A privacy-oriented verifiable distributed matrix multiplication outsourcing method

Abstract

The application provides a privacy protection-oriented verifiable distributed matrix multiplication outsourcing method, and relates to the technical field of outsourcing cloud computing services. The method involves a data owner, a cloud server and a client. The data owner first performs a keyGen algorithm, generates a public key, a private key, a verification key and a decryption key of a matrix by inputting a security parameter and the matrix. The data owner then performs a probGen algorithm, obtains an encrypted vector, auxiliary information and a decryption key of the vector by inputting the private key and a vector. The cloud server performs a Comp algorithm, inputs the public key and the encrypted vector, and each cloud server outputs a respective operation result. The client performs a Verify algorithm, inputs the verification key, the auxiliary information and the operation result sent by the first s cloud servers, and outputs a verification operation result. The data owner performs a Solve algorithm, inputs the encrypted operation result, and obtains a correct operation result. The method avoids the delay of weak computing power nodes on the entire calculation.

Description

Technical Field

[0001] This invention relates to the field of outsourced cloud computing service technology, and in particular to a privacy-preserving, verifiable distributed matrix multiplication outsourcing method. Background Technology

[0002] With the development of cloud computing technology, outsourced cloud computing services have received increasing attention. Outsourced cloud computing allows data owners to rent sufficient storage and computing resources from service providers, offering the fulfillment of their storage and computing needs as a service. In this paradigm, the data owner is often a weak computing entity receiving abundant computing resources from the service provider on a pay-as-you-go basis. In recent years, outsourced cloud computing has been widely applied in various real-world scenarios of information systems, such as e-government, energy, education, and healthcare. Taking the healthcare field as an example, IoT devices installed in hospitals collect patients' physiological data, which doctors then send to cloud servers for computation to analyze the patients' pathological conditions.

[0003] Outsourcing cloud computing services involves various computational models, such as polynomial computation, linear regression analysis, and matrix multiplication. Matrix multiplication is a fundamental computational method widely used in scientific research and engineering, but it has high computational complexity. For multiplying two matrices, the time complexity reaches a certain threshold, thus secure matrix outsourcing computations that take large-scale matrices as input has attracted considerable attention.

[0004] In 2012, Fiore and Gennaro designed a verifiable outsourced computation scheme. This scheme supports computation not only for high-order polynomials but also for matrix multiplication. Their scheme employs an amortized model, with a computationally complex data storage phase, but enables faster verification. As a key tool for establishing results, their scheme relies on the use of pseudo-random functions with closed-form efficiency. Furthermore, they developed new pseudo-random functions based on the decision linearity assumption, particularly suitable for groups with bilinear mappings. To improve the efficiency of verifiable computation, the cryptographic community continues its research and exploration, which will bring verifiable computation closer to practical application.

[0005] Data owners sending data for outsourced computation often contains sensitive information, such as transaction records, engineering data, and asset information. Therefore, to prevent the leakage of this sensitive information, data owners need to encrypt the data before outsourcing it to cloud servers. However, general encryption techniques can only support a small portion of these problems because cloud servers struggle to perform meaningful computations on encrypted data. Clearly, fully homomorphic encryption can perform computations on ciphertext, but existing fully homomorphic encryption schemes are still not practical enough due to excessive computational overhead.

[0006] To improve the efficiency of matrix multiplication calculations, many solutions employ distributed computing. However, distributed computing is susceptible to the impact of weak computing power cloud server nodes. If a weak computing power cloud server node times out, the entire system must wait for that node to submit its result, which consumes significant time and increases overall latency. Therefore, the efficiency of such distributed computing is easily affected by the system's delays. How to address the latency impact of weak computing power nodes is currently a bottleneck in distributed computing.

[0007] Furthermore, a complete mechanism for verifying the accuracy of computation results is crucial for secure outsourced computing; otherwise, no data owner would be willing to use outsourced computing services in real-world scenarios. Simultaneously, the computational power consumed in verifying the accuracy of the results must not exceed the computation itself; otherwise, the purpose of outsourcing is lost, meaning the efficiency of the entire verification process must be guaranteed.

[0008] In summary, existing verifiable outsourced matrix multiplication schemes have the following problems: 1) they cannot protect data privacy; 2) distributed computing is easily affected by weak computing nodes; and 3) the overall verifiable computing scheme is inefficient. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to address the shortcomings of the prior art by providing a verifiable distributed matrix multiplication outsourcing method for privacy protection, thereby enabling verifiable distributed matrix multiplication outsourcing services.

[0010] To address the aforementioned technical problems, the technical solution adopted by this invention is: a privacy-preserving, verifiable distributed matrix multiplication outsourcing method, involving a data owner, a cloud server, and a client, wherein:

[0011] Data Owner: The data owner, as an entity, owns an m×n matrix M and an n-dimensional vector x; the data owner divides the matrix M into s parts, and then encrypts the matrix M and vector x into a matrix σM and a vector σ x The task was then outsourced to a group of cloud servers, who were tasked with calculating σ. y =σM·σx The result; at the same time, the data owner generates a verification key VK and auxiliary information τ, and sends them to the client to complete the verification of the final calculation result;

[0012] Cloud servers: A group of N cloud servers is needed to distribute the computation of their respective polynomial codes; each cloud server k, k∈[0,N-1] will output its own independent value z after completing the computation. k Calculation results and verification evidence Send to the client for verification;

[0013] Client: The client will receive the verification key VK and auxiliary information τ from the data owner, as well as its own independent value z sent from the first s cloud servers that have completed the computation. k Calculation results and verification evidence Then through these independent values ​​z k Calculation results and verification evidence To reconstruct the true calculation result σ y The system first verifies the evidence (π), then verifies the accuracy of the result. After verifying the accuracy of the result, the client returns the verification result to the data owner. This includes the following steps:

[0014] Step 1: The data owner executes the KeyGen algorithm, generating a public key PK, a private key SK, a verification key VK, and a decryption key RK for matrix M by inputting the security parameter λ and matrix M. M ;

[0015] Step 1.1: The data owner calls the Kg algorithm of the pseudo-random function, inputs the security parameter λ, the number of rows m of matrix M, the number of columns n of matrix M, and obtains the key k and the public parameter pp;

[0016] Step 1.2: Select a random number in, Let h = e(g, g) represent integers whose size does not exceed p; α Where e is a bilinear mapping e: g is a group Generators;

[0017] Step 1.3: Generate a sparse matrix N with the same size as matrix M, and obtain matrix σM by blinding the addition of matrix M and matrix N;

[0018] Step 1.4: Define the domain Δ = [1, m] × [1, n]. For each (i, j) ∈ Δ, define and calculate... Among them, F k(i,j) is a pseudo-random function; let matrix T = {t} (i,j)} (i,j)∈Δ ;

[0019] Step 1.5: Divide matrices σM and T into s parts by rows, as shown in the following formula:

[0020]

[0021] Step 1.6: Output the public key PK = (σM, T), the private key SK = k, the verification key VK = h, and the decryption key RK for M. M = (M, N);

[0022] Step 2: The data owner executes the ProbGen algorithm, inputting the private key SK and the vector x to obtain the encrypted vector σ. x Auxiliary information τ and the decryption key RK for vector x x ;

[0023] Step 2.1: Generate a sparse vector u of the same size as vector x, and calculate the encrypted vector σ. x =x + u;

[0024] Step 2.2: For 1≤i≤m, calculate the i-th auxiliary information.

[0025] Step 2.3: Output the encrypted vector σ x Auxiliary information τ=(τ1,...,τ) m ), decryption key RK x =(x,u);

[0026] Step 3: The cloud server executes the Comp algorithm, inputting the public key PK and the encrypted vector σ. x Each cloud server k outputs its own calculation results.

[0027] Step 3.1: Due to the partitioning of matrix T, for 0 ≤ t ≤ s-1, define a new vector. in:

[0028]

[0029] Step 3.2: Calculate verification evidence for each cloud server k. and calculation results As shown in the formula below:

[0030]

[0031]

[0032] Step 3.3: Output after each cloud server completes the calculation To the client;

[0033] Step 4: The client executes the Verify algorithm, inputting the verification key VK, auxiliary information τ, and the data sent by the cloud server after the previous s calculations. Output the verification calculation result σ y Or ⊥;

[0034] Step 4.1: After receiving the values ​​sent by the cloud server after the first s completed calculations, the client uses this data to reconstruct the calculation results;

[0035] The client constructs the following polynomial:

[0036]

[0037]

[0038] Where z is the principal component of polynomials h1(z) and h2(z);

[0039] Send z from the cloud server that has completed the first s calculations. k and Substituting the points and values ​​into the two polynomials above for Fast Fourier Interpolation, we can finally solve for the coefficients ρ. t ,σM t σ x (t∈[0,s-1]), and then the verification evidence π and the encrypted calculation result σ are restored. y As shown in the formula below:

[0040]

[0041] Step 4.2: For 1≤i≤m, determine

[0042]

[0043] Whether it is true or not, where σ y,i For the calculation result σ y The i-th row of data; if all values ​​are true, output the encrypted calculation result σ. y Output the value to the data owner; otherwise, output ⊥ to indicate that the verification failed.

[0044] Step 5: The data owner executes the Solve algorithm, inputting the encrypted calculation result σ. y This yields the correct calculation result y;

[0045] After successful verification, the data owner receives the encrypted calculation result σ sent by the client. y The correct calculation result can be obtained through the following formula;

[0046] y = σ y -Mu-Nx-Nu.

[0047] The beneficial effects of adopting the above technical solution are as follows: This invention provides a privacy-preserving verifiable distributed matrix multiplication outsourcing method. Addressing the problems of low efficiency, inability to protect data privacy, and low distributed computing efficiency in the presence of weak computing nodes in existing verifiable matrix multiplication schemes, this invention outsources the matrix multiplication computation task to a cloud server and provides a public verification algorithm so that data owners can verify the accuracy of the calculation results. To ensure the privacy of the data owner's data, the data owner is allowed to encrypt data that needs to be encrypted before sending it to the cloud server. To solve the problem of weak computing nodes delaying the computation process in distributed computing, a polynomial encoding method is adopted, avoiding the delay caused by weak computing nodes and ensuring overall operating efficiency. Attached Figure Description

[0048] Figure 1 This is a schematic diagram illustrating polynomial distributed computing performed by four cloud servers according to an embodiment of the present invention.

[0049] Figure 2 This is a schematic diagram of a privacy-preserving verifiable distributed matrix multiplication outsourcing method provided in an embodiment of the present invention;

[0050] Figure 3 A flowchart illustrating a privacy-preserving, verifiable distributed matrix multiplication outsourcing method provided in this embodiment of the invention;

[0051] Figure 4 The figure shows a comparison of different outsourcing methods provided in the embodiments of the present invention. Detailed Implementation

[0052] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0053] In this embodiment, a privacy-preserving verifiable distributed matrix multiplication outsourcing method utilizes polynomial encoding to improve distributed computing efficiency in the presence of nodes with weak computing power.

[0054] In distributed computing, matrix M is divided into s parts, i.e.

[0055]

[0056] Each cloud server k (k∈[0, N-1]) has its own independent value z. kFor example, s=3, the number of cloud servers N=4, z k =k, first we can obtain the calculation method of matrix multiplication:

[0057]

[0058] For each cloud server, the allocated computing portion is

[0059]

[0060] What needs to be calculated is

[0061]

[0062] like Figure 1 As shown in the diagram, one of the four cloud servers, Server0, failed to submit the calculation results in a timely manner for some reason, resulting in σM0σ... x ,σM1σ x ,σM2σ x Consider the three coefficients of a polynomial. Since three other cloud servers submitted their calculation results, there are three equations. These three equations can be solved to obtain the three coefficients, and each equation has a unique solution. Therefore, the master node can solve for these three coefficients through interpolation, i.e., solve for σM0σ. x ,σM1σ x ,σM2σ x The value of σ was obtained, which means the solution was found. y The value of , because

[0063]

[0064] This completes the analysis of the result σ. y The restoration.

[0065] Based on the above algorithm, the efficiency of distributed computing can be improved in the presence of nodes with weak computing power.

[0066] The verification of the computation results is constructed using a closed-form efficiency pseudo-random function:

[0067] A closed-form efficiency pseudo-random function is constructed using two algorithms, Kg and F, specifically:

[0068] (k, pp) ← Kg(1) λ (m, n), let Where p is a group The order of g, where g is the group The generator, e, is a bilinear mapping e: For j∈[1, m], let For j∈[1, n], let The key generation algorithm outputs common parameters pp and the key k, where pp = (Λ, m, n) and k = {(u j ): j∈[1, n]}∪{(k i ): i∈[1,m]}.

[0069] Generally speaking, the domain of algorithm F is Δ = [1, m] × [1, n], and the range is... Given (i, j) ∈ Δ as input, output

[0070] Definition of calculation:

[0071]

[0072] in, It is an m×n matrix. It is an n-dimensional vector. Now let's use F... k (i, j) m×n Substituting (y into Eval(y, x)) i，j ) m×n We obtain the following equation:

[0073]

[0074] Therefore, we can conclude that when there is no key k, Eval(F) is calculated. k (i, j) m×n x) can only be calculated sequentially according to the definition, and a total of 1000 x) are required. Exponentiation and Multiplication; when the key k is available, the algorithm derived from the equation can be used. This part only needs to be calculated once, and a total of [number] parts are required. Exponentiation and The multiplication operation. Therefore, this pseudo-random function algorithm calculates Eval(F). k (i, j) m×n ,x) conforms to the definition of closed-form efficiency.

[0075] This method involves data owners, cloud servers, and clients, such as... Figure 2 As shown, where:

[0076] Data Owner: The data owner, as an entity, owns an m×n matrix M and an n-dimensional vector x; the data owner divides the matrix M into s parts, and then encrypts the matrix M and vector x into a matrix σM and a vector σ x The task was then outsourced to a group of cloud servers, who were tasked with calculating σ. y =σM·σ xThe result; at the same time, the data owner generates a verification key VK and auxiliary information τ, and sends them to the client to complete the verification of the final calculation result;

[0077] Cloud servers: A group of N cloud servers is needed to distribute the computation of their respective polynomial codes; each cloud server k, k∈[0,N-1] will output its own independent value z after completing the computation. k Calculation results and verification evidence Send to the client for verification;

[0078] Client: The client will receive the verification key VK and auxiliary information τ from the data owner, as well as its own independent value z sent from the first s cloud servers that have completed the computation. k Calculation results and verification evidence Then through these independent values ​​z k Calculation results and verification evidence To reconstruct the true calculation result σ y The system verifies the evidence π and then verifies the accuracy of the results. After verifying the accuracy of the results, the client returns the verification results to the data owner.

[0079] This method is as follows Figure 3 As shown, the specific steps include:

[0080] Step 1: The data owner executes the KeyGen algorithm, generating a public key PK, a private key SK, a verification key VK, and a decryption key RK for matrix M by inputting the security parameter λ and matrix M. M ;

[0081] Step 1.1: The data owner calls the Kg algorithm of the pseudo-random function, inputs the security parameter λ, the number of rows m of matrix M, the number of columns n of matrix M, and obtains the key k and the public parameter pp;

[0082] Step 1.2: Select a random number in, Let h = e(g, g) represent integers whose size does not exceed p; α Where e is a bilinear mapping e: g is a group Generators;

[0083] Step 1.3: Generate a sparse matrix N with the same size as matrix M, and obtain matrix σM by blinding the addition of matrix M and matrix N;

[0084] Step 1.4: Define the domain Δ = [1, m] × [1, n]. For each (i, j) ∈ Δ, define and calculate... Among them, F k (i,j) is a pseudo-random function; let matrix T = {t} (i,j)} (i,j)∈Δ ;

[0085] Step 1.5: Divide matrices σM and T into s parts by rows, as shown in the following formula:

[0086]

[0087] Step 1.6: Output the public key PK = (σM, T), the private key SK = k, the verification key VK = h, and the decryption key RK for M. M = (M, N);

[0088] Step 2: The data owner executes the ProbGen algorithm, inputting the private key SK and the vector x to obtain the encrypted vector σ. x Auxiliary information τ and the decryption key PK for vector x x ;

[0089] Step 2.1: Generate a sparse vector u of the same size as vector x, and calculate the encrypted vector σ. x =x + u;

[0090] Step 2.2: For 1≤i≤m, calculate the i-th auxiliary information.

[0091] Step 2.3: Output the encrypted vector σ x Auxiliary information τ=(τ1,...,τ) m ), decryption key RK x =(x,u);

[0092] Step 3: The cloud server executes the Comp algorithm, inputting the public key PK and the encrypted vector σ. x Each cloud server k outputs its own calculation results.

[0093] Step 3.1: Due to the partitioning of matrix T, for 0 ≤ t ≤ s-1, define a new vector. in:

[0094]

[0095] Step 3.2: Calculate verification evidence for each cloud server k. and calculation results As shown in the formula below:

[0096]

[0097]

[0098] Step 3.3: Output after each cloud server completes the calculation To the client;

[0099] Step 4: The client executes the Verify algorithm, inputting the verification key VK, auxiliary information τ, and the data sent by the cloud server after the previous s calculations. Output the verification calculation result σ y Or ⊥;

[0100] Step 4.1: After receiving the values ​​sent by the cloud server after the first s completed calculations, the client uses this data to reconstruct the calculation results;

[0101] The client constructs the following polynomial:

[0102]

[0103]

[0104] Where z is the principal component of polynomials h1(z) and h2(z);

[0105] Send z from the cloud server that has completed the first s calculations. k and Substituting the points and values ​​into the two polynomials above for Fast Fourier Interpolation, we can finally solve for the coefficients ρ. t ,σM t σ x (t∈[0,s-1]), and then the verification evidence π and the encrypted calculation result σ are restored. y As shown in the formula below:

[0106]

[0107] Step 4.2: For 1≤i≤m, determine

[0108]

[0109] Whether it is true or not, where σ y,i For the calculation result σ y The i-th row of data; if all values ​​are true, output the encrypted calculation result σ. y Output the value to the data owner; otherwise, output ⊥ to indicate that the verification failed.

[0110] Step 5: The data owner executes the Solve algorithm, inputting the encrypted calculation result σ. y This yields the correct calculation result y;

[0111] After successful verification, the data owner receives the encrypted calculation result σ sent by the client. yThe correct calculation result can be obtained through the following formula;

[0112] y = σ y -Mu-Nx-Nu.

[0113] This embodiment compares the schemes of Elkhiyaoui et al. (PVDC), Zhang et al. (BVC), Fiore et al. (PVDM), and Blanton et al. (ESVOM). The comparison results are as follows: Figure 4 As shown. The results demonstrate that the method of the present invention offers advantages in both functionality and efficiency.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A privacy-preserving, verifiable distributed matrix multiplication outsourcing method, involving a data owner, a cloud server, and a client, characterized in that: Data Owner: The data owner, as an entity, possesses a matrix 𝑀 of size 𝑚×𝑛 and an 𝑛-dimensional vector 𝑥; the data owner divides the matrix 𝑀 into 𝑠 parts, and then encrypts the matrix 𝑀 and vector 𝑥 into a matrix 𝜎𝑀 and a vector 𝑥. The task was then outsourced to a group of cloud servers, who were entrusted with the computation. The result; simultaneously, the data owner generates a verification key. With auxiliary information It is then sent to the client to complete the verification of the final calculation result; Cloud server: requires a set of shared Each cloud server computes the results of its polynomial encoding operation in a distributed manner; each cloud server After the calculation is completed, its independent value will be... Calculation results and verification evidence Send to the client for verification; Client: The client will receive a verification key from the data owner. and auxiliary information and from the former Each cloud server that has completed its calculations sends its own independent value. Calculation results and verification evidence Then through these independent values Calculation results and verification evidence To restore the true calculation results and verification evidence Then verify the accuracy of the results; After verifying the accuracy of the results, the client returns the verification results to the data owner. The method includes the following steps: Step 1: Data owner executes The algorithm, through input security parameters Generate a public key from the matrix 𝑀. private key Verify key And the decryption key for matrix 𝑀 ; Step 2: Data owner executes The algorithm, by inputting the private key sum vector The encrypted vector is obtained. Auxiliary information and vectors decryption key ; Step 3: Cloud server execution Algorithm, input public key and the encrypted vector Each cloud server Output the respective calculation results ,in, The first The calculation results and verification evidence of each cloud server; Step 4: Client execution Algorithm, input verification key Auxiliary information and the former A cloud server that has completed its calculations sent Output the verification calculation results Or ⊥; Step 5: Data owner executes Algorithm, input encrypted calculation result To obtain the correct calculation results ; The specific method for step 1 is as follows: Step 1.1: The data owner calls the pseudo-random function. Algorithm, input security parameters The number of rows in matrix 𝑀 The number of columns in matrix 𝑀 Obtain the key and common parameters ; Step 1.2: Select a random number ,in, The size does not exceed Integer; let ,in, It is a bilinear mapping , It is a group Generators; Step 1.3: Generate the matrix Sparse matrices of the same size By matrix With matrix Adding and blinding yields the matrix ; Step 1.4: Define the domain For each Define and calculate ,in, It is a pseudo-random function; let the matrix ; Step 1.5: Convert the matrix With matrix Divided by row The components are shown in the following formula: ； Step 1.6: Output the public key private key Verify key , decryption key ; The specific method for step 2 is as follows: Step 2.1: Generate vectors Sparse vectors of the same size Calculate the encrypted vector ; Step 2.2: For Calculate the i-th auxiliary information ; Step 2.3: Output the encrypted vector Auxiliary information Decryption key ; The specific method for step 3 is as follows: Step 3.1: Due to the matrix The division, for Define a new vector ,in: ； Step 3.2: Each cloud server Calculate and verify evidence and calculation results As shown in the formula below: ； Step 3.3: Output after each cloud server completes the calculation To the client; The specific method for step 4 is as follows: Step 4.1: Before receiving After the cloud server sends the completed calculation, the client uses this data to reconstruct the calculation result. The client constructs the following polynomial: ； Where z is the principal component of polynomials h1(z) and h2(z); Before A cloud server that has completed its calculations sent and Substituting the points and values ​​into the two polynomials above for Fast Fourier Interpolation, the coefficients are finally solved. In order to restore the verification evidence and encrypted calculation results As shown in the formula below: ； Step 4.2: For ,judge Whether it is true or not, among which, For the calculation results The i-th row of data; if all values ​​are true, output the encrypted calculation result. Output the value to the data owner; otherwise, output ⊥ to indicate that the verification failed. After successful verification in step 5, the data owner receives the encrypted calculation result sent by the client. The correct calculation result can be obtained through the following formula; 。

Images