A method and system for implementing softmax based on FHE

Abstract

The application discloses a kind of based on FHE's softmax implementation method and system, by calculating party in using FHE technology ciphertext calculation, then the new ciphertext input data (referred to as scrambling permutation ciphertext input data) of original ciphertext softmax input data is added noise, permutation ciphertext input data is sent to data party, data party obtains scrambling permutation plaintext input data after decryption to scrambling permutation ciphertext input data, then the permutation plaintext result data is calculated under plaintext, then permutation ciphertext result data is encrypted and sent to calculating party, calculating party recovers order and obtains original order ciphertext result data from permutation ciphertext result data, in this scheme, calculating party in using FHE technology ciphertext calculation, high-efficiency calculation softmax result is realized by the interaction with data party, while not leaking original data privacy, overcome the problem of low efficiency of exponential calculation and ciphertext division calculation under traditional FHE technology softmax algorithm.

Description

Technical Field

[0001] This application relates to the field of softmax implementation technology based on FHE, and in particular to a softmax implementation method and system based on FHE. Background Technology

[0002] The Softmax algorithm transforms an input vector into a probability vector where the sum of the probabilities of all its components is 1. The algorithm process is as follows:

[0003] Input vector Output in

[0004]

[0005] The softmax method is frequently used for classification in machine learning applications. A typical application scenario is as follows: classifying data given labels. d model This represents the number of category labels, i.e., the total number of categories. For example, in the application of digit recognition (0-9), d... model The value is 10. Model parameters are obtained during the machine learning training phase. During model inference, the probability l of classifying a sample into each label is calculated based on the input sample. j The calculation process consists of two steps:

[0006] First, calculate a numerical value x for each input sample using the model parameters. j ;

[0007] The corresponding label l is obtained by using the softmax algorithm for this value. j The probability y j Maximum probability value y j The corresponding tag l j As the final result of the reasoning.

[0008] In machine learning applications, the demand for data privacy protection is increasing. Therefore, implementing fully encrypted computation of the softmax algorithm using FHE technology has become a feasible way to protect data privacy. However, current FHE technology still has some shortcomings in its support for the softmax algorithm. For example, the BFV / BGV scheme does not support integer division or exponentiation, the CKKS scheme supports approximate division within a certain range, but it has limitations on the size of the divisor and its division operation has poor versatility. The TFHE scheme implements integer division through gate circuits, which has good versatility, but its computational performance is relatively low. Summary of the Invention

[0009] Therefore, to solve the problems that the prior art does not support integer division and exponential operation or the generality of division operation is not good, or the operation performance is low, a softmax implementation method and system based on FHE are provided.

[0010] In a first aspect, a softmax implementation method based on FHE is provided, and the method comprises the following steps.

[0011] A data party generates an FHE private key and generates a target public key according to the FHE private key; the data party encrypts plaintext data input by the data party to obtain first ciphertext data according to an FHE public key, and sends the first ciphertext data to a computing party;

[0012] The computing party encrypts model parameters of the computing party to obtain second ciphertext data according to the target public key; after a ciphertext calculation step is performed according to the second ciphertext data, original ciphertext input data X needed for softmax calculation is obtained c ; wherein X c ={x c1 ,x c2 …x cj ,…x cn}; a plaintext data t is randomly selected, the plaintext data t is encrypted to obtain x ct =enc(t); after adding noise to the softmax original ciphertext input data, scrambled ciphertext input data Xn c is obtained, wherein the Xn c ={xn c1 ,xn c2 …xn cj ,…xn cn}; xn cj =Add(x cj ,x ct ); random permutation is performed on n ciphertext data of the scrambled ciphertext input data Xn c : an array Index[n] is initialized, and 1, 2, …, n are randomly filled in the Index array, wherein each element in the Index array is a randomly selected number from 1, 2, …, n, and each number is different; the scrambled and permuted ciphertext input data Xnp c is obtained, wherein the scrambled and permuted ciphertext input data Xnp c1 ={xnp c2 ,xnp cj …xnp cn ,…xnp cj}, wherein the xnp cii = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider;

[0013] The data provider decrypts the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n}; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, Ynp = {ynp1, ynp2…ynp}. j ,…ynp n},in, The plaintext result of the softmax permutation is encrypted to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynp cn The softmax permutation ciphertext result data is sent to the computing party, which restores the softmax permutation ciphertext result data to its original order before the permutation, thus obtaining the softmax ciphertext result data Yn. c Get the array Index[n] to obtain the softmax ciphertext result data before the permutation: where Yn c ={yn c1 ,yn c2 …yn cj ,…yn cn}, where yn ci =ynp cj i = Index[j];

[0014] The calculation method uses the softmax ciphertext result data before the permutation for subsequent ciphertext calculations.

[0015] Optionally, in the above scheme, the data provider generates an FHE private key and generates a target public key based on the FHE private key, specifically including:

[0016] The data provider generates an FHE private key based on security parameters, and then generates an FHE encrypted public key based on the FHE private key; it also generates a re-linear key and a ciphertext bootstrap based on the FHE private key; wherein, the FHE encrypted public key and the bootstrap public key corresponding to the re-linear key and the ciphertext bootstrap are collectively referred to as the target public key; the querying party sends the target public key to the computing party.

[0017] In the above solution, further optionally, the relinearization key and ciphertext bootstrapping are relinearization keys and ciphertext bootstrapping needed in ciphertext calculation.

[0018] In the above solution, further optionally, the operations of the data party and the calculation party based on the FHE public key and the FHE private key are as follows:

[0019] The encryption function enc(a0) represents ciphertext obtained by encrypting plaintext data a0, and the decryption function dec(c0) represents plaintext data obtained by decrypting ciphertext data c0.

[0020] For ciphertext calculation of the FHE solution, the following applies:

[0021] The ciphertext multiplication function Mul(enc(a0), enc(a1)) = enc(a0 x a1);

[0022] The ciphertext addition function Add(enc(a0), enc(a1)) = enc(a0 + a1);

[0023] The ciphertext subtraction function Sub(enc(a0), enc(a1)) = enc(a0 - a1).

[0024] In a second aspect, a softmax implementation system based on FHE includes:

[0025] A public and private key generation module is used by the data party to generate an FHE private key and generate a target public key based on the FHE private key. The data party encrypts plaintext data input by the data party based on an FHE public key to obtain first ciphertext data, and sends the first ciphertext data to the calculation party.

[0026] A calculation party module is used by the calculation party to encrypt model parameters of the calculation party based on the target public key to obtain second ciphertext data. After performing a ciphertext calculation step based on the second ciphertext data, the calculation party obtains original ciphertext input data X needed for softmax calculation. c ; wherein X c = {x c1 ,x c2 …x cj ,…x cn}; a plaintext data t is randomly selected, and the plaintext data t is encrypted to obtain x ct = enc(t); after adding noise to the softmax original ciphertext input data, a scrambled ciphertext input data Xn c is obtained, wherein the Xn c = {xn c1 ,xn c2 …xn cj ,…xn cn};xn cj =Add(x cj ,x ct ); Input data Xn to the scrambled ciphertext c The n ciphertext data are randomly permuted: An array Index[n] is initialized, and the array is randomly filled with elements 1, 2, ..., n, where each element is a unique number randomly selected from 1, 2, ..., n; the permuted scrambled ciphertext input data is obtained, where the scrambled ciphertext input data Xnp c ={xnp c1 xnp c2 …xnp cj ,…xnp cn}, where the xnp cj =Xn ci i = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider;

[0027] Data Module: Used by the data module to decrypt the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n}; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, wherein the softmax permutation plaintext result Ynp={ynp1,ynp2…ynp j ,…ynp n},in, The data provider encrypts the plaintext result of the softmax permutation to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynp cn The data provider sends the softmax permutation ciphertext result data to the computation provider, which restores the softmax permutation ciphertext result data to its original order before the permutation, thus obtaining the softmax ciphertext result data Yn. c Get the array Index[n] to obtain the softmax ciphertext result data before the permutation: where Yn c ={yn c1 ,yn c2 …yn cj ,…yn cn}, where yn ci =ynpcj i = Index[j] ;

[0028] The computing module is used for calculating the permuted softmax ciphertext result data before permutation for subsequent ciphertext calculation.

[0029] The present application has at least the following beneficial effects:

[0030] Based on further analysis and research on the problems of the prior art, it is realized that the prior art has the problems of not supporting integer division and exponential operation or poor generality of division operation, or low operation performance. In the present application, when the computing party uses FHE technology for ciphertext calculation, noise is added to the original ciphertext softmax input data, and then new ciphertext input data (referred to as scrambled permutation ciphertext input data) is obtained after random permutation, which is sent to the data party. The data party decrypts the scrambled permutation ciphertext input data to obtain scrambled permutation plaintext input data, and then calculates the permutation plaintext result data under plaintext, and then encrypts the permutation plaintext result data into permutation ciphertext result data and sends it to the computing party. The computing party recovers the original order of the ciphertext result data from the permutation ciphertext result data. In this scheme, the computing party uses FHE technology for ciphertext calculation, and through interaction with the data party, it realizes efficient calculation of the softmax result while not leaking the original data privacy, overcoming the problem of low efficiency of exponential calculation and ciphertext division calculation in the traditional FHE technology. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 The flowchart of the FHE-based softmax implementation method provided by an embodiment of the present application is shown.

[0032] Figure 2 The internal structure diagram of the computer device in an embodiment is shown. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0034] The FHE-based softmax implementation method provided by the present application includes the following steps:

[0035] The data party generates an FHE private key and generates a target public key according to the FHE private key; the data party encrypts plaintext data input by the data party according to the FHE public key to obtain first ciphertext data, and sends the first ciphertext data to the computing party;

[0036] The computing party encrypts its model parameters using the target public key to obtain second ciphertext data; after performing ciphertext calculation steps based on the second ciphertext data, it obtains the original ciphertext input data X for which softmax calculation is required. c ; where X c ={x c1 ,x c2 …x cj ,…x cn Randomly select plaintext data t, and encrypt the plaintext data t to obtain x. ct =enc(t); This adds noise to the original softmax ciphertext input data to obtain the scrambled ciphertext input data Xn. c , wherein, the Xn c ={xn c1 ,xn c2 …xn cj ,…xn cn};xn cj =Add(x cj ,x ct ); Input data Xn to the scrambled ciphertext c The n ciphertext data are randomly permuted: An array Index[n] is initialized, and the array is randomly filled with elements 1, 2, ..., n, where each element is a unique number randomly selected from 1, 2, ..., n; the permuted scrambled ciphertext input data is obtained, where the scrambled ciphertext input data Xnp c ={xnp c1 xnp c2 …xnp cj ,…xnp cn}, where the xnp cj =Xn ci i = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider;

[0037] The data provider decrypts the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n}; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, wherein the softmax permutation plaintext result Ynp={ynp1,ynp2…ynp j ,…ynp n},in, The plaintext result of the softmax permutation is encrypted to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynp cn The softmax permutation ciphertext result data is sent to the computing party, which restores the softmax permutation ciphertext result data to its original order before the permutation, thus obtaining the softmax ciphertext result data Yn. c Get the array Index[n] to obtain the softmax ciphertext result data before the permutation: where Yn c ={yn c1 ,yn c2 …yn cj ,…yn cn}, where yn ci =ynp cj i = Index[j];

[0038] The calculation method uses the softmax ciphertext result data before the permutation for subsequent ciphertext calculations.

[0039] In this embodiment, the data provider generates an FHE private key and generates a target public key based on the FHE private key, specifically including:

[0040] The data provider generates an FHE private key based on security parameters, and then generates an FHE encrypted public key based on the FHE private key; it also generates a re-linear key and a ciphertext bootstrap based on the FHE private key; wherein, the FHE encrypted public key and the bootstrap public key corresponding to the re-linear key and the ciphertext bootstrap are collectively referred to as the target public key; the querying party sends the target public key to the computing party.

[0041] In this embodiment, the relinear key and ciphertext bootstrapping are the relinear key and ciphertext bootstrapping used in the ciphertext computation process.

[0042] In this embodiment, the operation rules for the data party and the computation party based on the FHE public key and FHE private key are as follows:

[0043] The encryption function enc(a0) represents the ciphertext obtained by encrypting plaintext data a0, and the decryption function dec(c0) represents the plaintext data obtained by decrypting ciphertext data c0.

[0044] The ciphertext calculation for the FHE scheme is as follows:

[0045] The ciphertext multiplication function Mul(enc(a0),enc(a1)) = enc(a0 × a1);

[0046] Ciphertext addition function Add(enc(a0), enc(a1)) = enc(a0 + a1)

[0047] Ciphertext subtraction function Sub(enc(a0), enc(a1)) = enc(a0 - a1).

[0048] In the above FHE-based softmax implementation method, FHE is a new privacy protection technology that can perform ciphertext calculation based on encrypted data and is commonly used in applications such as computing power outsourcing. In this scheme, there are two participants: a data party and a computing party. The data party is responsible for generating FHE public and private keys, and the computing party is responsible for ciphertext calculation; the security goal is that the softmax input data of the computing party is secret to the data party, and the specific order corresponding to the plaintext result of the softmax is secret to the data party (the softmax result contains n probability values and the corresponding order, and the data party knows that the n probability values are specific, but does not know the specific order corresponding to each probability value), the original plaintext data of the data party is secret to the computing party.

[0049] In one embodiment, the softmax calculation process based on FHE technology is as follows:

[0050] The data party is responsible for generating FHE public and private keys, which specifically include:

[0051] Generate FHE private key according to security parameters, denoted as sk;

[0052] Generate FHE encryption public key according to sk, denoted as enc_key;

[0053] Generate relinearization key and ciphertext bootstrap key needed in the ciphertext calculation process according to sk, denoted as rlk_key;

[0054] The encryption public key enc_key and the relinearization / bootstrap public key rlk_key are collectively referred to as the public key pk. The query party sends pk to the computing party;

[0055] The operation of the two parties based on the FHE public and private keys is defined as follows:

[0056] The encryption function enc(a0) represents the ciphertext obtained by encrypting the plaintext data a0, and the decryption function dec(c0) represents the plaintext data obtained by decrypting the ciphertext data c0. For the ciphertext calculation of the FHE scheme, the following is:

[0057] Ciphertext multiplication function Mul(enc(a0), enc(a1)) = enc(a0 x a1);

[0058] Ciphertext addition function Add(enc(a0), enc(a1)) = enc(a0 + a1);

[0059] Ciphertext subtraction function Sub(enc(a0), enc(a1)) = enc(a0-a1).

[0060] In this embodiment, the data party encrypts the plaintext data input by the data party according to the public key to obtain first ciphertext data, and sends the ciphertext data to the computing party;

[0061] The computing party encrypts the model parameters of the computing party according to the public key to obtain ciphertext data;

[0062] After the computing party performs a plurality of ciphertext calculation steps according to the ciphertext data, the original ciphertext input data X required for softmax calculation is obtained c :

[0063] X c = {x c1 ,x c2 …x cj ,…x cn}

[0064] The computing party randomly selects a plaintext data t, encrypts t to obtain x ct = enc(t);

[0065] In this embodiment, the computing party adds noise to the softmax original ciphertext input data to obtain the scrambled ciphertext input data Xn c :

[0066] Xn c = {xn c1 ,xn c2 …xn cj ,…xn cn}

[0067] xn cj = Add(x cj ,x ct )

[0068] The computing party randomly permutes the n ciphertext data of Xn c :

[0069] Initialize the array Index[n];

[0070] Fill the Index array with 1, 2, … n randomly, each element in the Index array is a randomly selected number from 1, 2, … n, and each is different;

[0071] Get the permuted scrambled permuted ciphertext input data Xnp c :

[0072] Xnp c= {xnp c1 ,xnp c2 …xnp cj ,…xnp cn}, wherein xnp cj = Xn ci , i = Index[j]

[0073] The calculation party sends Xnp c to the data party.

[0074] In this embodiment, the data party decrypts the received Xnp c to obtain the scrambled plaintext input data Xnp:

[0075] Xnp = {xnp1, xnp2…xnp j ,…xnp n} ;

[0076] The data party calculates the softmax result according to the plaintext Xnp, and obtains the softmax plaintext result Ynp:

[0077] Ynp = {ynp1, ynp2…ynp j ,…ynp n}, wherein

[0078]

[0079] The data party encrypts the Ynp result, and obtains the softmax ciphertext result data:

[0080] Ynp c = {ynp c1 , ynp c2 …ynp cj ,…ynp cn} ;

[0081] The data party sends the ciphertext Ynp c to the calculation party.

[0082] In this embodiment, the data party restores the ciphertext Ynp c to the order before permutation, and obtains the softmax ciphertext result data Yn c :

[0083] Obtain the array Index[n];

[0084] Obtain the softmax ciphertext result data before permutation:

[0085] Yn c = {yn c1 , yn c2 …yncj ,…yn cn}, wherein yn ci = yn cj , i = Index[j]

[0086] The computing party calculates Yn c for subsequent ciphertext calculation steps.

[0087] In one embodiment, a specific instance process is illustrated by taking the application of softmax function in a large language model as an example. The participants include a data party and a computing party. The computing party holds the model parameters and is secret to the data party, and the input data of the data party is secret to the computing party. n vocab represents the total number of model tokens, d model represents the dimension of each token model parameter, T represents the context window size, n heads represents the number of Attention layers in parallel. The specific process is as follows:

[0088] S-1: The data party generates FHE algorithm parameters and discloses the FHE public key to the computing party;

[0089] S-2: The data party sends the encrypted data to the computing party after encryption;

[0090] S-3: The computing party encrypts the model parameters using the FHE public key, and then performs the following ciphertext calculation steps;

[0091] Calculate the embedding vector and the position vector, and get the result as the input of the next attention block;

[0092] After h layers of attention blocks, each attention block inputs a matrix X, and the model parameters The dimension of each sub-attention model parameter is d head = d model / n heads . Each attention block performs the following submodule calculation;

[0093] Attention block submodule 1:

[0094] Attention block submodule 2 softmax:

[0095] The computing party initially calculates A ieach row of ciphertext data of S as the original ciphertext input data X of softmax computation c ;

[0096] The computing party converts X c into the scrambled permutation ciphertext input data Xnp c and sends it to the data party;

[0097] The data party decrypts Xnp c through the FHE private key to obtain the softmax permutation plaintext result Ynp

[0098] The data party encrypts Ynp c through the FHE public key to obtain the softmax permutation ciphertext result data Ynp

[0099] The computing party recovers the original softmax ciphertext result data Yn c from Ynp c ;

[0100] Attention block sub-module 3:

[0101] Attention block sub-module 4:

[0102] Take as input, continue to process the subsequent ciphertext computation sub-modules Add, Norm and FFN;

[0103] The above 3)-7) are repeated h times;

[0104] The output obtained after linear layer processing and embeddingmatrix softmax algorithm computes softmax(X(W e ) T ), denoted as S=X(W e ) T ,

[0105] S-4: Each row of S is an n vocab vector ciphertext data, which is the ciphertext input data of the softmax algorithm. The computing party and the data party perform the following interactive computation to obtain the softmax ciphertext result;

[0106] The computing party initially takes each row of ciphertext data of the matrix S as the original ciphertext input data X of softmax computation c ;

[0107] The computing party converts X cXnp c and send to the data party;

[0108] The data party decrypts Xnp c to obtain the softmax plaintext result Ynp

[0109] The data party encrypts Ynp c to obtain the softmax ciphertext result data Ynp

[0110] The computing party recovers the original softmax ciphertext result data Yn c from Ynp c ;

[0111] S-5: The computing party performs subsequent ciphertext calculation according to the softmax ciphertext result data Yn c .

[0112] In this embodiment, when the computing party uses FHE technology for ciphertext calculation, noise is added to the original ciphertext softmax input data, and then the new ciphertext input data (referred to as scrambled permutation ciphertext input data) is obtained after random permutation and sent to the data party. The data party decrypts the scrambled permutation ciphertext input data to obtain scrambled permutation plaintext input data, and then calculates the permutation plaintext result data under plaintext. Then, the computing party recovers the original order of the ciphertext result data from the permutation ciphertext result data. When the computing party uses FHE technology for ciphertext calculation, the high-efficiency calculation of the softmax result is realized through the interaction with the data party, and the original data privacy is not leaked. The problem of low efficiency of exponential calculation and ciphertext division calculation of the softmax algorithm under the traditional FHE technology is overcome.

[0113] In one embodiment, an FHE-based softmax implementation system is provided, including the following program modules:

[0114] A public and private key generation module is used for the data party to generate an FHE private key and generate a target public key according to the FHE private key. The data party encrypts the plaintext data input by the data party to obtain first ciphertext data according to the FHE public key, and sends the first ciphertext data to the computing party.

[0115] A computing party module is used for the computing party to encrypt the model parameters of the computing party to obtain second ciphertext data according to the target public key. After the ciphertext calculation step is performed according to the second ciphertext data, the original ciphertext input data X c for softmax calculation is obtained; wherein X c ={xc1 ,x c2 …x cj ,…x cn Randomly select plaintext data t, and encrypt the plaintext data t to obtain x. ct =enc(t); This adds noise to the original softmax ciphertext input data to obtain the scrambled ciphertext input data Xn. c , wherein, the Xn c ={xn c1 ,xn c2 …xn cj ,…xn cn};xn cj =Add(x cj ,x ct ); Input data Xn to the scrambled ciphertext c The n ciphertext data are randomly permuted: An array Index[n] is initialized, and the array is randomly filled with elements 1, 2, ..., n, where each element is a unique number randomly selected from 1, 2, ..., n; the permuted scrambled ciphertext input data is obtained, where the scrambled ciphertext input data Xnp c ={xnp c1 xnp c2 …xnp cj ,…xnp cn}, where the xnp cj =Xn ci i = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider;

[0116] Data Module: Used by the data module to decrypt the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n}; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, wherein the softmax permutation plaintext result Ynp={ynp1,ynp2…ynp j ,…ynp n},in, The data provider encrypts the plaintext result of the softmax permutation to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynpcn The data party sends the softmax permutation ciphertext result data to the computing party, restores the softmax permutation ciphertext result data to the order before permutation, and obtains softmax ciphertext result data Yn c , obtains an array Index[n], and obtains the softmax ciphertext result data before permutation: Yn c = {yn c1 , yn c2 … yn cj ,… yn cn}, wherein yn ci = yn cj , i = Index[j];

[0117] The computing module is configured to use the softmax ciphertext result data before permutation by the computing party for subsequent ciphertext calculation.

[0118] In one embodiment, the data party in the generating public and private key module generates an FHE private key, and generates a target public key according to the FHE private key, specifically including:

[0119] The data party generates an FHE private key according to a security parameter, generates an FHE encryption public key according to the FHE private key, generates a relinearization key and ciphertext bootstrap according to the FHE private key; wherein the FHE encryption public key and the bootstrap public key corresponding to the relinearization key and the ciphertext bootstrap are collectively referred to as a target public key; the querying party sends the target public key to the computing party.

[0120] In one embodiment, the relinearization key and the ciphertext bootstrap are relinearization keys and ciphertext bootstraps needed in the ciphertext calculation process.

[0121] In one embodiment, the operations of the data party and the computing party based on the FHE public key and the FHE private key are as follows:

[0122] The encryption function enc(a0) represents the ciphertext obtained by encrypting the plaintext data a0, and the decryption function dec(c0) represents the plaintext data obtained by decrypting the ciphertext data c0;

[0123] For ciphertext calculation of the FHE scheme, the following applies:

[0124] The ciphertext multiplication function Mul(enc(a0), enc(a1)) = enc(a0×a1);

[0125] The ciphertext addition function Add(enc(a0), enc(a1)) = enc(a0+a1);

[0126] The ciphertext subtraction function Sub(enc(a0), enc(a1)) = enc(a0-a1).

[0127] The specific limitations of the FHE-based softmax implementation system can refer to the limitations of the FHE-based softmax implementation method described above, which will not be repeated here. Each module in the FHE-based softmax implementation system described above can be implemented by software, hardware, and combinations thereof, in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0128] In one embodiment, a computer device, which can be a terminal, is provided, and its internal structure diagram can be as shown in Figure 2 The computer device includes a processor, a memory, a communication interface, a display screen, and an input system connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. The wireless manner can be achieved through WIFI, operator network, NFC (Near Field Communication), or other technologies. The computer program is executed by the processor to implement an FHE-based softmax implementation method. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input system of the computer device can be a touch layer overlaid on the display screen, or a key, trackball, or touchpad provided on the computer device shell, or an external keyboard, touchpad, or mouse, etc.

[0129] Those skilled in the art can understand that Figure 2 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0130] In one embodiment, a computer device is provided, which includes a memory and a processor, and the memory stores a computer program related to all or part of the processes in the above-mentioned embodiment method.

[0131] In one embodiment, a computer readable storage medium is provided, which stores a computer program related to all or part of the processes in the above-mentioned embodiment method.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0133] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0134] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A softmax implementation method based on FHE, characterized in that, The method includes: The data provider generates an FHE private key and generates a target public key based on the FHE private key; the data provider encrypts the plaintext data input by itself based on the FHE public key to obtain first ciphertext data, and sends the first ciphertext data to the computing provider; The computing party encrypts its model parameters using the target public key to obtain second ciphertext data; after performing ciphertext calculation steps based on the second ciphertext data, it obtains the original ciphertext input data X for which softmax calculation is required. c ; where X c ={x c1 ,x c2 …x cj ,…x cn Randomly select plaintext data t, and encrypt the plaintext data t to obtain x. ct =enc(t); This adds noise to the original softmax ciphertext input data to obtain the scrambled ciphertext input data Xn. c , wherein, the Xn c ={xn c1 ,xn c2 …xn cj ,…xn cn };xn cj =Add(x cj ,x ct ); Input data Xn to the scrambled ciphertext c The n ciphertext data are randomly permuted: The array Index[n] is initialized, and the array is randomly filled with elements 1, 2, ..., n, where each element in the Index array is a unique number randomly selected from 1, 2, ..., n; The permuted scrambled ciphertext input data is obtained, where Xnp is the scrambled permuted ciphertext input data. c ={xnp c1 xnp c2 …xnp cj ,…xnp cn }, where the xnp cj =Xn ci i = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider; The data provider decrypts the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n }; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, wherein the softmax permutation plaintext result Ynp={ynp1,ynp2…ynp j ,…ynp n },in, The plaintext result of the softmax permutation is encrypted to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynp cn The softmax permutation ciphertext result data is sent to the computing party, which restores the softmax permutation ciphertext result data to its original order before the permutation, thus obtaining the softmax ciphertext result data Yn. c Get the array Index[n] to obtain the softmax ciphertext result data before the permutation: where Yn c ={yn c1 ,yn c2 …yn cj ,…yn cn }, where yn ci =ynp cj i = Index[j]; The calculation method uses the softmax ciphertext result data before the permutation for subsequent ciphertext calculations.

2. The method according to claim 1, characterized in that, The data provider generates an FHE private key and generates a target public key based on the FHE private key, specifically including: The data provider generates an FHE private key based on security parameters, and then generates an FHE encrypted public key based on the FHE private key; it also generates a re-linear key and a ciphertext bootstrap based on the FHE private key; wherein, the FHE encrypted public key and the bootstrap public key corresponding to the re-linear key and the ciphertext bootstrap are collectively referred to as the target public key; the querying party sends the target public key to the computing party.

3. The method according to claim 2, characterized in that, The relinear key and ciphertext bootstrapping are the relinear key and ciphertext bootstrapping used in the ciphertext computation process.

4. The method according to claim 2, characterized in that, The operation rules for the data party and the computation party based on the FHE public key and FHE private key are as follows: The encryption function enc(a0) represents the ciphertext obtained by encrypting plaintext data a0, the encryption function enc(a1) represents the ciphertext obtained by encrypting plaintext data a1, and the decryption function dec(c0) represents the plaintext obtained by decrypting ciphertext data c0. The ciphertext calculation for the FHE scheme is as follows: The ciphertext multiplication function Mul(enc(a0),enc(a1)) = enc(a0 × a1); The encrypted addition function Add(enc(a0),enc(a1)) = enc(a0 + a1); The ciphertext subtraction function Sub(enc(a0),enc(a1)) = enc(a0-a1).

5. A softmax implementation system based on FHE, characterized in that, The system includes: The public / private key generation module is used by the data party to generate an FHE private key and generate a target public key based on the FHE private key; the data party encrypts the plaintext data input by itself based on the FHE public key to obtain the first ciphertext data, and sends the first ciphertext data to the computing party; The computation module is used to encrypt the model parameters of the computation party according to the target public key to obtain second ciphertext data; after performing ciphertext calculation steps based on the second ciphertext data, the original ciphertext input data X for softmax calculation is obtained. c ; where X c ={x c1 ,x c2 …x cj ,…x cn Randomly select plaintext data t, and encrypt the plaintext data t to obtain x. ct =enc(t); This adds noise to the original softmax ciphertext input data to obtain the scrambled ciphertext input data Xn. c , wherein, the Xn c ={xn c1 ,xn c2 …xn cj ,…xn cn };xn cj =Add(x cj ,x ct ); Input data Xn to the scrambled ciphertext c The n ciphertext data are randomly permuted: The array Index[n] is initialized, and the array is randomly filled with elements 1, 2, ..., n, where each element in the Index array is a unique number randomly selected from 1, 2, ..., n; The permuted scrambled ciphertext input data is obtained, where the scrambled ciphertext input data Xnp c ={xnp c1 xnp c2 …xnp cj ,…xnp cn }, where the xnp cj =Xn ci i = Index[j]; The computer sends the scrambled permutation ciphertext input data to the data provider; Data Module: Used by the data module to decrypt the received scrambling permutation ciphertext input data to obtain scrambling permutation plaintext input data, wherein the scrambling permutation plaintext input data Xnp={xnp1,xnp2…xnp j ,…xnp n }; Calculate the softmax result based on the scrambled permutation plaintext input data, and obtain the softmax permutation plaintext result, wherein the softmax permutation plaintext result Ynp={ynp1,ynp2…ynp j ,…ynp n },in, The data provider encrypts the plaintext result of the softmax permutation to obtain the ciphertext result data Ynp. c ={ynp c1 ynp c2 …ynp cj ,…ynp cn The data provider sends the softmax permutation ciphertext result data to the computing provider, which restores the softmax permutation ciphertext result data to its original order before the permutation, thus obtaining the softmax ciphertext result data Yn. c Get the array Index[n] to obtain the softmax ciphertext result data before the permutation: where Yn c ={yn c1 ,yn c2 …yn cj ,…yn cn }, where yn ci =ynp cj i = Index[j]; Calculation module: Used by the calculator to apply the softmax ciphertext result data before permutation to subsequent ciphertext calculations.

6. The system according to claim 5, characterized in that, The public / private key generation module generates an FHE private key from the data provider and generates a target public key based on the FHE private key, specifically including: The data provider generates an FHE private key based on security parameters, and then generates an FHE encrypted public key based on the FHE private key; it also generates a re-linear key and a ciphertext bootstrap based on the FHE private key; wherein, the FHE encrypted public key and the bootstrap public key corresponding to the re-linear key and the ciphertext bootstrap are collectively referred to as the target public key; the querying party sends the target public key to the computing party.

7. The system according to claim 6, characterized in that, The relinear key and ciphertext bootstrapping are the relinear key and ciphertext bootstrapping used in the ciphertext computation process.

8. The system according to claim 6, characterized in that, The operation rules for the data party and the computation party based on the FHE public key and FHE private key are as follows: The encryption function enc(a0) represents the ciphertext obtained by encrypting plaintext data a0, the encryption function enc(a1) represents the ciphertext obtained by encrypting plaintext data a1, and the decryption function dec(c0) represents the plaintext obtained by decrypting ciphertext data c0. The ciphertext calculation for the FHE scheme is as follows: The ciphertext multiplication function Mul(enc(a0),enc(a1)) = enc(a0 × a1); The encrypted addition function Add(enc(a0),enc(a1)) = enc(a0 + a1); The ciphertext subtraction function Sub(enc(a0),enc(a1)) = enc(a0-a1).

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images