Z be the mask space. MASK Generate a super-growing vector A = (a1,...,a2) d )satisfy:

[0135] a1=1,a i >I·mask·(a1+...+a i-1 (1)

[0136] Calculate the packaged data p = a1x1 + a2x2 + ... + a E x E It is important to note that the super-growth vector here will be generated by a trusted authority (TA), meaning that all participants use the same super-growth vector throughout the entire training protocol. Let there be a total of m DOs. The following is a simple proof of the additive homomorphism of the packing algorithm designed in this invention.

[0137] ∑ i∈ [m]p i =a1∑ i∈ [m]w i,1 +a2∑i∈[m]w i,2 +...+a d ∑ i∈[m] w i,d (2)

[0138] According to formula (2), data packaged using the same super-growth vector has all its internal elements successfully accumulated. Based on max(∑ i∈[m] w i,1 ,∑ i∈[m] w i,2 ,...,∑ i∈[m] w i,d )≤I and formula (1), combined with the research of Yang et al., can make the original vector be correctly recovered from the packaged data.

[0139] 7.2.2 Encryption Algorithm for Packaged Data

[0140] First, this invention addresses the NewPai additive homomorphic encryption scheme proposed by Ma et al., and improves the key generation process at a 112-bit security level, reducing the time spent selecting security parameters during key generation, while retaining the NewPai encryption algorithm, which is directly applied to the packet encryption of this invention.

[0141] Because the plaintext space is only 2048 bits under the 112-bit security level, the packing algorithm designed in Section 7.2.1 cannot pack data of any dimension without restriction. Therefore, this invention quantifies the maximum dimension that can be packed at one time.

[0142] (1) Improve NewPai's key parameter generation algorithm

[0143] First, let's review the key generation algorithm designed for the NewPai scheme.

[0144] Step 1: Input the security parameter κ, and randomly generate two odd prime numbers p and q with a bit length of l(κ) / 2, and two odd numbers p' and q' with a bit length of (n(κ)-l(κ)) / 2-1.

[0145] Step 2: Calculate P = 2pp' + 1 and Q = 2qq' + 1. If P and Q are prime numbers and p, q, p', and q' are pairwise coprime, proceed to step 3; otherwise, repeat step 1.

[0146] Step 3: Calculate α = pq, β = p'q', n = PQ, and randomly select... Calculate h = -y 2β mod n yields the output of the key generation algorithm, i.e., public key pk = (n, h) and private key sk = α.

[0147] Then, this invention designs an improved key generation algorithm. The core idea is to change the odd numbers p',q' with a bit length of (n(κ)-l(κ)) / 2-1 to odd prime numbers p',q'; and first fix the larger odd prime number p',q', while cyclically searching for the smaller odd prime number p,q; finally, for faster encryption, pre-calculate hs = h n modn 2 Specifically:

[0148] Step 1: Generate two odd numbers p' and q' with a bit length of (n(κ)-l(κ)) / 2-1. If p' = q', then execute Step 1 again.

[0149] Step 2: Randomly generate an odd prime number p and calculate P = 2pp' + 1. If P is not a prime number, then execute step 2 again.

[0150] Step 3: Randomly generate an odd prime number q and calculate Q = 2qq' + 1. If Q is not a prime number, or q = p, Q = P, then execute step 3 again.

[0151] Step 4: Same as step 3 of the NewPai scheme, but requires additional pre-calculation of hs = h n modn 2The improved key generation algorithm outputs the public key pk = (n, hs) and the private key sk = (α, p, q, P, Q).

[0152] This section describes the improvement to the key generation algorithm proposed in this invention. The design principles and ideas are summarized below. Based on the NewPai scheme proposed by Ma et al., it is known that the bit length of large numbers p' and q' is much smaller than that of p and q, and according to the distribution law of prime numbers, smaller prime numbers are more densely distributed. Based on this distribution law, this invention designs its first improvement: first, it generates and fixes larger odd prime numbers, then iteratively searches for smaller prime numbers. If the requirement is met, the loop stops, and the next step can be executed.

[0153] (2) Application of NewPai and Packaging Design Packaging Encryption Algorithm

[0154] Combining the multidimensional data packing algorithm designed in 7.2.1 with the public key output by the aforementioned key generation algorithm, an efficient multidimensional data packing algorithm can be designed and implemented. The input of this algorithm is an E-dimensional vector data X = (x1, x2, ... x... E ), where E is the plaintext space of Z. n The algorithm steps are as follows: (The maximum dimension that can be packed at one time is given.)

[0155] Step 1: Execute the packing algorithm designed in 7.2.1 to obtain p = a1x1 + a2x2 + ... + a E x E Where p is the packed data, and its bit length will not exceed the plaintext space Z. n This is to ensure the correctness of the decryption algorithm.

[0156] Step 2: Select a random number r of bit length l (κ) and calculate the ciphertext:

[0157] C(p) = Enc pk (p)=(1+p·n)·hs r modn 2

[0158] After the above two steps, the packet encryption algorithm is complete. Since the distributed threshold decryption algorithm was designed in Section 7.2.3 of this invention, the decryption process will not be described again here. After decryption, the packet data p can be obtained, and the unpacking algorithm can call the algorithm designed by Yang et al. to recover the multidimensional vector.

[0159] (3) Quantitatively evaluate the maximum dimension of a single performance-based packet encryption

[0160] As can be seen from the packing algorithm designed in Section 7.2.1, the packed data will increase exponentially with the increase of dimension. Because, under a certain security level (e.g., 112-bit security level), the plaintext space is finite (e.g., 2048 bits), this invention quantitatively evaluates the maximum vector dimension that can be packed in one operation for the designed packing algorithm.

[0161] First, assuming each data item in the high-dimensional vector is 64 bits, this is sufficient for many application scenarios (such as machine learning). Section 7.2.4 designed a privacy-preserving Naive Bayes model training algorithm. Assuming the mask used to protect intermediate statistical results is 80 bits, the equation can be derived as follows:

[0162] 64+log2((I·mask+1) E -1)-log2(I·mask)=n(κ)(3)

[0163] At the 112-bit security level, substituting the parameters into the above equation, we can solve the equation to get E = 18 (rounded down). The construction of equation (3) is analyzed below, and it is proven that after packing 18 64-bit data at once, the packing result p is still in the plaintext space.

[0164] First, let's analyze the construction of equation (3). In order to solve for the maximum dimension E of the data p packed with E-dimensional vectors, satisfying log2(p) < n(κ), we need to construct the equation log2(p) = n(κ) for calculating the critical value. The derivation process is analyzed below:

[0165] log2(p)=log2(∑ i∈[E] a i w i )

[0166] ≤64+log2(∑ i∈[E] a i )

[0167] = 64 + log2((I·mask+1) E -1)-log2(I·mask)

[0168] Where I represents the total number of samples involved in model training, assumed to be 10. 10(Billions of data); mask is an 80-bit random number used to protect intermediate calculation results in distributed decryption; at a 112-bit security level, n(κ) = 2048. Substituting the above parameters into equation (3) and solving the equation, rounding the solution down, we obtain that under the parameters set in this invention, the maximum vector dimension E = 18 that can be packed at one time, that is, compared with encrypting each item in the vector, the packing encryption algorithm designed in this invention will achieve an 18-fold speedup.

[0169] 7.2.3 Distributed Threshold Decryption Algorithm

[0170] In a single-server architecture, the service provider (SP) needs to handle outsourced data storage and model training and prediction. In the prediction service, to provide users with plaintext prediction results, the SP needs plaintext model parameters. This means the SP must possess the complete private key; otherwise, it cannot train a plaintext model using an encrypted dataset. If the SP is malicious, its possession of the complete private key threatens the privacy of the training data. Furthermore, the single-server architecture suffers from a single point of failure: if one server fails, the entire system collapses, threatening its stability. To address these privacy and stability concerns, this invention utilizes Shamir threshold secret sharing technology and, based on the improved NewPai scheme designed in 7.2.2, proposes a corresponding distributed threshold decryption algorithm. Compared to previous threshold decryption algorithms, this invention extends the improved NewPai scheme, offering higher encryption efficiency. The following section briefly introduces Shamir secret sharing and the steps of the threshold decryption algorithm designed in this invention.

[0171] Shamir's secret sharing is an (n,t) threshold secret sharing technique. Assuming the secret to be shared is δ, a (t-1)th order polynomial q(x) = δ + b1x + ... + b is first randomly generated. t-1 x t-1 Then, calculate n sub-secrets (i, sk = q(i)). Recovering the secret only requires t sub-secrets, because the polynomial q(x) has only t unknowns, so substituting t points is sufficient to solve for the polynomial. Specifically, the Lagrange interpolation formula is used to calculate:

[0172]

[0173] Based on Shamir's secret sharing and the improved NewPai packet encryption algorithm, this section designs a corresponding distributed threshold decryption algorithm, with the specific steps as follows.

[0174] Step 1: Private key decomposition phase, let δ satisfy δ≡0 (mod 2α), δ≡1 (mod n) 2 ), which can be understood using the Chinese surplus theorem.

[0175] δ=(2α)·((2α) -1 modn 2 )+k(2α·n 2 (5)

[0176] Randomly select a positive integer k, calculate δ according to formula (5), and then use Shamir secret sharing to make each participant obtain a sub-secret (i, sk = q(i)).

[0177] Step 2: The i-th participant i Calculate the encrypted PC i =PDec i (C), for example Then a portion of the ciphertext is sent to the decryptor.

[0178] Step 3: The decryptor receives at least t partial ciphertexts, for example, {(PC i ,i)},i=1,2,...,t,Calculate:

[0179]

[0180] in, Formula (6) is based on Lagrange interpolation, and its correctness is proven as follows.

[0181] L(C δ ,n)=L((1+p·n·δ)hs rδ modn 2 ,n)

[0182] =L(1+p·n,n)=p

[0183] 7.2.4 Privacy-Preserving Model Training Protocol

[0184] This section designs a privacy-preserving Naive Bayes model training protocol. First, it briefly introduces the principle of the Naive Bayes classifier and the core idea behind the protocol design in this invention. The Naive Bayes classifier model is a classification model based on Bayesian theory and probability statistics. Assuming there are U attribute features, the probability of classifying X into the y-th class is:

[0185] Pr(y|X)=argmax y {Pr(y)·∏ i∈[U] Pr(x i |y)}(7)

[0186] Where Pr(y) = N y / N,Pr(x i |y)=N y,x / N y , N,Ny N y,x These represent the total number of samples, the total number of samples labeled y, and the total number of samples in the sample set labeled y that have attribute x, respectively.

[0187] The challenge of training a Naive Bayes classifier based on homomorphic encryption is that, in the ciphertext state, it is difficult to determine whether the label of a sample is y, and therefore it is impossible to statistically analyze N. y,x To address this problem, this invention expands the training samples into binary high-dimensional vectors as shown in Table 1, and counts N by counting the number of samples of x in the y-th partition. y,x Because everything is binarized, the number of 1s is N. y,x This does not require decryption.

[0188] Based on the core ideas above, using the previously invented multidimensional data packaging algorithm, the improved NewPai encryption scheme, and the threshold decryption algorithm extended from NewPai, combined with... Figure 1 In the application scenario, a privacy-preserving Naive Bayes model training protocol is designed, followed by the protocol execution steps.

[0189] • Step 1: As Figure 1 As shown in Section 7.1, the trusted authority will perform a (2,2) threshold key generation algorithm on DS and SP. This algorithm combines the improved NewPai key generation designed in Section 7.2.2 of this invention with the key splitting algorithm designed in Section 7.2.3, so that DS and SP obtain partial private keys sk1 and sk2 respectively, and each DO obtains the public key pk.

[0190] • Step 2: As shown in Table 1, each data owner (DO) i Local training data (X) i ,y i Expanding x into a d-dimensional vector. Where x v,u,k v∈[1,V],u∈[1,U],k∈[1,K] indicates that the label of the sample is y. v And the number of samples with the u-th attribute feature belonging to the k-th level. According to Table 1, and DO i Number of samples in the local dataset l i We can obtain two important statistical pieces of information, namely: This constitutes d-dimensional statistical data (Nx) v,u,k ,Ny v Then, DO i Using the packing encryption methods described in 7.2.1 and 7.2.2, we obtain ciphertext C. i =Enc pk (p i ), where p iThis involves packaging the data from the aforementioned d-dimensional data, and then outsourcing the ciphertext and local data volume to DS.

[0191] Step 3: DS performs statistical aggregation on the ciphertext from each DO, i.e., executes:

[0192] C = ∏ i∈[m] C i =∏ i∈[m] Enc pk (p i ) = Enc pk (∑ i∈[m] p i (8)

[0193] After performing the above statistical aggregation, the ciphertext C actually contains To enhance privacy and protect the privacy of intermediate statistical results, mask∈Z is randomly selected. MASK ,calculate:

[0194] C * =C mask modn 2 =Enc pk (mask·p),l * =mask·∑ i∈[m] l i

[0195] Then DS executes part of the decryption algorithm designed in 7.2.3 to obtain... Then send both ciphertexts to SP.

[0196] Step 4: SP Calculation

[0197]

[0198] Obtain statistical results with a mask. and l * =mask·l. Because of the presence of a random mask, SP cannot obtain any information about the aggregated statistical results, while the CAER scheme proposed by Wang et al. leaks statistical information about the dataset. Since the training of the Naive Bayes classifier involves division, and the mask is added by multiplying the statistical result by the same positive integer, direct division can yield the Naive Bayes model parameters. The calculation process is as follows:

[0199]

[0200]

[0201] Pr(x u,k =0|y v =1)=1-Pr(xu,k =1|y v =1),Pr(x u,k =0|y v =0)=1-Pr(x u,k =1|y v =0)(12)

[0202] Through the aforementioned protocol, SP enables the training of the Naive Bayes model while protecting the privacy of the DO's training data and the statistical results related to the training data. Compared to previous solutions, protecting intermediate statistical results brings stronger security to this invention.

[0203] 7.2.5 Privacy-Preserving Model Training Process

[0204] To more intuitively describe the multi-party privacy-preserving Naive Bayes model training protocol designed in this invention, this section combines... Figure 1 A simplified process for implementing the protocol is outlined to facilitate easier understanding and use of the invention.

[0205] • Step 1: The trusted authority TA distributes the public key pk to each participant in the system, and distributes partial private keys sk1 and sk2 to DS and SP respectively for (2,2) threshold decryption.

[0206] • Step 2: Preprocess and pre-statistically analyze the local training data of each DO to obtain d-dimensional binary vector data.

[0207] Step 3: Each DO uses the data packet encryption algorithm designed in Sections 7.2.1 and 7.2.2 to obtain the packetized data p in ciphertext state, which contains the statistical information l and Ny from the training of the training model. v ,Nx v,u,k And then send the encrypted message to DS.

[0208] Step 4: DS adds a mask to the statistical information, performs partial decryption, and sends both the ciphertext and the partial ciphertext to SP.

[0209] Step 5: SP performs partial decryption on the ciphertext and combines it with the partial decryption result sent by DS to obtain masked statistical information. And calculate the Naive Bayes model.

[0210] Next, in Section 7.3, a security protocol is designed for SP to provide classification prediction services to users who request classification using the Naive Bayes model.

[0211] 7.3 Non-interactive Naive Bayes Model Prediction Protocol

[0212] In Section 7.2, this invention designs a Naive Bayes model training protocol with multi-party privacy protection, allowing the SP to obtain the Naive Bayes model parameters in plaintext while protecting the privacy of the training data and the security of intermediate statistical results. After the SP obtains the plaintext, it will provide prediction services to the user RU who needs to request classification prediction services.

[0213] Prediction services based on Naive Bayes classifier models are very common, such as disease risk prediction services in e-health applications. Wang et al.'s CAER scheme introduces a Naive Bayes prediction protocol based on symmetric cryptographic primitives. The prediction protocol implemented in the CAER scheme has low computational overhead because it only uses lightweight symmetric cryptographic operations such as modular multiplication and inverses. However, this scheme still requires the service requesting user (RU) to bear certain computational and communication costs, especially the communication overhead, which is unacceptable for users in poor network environments. Furthermore, most users of e-health services lack sufficient network and communication resources.

[0214] To ensure that users in prolonged periods of poor network conditions can still enjoy high-quality Naive Bayes model prediction services, this invention designs a non-interactive security protocol. This protocol protects the privacy of both model and user data without requiring user data to leave the local machine. Instead, it allows users to perform queries offline, improving both efficiency and security. The following sections will detail the design of this non-interactive Naive Bayes model prediction protocol.

[0215] 7.3.1 User requests Naive Bayes model prediction service

[0216] In this invention, the requesting user (RU) only needs to initiate a simple request signal to notify the SP to prepare the model prediction service. Unlike the CAER scheme, the RU does not need to encrypt requests and data, thus saving computing and communication resources on the user side.

[0217] Specifically, the requesting user RU sends a simple request signal {τ,p} to SP. SP then generates a large prime number σ, secretly stores {τ,σ,p}, and then SP executes a lightweight Naive Bayes model encryption algorithm.

[0218] 7.3.2 Lightweight Naive Bayes Model Encryption Algorithm

[0219] This section describes the process of implementing the Naive Bayes model encryption algorithm by SP. First, in order to encrypt, SP needs to predict each label y... v The required model parameters are discretized.

[0220] Ld v =log(Pr(y) v=1),Lp v,u,k =log(Pr(x) u,k =1|y v =1),Ln v,u,k =log(Pr(x) u,k =0|y v =1))

[0221] Ld' v =log(Pr(y) v =0),Lp' v,u,k =log(Pr(x) u,k =1|y v =0),Ln' v,u,k =log(Pr(x) u,k =0|y v =0))

[0222] For each type of label y v Each prediction has two 2UK+1 dimension model vectors, representing the model parameters for predicting positive and negative examples, as follows:

[0223] LM v =(Lp v,1,1 ,...,Lp v,U,K ,Ln v,1,1 ,...,Ln v,U,K ,Ld v )

[0224] LM' v =(Lp' v,1,1 ,...,Lp' v,U,K ,Ln' v,1,1 ,...,Ln' v,U,K ,Ld' v )

[0225] Then generate UK+1 large random numbers {c j}, and calculate the encryption model by combining the large prime number σ corresponding to this service request.

[0226] CLM v,j =σ·(LM) v,j ·τ+c j )modp

[0227] CLM' v,j =σ·(LM' v,j ·τ+c j )modp

[0228] Then, the ciphertext {CLM v,j ,CLM' v,j}, v∈[V], j∈[2UK+1] are sent to RU.

[0229] 7.3.3 Non-interactive Naive Bayes Model Prediction Protocol

[0230] After RU receives the encrypted Naive Bayes model parameters from SP, it first divides the ciphertext into Lp according to the format (first UK term, second UK term, last term). v ,Ln v ,Ld v , respectively representing the predicted value as y v Under the given conditions, the probabilities of attributes being positive and negative, and the prediction being y. v The probability. Then, based on the local attribute feature vector, it is expanded into a binary, UK-dimensional vector, thus obtaining...

[0231] To predict whether the label is y v For example, according to {CLM v,j ,CLM' v,j}, calculate intermediate results:

[0232]

[0233] Then calculate D. v =∑ j∈[UK] E v,j +CLM v,2UK+1 ,D' v =∑ j∈[UK] E' v,j +CLM' v,2UK+1 Calculate the prediction results:

[0234]

[0235] Finally, all samples y are obtained. v The prediction results are {R1,R'1,R2,R'2,...,R v ,R' v After sorting, the most probable prediction result can be obtained. Taking disease risk prediction as an example, the above prediction result represents the probability (σ times) that the requesting user may or may not have a certain disease. Because σ is a positive integer, it does not affect the sorting of the prediction results; it is still possible to analyze which is more likely to have a certain disease and which is more likely not to have a certain disease.

[0236] Next, we will first analyze the correctness of the above protocol. According to formula (7), when the feature vector is x, the predicted sample belongs to label y. v The probability is Pr(y) v |x)=Pr(y v )·Π j∈[UK]Pr(x j |y v To simplify the calculation, we first take the logarithm of both sides of the probability formula, resulting in:

[0237] log(Pr(y v |x))=log(Pr(y v ))+∑ j∈[UK] log(Pr(x j |y v ))

[0238] RU, on the other hand, uses a ciphertext model, which accumulates based on attribute feature vectors. Assume that the element x in the attribute vector... u,k =1 means accumulating σ·(Lp) v,u,k ·τ+c j )modp, otherwise accumulate σ·(Ln) v,u,k ·τ+c j )modp, after accumulation, will yield:

[0239] D v =σ·τ·(log(Pr(y)) v ))+∑ j∈[UK] log(Pr(x j |y v )))+σ·∑ t∈[UK+1] c t

[0240] , because σ·∑ t∈[UK+1] c t <τ, therefore D v modτ=σ·∑ t∈[UK+1] c t The derivation and prediction results are as follows

[0241]

[0242] To protect the privacy of the model, in this model prediction service, the label of the sample calculated by RU is y. v The results are all multiplied by a large prime number σ, which neither affects the ranking analysis of the prediction results (analyzing what the most likely label is) nor leaks private information about the model data.

[0243] Based on the above correctness analysis, the selected parameter τ must be large enough to satisfy σ·∑ t∈[UK+1] c t <τ, otherwise the modulus τ will not yield the complete σ·∑ j∈[UK] c j This leads to incorrect results. Furthermore, the modulus p must be large enough to satisfy any LM. v,j and c j , have σ·(LMv,j ·τ+c j If p < p, then the complete ciphertext model cannot be obtained after modulo p, resulting in an incorrect result.

[0244] 7.3.4 Security-Enhanced Naive Bayes Model Prediction Process

[0245] To more clearly describe the non-interactive Naive Bayes model prediction protocol designed based on lightweight cryptographic operations, and to make it easier for readers to use this invention, this section summarizes the flow of the prediction protocol designed in Section 7.3.

[0246] Step 1: The user RU sends a simple request to the service provider SP, including the modulus p, τ needed for the SP to encrypt the model parameters. The SP then performs the encryption process for the model parameters.

[0247] • Step 2: SP generates key parameters σ to protect model privacy, then discretizes and encrypts the model, and sends the encrypted model to RU. This ensures that RU cannot obtain any information about model privacy by providing the encrypted model.

[0248] Step 3: RU preprocesses the feature vectors that need to be predicted locally, and then uses an encrypted model to calculate whether the prediction is the label y. v The probability is σ times the probability of y. Since σ is a positive integer, it does not affect the relative magnitude of the probabilities; the probabilities can still be sorted, and the label y that is more likely to belong can still be determined. v (or a tag that does not belong to y) v ).

[0249] The non-interactive Naive Bayes model prediction protocol designed in this invention reduces the computational and communication overhead on the user end compared to the prediction protocol designed by CAER, prevents user data from leaving the local machine, enhances user data security, and improves service efficiency. Most importantly, it provides convenience for users with poor network environments who urgently need model prediction services (such as disease risk prediction services in e-health environments). Users only need to register for the service in advance when the network environment is good to obtain encrypted model information, and can then perform prediction queries locally anytime, anywhere without an internet connection.

[0250] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the essence and scope of the technical solutions of the present invention.

Claims

1. A non-interactive prediction method based on multi-party high-dimensional privacy data, characterized in that: Comprising the following steps: Step one, model training; First step: the trusted authority generates a public key and a private key, and obtains a plurality of sub-keys through a distributed threshold decryption algorithm, a part of the sub-keys are sent to the data service center, and another part of the sub-keys are sent to the model service provider; the trusted authority distributes the public key to the data service center, the model service provider and a plurality of data owners; Second step: each data owner pre-processes and pre-counts the local training data to obtain d-dimensional statistical data, and the statistical data is binary vector data; Third step: each data owner uses the public key to package and encrypt the d-dimensional statistical data to obtain the packaged data in the ciphertext state, and sends the packaged data as ciphertext to the data service center; Fourth step: the data service center partially decrypts the ciphertext through a part of the sub-keys, adds a mask to the statistical information of the partially decrypted ciphertext to form a part of the ciphertext, and sends the ciphertext and the part of the ciphertext to the model service provider; Fifth step: the model service provider performs partial decryption on the ciphertext to generate a part of the ciphertext, and combines the part of the ciphertext to obtain the statistical information with the mask, and then inputs the statistical information with the mask into the naive Bayes model to be trained to obtain the trained model; Step two, data prediction: Sixth step: the request user initiates a request information to the service provider, and the request information includes the modulus p and tau required by the service provider to encrypt the model parameters; then the service provider uses symmetric encryption and password parameters to encrypt the model parameters of the trained model; the service provider generates key parameters sigma to protect the privacy of the model, and then encrypts the trained model to obtain encrypted model parameters, and sends the encrypted model parameters to the request user; Seventh step: the request user inputs the encrypted model parameters into the model locally to obtain an encrypted model, then pre-processes the feature vector to be predicted locally, and then inputs the encrypted model to obtain a prediction result and sort.

2. The non-interactive prediction method based on multi-party high-dimensional privacy data according to claim 1, characterized in that: In the first step, the trusted authority generates a public key and a private key as follows: S1.1: generate two bits of length (n(κ)-l(κ)) / 2-1 odd p', q', if p'=q', then regenerate p', q' step; n(κ) represents the length of the plaintext when the security parameter is k, which is also a security parameter, the size of which changes with k, l(κ) represents the range of random number r when the security parameter is k, the size of which changes with k, k represents the security parameter, which represents the security level; S1.2: randomly generate an odd prime number p, and calculate P=2pp'+1, if P is not a prime number, then regenerate p; S1.3: randomly generate an odd prime number q, and calculate Q=2qq'+1, if Q is not a prime number, or q=p, Q=P, then regenerate q; S1.4 compute a = pq, b = p'q', n = PQ, randomly select Compute h = -y 2β mod n, hs = h n mod n 2 , get public key pk = (n, hs), private key sk = (a, p, q, P, Q); denotes the set of all positive integers less than n and coprime with n; n represents the plaintext modulus, that is: the plaintext cannot exceed n.

3. The non-interactive prediction method based on multi-party high-dimensional private data of claim 2, wherein: In the second step, the data owner pre-processes and pre-counts the local training data as follows: the data owner pre-processes the local training data, that is, classifies the floating-point numbers to obtain discretized training data, and then performs binarization and pre-counting on the local discretized medical data through the CARER scheme to obtain a high-dimensional vector suitable for the homomorphic training Naive Bayes model; if the local training data has a total of U attributes, each attribute has K levels, and there are a total of V labels, according to the CARER scheme, a d=V·U·K+V-dimensional vector data W is pre-counted, W=(w1, w2,..., w V·U·K ,w V·U·K+1 ,...,w V·U·K+V ); the vector data W=(X, Y) is composed of the binarized and pre-counted attribute vector X and the label vector Y; The maximum number of training sample pieces of the orientation vector data W is I pieces, and the mask space is Z MASK , a super-growth vector A = (a1,..., a d ) is generated, which satisfies: a1= 1, a i > I • mask • (a1+... +a i-1 ) (1) Calculate the packaged data p: p = a1x1 + a2x2 +... + anxn E x E ; a E represents the E-th hyper-increasing vector, x E represents the E-th binarized vector of dimension d.

4. The non-interactive prediction method based on multi-party high-dimensional private data of claim 3, wherein: In the third step, the data owner uses the public key to package and encrypt the d-dimensional binary vector data as follows: S3.1 : p = a1x1 + a2x2 +... + anxn mod q E x E where p is the packed data, whose bit length is no more than the plaintext space Z n to ensure the correctness of the decryption algorithm; S3.2: select a random number r of bit length l(κ), and calculate the ciphertext C(p): C(p) = Enc pk (p) = (1 + p - n) - hs r mod n 2 hs r represents a part of the encryption algorithm, mod represents a modulo operation, ENc pk (p) represents encryption of p; That is, the package encryption is completed.

5. The non-interactive prediction method based on multi-party high-dimensional private data of claim 1, wherein: In the first step, the private key is obtained by a distributed threshold decryption algorithm to obtain several sub-keys, and the method is as follows: S1.5: Let the secret to be shared be δ, and let δ satisfy δ≡0(mod 2α), δ≡1(mod n 2 ), which can be understood by using the Chinese remainder theorem δ = (2a) · ((2a) -1 mod n 2 )+k(2a·n 2 ) (5) A positive integer k is randomly selected, and delta is calculated according to formula (5); Then, Shamir secret sharing is used to enable each participant to obtain a sub-secret (i, sk=q(i)); First, a (t-1) order polynomial q(x) = d + b1x +... + b t-1 x t-1 is randomly generated, and c sub-secrets (i, sk = q(i)) are calculated. i denotes the number of the ith participant, sk denotes the shared private key, i.e. δ, q(i) denotes the value of the polynomial at the abscissa x = i, denotes the split partial private key, q(x) denotes a polynomial function of the argument x, x denotes the argument, b t-1 denotes the tth coefficient, is a random number, x t-1 denotes the t - 1th power of x, is a component of the polynomial; The method of Shamir secret sharing is as follows: Only t sub-secrets are needed to restore the secret, because the polynomial q(x) has only t unknowns, so t points can be substituted to solve the polynomial; Specifically, the Lagrange interpolation formula is used to calculate: S1.6: the ith participant Part i Computing partial ciphertext PC i = PDec i (C), as The partial ciphertext is then sent to the decrypter; PDec i (C) represents a partial decryption algorithm, C represents the ciphertext that is not decrypted; Ci represents the ciphertext after the i-th partial decryption, which is not fully decrypted and is still ciphertext. S1.7: The decrypter receives at least t partial ciphertexts, such as {(PC i ,i)}, i = 1, 2,..., t, and computes: represents the processing of the partial ciphertext computed for the ith participant, and Δ, represents the number of computations required for the processing, i.e. L is a function defined as represents a processing of the aggregation of all partial ciphertexts, and after the processing and the computation of the L function, the plaintext is obtained; x represents the argument.

6. The non-interactive prediction method based on multi-party high-dimensional private data of claim 1, wherein: i represents the i-th sub-secret, that is, the number of the i-th participant, j represents the j-th sub-secret, that is, the change of the j-th participant, and q(0) represents the constant term of the polynomial, and after the polynomial is restored, the constant term is the secret; The specific steps of step one, model training, are as follows: S2: i-th data owner DO i Extending the local training data (X i , y i ) into a d-dimensional vector, X i represents the i-th feature data, y i represents the i-th label; wherein, x v,u,k , v e [1, V], u e [1, U], k e [1, K] represents the label of the sample is y v , and the number of samples of the u-th attribute feature belonging to the k-th bin; according to the DO i The number of samples of the local data set l i , get two statistical information, respectively The statistical data (Nx v,u,k , Ny v ) of d dimensions are composed; wherein, The data amount of the i-th data provider local statistics, the label Yv, l i The data number of the i-th data provider, Ny v The total data number of all data providers, the label Yv, S3: Data Owner DO i Statistical data (Nx v,u,k , Ny v ) of d dimensions are packaged and encrypted to obtain ciphertext C i = Enc pk (p i ), where p i is the packaged data of the above d-dimensional data, and then the ciphertext and local data volume are outsourced to the DS; S1: The data service center and the model service provider respectively obtain part of the private key sk1, sk2, and each data owner obtains the public key pk; C = Π i∈[m] C i = Π i∈[m] Enc pk (p i ) = Enc pk (∑ i∈[m] p i ) (8) wherein, ∏ represents a multiplication operation, m represents a total of m data providers received training data, C i represents the i-th data provider, encrypts its own training data, and obtains ciphertext; After performing the above statistical aggregation, the ciphertext C actually contains In order to enhance privacy, protect the privacy of the intermediate statistical result, randomly select mask∈Z MASK , calculate: C * = C mask mod n 2 = Enc pk (mask-p),l * = mask-∑ i∈[m] l i Mask represents a mask, i.e., a random number used to hide the real statistical information, Z MASK represents that the mask is randomly selected, and the selected range is Z_MASK, C * represents the ciphertext after adding the mask, C mask represents an operation, i.e., C^mask, is a power operation, l * represents the statistical information after being multiplied by the mask mask, i.e., the number of all data items x the mask mask; Then the data service center executes a partial decryption algorithm to get C * , Then C * , are sent to the model service provider; P means Partial, the P indicates part, PC is partial ciphertext, PDec means partial decryption, DS means data service center, PC_DS means partial ciphertext after partial decryption in DS; S4: The data service center aggregates the ciphertexts from each data owner, that is, executes: Obtaining statistics with a mask and l * = mask * l; represents the partial ciphertext calculated by the service provider SP, represents the number of data with label Yv among all data with mask, v,u,k represents the number of samples with the k-th attribute value of the u-th attribute among the data with label Yv among all data, represents Nx_{v,u,k}×mask, with the label * multiplied by the random mask mask; because of the existence of the random mask, the model service provider cannot obtain any information about the aggregated statistics; will Bring into formulas (10), (11), (12), directly divide to get the naive Bayes model parameters, the calculation process is as follows: Pr(x u,k = 0 | y v = 1) = 1 - Pr(x u,k = 1 | y v = 1), Pr(x u,k = 0 | y v = 0) = 1 - Pr(x u,k = 1 | y v = 0) (12) where Pr(y v ) represents the probability of predicting the label as Yv, Pr(x u,k | y v ) represents the probability of predicting the u-th attribute to exhibit the k-th attribute value given that the label is Yv, [V] represents the closed interval [1, V], x u,k represents whether the u-th attribute exhibits the k-th attribute value, which is a binary of 0 or 1, and y v represents whether it is the Yv-th label, which is a binary of 0 or 1. S5: The model service provider calculates:

7. The non-interactive prediction method based on multi-party high-dimensional privacy data of claim 6, wherein: Through the above protocol, the model service provider realizes the training of the naive Bayes model, while protecting the privacy of the training data of the data owner, and also protecting the statistical results about the training data. S6.1: Model service provider predicts each label y v The required model parameters are discretized; Ld v = log(Pr(y v = 1)), Lp v,u,k = log(Pr(x u,k = 1 | y v = 1)), Ln v,u,k = log(Pr(x u,k = 0 | y v = 1)) Ld' v =log(Pr(y v =0)),Lp' v,u,k =log(Pr(x u,k =1|y v =0)),Ln' v,u,k =log(Pr(x u,k =0|y v =0)) wherein d v represents the log of Pr(y_v = 1), L represents the log Log, d represents the decision, i.e., the log of the probability of the label being Yv, d' v represents the log of the probability of the label not being Yv, n v,u,k represents the log of the probability of the label being Yv and the u-th attribute not exhibiting the k-th attribute value, n' v,u,k represents the log of the probability of the label not being Yv and the u-th attribute not exhibiting the k-th attribute value, p v,u,k represents the log of the probability of the label being Yv and the u-th attribute exhibiting the k-th attribute value, p' v，u，k represents the log of the probability of the label not being Yv and the u-th attribute exhibiting the k-th attribute value. For each label y v there are two model vectors of dimension 2UK+1, one for the positive and one for the negative example, as follows: LM v = (Lp v,1,1 ,...,Lp v,U,K ,Ln v,1,1 ,...,Ln v,U,K ,Ld v ) LM' v = (Lp' v,1,1 ,...,Lp' v,U,K ,Ln' v,1,1 ,...,Ln' v,U,K ,Ld' v ) where M v represents the model parameters for judging that the label is Yv, M' v represents the model parameters for judging that the label is not Yv; Then generate UK+1 big random number {c j}, combine the corresponding big prime number σ of this service request, calculate the encrypted model; CLM v,j = σ · (LM v,j · τ + c j ) mod p CLM' v,j = σ · (LM' v,j · τ + c j ) mod p C represents the encrypted model parameters, j represents that the model parameters are a vector, j represents the jth item, M v,j represents the jth item of the model parameters that determine that the label is Yv, τ represents a cryptographic parameter common to the service provider SP and the requesting user RU, M v,j represents the jth item of the model parameters that determine that the label is Yv, M' v,j represents the jth item of the model parameters that determine that the label is not Yv, σ represents a cryptographic parameter private to the server, used to protect the privacy of the model; Then, the encrypted naive Bayes model parameters of the encrypted model {CLM v,j ,CLM' v,j}, v e [V], j e [2UK+1] are sent to the requesting user; The service provider uses symmetric encryption and password parameters to perform the encryption process of the model parameters of the trained model in the sixth step as follows:

8. The non-interactive prediction method based on multi-party high-dimensional privacy data of claim 7, wherein: v represents the v-th label Yv, and V represents a total of V labels. The steps of the seventh step are as follows: After the user receives the encrypted Naive Bayes model parameters from the model service provider, the ciphertext is first divided into Lp segments according to the format: first UK segment, second UK segment, and last segment. v ,Ln v ,Ld v , respectively representing the predicted value as y v Under the given conditions, the probabilities of attributes being positive and negative, and the prediction being y. v The probability is then calculated; subsequently, based on the local attribute feature vector, it is expanded into a binary, UK-dimensional vector, thus obtaining... x * To extend the originally multi-valued, U-dimensional vector, x, into a 2-valued, UK-dimensional vector, x*, we have x*_UK = 1 if the Uth attribute exhibits the Kth attribute value Predict whether the label is y v : Compute intermediate results according to {CLM v,j , CLM v,j} denotes the jth item of the x vector, M v，UK+j denotes the probability that the Uth attribute does not exhibit the Kth attribute value given that the jth label is Yv, M' v，UK+j denotes the probability that the Uth attribute does not exhibit the Kth attribute value given that the jth label is not Yv; Then calculate D v =∑ j∈[UK] E v,j +CLM v,2UK+1 ,D' v =Σ j∈[UK] E' v,j +CLM' v,2UK+1 , calculate the prediction result: Finally, the prediction results {R1, R'1, R2, R'2,..., R v , v R' v} for all samples y are obtained and sorted. where R v represents the result of predicting Yv, is a probability multiplied by a key σ, R' v represents the result of predicting not Yv, is a probability multiplied by a key σ; D v represents an intermediate calculation result, used to calculate Rv, E v，j represents an intermediate calculation result.

Images