A secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU

Abstract

The present invention relates to the field of machine learning privacy computing technology, and more specifically, to a method for secure outsourcing verification of floating-point matrix multiplication based on TEE and GPU. ′ ,Y ′ and Z ′ In this way, whether it is TEE or GPU, in the same calculation order, Z ′ Each element in must be consistent with X ′ Y ′ The product of the two elements is identical. Compared with existing solutions, this approach avoids verification errors caused by computer precision and the problem of GPUs producing erroneous results within a certain range due to tolerance that cannot be verified by the TEE. It also solves the problem of correctness verification for outsourced floating-point matrix multiplication.

Description

Technical Field

[0001] The present invention relates to the field of machine learning privacy computing technology, and more specifically, to a secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU. Background Art

[0002] To protect the privacy of machine learning data, executing machine learning in a Trusted Execution Environment (TEE) is a promising solution. However, matrix multiplications are computationally expensive, and the TEE's computing resources come from the CPU. To achieve higher efficiency for privacy-preserving machine learning, one solution is to securely outsource this matrix multiplication to the GPU. A secure outsourcing algorithm for floating-point matrix multiplication based on the TEE and GPU allows this secure outsourcing of matrix multiplication to the GPU. While existing secure outsourcing algorithms are relatively comprehensive in obfuscating source data, they are less effective in verifying the accuracy of the results returned by the GPU.

[0003] Let the matrix that needs to be outsourced be X m×n and Y n×s , the result is Z m×s , the outsourced matrix is ​​X′ m×n and Y′ n×s , the result is Z′ m×s According to the 1977 Freivalds Lemma, verification can be performed by generating a random n-dimensional 0-1 vector s and then determining whether the equation Zs = X(Ys) holds. Multiple verifications can ensure the correctness of the calculation result. This method is widely used in secure outsourcing of calculations over finite fields. In 2016, Cao et al., in their paper "A Note on 'Outsourcing Large Matrix Inversion Computation to a Public Cloud'," stated that this verification method has problems in floating-point outsourcing algorithms. Because real numbers have precision in computers, the Freivalds verification method can often misjudge Zs ≠ X(Ys) even when the calculation is correct, i.e., Z = XY, causing verification to fail. To this end, the study proposed setting an error tolerance to pass verification. However, this solution does not fundamentally solve the problem of result verification accuracy. The GPU can still deliberately return an erroneous result within the tolerance to pass the TEE inspection. Summary of the Invention

[0004] In order to overcome the above-mentioned defects in the prior art, the present invention provides a secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU, so that the correctness of the outsourced calculation of floating-point matrix multiplication can be verified in the outsourced calculation in TEE and GPU.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU is used for each outsourced matrix multiplication during machine learning training, including the following steps:

[0007] S1. TEE generates outsourced matrices X′ and Y′ and transmits them to the GPU for computation.

[0008] S2.GPU returns the matrix Z′=X′Y′;

[0009] S3.TEE randomly selects ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

[0010] Based on the above technical means, the present invention places the verification of outsourced calculations on X′, Y′, and Z′. This way, regardless of whether it is a TEE or a GPU, every element in Z′ is identical to every element of the product of X′Y′, provided the calculation order is the same. Compared with existing solutions, this avoids verification errors caused by computer precision and the problem that GPUs can produce incorrect results within a certain range due to tolerance and cannot be verified by the TEE. It solves the problem of correctness verification of outsourced floating-point matrix multiplication.

[0011] Furthermore, in step S1, the specific steps of generating the outer matrix X' and Y' are as follows:

[0012] S11. The two matrices that TEE needs to outsource are X m×n and Y n×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α ={α1,…,α m}、K β ={β1,…,β n} and K γ ={γ1,…,γs}, where α i ,β j ,γ k ∈R\{0}∩[-2 l ,2 l ], 1≤i≤m,1≤j≤n,1≤k≤s;

[0013] S12. TEE calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Return to step S11 and regenerate the random vector K α ,K β ,K γ .

[0014] Furthermore, after verification, the matrix Z=XY is restored by calculating And Z=Z′-S, T represents the transpose of the vector.

[0015] Furthermore, in step S11, the method for selecting the system parameter l includes: using X′ (i,j) =X (i,j) +α i β j For example, in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >>X (i,j) , so Where x is any element in X.

[0016] The present invention also provides a floating-point matrix multiplication security outsourcing verification system based on TEE and GPU, including:

[0017] Outsourced matrix generation module: used by TEE to generate outsourced matrices X′ and Y′ and transmit them to GPU for calculation;

[0018] Matrix return module: used for GPU to return matrix Z′=X′Y′;

[0019] Verification module: used by TEE to randomly select ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z=V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

[0020] Based on the above technical means, the present invention places the verification of outsourced calculations on X′, Y′, and Z′. This way, regardless of whether it is a TEE or a GPU, every element in Z′ is identical to every element of the product of X′Y′, provided the calculation order is the same. Compared with existing solutions, this avoids verification errors caused by computer precision and the problem that GPUs can produce incorrect results within a certain range due to tolerance and cannot be verified by the TEE. It solves the problem of correctness verification of outsourced floating-point matrix multiplication.

[0021] Furthermore, in the outsourcing matrix generation module, the two matrices that TEE needs to outsource are X m×n and Y n ×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α ={α1,…,α m}、K β ={β1,…,β n} and K γ ={γ1,…,γ s}, where α i ,β j ,γ k ∈R\{0}∩[-2 l ,2 l ], 1≤i≤m,1≤j≤n,1≤k≤s; TEE calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Then regenerate the random vector K α ,K β ,K γ .

[0022] Furthermore, it also includes a matrix restoration module: used to restore the matrix Z=XY after verification; the restoration method is to calculate And Z=Z′-S, T represents the transpose of the vector.

[0023] Furthermore, in the outsourcing matrix generation module, for X′ (i,j) =X(i,j) +α i β j , in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >>X (i,j) , so Where x is any element in X.

[0024] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0025] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0026] Compared with the existing technology, the beneficial effects are: the present invention provides a floating-point matrix multiplication security outsourcing verification method and system based on TEE and GPU, which avoids the verification error problem caused by the computer's precision, and the problem that the GPU may produce erroneous results within a certain range due to tolerance and cannot be verified by TEE, and solves the problem of correctness verification of floating-point matrix multiplication outsourcing calculation. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic flow chart of the method of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The present invention is described in one of the embodiments below in combination with the specific implementation methods. Among them, the drawings are only for illustrative purposes and represent only schematic diagrams rather than physical drawings, and cannot be understood as limitations on this patent; in order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product; for those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0029] In the description of the present invention, it should be understood that if the terms "upper," "lower," "left," "right," etc. indicate an orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the purpose of facilitating the description of the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, the terms describing the positional relationship in the accompanying drawings are only for illustrative purposes and should not be construed as limiting this patent. For those skilled in the art, the specific meanings of the above terms can be understood based on the specific circumstances. In addition, if there are descriptions of "first," "second," etc. in the embodiments of the present invention, the descriptions of "first," "second," etc. are only for descriptive purposes and should not be construed as indicating or implying their relative importance or implicitly indicating the number of the technical features indicated. Therefore, the definition of "first" or "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing throughout the text includes three parallel solutions. For example, "A and / or B" includes solution A, solution B, or solutions that meet both A and B.

[0030] Example 1:

[0031] like Figure 1 As shown in the figure, a secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU is used in each outsourcing matrix product process during machine learning training, including the following steps:

[0032] S1. TEE generates outsourced matrices X′ and Y′ and transmits them to the GPU for computation.

[0033] S2.GPU returns the matrix Z′=X′Y′;

[0034] S3.TEE randomly selects ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

[0035] In step S1, the specific steps of generating the outer matrix X' and Y' are as follows:

[0036] S11. The two matrices that TEE needs to outsource are X m×n and Y n×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α={α1,…,α m}、K β ={β1,…,β n} and K γ ={γ1,…,γ s}, where α i ,β j ,γ k ∈R\{0}∩[-2 l ,2 l ], 1≤i≤m,1≤j≤n,1≤k≤s;

[0037] S12. TEE calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Return to step S11 and regenerate the random vector K α ,K β ,K γ .

[0038] After verification, it is necessary to restore the matrix Z = XY. The restoration method is to calculate And Z=Z′-S, T represents the transpose of the vector.

[0039] In step S11, the method for selecting the system parameter l includes: (i,j) =X (i,j) +α i β j For example, in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >> (i,j) , so Where x is any element in X.

[0040] Based on the above technical solution, the present invention places verification of outsourced calculations on X′, Y′, and Z′. This way, regardless of whether it is a TEE or a GPU, every element in Z′ is identical to every element in the product of X′Y′, provided the calculation order is the same. Compared with existing solutions, this avoids verification errors caused by computer precision and the problem of GPUs producing erroneous results within a certain range due to tolerance, which cannot be verified by the TEE. It solves the problem of correctness verification of outsourced floating-point matrix multiplication.

[0041] Example 2

[0042] This embodiment provides a secure outsourcing verification system for floating-point matrix multiplication based on TEE and GPU, including:

[0043] Outsourced matrix generation module: used by TEE to generate outsourced matrices X′ and Y′ and transmit them to GPU for calculation;

[0044] Matrix return module: used for GPU to return matrix Z′=X′Y′;

[0045] Verification module: used by TEE to randomly select ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

[0046] In the outsourcing matrix generation module, the two matrices that TEE needs to outsource are X m×n and Y n×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α ={α1,…,α m}、K β ={β1,…,β n} and K γ ={γ1,…,γ s}, where α i ,β j ,γ k ∈R\{0}∩[-2 l ,2 l ], 1≤i≤m,1≤j≤n,1≤k≤s; TEE calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Then regenerate the random vector K α ,K β ,K γ .

[0047] In addition, it also includes a matrix restoration module: used to restore the matrix Z = XY after verification; the restoration method is to calculate And Z=Z′-S, T represents the transpose of the vector.

[0048] In the outsourced matrix generation module, for X′ (i,j) =X (i,j) +α i β j , in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >>X (i,j) , so Where x is any element in X.

[0049] Example 3

[0050] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in Example 1 when executing the computer program.

[0051] Example 4

[0052] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method described in Embodiment 1 are implemented.

[0053] Example 5

[0054] Taking Intel SGX as an example, TEE sets the initial system parameter l=2 8 , the two matrices that need to be outsourced for matrix multiplication are set as follows:

[0055]

[0056] In step S1, SGX generates outsourced matrices X′ and Y′ and transmits them to the GPU for computation. The specific steps are as follows:

[0057] S11. Based on the above matrix size m = 2, n = 3, s = 4 and system parameter l = 2 8 , generate a random vector K α ={178.159,-140.457}, K β ={-226.255,-73.043,71.726} and K γ ={-146.464,-28.199,-68.962,84.338}, each element α i ,βj ,γ k ∈R\{0}∩[-2 l ,2 l ];

[0058] S12.SGX calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k , the specific results are:

[0059]

[0060]

[0061] At the same time, check whether each element belongs to [-2 2l ,2 2l ], that is, within [-65536, 65536]. If it does not meet the requirements, return to step S11 to regenerate the random vector K α ,K β ,K γ .

[0062] Step S2. GPU returns the matrix Z′=X′Y′, which is as follows:

[0063]

[0064] Step S3. SGX randomly selects ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails. Otherwise, continue to execute. The specific steps are as follows:

[0065] SGX randomly selects ρ=1 rows in X′ and selects the first row of X′ to form the matrix V X =[-40279.764 -12983.632 12774.118], randomly selected from Y′ Column, select the second and third columns of Y' to form a matrix Calculate the check matrix V Z =V X V Y =[-310372370.876 -757268040.213], and compare Vz Check whether the value is exactly the same as the corresponding value in Z′. If not, exit the outsourcing process. Here we can see that they are exactly the same.

[0066] Additionally, the outsourcing method of step S11, when restoring the matrix Z=XY, has the following specific steps:

[0067] SGX computing The result is:

[0068]

[0069] SGX calculates Z = Z′ - S, and the result is:

[0070]

[0071] Finally, when this verification method is actually used, step S11 generates a random vector by first using the sgx_read_random function in the SGX API to generate a 128-bit random key. Then, using the sgx_aes_ctr_encrypt function and the key, it generates a random bit string of the corresponding length. This random bit string is converted into a random number to form a random vector. The matrix dimensions are generally much larger than those in this embodiment to ensure efficient outsourcing of the operations.

[0072] Example 5

[0073] The TEE environment uses AMD SEV technology, which is similar to the relevant steps of the SGX environment in Example 1, and is replaced by the corresponding operations of AMD SEV.

[0074] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0075] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A secure outsourcing verification method for floating-point matrix multiplication based on TEE and GPU, characterized in that: The following steps are involved: S1. The TEE generates outsourced matrices X′ and Y′ and transmits them to the GPU for computation. In step S1, the specific steps for generating outsourced matrices X′ and Y′ are as follows: S11. The two matrices that TEE needs to outsource are X m×n and Y n×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α ={α1,…,α m }、K β ={β1,…,β n } and K γ ={γ1,…,γ s },in 1≤i≤m,1≤j≤n,1≤k≤s; The method for selecting the system parameter l includes: for X′ (i,j) =X (i,j) +α i β j , in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >>X (i,j) , so Where x is any element in X; S12. TEE calculates X′ (i,j) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Return to step S11 and regenerate the random vector K α ,K β ,K γ ; S2.GPU returns the matrix Z′=X′Y′; S3.TEE randomly selects ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

2. The method for secure outsourcing verification of floating-point matrix multiplication based on TEE and GPU according to claim 1 is characterized in that: After verification, restore the matrix Z = XY by calculating And Z=Z′-S, T represents the transpose of the vector.

3. A floating-point matrix multiplication security outsourcing verification system based on TEE and GPU, characterized by: include: Outsourcing matrix generation module: used for TEE to generate outsourcing matrix X' and matrix Y', and transmit them to GPU for calculation; in the outsourcing matrix generation module, the two matrices that TEE needs to outsource are X m×n and Y n×s , generate a uniformly distributed random vector K based on the initial system parameters l and the scale parameters m, n, s of the outsourcing matrix α ={α1,…,α m }、K β ={β1,…,β n } and K γ ={γ1,…,γ s },in 1≤i≤m,1≤j≤n,1≤k≤s; TEE calculates X′ (i,k) =X (i,j) +α i β j , Y′ (j,k) =Y (j,k) +β j γ k ,if Then regenerate the random vector K α ,K β ,K γ ; System parameter l selection method includes: for X' (i,j) =X (i,j) +α i β j , in order to make X′ indistinguishable from a random matrix, we need α i β j The product is much larger than X (i,j) , that is, α i β j >>X (i,j) , so Where x is any element in X; Matrix return module: used for GPU to return matrix Z′=X′Y′; Verification module: used by TEE to randomly select ρ rows in X′ to form the matrix V X , randomly select The columns form the matrix V Y , calculate the check matrix V Z =V X V Y , and compare V z Check whether the value is exactly the same as the corresponding value in Z′. If not, the verification fails and the outsourcing process is exited. Otherwise, the execution continues.

4. The floating-point matrix multiplication security outsourcing verification system based on TEE and GPU according to claim 3 is characterized in that: It also includes a matrix restoration module: used to restore the matrix Z=XY after the verification is passed; The reduction method is calculation And Z=Z′-S, T represents the transpose of the vector.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to claim 1 or 2 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claim 1 or 2 are implemented.

Images