Data encryption method, device, computer equipment and storage medium

Abstract

The present application relates to a data encryption method, apparatus, computer equipment, storage medium and computer program product. The method comprises: receiving a public key and a ciphertext of an intermediate calculation result sent by a second data party, and determining the ciphertext of a predicted label and the ciphertext of a label difference; blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain the ciphertext of a blinded predicted label and the ciphertext of a blinded label difference; sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model, and blinding the received ciphertext on the labeled data party to achieve the goal that during the training and prediction process, the labeled data party cannot know the plaintext of the gradient and model weight of the unlabeled data party, thereby improving the security of the data and the performance of the model training.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a data encryption method, apparatus, computer equipment, storage medium, and computer program product. Background Art

[0002] With the development of security technology, mature and mainstream data sharing security technologies such as federated learning and multi-party secure computing have emerged, and the industry has begun to increasingly use these technologies in modeling. Among them, the demand for linear model training and prediction in vertical federated learning scenarios (such as cross-enterprise and cross-industry joint modeling) is particularly strong.

[0003] In the related technology, the linear model includes a labeled data party and an unlabeled data party for joint training. The specific process is: since the labeled data party updates the weight through its own gradient, the labeled data party needs to know its own plaintext gradient. However, after knowing the plaintext gradient of the other party, the labeled data party can use its own plaintext gradient combined with other known intermediate parameters and conditions to infer the other party's model parameter wx, and use the model parameter wx and the known intermediate parameters to infer the other party's original feature data x. Based on this, the labeled data party can infer the original data of the unlabeled data participant through the available information, which poses a risk of data leakage, resulting in poor data security. Summary of the Invention

[0004] Based on this, it is necessary to provide a data encryption method, device, computer equipment, computer-readable storage medium and computer program product that can improve data security in response to the above technical problems.

[0005] In a first aspect, the present application provides a data encryption method, applied to a first data party, where the first data party is a labeled data party, the method comprising:

[0006] Receive the public key sent by the second data party and the ciphertext of the intermediate calculation result, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data;

[0007] Determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0008] Blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain a blinded ciphertext of the predicted label and a blinded ciphertext of the label difference;

[0009] The ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0010] In one embodiment, determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic component of the labeled sample data includes:

[0011] For the i-th sample data in the unlabeled sample data, determine the ciphertext of the i-th predicted label based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the current first model parameter of the first data party, and the i-th feature component in the labeled sample data;

[0012] For the i-th sample data in the unlabeled sample data, the ciphertext of the label difference is determined based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the i-th intermediate calculation result in the labeled sample data, and the i-th label data.

[0013] In one embodiment, obtaining the ciphertext of the first model weight of the first data entity and the second model weight of the second data entity corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes:

[0014] Sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity, so that the second data entity performs decryption processing to obtain a blinded second-party gradient;

[0015] receiving a blinded second-party gradient sent by the second data party, performing a deblinding process on the blinded second-party gradient to obtain a second-party gradient, and sending the second-party gradient to the second data party, so that the second data party obtains an updated second model weight and target indication information based on the second-party gradient;

[0016] If it is determined based on the target indication information that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined based on the target indication information that the preset training completion conditions are met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0017] In one embodiment, obtaining the ciphertext of the first model weight of the first data cube corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes:

[0018] Calculate the ciphertext of the loss sub-function of the first data party based on the i-th label data and the ciphertext of the label difference;

[0019] Blinding the ciphertext of the loss sub-function of the first data cube to obtain a blinded ciphertext of the loss sub-function of the first data cube;

[0020] Sending the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the loss subfunction of the blinded first data cube to the second data cube, so that the second data cube performs decryption processing to obtain a blinded second-cube gradient and a blinded loss function;

[0021] receiving the blinded second-party gradient and the blinded loss function sent by the second data party, performing unblinding processing on the blinded second-party gradient and the blinded loss function to obtain a second-party gradient and a loss function, and sending the second-party gradient to the second data party;

[0022] If it is determined based on the loss function that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined based on the loss function that the preset training completion conditions are met, then the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0023] In one embodiment, obtaining the ciphertext of the first model weight of the first data entity and the second model weight of the second data entity corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes:

[0024] Sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity, so that the second data entity performs decryption processing to obtain a blinded second-party gradient;

[0025] receiving a blinded second-party gradient sent by the second data party, performing a deblinding process on the blinded second-party gradient to obtain a second-party gradient, and sending the second-party gradient to the second data party, so that the second data party obtains an updated second model weight based on the second-party gradient;

[0026] If it is determined that the preset training completion conditions are not met, the steps of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result are re-executed until it is determined that the preset training completion conditions are met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0027] In one embodiment, the method further comprises:

[0028] Determining a current gradient ciphertext of the first data entity based on the characteristic components of the labeled sample data and the ciphertext of the label difference;

[0029] Based on the current gradient ciphertext of the first data entity and the model parameters of the labeled sample data, the ciphertext of the first model weight of the current first data entity is calculated.

[0030] In one embodiment, the method further comprises:

[0031] Calculate the random ciphertext of the test sample data based on the ciphertext of the model parameters of the first data entity corresponding to the trained model, the characteristic components of the labeled sample data, and the test random number;

[0032] Sending the random ciphertext of the test sample data to the second data party, so that the second data party processes the random ciphertext of the test sample data to obtain random data for predicting label data;

[0033] Receive the random data of the predicted label data sent by the second data party, de-randomize the random data of the predicted label data, and obtain the ciphertext of the predicted label data, where the ciphertext of the predicted label data is used to determine the test result.

[0034] In a second aspect, the present application provides a data encryption method, applied to a second data entity, where the second data entity is an unlabeled data entity, the method comprising:

[0035] Calculating an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of the each unlabeled sample data, encrypting the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and sending the ciphertext of the intermediate calculation result to the first data party;

[0036] Receive the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference sent by the first data party, and obtain the second model weight of the second data party corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0037] In one embodiment, obtaining the second model weight of the second data cube corresponding to the trained model based on the received ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes:

[0038] Decrypt the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to obtain the blinded second-party gradient;

[0039] Sending the blinded second-party gradient to the first data cube, so that the first data cube obtains the second-party gradient;

[0040] Receive the second-party gradient sent by the first data party, and based on the second-party gradient, update the second model weight of the current second data party to obtain the updated second model weight, and based on the updated second model weight, generate target indication information, the target indication information represents whether the preset training completion condition is met or not, and send the target indication information to the first data party.

[0041] In one embodiment, obtaining the second model weight of the second data cube corresponding to the trained model based on the received ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes:

[0042] Receive the ciphertext of the blinded predicted label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction;

[0043] Decrypting the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction to obtain a blinded loss function and a blinded second-party gradient;

[0044] Sending the blinded loss function and the blinded second-party gradient to the first data cube, so that the first data cube determines the second-party gradient and the training result based on the blinded loss function and the blinded second-party gradient;

[0045] The training result and the second-party gradient are received, and based on the second-party gradient, the second model weight of the current second data cube is updated to obtain an updated second model weight.

[0046] In one embodiment, the method further comprises:

[0047] Receive random ciphertext of test sample data sent by the first data party, where the random ciphertext of the test sample data is obtained by the first data party based on the ciphertext of the model parameters of the first data party corresponding to the trained model, the feature components of the labeled sample data, and the test random number;

[0048] Decrypting the random ciphertext of the test sample data to obtain random data of the test sample data, and obtaining random data of the predicted label data based on the characteristic components of the unlabeled sample data, the model parameters of the second data party, and the random data of the test sample data;

[0049] The random data of the predicted label data is sent to the first data party so that the first data party de-randomizes the random data of the predicted label data to obtain the ciphertext of the predicted label data, and the ciphertext of the predicted label data is used to determine the test result.

[0050] In a third aspect, the present application provides a data encryption method, applied to a first data party and a second data party, where the first data party is a labeled data party and the second data party is an unlabeled data party, the method comprising:

[0051] The second data party calculates an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data, encrypts the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and sends the ciphertext of the intermediate calculation result to the first data party;

[0052] The first data party determines the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data; blinds the ciphertext of the predicted label and the ciphertext of the label difference to obtain the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; and sends the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model;

[0053] The first data cube obtains a second model weight of the second data cube corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0054] In a fourth aspect, the present application provides a data encryption device, applied to a first data party, where the first data party is a labeled data party, and the device includes:

[0055] A first receiving module is configured to receive a public key and a ciphertext of an intermediate calculation result sent by a second data party, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data;

[0056] A first determination module is configured to determine the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0057] A blinding processing module, configured to perform blinding processing on the ciphertext of the predicted label and the ciphertext of the label difference to obtain the blinded ciphertext of the predicted label and the ciphertext of the blinded label difference;

[0058] The second determination module is used to send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0059] In a fifth aspect, the present application provides a data encryption device, applied to a second data entity, where the second data entity is an unlabeled data entity, and the device includes:

[0060] a third determining module, configured to calculate an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of the each unlabeled sample data, encrypt the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and send the ciphertext of the intermediate calculation result to the first data party;

[0061] The second receiving module is used to receive the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference sent by the first data party, and obtain the second model weight of the second data party corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0062] In a sixth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0063] Receive the public key sent by the second data party and the ciphertext of the intermediate calculation result, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data;

[0064] Determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0065] Blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain a blinded ciphertext of the predicted label and a blinded ciphertext of the label difference;

[0066] The ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0067] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0068] Receive the public key sent by the second data party and the ciphertext of the intermediate calculation result, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data;

[0069] Determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0070] Blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain a blinded ciphertext of the predicted label and a blinded ciphertext of the label difference;

[0071] The ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0072] In an eighth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0073] Receive the public key sent by the second data party and the ciphertext of the intermediate calculation result, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data;

[0074] Determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0075] Blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain a blinded ciphertext of the predicted label and a blinded ciphertext of the label difference;

[0076] The ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0077] The above-mentioned data encryption method, apparatus, computer equipment, storage medium and computer program product receive the public key sent by the second data party and the ciphertext of the intermediate calculation result; determine the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data; blind the ciphertext of the predicted label and the ciphertext of the label difference to obtain the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; send the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model. By adopting this method, the received ciphertext can be blinded on the labeled data party, so that during the training and prediction process, the labeled data party cannot know the plaintext of the gradient and model weight of the unlabeled data party, and all the data that can be obtained is encrypted and protected by the public key of the unlabeled data party, thereby avoiding data leakage and improving data security and model training performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 A diagram showing an application environment of a data encryption method in one embodiment;

[0079] Figure 2 Schematic diagram of a data encryption method according to an embodiment;

[0080] Figure 3 A schematic diagram of a flow chart of a ciphertext step of determining a tag difference in one embodiment;

[0081] Figure 4 A schematic flow chart of a ciphertext step of determining a first model weight in one embodiment;

[0082] Figure 5 A schematic flow chart of a ciphertext step of determining a first model weight in one embodiment;

[0083] Figure 6 A schematic flow chart of a ciphertext step of determining a first model weight in one embodiment;

[0084] Figure 7 Schematic diagram of a test process in one embodiment;

[0085] Figure 8 Schematic diagram of a data encryption method according to an embodiment;

[0086] Figure 9 A schematic diagram of a flow chart of steps for generating a target indication message in one embodiment;

[0087] Figure 10 A schematic flow chart of a ciphertext step of determining a second model weight in one embodiment;

[0088] Figure 11 A schematic diagram of a flow chart of the step of determining predicted label data in one embodiment;

[0089] Figure 12 is a structural block diagram of a data encryption device in one embodiment;

[0090] Figure 13 is a structural block diagram of a data encryption device in one embodiment;

[0091] Figure 14 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0092] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0093] The data encryption method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. The first terminal 102 and the second terminal 104 can respectively communicate with the server 106 via a network. The first terminal can be the first training client in federated learning, and the second terminal can be another training client in federated learning. The first terminal can store labeled data, and the second terminal can store unlabeled data. The first terminal and the second terminal can jointly perform training based on labeled data and unlabeled data. The first terminal 102 and the second terminal 104 can be, but are not limited to, various personal computers, laptops, smartphones, tablets, etc. The server 106 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0094] In one embodiment, a data encryption method is provided, which is applied to a terminal corresponding to a first data party, where the first data party is a labeled data party, such as Figure 2 As shown, the data encryption method includes:

[0095] Step 202: Receive the public key and the ciphertext of the intermediate calculation result sent by the second data party.

[0096] Among them, the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data. The first data party can be a labeled data party that stores labeled data, for example, it can be a guest party; the second data party can be an unlabeled data party that stores unlabeled data, for example, it can be a host party. The public key sent by the second data party can be a public key calculated by the second data party, and the public key is used to encrypt the data sent by the second data party to the first data party. The ciphertext of the intermediate calculation result can be obtained by the second data party encrypting the intermediate calculation result based on the second data party's public key; in one example, the encryption processing performed by the second data party can also be the second data party performing addition-type homomorphic encryption processing on the intermediate calculation result.

[0097] In implementation, the second data party can process the model parameters corresponding to the locally stored unlabeled sample data and the characteristic components of each unlabeled sample data to obtain an intermediate calculation result. Based on this, the second data party can encrypt the obtained intermediate calculation result based on its own public key to obtain the ciphertext of the intermediate calculation result. In one example, the second data party can determine the homomorphic encryption public key, and perform homomorphic encryption on the intermediate calculation result based on the homomorphic encryption public key to obtain the intermediate calculation result under the homomorphic encryption public key, that is, the ciphertext of the intermediate calculation result. In this way, the second data party can send the public key and the ciphertext of the intermediate calculation result calculated based on the model parameters corresponding to the unlabeled sample data and each unlabeled sample data to the first data party. The first data party can receive the public key of the second data party and the ciphertext of the intermediate calculation result.

[0098] Step 204 : Determine the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data.

[0099] Among them, the ciphertext of the predicted label represents the predicted value of the labeled sample data in ciphertext form, and the labeled sample data is the sample data stored in the labeled data side; the ciphertext of the label difference is calculated based on the ciphertext of the intermediate calculation result corresponding to the labeled sample data, the ciphertext of the intermediate calculation result corresponding to the unlabeled sample data, and the label data in the labeled sample data, and represents the difference between the sample data and the label data.

[0100] In implementation, the first data party may calculate the ciphertext of the predicted label and the ciphertext of the calculated label difference based on the ciphertext of the intermediate calculation result and the feature components determined based on the labeled sample data. In one example, the first data party may perform operations based on the ciphertext of the intermediate calculation result corresponding to the labeled sample data, the ciphertext of the intermediate calculation result corresponding to the unlabeled sample data, and the label data in the labeled sample data to determine the ciphertext of the predicted label and the ciphertext of the label difference.

[0101] Step 206 , blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain the blinded ciphertext of the predicted label and the blinded ciphertext of the label difference.

[0102] The blinding process may be a random process based on a random number, and the random number may be a random bit of fixed length.

[0103] In implementation, the first data party may determine one or more random numbers, and blind the ciphertext of the predicted label and the ciphertext of the label difference based on the first or more random numbers determined, to obtain the blinded ciphertext of the predicted label and the ciphertext of the blinded label difference. In one example, the first data party may determine a first random number and a second random number, and process the ciphertext of the predicted label based on the determined first random number to obtain the blinded ciphertext of the predicted label. The first data party may also blind the ciphertext of the label difference based on the first random number and the second random number to obtain the blinded ciphertext of the first label difference.

[0104] Step 208: Send the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model.

[0105] In implementation, the first data party can send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party can perform decryption processing based on the received ciphertext of the blinded prediction label and the ciphertext of the blinded label difference, and interact with the first data party so that the first data party can obtain the ciphertext of the first model weight corresponding to the first data party in the trained model.

[0106] In the above data encryption method, the public key sent by the second data party and the ciphertext of the intermediate calculation result are received; based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data, the ciphertext of the predicted label and the ciphertext of the label difference are determined; the ciphertext of the predicted label and the ciphertext of the label difference are blinded to obtain the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model. By adopting this method, the received ciphertext can be blinded on the labeled data party, so that during the training and prediction process, the labeled data party cannot know the plaintext of the gradient and model weight of the unlabeled data party, and all the data that can be obtained are encrypted and protected by the public key of the unlabeled data party, thereby avoiding data leakage and improving data security and model training performance.

[0107] In one embodiment, Figure 3 As shown, the specific processing process of step 204 "determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data" includes:

[0108] Step 302: For the i-th sample data in the unlabeled sample data, determine the ciphertext of the i-th predicted label based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the current first model parameter of the first data party, and the i-th feature component in the labeled sample data.

[0109] The unlabeled sample data may include multiple pieces of sample data; the ciphertext of the current first model parameter of the first data entity may be the ciphertext of the first model parameter corresponding to the first data entity at the current moment.

[0110] In implementation, for the i-th sample data in the unlabeled sample data, the first data party can obtain the ciphertext of the current first model parameter of the first data party and the i-th characteristic component in the labeled sample data, perform calculations, and obtain a first intermediate quantity; based on this, the first data party can calculate the sum of the ciphertext of the first intermediate quantity and the i-th intermediate calculation result, and determine the obtained sum as the ciphertext of the i-th predicted label.

[0111] Step 304 : for the i-th sample data in the unlabeled sample data, determine the ciphertext of the label difference based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the i-th intermediate calculation result in the labeled sample data, and the i-th label data.

[0112] In implementation, the first data party can process the ciphertext of the i-th intermediate calculation result corresponding to the unlabeled sample data, the ciphertext of the i-th intermediate calculation result corresponding to the labeled sample data, and the i-th label data in the labeled sample data to obtain the ciphertext of the i-th label difference.

[0113] In this embodiment, model training is achieved by calculating the ciphertext of the predicted label and the ciphertext of the label difference, which can ensure the training performance of the model training.

[0114] In one embodiment, Figure 4 As shown, the specific processing process of step 208 "sending the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model" includes:

[0115] Step 402: Send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party performs decryption processing to obtain the blinded second party gradient.

[0116] In implementation, after obtaining the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference, the first data party can send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party; the second data party can perform decryption processing to obtain the blinded prediction label and the blinded label difference, and calculate based on the blinded label difference and the characteristic components of the unlabeled data to obtain the blinded second-party gradient, and return the blinded second-party gradient to the first data party.

[0117] Step 404: Receive the blinded second-party gradient sent by the second data party, deblind the blinded second-party gradient to obtain the second-party gradient, and send the second-party gradient to the second data party so that the second data party obtains the updated second model weight and target indication information based on the second-party gradient.

[0118] The target indication information is used to indicate whether the preset training completion condition is met. The target indication information can be used to indicate whether the preset training completion condition is met or not.

[0119] In implementation, the first data party can perform deblinding based on the received blinded second-party gradient. For example, the received blinded second-party gradient can be deblinded based on the determined first and second random numbers to obtain the second-party gradient. Based on this, the first data party can send the second-party gradient to the second data party; the second data party can update the current second model weights based on the received second-party gradient to obtain updated second model weights. Based on the updated second-party gradient, the second data party determines whether the preset training completion conditions are met and generates target indication information. In this way, the second data party can return the target indication information to the first data party.

[0120] In step 406, if it is determined based on the target indication information that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined based on the target indication information that the preset training completion conditions are met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0121] In implementation, if the first data party determines, based on the received target indication information, that the information carried in the target indication information represents that the preset training completion conditions are not currently met, then the first data party can use the ciphertext of the first model weight of the first data party obtained in the above steps as the first model parameter of the first data party corresponding to the model under training at the current moment, and re-execute the above steps of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result, until the first data party determines, based on the received target indication information, that the information carried in the target indication information represents that the preset training completion conditions are currently met, then the first data party can determine the ciphertext of the current first data party's first model weight, which can be the ciphertext of the first model weight of the first data party corresponding to the trained model, that is, the ciphertext of the first model parameter of the first data party corresponding to the trained model.

[0122] In one example, the second data entity may determine whether a preset training completion condition is satisfied based on a change in the updated second model weight. Optionally, the preset training completion condition may be a preset convergence condition, etc.

[0123] In this embodiment, the unlabeled data party determines whether the preset training completion conditions are met based on the changes in the model weights corresponding to the updated unlabeled data party, which can enrich the judgment method of the training completion conditions and ensure the accuracy of judging whether the training is completed.

[0124] In one embodiment, the specific processing process of step 208 of "sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model" includes:

[0125] Step 1: Send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party performs decryption processing to obtain the blinded second-party gradient.

[0126] In implementation, after obtaining the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference, the first data party can send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party; the second data party can perform decryption processing to obtain the blinded prediction label and the blinded label difference, and calculate based on the blinded label difference and the characteristic components of the unlabeled data to obtain the blinded second-party gradient, and return the blinded second-party gradient to the first data party.

[0127] Step, receiving the blinded second-party gradient sent by the second data party, de-blinding the blinded second-party gradient to obtain the second-party gradient, and sending the second-party gradient to the second data party, so that the second data party obtains the updated second model weight based on the second-party gradient.

[0128] In implementations, the first data party may perform unblinding processing based on the received blinded second-party gradient. For example, the received blinded second-party gradient may be unblinded based on the determined first random number and the second random number to obtain the second-party gradient. Based on this, the first data party may send the second-party gradient to the second data party; and the second data party may update the current second model weights based on the received second-party gradient to obtain updated second model weights.

[0129] If it is determined that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined that the preset training completion conditions are met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0130] In implementation, the first data party can determine whether the preset training completion conditions are currently met based on its own data. If it is determined that the preset training completion conditions are not currently met, the first data party can use the ciphertext of the first model weight of the first data party obtained in the above steps as the first model parameter of the first data party corresponding to the model under training at the current moment, and re-execute the above steps of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result, until the first data party determines that the preset training completion conditions are currently met based on its own data. The first data party can then determine the ciphertext of the current first data party's first model weight, which can be the ciphertext of the first model weight of the first data party corresponding to the trained model, that is, the ciphertext of the first model parameter of the first data party corresponding to the trained model.

[0131] In one example, the data of the first data party itself can be the current number of iterations. After the step of sending the second party gradient to the second data party, the terminal corresponding to the first data party can obtain the current number of iterations and compare the current number of iterations with a preset iteration number threshold. If the terminal corresponding to the first data party determines that the current number of iterations is less than the preset iteration number threshold, the terminal corresponding to the first data party can determine that the preset training completion condition is not currently met; if the terminal corresponding to the first data party determines that the current number of iterations is greater than or equal to the preset iteration number threshold, the terminal corresponding to the first data party can determine that the preset training completion condition is met.

[0132] In one example, the data of the first data party itself can be the first model weight corresponding to the first data party. After the step of sending the second party gradient to the second data party, the terminal corresponding to the first data party can calculate the ciphertext of the current first model weight with the ciphertext of the first model weight in the previous round of iteration to obtain a weight difference parameter. If the weight difference parameter is less than the target value, the terminal corresponding to the first data party can determine that the preset training completion condition is currently met; if the terminal corresponding to the first data party determines that the weight difference parameter is greater than or equal to the target value, the terminal corresponding to the first data party can determine that the preset training completion condition is not met. Optionally, the target value can be, for example, 0, etc.

[0133] In this embodiment, the party with labeled data can determine whether the preset training completion conditions are met based on the calculated weight difference or the number of iterations. This can enrich the method of determining the training completion conditions and achieve high accuracy in determining whether the training is completed while ensuring training performance and saving computing resources required for training.

[0134] In one embodiment, Figure 5 As shown, the specific processing process of step 208 "sending the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model" includes:

[0135] Step 502: Calculate the ciphertext of the loss sub-function of the first data party based on the i-th label data and the ciphertext of the label difference.

[0136] The loss sub-function of the first data party can be calculated based on the label difference and the label data in the sample data, for example, it can be a loss fragment; the i-th label data can be the i-th label data among the multiple label data contained in the labeled sample data (which can be recorded as y i ).

[0137] In implementation, the first data party may calculate the ciphertext of the loss sub-function of the i-th first data party based on the ciphertext of the i-th label data and the i-th label difference. The first data party may perform a superposition process based on the ciphertexts of each loss sub-function to obtain the ciphertext of the loss sub-function of the first data party. In one example, the first data party may perform a product operation on the ciphertext of the i-th label difference with the corresponding i-th label data to obtain the ciphertext of each loss sub-function.

[0138] Step 504 : Blind the ciphertext of the loss sub-function of the first data cube to obtain the blinded ciphertext of the loss sub-function of the first data cube.

[0139] In implementation, the terminal corresponding to the first data party can blind the calculated ciphertext of the loss sub-function of the first data party based on a predetermined random number; in one example, the terminal corresponding to the first data party can multiply the ciphertext of the loss sub-function of the first data party by the random number, and determine the obtained product as the ciphertext of the blinded loss sub-function of the first data party.

[0140] Step 506: Send the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction of the first data party to the second data party, so that the second data party performs decryption processing to obtain the blinded second party gradient and the blinded loss function.

[0141] In implementation, the terminal corresponding to the first data party can exchange data with the terminal corresponding to the second data party. The specific data interaction process can be: the terminal corresponding to the first data party can send the calculated blinded prediction label ciphertext, the blinded label difference ciphertext, and the blinded first data party's loss sub-function ciphertext to the terminal corresponding to the second data party. In this way, the terminal corresponding to the second data party can decrypt the received data based on the public key after receiving the blinded prediction label ciphertext, the blinded label difference ciphertext, and the blinded first data party's loss sub-function ciphertext, and return the decrypted data to the terminal corresponding to the first data party.

[0142] In one example, the second data party can decrypt the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss sub-function of the first data party based on the public key of the second data party to obtain the blinded complete loss function and the blinded second-party gradient, that is, the blinded loss function and the blinded second-party gradient; wherein the second-party gradient is used to update the model weight of the second data party, and the blinded loss function is used to determine whether the preset training completion conditions are currently met.

[0143] Step 508: Receive the blinded second-party gradient and the blinded loss function sent by the second data party, perform deblinding on the blinded second-party gradient and the blinded loss function to obtain the second-party gradient and the loss function, and send the second-party gradient to the second data party.

[0144] In implementation, the terminal corresponding to the first data party performs unblinding processing on the blinded second-party gradient and blinded loss function received from the terminal corresponding to the second data party. For example, the received blinded second-party gradient and blinded loss function may be unblinded based on the first random number and the second random number that have been pre-blinded, respectively, to obtain the second-party gradient and loss function. Based on this, the terminal corresponding to the first data party may send the second-party gradient obtained by the unblinding processing to the terminal corresponding to the second data party.

[0145] In step 510, if it is determined based on the loss function that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined based on the loss function that the preset training completion conditions are met, then the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

[0146] In implementation, the terminal corresponding to the first data party can determine whether the preset training completion condition is currently met based on the loss function obtained by the deblinding process. If it is determined that the preset training completion condition is currently met, the terminal corresponding to the first data party can determine the ciphertext of the first model weight of the current first data party, which is the ciphertext of the first model weight of the first data party corresponding to the trained model, and the terminal corresponding to the second data party can also obtain the second model weight of the second data party corresponding to the trained model. That is, if it is determined that the preset training completion condition is not currently met, the first data party can use the ciphertext of the first model weight of the first data party obtained in the above step as the first model parameter of the first data party corresponding to the model under training at the current moment, and re-execute the above step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result, until the terminal corresponding to the first data party determines that the preset training completion condition is currently met, then the first data party can determine the ciphertext of the first model weight of the current first data party, which can be the ciphertext of the first model weight of the first data party corresponding to the trained model, that is, the ciphertext of the first model parameter of the first data party corresponding to the trained model. Similarly, the terminal corresponding to the second data party can also determine the second model weight of the current first data party, which is the second model weight of the second data party corresponding to the trained model, that is, the second model parameter of the second data party corresponding to the trained model.

[0147] In this embodiment, the loss function is used as the basis for judging whether the preset training completion conditions are met, which can ensure the efficiency and accuracy of the training, and can also ensure that the loss function is obtained in a fully protected state, thereby ensuring the security of the loss function-related data.

[0148] In one embodiment, Figure 6 As shown, the data encryption method also includes:

[0149] Step 602: Determine the current gradient ciphertext of the first data entity based on the characteristic components of the labeled sample data and the ciphertext of the label difference.

[0150] In implementation, the terminal corresponding to the first data party can process the i-th sample data in the labeled sample data and the corresponding ciphertext of the i-th label difference to obtain the intermediate quantity corresponding to the i-th sample data. In this way, the terminal corresponding to the first data party can superimpose the intermediate quantity corresponding to each sample data in the labeled sample data to obtain the current gradient ciphertext of the first data party, that is, the current gradient of the first data party in the ciphertext form.

[0151] Step 604 : Calculate the ciphertext of the first model weight of the current first data cube based on the current gradient ciphertext of the first data cube and the model parameters of the labeled sample data.

[0152] In implementation, the terminal corresponding to the first data party determines an adjustment factor and calculates the product of the adjustment factor and the current gradient ciphertext of the first data party in the above steps to obtain a product value. In this way, the terminal corresponding to the first data party can calculate the difference between the model parameters of the labeled sample data and the product value, and determine the difference as the ciphertext of the current first model weight of the first data party.

[0153] In an example, the first data party can determine that the difference is the ciphertext of the first model weight of the current first data party. The current one may be, for example, the nth round of iteration. Then, the terminal corresponding to the first data party can determine that the ciphertext of the first model weight of the current first data party is the ciphertext of the first model parameter of the first data party in the n+1th round of iteration. Similarly, the terminal corresponding to the second data party will also perform a similar process, which will not be repeated here.

[0154] In this embodiment, the ciphertext of the first model weight is updated by the ciphertext of the characteristic components of the labeled sample data and the label difference, thereby ensuring the accuracy of the obtained weight ciphertext and avoiding the risk of data leakage.

[0155] In one embodiment, Figure 7 As shown, the data encryption method also includes:

[0156] Step 702 : Calculate the random ciphertext of the test sample data based on the ciphertext of the model parameters of the first data entity corresponding to the trained model, the characteristic components of the labeled sample data, and the test random number.

[0157] In implementation, the terminal corresponding to the first data party can determine the ciphertext of the first model parameters of the corresponding first data party based on the ciphertext of the first model weights of the trained model, and calculate the product of the ciphertext of the model parameters of the first data party and the characteristic components of the labeled sample data. In this way, the terminal can randomize the product based on the test random number to obtain the random ciphertext corresponding to the test sample data.

[0158] Step 704: Send the random ciphertext of the test sample data to the second data party so that the second data party decrypts the random ciphertext of the test sample data to obtain the random data of the test sample data, and obtains the random data of the predicted label data based on the characteristic components of the unlabeled sample data, the model parameters of the second data party and the random data of the test sample data.

[0159] During implementation, the terminal corresponding to the first data party can send the random ciphertext corresponding to the calculated test sample data to the terminal corresponding to the second data party, so that the terminal corresponding to the second data party can decrypt the random ciphertext of the test sample data to obtain the random data of the test sample data, and obtain the random data of the predicted label data based on the characteristic components of the unlabeled sample data, the model parameters of the second data party and the random data of the test sample data.

[0160] Step 706: Receive the random data of the predicted label data sent by the second data party, de-randomize the random data of the predicted label data to obtain the predicted label data, and use the ciphertext of the predicted label data to determine the test result.

[0161] In implementation, the terminal corresponding to the first data party can perform derandomization processing based on the random data of the received predicted label data to obtain predicted label data. In this way, the terminal corresponding to the first data party can determine the test result based on the obtained predicted label data, and the test result may include test pass or test fail, etc.

[0162] In this embodiment, by performing test processing on the test data, accurate test results can be obtained, thereby ensuring the effectiveness of model training.

[0163] In one embodiment, a data encryption method is provided, which is applied to a terminal corresponding to a second data party, where the second data party is an unlabeled data party, such as Figure 8 As shown, the data encryption method includes:

[0164] Step 802: Calculate the intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data, encrypt the intermediate calculation result, obtain the ciphertext of the intermediate calculation result, and send the ciphertext of the intermediate calculation result to the first data party.

[0165] In implementation, the terminal corresponding to the second data party can process the model parameters corresponding to the locally stored unlabeled sample data and the characteristic components of each unlabeled sample data to obtain an intermediate calculation result. Based on this, the second data party can encrypt the obtained intermediate calculation result based on its own public key to obtain the ciphertext of the intermediate calculation result. In one example, the second data party can determine the homomorphic encryption public key, and perform homomorphic encryption on the intermediate calculation result based on the homomorphic encryption public key to obtain the intermediate calculation result under the homomorphic encryption public key, that is, the ciphertext of the intermediate calculation result. In this way, the second data party can send the public key and the ciphertext of the intermediate calculation result calculated based on the model parameters corresponding to the unlabeled sample data and each unlabeled sample data to the first data party.

[0166] Step 804: Receive the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference sent by the first data party, and obtain the second model weight of the second data party corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0167] In implementation, the terminal corresponding to the second data party can perform decryption processing based on the received ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to obtain the blinded prediction label and the blinded label difference. The specific process can be: the terminal corresponding to the second data party can perform processing based on the characteristic components of the unlabeled sample data and the blinded label differences corresponding to the unlabeled sample data to obtain the second model weight of the blinded second data party, and when it is determined that the preset training completion condition is currently met, the second model weight of the second data party corresponding to the trained model is determined based on the second model weight of the current second data party.

[0168] In this embodiment, the received ciphertext can be blinded on the labeled data side and encrypted on the unlabeled data side, so that during the training process and the prediction process, the labeled data side cannot know the plaintext of the gradient and model weight of the unlabeled data side, and the unlabeled data side cannot obtain the ciphertext of the gradient and model weight of the labeled data side. All data that can be obtained by the labeled data side are protected by the public key encryption of the unlabeled data side, and all data that can be obtained by the unlabeled data side are protected by the random number of the labeled data side, so as to avoid data leakage, improve data security and improve the training efficiency of model training.

[0169] In one embodiment, Figure 9 As shown, the specific processing process of step 804 "obtaining the second model weight of the second data cube corresponding to the trained model based on the received ciphertext of the blinded prediction label and the ciphertext of the blinded label difference" includes:

[0170] Step 902: Decrypt the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to obtain a blinded second-party gradient.

[0171] In implementation, the terminal corresponding to the second data party can decrypt the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference respectively. For example, the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference can be decrypted respectively based on the predetermined public key of the second data party to obtain the blinded second-party gradient, that is, the blinded second-party gradient.

[0172] Step 904: Send the blinded second-party gradient to the first data party, so that the first data party obtains the second-party gradient.

[0173] In implementation, the second data party can send a blinded second-party gradient to the first data party. After receiving the blinded second-party gradient, the first data party can de-blind the blinded second-party gradient to obtain the second-party gradient, and the first data party can send the determined second-party gradient to the terminal corresponding to the second data party.

[0174] Step 906: Receive the second party gradient sent by the first data party, and update the second model weight of the current second data party based on the second party gradient to obtain the updated second model weight, and generate target indication information based on the updated second model weight.

[0175] The target indication information indicates whether a preset training completion condition is met or not, and the target indication information is sent to the first data party.

[0176] In implementation, the terminal corresponding to the second data party may perform a model weight update process based on the received second-party gradient, that is, the terminal corresponding to the second data party may update the second model weight of the current second data party based on the currently received second-party gradient to obtain the updated second model weight. In one example, the terminal corresponding to the second data party may update the second model weight of the second data party in the n-1th iteration based on the received second-party gradient in the nth iteration to obtain the second model weight in the nth iteration, and determine the second model weight calculated in the nth iteration as the second model parameter of the second data party in the n+1th iteration.

[0177] Optionally, the terminal corresponding to the second data party determines whether the preset training completion condition is met based on the updated second model weight. If it is determined that the preset training completion condition is currently met, target indication information is generated to ensure that the preset training completion condition is met. For example, the terminal corresponding to the second data party can determine whether the second model weight converges based on the second model weight in the nth iteration process and the second model weight in the n-1th iteration process. If it is determined that the second model weight meets the preset convergence condition, the terminal corresponding to the second data party can determine that the preset training completion condition is currently met and generate target indication information for characterizing that the preset training completion condition is currently met. Similarly, if the terminal corresponding to the second data party determines that the preset training completion condition is not currently met, target indication information can be generated to characterize that the preset training completion condition is not currently met. Based on this, the terminal corresponding to the second data party can return the generated target indication information to the terminal corresponding to the first data party.

[0178] In this embodiment, the terminal corresponding to the second data party determines whether the preset training completion conditions are met based on the second model weight, which can enrich the judgment method of the preset training completion conditions and ensure the performance of model training.

[0179] In one embodiment, Figure 10 As shown, the specific processing process of the step of "obtaining the second model weight of the second data cube corresponding to the trained model based on the received ciphertext of the blinded prediction label and the ciphertext of the blinded label difference" includes:

[0180] Step 1002: Receive the ciphertext of the blinded predicted label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction.

[0181] In implementation, the terminal corresponding to the second data party may receive the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction sent by the terminal corresponding to the first data party. The ciphertext of the blinded loss subfunction may be the ciphertext of the blinded loss fragment.

[0182] Step 1004 : Decrypt the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction to obtain a blinded loss function and a blinded second-party gradient.

[0183] In implementation, the terminal corresponding to the second data party can decrypt the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss sub-function. For example, the above data can be decrypted based on the predetermined homomorphic encryption key of the second data party to obtain the blinded prediction label, the blinded label difference, and the blinded loss sub-function; based on this, the terminal corresponding to the second data party can perform a multiplication operation based on the blinded prediction label and the blinded label difference, and obtain a blinded loss function based on the obtained product value and the obtained blinded loss sub-function; similarly, the terminal corresponding to the second data party can perform calculations based on the unlabeled sample data and the blinded label difference to obtain a blinded second-party gradient.

[0184] Step 1006: Send the blinded loss function and the blinded second-party gradient to the first data cube, so that the first data cube determines the second-party gradient and the training result based on the blinded loss function and the blinded second-party gradient.

[0185] In implementation, the terminal corresponding to the second data party can unblind the loss function and the blinded second-party gradient to the first data party, so that the terminal corresponding to the first data party can deblind the blinded loss function and the blinded second-party gradient to obtain the second-party gradient and the loss function. The terminal corresponding to the first data party can determine whether the preset training completion condition is currently met based on the obtained loss function. If it is determined that the preset training completion condition is met, the terminal corresponding to the first data party can generate a training result for characterizing the completion of the training, and return the second-party gradient and the training result for ensuring the completion of the training to the terminal corresponding to the second data party; similarly, if it is determined that the preset training completion condition is not met, the terminal corresponding to the first data party can generate a training result for characterizing the incomplete training, and return the second-party gradient and the training result for ensuring the incomplete training to the terminal corresponding to the second data party.

[0186] Step 1008: Receive the training result and the second-party gradient, and update the second model weight of the current second data cube based on the second-party gradient to obtain an updated second model weight.

[0187] During implementation, the terminal corresponding to the second data party can receive the training results and the second party gradient, update the second model weight of the current second data party based on the second party gradient, and obtain the updated second model weight. If the training is determined to be completed based on the training results, the terminal corresponding to the second data party can determine the updated second model weight as the second model weight of the second data party corresponding to the trained model.

[0188] In this embodiment, whether the current training is complete is determined by the training results sent by the first data party, and the current second model weights are updated based on the second party gradient to ensure the effectiveness of the training.

[0189] In one embodiment, Figure 11 As shown, the data encryption method also includes:

[0190] Step 1102: Receive the random ciphertext of the test sample data sent by the first data party.

[0191] The random ciphertext of the test sample data is obtained by the first data party based on the ciphertext of the model parameters of the first data party corresponding to the trained model, the characteristic components of the labeled sample data, and the test random number.

[0192] During implementation, the terminal corresponding to the second data party may receive the random ciphertext of the test sample data sent by the first data party.

[0193] Step 1104: decrypt the random ciphertext of the test sample data to obtain random data of the test sample data, and obtain random data of the predicted label data based on the characteristic components of the unlabeled sample data, the model parameters of the second data party, and the random data of the test sample data.

[0194] During implementation, the terminal corresponding to the second data party can decrypt the random ciphertext of the test sample data to obtain random data for the test sample data. Thus, the terminal corresponding to the second data party can perform processing based on the characteristic components of the unlabeled sample data and the second model parameters of the second data party to obtain an intermediate quantity. The terminal corresponding to the second data party can perform calculations based on the intermediate quantity, the random data of the test sample data, and the test random number to obtain random data for predicting the label data.

[0195] Step 1106: Send the random data of the predicted label data to the first data party, so that the first data party de-randomizes the random data of the predicted label data to obtain the predicted label data.

[0196] Among them, the predicted label data is used to determine the test results.

[0197] In implementation, the second data party may send random data for predicting the label data to the first data party. In this way, the first data party may perform de-randomization based on the random data of the predicted label data. For example, the random data of the predicted label data may be de-randomized based on the test random number to obtain the predicted label data. The test result may include a pass or fail.

[0198] In one embodiment, a data encryption method is provided, which is applied to a terminal corresponding to a first data party and a terminal corresponding to a second data party, where the first data party is a labeled data party and the second data party is an unlabeled data party. The data encryption method includes:

[0199] The second data party calculates the intermediate calculation results based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data, encrypts the intermediate calculation results, obtains the ciphertext of the intermediate calculation results, and sends the ciphertext of the intermediate calculation results to the first data party.

[0200] The first data entity determines the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data. The ciphertext of the predicted label and the ciphertext of the label difference are blinded to obtain the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference. The ciphertext of the blinded predicted label and the ciphertext of the blinded label difference are sent to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model.

[0201] The second data cube obtains a second model weight of the second data cube corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0202] In this embodiment, the received ciphertext can be blinded on the labeled data side and encrypted on the unlabeled data side, so that during the training process and the prediction process, the labeled data side cannot know the plaintext of the gradient and model weight of the unlabeled data side, and the unlabeled data side cannot obtain the ciphertext of the gradient and model weight of the labeled data side. All data that can be obtained by the labeled data side are protected by the public key encryption of the unlabeled data side, and all data that can be obtained by the unlabeled data side are protected by the random number of the labeled data side, so as to avoid data leakage, improve data security and improve the training efficiency of model training.

[0203] The following describes in detail the specific implementation process of the above data encryption method in conjunction with a specific embodiment:

[0204] With the continuous development of data sharing security technologies, the application scope of federated learning and multi-party secure computation has become increasingly broad, and the industry has begun to use these technologies more and more in modeling. In particular, in vertical federated learning scenarios (such as cross-enterprise and cross-industry joint modeling applications), there is a strong demand for linear model training and prediction. Classification and regression problems solved by machine learning algorithms such as linear models (such as linear regression and logistic regression) are the main research areas of supervised learning.

[0205] However, there are many attack methods for the above linear model in the federated learning framework. The current mainstream vertical federated linear model algorithm has potential data leakage problems: the labeled data party B needs to pass its own gradient g B To update the weight w B , so the party with labeled data must know its own plaintext gradient g B Therefore, the party with labeled data can reverse the other party's original feature data through the following process, but can use the following steps to get the gradient g from the party B Or the model parameter w B The original feature data x (i.e. X A ):

[0206] 1. The labeled data party B passes its own plaintext gradient g B Combine other known intermediate parameters and conditions to infer the other party's wx A (i.e. X A W A );

[0207] 2. Party B with labeled data can combine wx A And combined with other known intermediate parameters to deduce, we can get the original data x (i.e. X A ) of the quadratic linear equations;

[0208] 3) By satisfying the matrix inversion conditions of the quadratic equation system and knowing some data, the original feature data x (i.e. X A ).

[0209] Based on the above description, it can be determined that the related linear model in the existing technology has the risk of data leakage in the application scenario of federated learning, and the data security is low.

[0210] The data encryption method provided in this embodiment includes a model training method and a prediction method for a longitudinal federated learning linear model based on semi-homomorphic encryption and random number multiplication blinding. The purpose is to avoid data leakage problems of linear models in the application scenarios of federated learning and ensure data security: for example, in this embodiment, during the entire model training and prediction process, the labeled data party cannot obtain the model weights and gradients of any unlabeled data, eliminating potential data leakage risks. By using semi-homomorphic encryption instead of secret sharing technology, both security and performance are taken into account.

[0211] The vertical federated linear model training and prediction method in the data encryption method provided in this embodiment may include:

[0212] Step 1: Data preprocessing and encrypted sample alignment

[0213] According to the conventional vertical federated learning framework, the labeled data party (which can be recorded as the Guest party) and the unlabeled data party (which can be recorded as the Host party) encrypt samples to obtain a virtual fusion data set, and perform appropriate data preprocessing, feature selection and feature engineering on the data set.

[0214] Step 2: The unlabeled data party configures a key pair and transmits the public key and encryption parameter fragments

[0215] The unlabeled data party generates its own additive homomorphic encryption public and private key pair (which can be recorded as PK H , SK H ), the unlabeled data party can distribute the public key (which can be recorded as PK) to the labeled data party H The terminal corresponding to the unlabeled data party can calculate the intermediate calculation result of each sample data of the unlabeled data party, and the intermediate calculation result of the i-th sample data in the unlabeled sample data (which can be recorded as ), can be calculated by the following formula:

[0216]

[0217] Among them, w H represents the model parameters of unlabeled sample data, Represents the characteristic component of the i-th sample data in the unlabeled sample data.

[0218] Unlabeled data can be used for all intermediate calculation results (which can be recorded as )Use public key PK H Perform homomorphic encryption to obtain the ciphertext of the intermediate calculation result, and send the ciphertext of the intermediate calculation result to the party with the labeled data (which can be recorded as ).

[0219] In addition, if it is the first iteration in the training process, the unlabeled data party needs to initialize the model weights (i.e., the first model weights) of the labeled data party and use the public key PK H After homomorphic encryption, it is sent to the party with labeled data.

[0220] Step 3: The party with labeled data calculates the required intermediate parameters and encrypted model weights and stores them

[0221] For labeled data, based on each sample i received The ciphertext (i.e. the ciphertext of the intermediate calculation result) calculates the ciphertext of the predicted label of each sample i (which can be recorded as ), label difference (which can be recorded as ), and the ciphertext of the loss subfunction (which can be recorded as For example, it can be a ciphertext of a lost fragment). The unlabeled data party can calculate the encrypted gradient of the labeled data party based on the product of the label difference ciphertext and the characteristic component of the labeled sample data of the labeled data party. The gradient is then used to calculate the ciphertext of the model weights related to the local features of the labeled data in the new round (the ciphertext of the model weights will be used to calculate the intermediate parameters required for the next round). The ciphertexts of the predicted labels, label differences, and loss fragments are each subjected to multiplication blinding protection, and the blinded parameters are sent to the unlabeled data. For example, they can be calculated using the following formula:

[0222]

[0223]

[0224]

[0225]

[0226]

[0227] in, Represents the ciphertext of the intermediate calculation result corresponding to the i-th sample data in the unlabeled sample data, The ciphertext of the first model parameter representing the labeled data, Represents the i-th feature component in the labeled sample data; y i Represents the i-th label data in the labeled sample data; represents the first gradient ciphertext of the first data cube (labeled data cube), Indicates the ciphertext of the first model weight corresponding to the labeled sample data. The ciphertext of the model parameters representing the labeled sample data.

[0228] Step 4: The unlabeled data party decrypts the intermediate parameters and calculates the blind loss L and the blinded self-gradient

[0229] The unlabeled data party can use the received blinded predicted label ciphertext, the blinded label difference ciphertext, and the blinded loss fragment ciphertext to obtain the data based on the private key SK H Decryption is performed to obtain blinded intermediate parameters, which may include blinded prediction labels (which can be recorded as ), the blinded label difference (which can be recorded as ), and the blinded loss subfunction And calculate the blind loss function L and blind own gradient by blinding intermediate parameters The blind loss L and the blinded self-gradient are sent to the labeled data party, for example, by the following formula:

[0230]

[0231]

[0232] in, represents the blinding loss function, represents the blinded second-order gradient.

[0233] Step 5: Randomize the labeled data and transfer the gradient to the unlabeled data

[0234] The labeled data party will receive the blind loss L and the blind unlabeled data party gradient, and then derandomize the loss L and the unlabeled data party gradient to obtain the plain text. The unlabeled data party gradient is sent to the unlabeled data party, for example, the second party gradient g H .

[0235] Step 6: Update the model for unlabeled data

[0236] The unlabeled data cube uses the gradient of the unlabeled data cube of this round obtained from the labeled data cube And use this gradient Update the model to obtain the model weights related to the features of the new round of unlabeled data. For example, the second model weight can be updated by the following formula to obtain the updated second model weight (which can be recorded as W H* ):

[0237] W H* =W H -ηg H

[0238] Step 7: Stop condition judgment when there is labeled data

[0239] The party with labeled data uses some indicators or early stopping conditions (commonly, judging whether convergence is based on the loss L of this round and the loss of the previous round) to determine whether to enter the next round of iteration. If so, steps 2 to 6 are looped. Otherwise, training is completed.

[0240] Specifically, the prediction process may include: the label data party calculates the random ciphertext of the test sample data (which can be recorded as ), for example, can be calculated by the following formula:

[0241]

[0242] Among them, r i Represents a test random number.

[0243] The labeled data party sends the random ciphertext of the test sample data to the unlabeled data party, and the unlabeled data party decrypts it to obtain the random data of the test sample data (which can be recorded as ), and based on the test sample data corresponding to the second data party Test sample data corresponding to the first data party Get random data for predicting label data (which can be recorded as ), for example, by The random data of the predicted label data is returned to the party with the label data (which can be recorded as ). In this way, the party with label data can de-randomize the random data of the predicted label data to obtain the predicted label data, for example, Got it.

[0244] The data encryption method provided in this embodiment can be used by the labeled data party to obtain the public key PK of the unlabeled data party in the last round of training. H The model weight W of the encrypted labeled data G , calculate the value of each sample i about the characteristics of the party The ciphertext is then added with the addition mask r i Then it is sent to the unlabeled data party, who decrypts it and adds the data obtained by local calculation After that, the calculation result is sent back to the unlabeled data party, and the unlabeled data party subtracts the mask r i After restoring the plain text of the calculation results, appropriate processing is performed (for example, logistic regression can perform sigmoid nonlinear transformation) to obtain the final result, avoid data leakage, and ensure data security.

[0245] The data encryption method provided in this embodiment prevents the parties with labeled data from knowing the plaintext of their own gradients and model weights during the entire federated linear model modeling and prediction process. All available data is protected by public key encryption of the parties with unlabeled data, thereby solving the following security issues existing in the existing federated learning linear model framework: preventing the parties with labeled data from inferring the original data of the parties with unlabeled data through available information, thereby preventing potential data leakage. In addition, by using additive homomorphic encryption, the performance of the algorithm can be improved.

[0246] Specifically, the labeled data party is referred to as the Guest party, the unlabeled data party is referred to as the Host party, the training data identification set formed by the HOST data party and the GUEST data party through sample alignment is D, and the training data held by the HOST party is represented as The training data held by the GUEST party is represented as Each iteration process needs to calculate the following intermediate variables:

[0247]

[0248]

[0249]

[0250]

[0251]

[0252]

[0253] w H ,w G They are the current HOST side model parameters and GUEST side model parameters respectively. are the characteristic components of the data samples marked as i on the HOST and GUEST sides, that is, the characteristic components, L is the loss function, and the two partial derivatives are the gradients required for the two parties to update their respective models.

[0254] Agreed Use To mark X in the homomorphic encryption public key PK H The ciphertext is generated under the public key generated by the host. The Paillier homomorphic encryption algorithm is used for additive homomorphic encryption, and RSA, SM2, and other common public key encryption algorithms can be used.

[0255] In another embodiment, the party with labeled data is referred to as Guest party, and the party without labeled data is referred to as Host party. If the training data identification set formed by HOST and GUEST through sample alignment is D, the training data held by HOST party is represented as The training data held by the GUEST party is represented as Each iteration process needs to calculate the following intermediate variables (the loss L uses a second-order Taylor expansion):

[0256]

[0257]

[0258]

[0259]

[0260]

[0261]

[0262] w H ,w G They are the current HOST side model (model parameters) and GUEST side model (model parameters), are the characteristic components of the data samples marked as i on the HOST and GUEST sides respectively, L is the loss function, and the two partial derivatives are the gradients required for the two parties to update their respective models.

[0263] Agreed Use To mark X in the homomorphic encryption public key PK H The ciphertext is generated under the public key generated by the host. The Paillier homomorphic encryption algorithm is used for additive homomorphic encryption, and RSA, SM2, and other common public key encryption algorithms can be used.

[0264] The data encryption method provided in this embodiment is that during the entire training and prediction process, the party with labeled data cannot know the model weight plaintext of any round and the gradient plaintext required for model weight update. All weight-related information is protected by the public key of the unlabeled data party, and the entire process is encrypted based on the additive homomorphic encryption algorithm; the intermediate calculation result fragments are protected by blinding of multiplication random numbers so that they can be safely decrypted, and the multiplication random number replacement and subsequent calculation implementation are performed using the division cancellation method; the loss function can also be Taylor expanded, and a special intermediate calculation result splitting method, multiplication random number blinding and additive homomorphic encryption and decryption method are used to convert nonlinear terms into linear terms, so that the loss L can be calculated and obtained while being protected throughout the process.

[0265] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0266] Based on the same inventive concept, embodiments of the present application also provide a data encryption device for implementing the aforementioned data encryption method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in the first or more data encryption device embodiments provided below can be found in the above-mentioned limitations on the data encryption method and will not be repeated here.

[0267] In one embodiment, Figure 12 As shown, a data encryption device 1200 is provided, which is applied to a first data entity, where the first data entity is a labeled data entity, and includes:

[0268] A first receiving module 1202 is configured to receive a public key and a ciphertext of an intermediate calculation result sent by the second data party, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the feature components of each unlabeled sample data;

[0269] A first determination module 1204 is configured to determine the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data;

[0270] A blinding processing module 1206 is used to perform blinding processing on the ciphertext of the predicted label and the ciphertext of the label difference to obtain the blinded ciphertext of the predicted label and the blinded ciphertext of the label difference;

[0271] The second determination module 1208 is configured to send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model.

[0272] In one embodiment, Figure 13 As shown, a data encryption device 1300 is provided, which is applied to a second data entity, where the second data entity is an unlabeled data entity, and includes:

[0273] The third determining module 1302 is configured to calculate an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data, encrypt the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and send the ciphertext of the intermediate calculation result to the first data party;

[0274] The second receiving module 1304 is used to receive the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference sent by the first data party, and obtain the second model weight of the second data party corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference.

[0275] Each module in the above-mentioned data encryption device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor of the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0276] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 14As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data related to data encryption. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a data encryption method.

[0277] Those skilled in the art will understand that Figure 14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0278] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0279] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0280] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0281] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0282] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0283] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0284] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A data encryption method, characterized in that: Applied to a first data entity, where the first data entity is a labeled data entity, the method includes: Receive the public key sent by the second data party and the ciphertext of the intermediate calculation result, where the intermediate calculation result is calculated by the second data party based on the model parameters of each unlabeled sample data and the characteristic components of each unlabeled sample data; Determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data; Blinding the ciphertext of the predicted label and the ciphertext of the label difference to obtain a blinded ciphertext of the predicted label and a blinded ciphertext of the label difference; Sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model; The sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model includes: Send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party performs decryption processing to obtain a blinded second-party gradient; receive the blinded second-party gradient sent by the second data party, deblind the blinded second-party gradient to obtain a second-party gradient, and send the second-party gradient to the second data party, so that the second data party obtains an updated second model weight and target indication information based on the second-party gradient; if it is determined based on the target indication information that the preset training completion condition is not met, re-execute the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result until it is determined based on the target indication information that the preset training completion condition is met, and determine that the ciphertext of the first model weight of the current first data party is the ciphertext of the first model weight of the first data party corresponding to the trained model.

2. The method according to claim 1, characterized in that The step of determining the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic component of the labeled sample data includes: For the i-th sample data in the unlabeled sample data, determine the ciphertext of the i-th predicted label based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the current first model parameter of the first data party, and the i-th feature component in the labeled sample data; For the i-th sample data in the unlabeled sample data, the ciphertext of the label difference is determined based on the ciphertext of the i-th intermediate calculation result, the ciphertext of the i-th intermediate calculation result in the labeled sample data, and the i-th label data.

3. The method according to claim 1, characterized in that The sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model includes: Sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity, so that the second data entity performs decryption processing to obtain a blinded second-party gradient; receiving a blinded second-party gradient sent by the second data party, performing a deblinding process on the blinded second-party gradient to obtain a second-party gradient, and sending the second-party gradient to the second data party, so that the second data party obtains an updated second model weight based on the second-party gradient; If it is determined that the preset training completion conditions are not met, the steps of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result are re-executed until it is determined that the preset training completion conditions are met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

4. The method according to claim 1, wherein The sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model includes: Calculate the ciphertext of the loss sub-function of the first data party based on the i-th label data and the ciphertext of the label difference; Blinding the ciphertext of the loss sub-function of the first data cube to obtain a blinded ciphertext of the loss sub-function of the first data cube; Sending the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the loss subfunction of the blinded first data cube to the second data cube, so that the second data cube performs decryption processing to obtain a blinded second-cube gradient and a blinded loss function; receiving the blinded second-party gradient and the blinded loss function sent by the second data party, performing unblinding processing on the blinded second-party gradient and the blinded loss function to obtain a second-party gradient and a loss function, and sending the second-party gradient to the second data party; If it is determined based on the loss function that the preset training completion conditions are not met, the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result is re-executed until it is determined based on the loss function that the preset training completion conditions are met, then the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

5. The method according to claim 4 or 3, characterized in that The method further comprises: Determining a current gradient ciphertext of the first data entity based on the characteristic components of the labeled sample data and the ciphertext of the label difference; Based on the current gradient ciphertext of the first data entity and the model parameters of the labeled sample data, the ciphertext of the first model weight of the current first data entity is calculated.

6. The method according to claim 1, characterized in that The method further comprises: Calculate the random ciphertext of the test sample data based on the ciphertext of the model parameters of the first data entity corresponding to the trained model, the characteristic components of the labeled sample data, and the test random number; Sending the random ciphertext of the test sample data to the second data party, so that the second data party processes the random ciphertext of the test sample data to obtain random data for predicting label data; Receive the random data of the predicted label data sent by the second data party, de-randomize the random data of the predicted label data, and obtain the predicted label data, where the predicted label data is used to determine a test result.

7. A data encryption method, characterized in that: Applied to a second data cube, where the second data cube is an unlabeled data cube, the method includes: Calculating an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of the each unlabeled sample data, encrypting the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and sending the ciphertext of the intermediate calculation result to the first data party; Receiving the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference sent by the first data entity, and obtaining a second model weight of the second data entity corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; Obtaining a second model weight of a second data cube corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference includes: The ciphertext of the blinded prediction label and the ciphertext of the blinded label difference are decrypted to obtain a blinded second-party gradient; the blinded second-party gradient is sent to the first data party so that the first data party obtains the second-party gradient; the second-party gradient sent by the first data party is received, and based on the second-party gradient, the second model weight of the current second data party is updated to obtain an updated second model weight, and based on the updated second model weight, target indication information is generated, where the target indication information indicates whether a preset training completion condition is met or not, and the target indication information is sent to the first data party.

8. The method according to claim 7, characterized in that The obtaining, based on the received ciphertext of the blinded prediction label and the ciphertext of the blinded label difference, a second model weight of the second data cube corresponding to the trained model includes: Receive the ciphertext of the blinded predicted label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction; Decrypting the ciphertext of the blinded prediction label, the ciphertext of the blinded label difference, and the ciphertext of the blinded loss subfunction to obtain a blinded loss function and a blinded second-party gradient; Sending the blinded loss function and the blinded second-party gradient to the first data cube, so that the first data cube determines the second-party gradient and the training result based on the blinded loss function and the blinded second-party gradient; The training result and the second-party gradient are received, and based on the second-party gradient, the second model weight of the current second data cube is updated to obtain an updated second model weight.

9. The method according to claim 7, characterized in that The method further comprises: Receive random ciphertext of test sample data sent by the first data party, where the random ciphertext of the test sample data is obtained by the first data party based on the ciphertext of the model parameters of the first data party corresponding to the trained model, the feature components of the labeled sample data, and the test random number; Decrypting the random ciphertext of the test sample data to obtain random data of the test sample data, and obtaining random data of the predicted label data based on the characteristic components of the unlabeled sample data, the model parameters of the second data party, and the random data of the test sample data; The random data of the predicted label data is sent to the first data party, so that the first data party de-randomizes the random data of the predicted label data to obtain the predicted label data, and the predicted label data is used to determine the test result.

10. A data encryption method, characterized in that: Applied to a first data entity and a second data entity, where the first data entity is a labeled data entity and the second data entity is an unlabeled data entity, the method includes: The second data party calculates an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data, encrypts the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and sends the ciphertext of the intermediate calculation result to the first data party; The first data party determines the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data; blinds the ciphertext of the predicted label and the ciphertext of the label difference to obtain the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; and sends the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data party to obtain the ciphertext of the first model weight of the first data party corresponding to the trained model; The second data cube obtains a second model weight of the second data cube corresponding to the trained model based on the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference; The sending the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model includes: Send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party performs decryption processing to obtain a blinded second-party gradient; receive the blinded second-party gradient sent by the second data party, deblind the blinded second-party gradient to obtain a second-party gradient, and send the second-party gradient to the second data party, so that the second data party obtains an updated second model weight and target indication information based on the second-party gradient; if it is determined based on the target indication information that the preset training completion condition is not met, re-execute the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result until it is determined based on the target indication information that the preset training completion condition is met, and determine that the ciphertext of the first model weight of the current first data party is the ciphertext of the first model weight of the first data party corresponding to the trained model.

11. A data encryption device, characterized in that: Applied to a first data entity, where the first data entity is a labeled data entity, the apparatus includes: A first receiving module is configured to receive a public key and a ciphertext of an intermediate calculation result sent by a second data party, where the intermediate calculation result is calculated by the second data party based on the model parameters corresponding to each unlabeled sample data and the characteristic components of each unlabeled sample data; A first determination module is configured to determine the ciphertext of the predicted label and the ciphertext of the label difference based on the ciphertext of the intermediate calculation result and the characteristic components of the labeled sample data; A blinding processing module, configured to perform blinding processing on the ciphertext of the predicted label and the ciphertext of the label difference to obtain the blinded ciphertext of the predicted label and the ciphertext of the blinded label difference; A second determination module is configured to send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data entity to obtain the ciphertext of the first model weight of the first data entity corresponding to the trained model; The second determination module is specifically used to: send the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to the second data party, so that the second data party performs decryption processing to obtain a blinded second-party gradient; receive the blinded second-party gradient sent by the second data party, deblind the blinded second-party gradient to obtain a second-party gradient, and send the second-party gradient to the second data party, so that the second data party obtains an updated second model weight and target indication information based on the second-party gradient; if it is determined based on the target indication information that the preset training completion condition is not met, then re-execute the step of receiving the public key sent by the second data party and the ciphertext of the intermediate calculation result until it is determined based on the target indication information that the preset training completion condition is met, and the ciphertext of the first model weight of the current first data party is determined to be the ciphertext of the first model weight of the first data party corresponding to the trained model.

12. A data encryption device, characterized in that: Applied to a second data entity, where the second data entity is an unlabeled data entity, the apparatus comprises: a third determining module, configured to calculate an intermediate calculation result based on the model parameters corresponding to each unlabeled sample data and the characteristic components of the each unlabeled sample data, encrypt the intermediate calculation result to obtain a ciphertext of the intermediate calculation result, and send the ciphertext of the intermediate calculation result to the first data party; a second receiving module, configured to receive the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference sent by the first data entity, and obtain a second model weight of the second data entity corresponding to the trained model based on the ciphertext of the blinded predicted label and the ciphertext of the blinded label difference; The second receiving module is specifically used to decrypt the ciphertext of the blinded prediction label and the ciphertext of the blinded label difference to obtain a blinded second-party gradient; send the blinded second-party gradient to the first data party so that the first data party obtains the second-party gradient; receive the second-party gradient sent by the first data party, and based on the second-party gradient, update the second model weight of the current second data party to obtain an updated second model weight, and generate target indication information based on the updated second model weight, where the target indication information indicates whether a preset training completion condition is met or not, and send the target indication information to the first data party.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images