Privacy preserving linear regression method, system, storage medium, and device

Abstract

The application relates to a privacy protection-based linear regression method, which comprises the following steps: a first participant constructs a column-encrypted data matrix of an original data matrix formed by private original data as a submatrix according to the original data matrix, and after a decomposition factor matrix of an inverse matrix of a regular symmetric matrix of the column-encrypted data matrix is calculated, an encrypted influence matrix corresponding to the decomposition factor matrix, which comprises a column-encrypted data and factor product matrix and a multiplication-encryption factor matrix, is sent to a label data owner or forwarded to the label data owner by other participants according to a preset encryption transmission sequence; and the label data owner calculates a multiplication-encryption linear regression coefficient vector according to a private label column vector and the received encrypted influence matrix. Compared with the prior art, the application does not need to introduce a trusted initializer and an encryption service provider, and does not need to realize a very high complexity confusion circuit, so that the implementation complexity can be reduced, and the actual application requirements are met.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, and in particular to a privacy-preserving linear regression method, system, storage medium, and terminal device. Background Technology

[0002] The development of machine learning-based artificial intelligence relies heavily on the massive amounts of data supporting its training models. However, the practical application of AI technology across various industries faces numerous challenges, including privacy, security, and efficiency, with data being a crucial factor influencing application development. Privacy concerns regarding training data and trust issues among stakeholders hinder the flow of private data between enterprises, preventing the realization of potential application value and hindering valuable data collaboration, thus restricting their further development.

[0003] Federated learning, as a new branch of artificial intelligence technology, enables data sharing, model training, and the release of data value among multiple participants while ensuring privacy protection and data security. This supports industrial innovation and promotes enterprise and industry development. Federated learning applications can be divided into horizontal federated learning and vertical federated learning. Horizontal federated learning, also known as sample-based federated learning, involves participants possessing different data samples who collaborate to improve the performance of the trained model. These participants may be data-owning enterprises or user clients. Vertical federated learning, also known as feature-based federated learning, involves participants possessing different features of the samples. These participants are typically enterprises and large organizations with different domains and focuses.

[0004] In existing longitudinal federated learning techniques for implementing linear regression, secure multi-party computation requires obfuscated circuits, as well as the introduction of trusted initializers, encryption service providers, and evaluators, making the technical implementation extremely complex. Summary of the Invention

[0005] Therefore, it is necessary to provide a privacy-preserving linear regression method, system, storage medium, and terminal device that can be completed solely through collaboration between users who possess the data, without the need for a trusted initializer, encryption service provider, or highly complex obfuscation circuit, thereby reducing implementation complexity.

[0006] This invention provides a privacy-preserving linear regression method, which includes the following steps:

[0007] The first participant constructs a column-encrypted data matrix of the original data matrix formed by the private original data as a sub-matrix according to the original data matrix, and after calculating a decomposition factor matrix of an inverse matrix of a regular symmetric matrix of the column-encrypted data matrix, sends an encrypted influence matrix corresponding to the decomposition factor matrix to a label data owner or forwards the encrypted influence matrix to the label data owner in a preset encrypted transmission order by other participants; the encrypted influence matrix includes column-encrypted data and factor product matrix and multiplication encrypted factor matrix; the column-encrypted data and factor product matrix is a product of the column-encrypted data matrix and the decomposition factor matrix; the multiplication encrypted factor matrix is a product of multiplication encrypted mask matrix and the decomposition factor matrix; the other participants are any other participants providing private data except the first participant;

[0008] The label data owner calculates a multiplication encrypted linear regression coefficient vector according to a private label column vector and the received encrypted influence matrix.

[0009] Further, the decomposition factor matrix is one of a square root matrix and an LDL T decomposed L factor matrix.

[0010] When the decomposition factor matrix is an LDL T decomposed L factor matrix, the encrypted influence matrix further includes an LDL T decomposed D factor matrix corresponding to the L factor matrix.

[0011] Further, the constraint of the square root matrix obtained by the first participant is:

[0012]

[0013] wherein F1 is a square root matrix, is a transpose of F1, is a column-encrypted data matrix of the first participant, is a transpose of , λ is a regularization coefficient greater than or equal to zero, and I is a unit matrix.

[0014] The constraint of the L factor matrix and the D factor matrix obtained by the first participant is:

[0015]

[0016] wherein D1 is a D factor matrix, which is a diagonal matrix; and L1 is an L factor matrix, which is a square matrix.

[0017] Further, after sending the encrypted influence matrix corresponding to the decomposition factor matrix to the other participants, the method further includes:

[0018] The other participants update the encrypted influence matrix to include the influence of their own column encrypted data matrix as a sub-matrix based on the original data matrix formed by the original data matrix containing their own private original data. The updated encrypted influence matrix is ​​then sent to the next participant that provides private data or the owner of the tag data.

[0019] Furthermore, the column encryption data matrix is ​​one of the following: the original data matrix of the participants, the original data matrix of the participants, and the column encryption mask matrix; the column encryption mask matrix contains one or more columns.

[0020] Furthermore, when the column-encrypted data matrix of the first participant is a matrix composed of the original data matrix of the first participant and the column-enhanced encryption mask matrix, after calculating the multiplied encrypted linear regression coefficient vector, the method further includes:

[0021] The tag data owner sends the multiplication-encrypted linear regression coefficient vector to the first participant or is forwarded to the first participant by other participants, so that the first participant, based on its own private multiplication encryption mask matrix, at least partially eliminates the influence of its own increment encryption mask matrix on the multiplication-encrypted linear regression coefficient vector, and updates the multiplication-encrypted linear regression coefficient vector.

[0022] Furthermore, when the column-encrypted data matrix of the other participants is a matrix composed of the original data matrix and the added-column encryption mask matrix of the other participants, after calculating the multiplied encrypted linear regression coefficient vector, the method further includes:

[0023] The tag data owner sends the multiplicative encrypted linear regression coefficient vector to the other participants or is forwarded to the other participants by any participant other than the other participants, so that the other participants, based on their own private multiplicative encryption mask matrix, at least partially eliminate the influence of their own incremented encryption mask matrix on the multiplicative encrypted linear regression coefficient vector, and update the multiplicative encrypted linear regression coefficient vector.

[0024] Furthermore, the method also includes:

[0025] The tag data owner, the first participant, or the other participants send several multiplied encrypted linear regression coefficients corresponding to several data features to the corresponding participants, so that the corresponding participants can decrypt the received several multiplied encrypted linear regression coefficients according to their own multiplied encryption mask matrix to obtain the corresponding several linear regression coefficients.

[0026] Furthermore, the formula for calculating the multiplied encrypted linear regression coefficient vector is as follows:

[0027]

[0028] Where m represents the number of participants providing private data; P is the label vector. m and T m These are the multiplication encryption factor matrix and column encryption data and factor product matrix received by the tag data owner from the first participant or other participants;

[0029] The multiplication encryption linear regression coefficient vector With the linear regression coefficient vector The following conditions must be met:

[0030]

[0031] Among them, Ξ i The encryption mask matrix is ​​the multiplication of the i-th participant who provides private data.

[0032] Another embodiment of the present invention proposes a privacy-preserving linear regression system, the system comprising:

[0033] The first data encryption module is used to enable a first participant to construct a column-encrypted data matrix, with the original data matrix as a submatrix, based on the original data matrix formed from private original data. After calculating the factor matrix of the inverse of the regularized symmetric matrix of the column-encrypted data matrix, the module sends the encrypted influence matrix corresponding to the factor matrix to the tag data owner or has it forwarded to the tag data owner by other participants according to a preset encrypted transmission order. The encrypted influence matrix includes a column-encrypted data and factor product matrix and a multiplied encryption factor matrix. The column-encrypted data and factor product matrix is ​​the product of the column-encrypted data matrix and the factor matrix. The multiplied encryption factor matrix is ​​the product of the multiplied encryption mask matrix and the factor matrix. The other participants are any other participants providing private data besides the first participant.

[0034] The second data encryption module is used to enable the tag data owner to calculate the encrypted linear regression coefficient vector based on the private tag column vector and the received encrypted influence matrix.

[0035] Another embodiment of the present invention provides a computer-readable storage medium comprising a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium resides to perform the privacy-preserving linear regression method as described above.

[0036] Another embodiment of the present application also provides a terminal device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, the processor implementing the privacy protection based linear regression method as described above when executing the computer program.

[0037] The privacy protection based linear regression method, the first participant constructs the original data matrix as a column encrypted data matrix of a sub-matrix according to the original data matrix formed by the private original data, and after obtaining the decomposition factor matrix of the inverse matrix of the regularized symmetric matrix of the column encrypted data matrix, sends the encrypted influence matrix corresponding to the decomposition factor matrix, comprising the column encrypted data and the factor product matrix and the multiplication encrypted factor matrix, to the label data owner or forwards it to the label data owner in a preset encrypted transmission order by other participants; the label data owner obtains the multiplication encrypted linear regression coefficient vector according to the private label column vector and the received encrypted influence matrix. Compared with the prior art, the present application does not need to introduce a trusted initializer and an encryption service provider, and does not need to implement a very complex confusion circuit, thereby reducing the implementation complexity and meeting the actual application requirements. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 A flowchart of the privacy protection based linear regression method provided by the embodiment one of the present application is shown;

[0039] Figure 2 A flowchart of step S11 in the embodiment two of the present application is shown;

[0040] Figure 3 A flowchart of step S12 in the embodiment two of the present application is shown;

[0041] Figure 4 A flowchart of the overall process obtained by combining steps S11 and S12 in the embodiment two of the present application is shown;

[0042] Figure 5 A flowchart of the overall process obtained by combining steps S11 and S12 in the embodiment three of the present application is shown;

[0043] Figure 6 A flowchart of the overall process obtained by combining steps S11 and S12 in the embodiment four of the present application is shown;

[0044] Figure 7 A structure block diagram of the privacy protection based linear regression system provided by the embodiment of the present application is shown;

[0045] Figure 8 A structure diagram of the terminal device provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0046] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0047] It should be noted that the step numbers in the text are only for the convenience of explaining the specific embodiments, and do not serve as the basis for determining the execution sequence of the steps. The method provided in the embodiment can be executed by a related server, and the server is taken as an example for description hereinafter.

[0048] The linear regression method based on privacy protection is a method for providing data privacy protection for data owners based on an application scenario of vertical federated learning jointly participated in by m (m≥1) data owners providing private data and a label data owner owning label data, wherein the m (m≥1) data owners providing private original data are referred to as m participants, and correspondingly, in order to distinguish the participant owning label data from the data owners providing private data, the participant owning label data is referred to as the m+1 participant, which can also be referred to as the label owner, and the label owner can be one of the m participants or another participant other than the m participants. The linear regression method based on privacy protection can be understood as follows: first, the m participants participating in the vertical federated learning use a method for protecting the privacy of their respective private original data to cooperatively calculate the decomposition factor matrix of the inverse matrix (X T X+λI) T X+λI) -1 of the regularized symmetric matrix X of the m participant original data matrices X, and then the linear regression coefficient vector T is calculated based on the theoretical derivation of the linear regression coefficient of the vertical federated learning, wherein the decomposition factor matrix is one of the square root matrix and the L factor matrix of the LDL i decomposition, and correspondingly, the process of calculating the linear regression coefficient vector can be understood as follows: the m participants participating in the vertical federated learning use a method for protecting the privacy of their respective private original data X T to cooperatively calculate the matrix F satisfying FF T =(X -1 X+λI) T , or the matrix F satisfying LDL T =(X -1 X+λI) T .Let L and D be matrices, where F is a regularized symmetric matrix X formed by concatenating the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 The square root matrix, matrix L, and matrix D represent the regularized symmetric matrix X of the concatenated matrix X of the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 The L-factor matrix and D-factor matrix; simultaneously, m participants collaboratively calculate matrix T = XF, or T′ = XL, using methods that protect their respective data privacy. Here, matrix T is the product of the concatenated matrix X of the original data matrices of the m participants and the aforementioned square root matrix F, or matrix T′ is the product of the concatenated matrix X of the original data matrices of the m participants and the aforementioned L-factor matrix L; then... The linear regression coefficient vector is calculated. Because substituting T=XF into... It can be obtained Then put FF T =(X T X+λI) -1 Substitution It can be obtained Similarly, this step can also be performed by obtaining the aforementioned matrices F and T from matrix T′, the L factor matrix L, and the D factor matrix D, and then using the method described above... The linear regression coefficient vector is calculated. The detailed derivation process will not be elaborated here.

[0049] like Figure 1 As shown, the privacy-preserving linear regression method provided in Embodiment 1 of the present invention includes steps S11 to S12:

[0050] Step S11: The first participant constructs a column-encrypted data matrix with the original data matrix as a submatrix based on the original data matrix formed by the private original data. After calculating the factorization matrix of the inverse of the regularized symmetric matrix of the column-encrypted data matrix, the first participant sends the encrypted influence matrix corresponding to the factorization matrix to the tag data owner or forwards it to the tag data owner by other participants according to a preset encrypted transmission order. The encrypted influence matrix includes a column-encrypted data and factor product matrix and a multiplied encryption factor matrix. The column-encrypted data and factor product matrix is ​​the product of the column-encrypted data matrix and the factorization matrix. The multiplied encryption factor matrix is ​​the product of the multiplied encryption mask matrix and the factorization factor matrix. The other participants are any other participants that provide private data besides the first participant.

[0051] The column encryption data matrix of the first participant is one of an original data matrix of the first participant, and a matrix composed of the original data matrix of the first participant and an additional column encryption mask matrix; the additional column encryption mask matrix contains one column or multiple columns; it should be noted that when the column encryption data matrix of the first participant is the original data matrix, it can be understood that the first participant does not use the additional column encryption mask matrix to encrypt and protect the private original data in the participation in the vertical federated learning; when the column encryption data matrix of the first participant is the matrix composed of the original data matrix and the additional column encryption mask matrix, it can be understood that the first participant encrypts and protects the private data owned by the first participant in the form of adding one column or multiple columns to the private original data matrix after the participation in the vertical federated learning, calculates the corresponding decomposition factor matrix, and then sends the column encryption data corresponding to the decomposition factor matrix, the factor multiplication matrix and the multiplication encryption factor matrix to the label data owner (when m=1) or other participants (when m>1) first, and then forwards to the label data owner according to the preset encryption transmission order.

[0052] In step S12, the label data owner calculates a multiplication encryption linear regression coefficient vector according to the private label column vector and the received encryption influence matrix; wherein the multiplication encryption linear regression coefficient vector can be understood as the multiplication encryption factor matrix P m , the column encryption data and factor multiplication matrix T m , and the label column vector of the label data owner, and the multiplication encryption linear regression coefficient vector calculated by the label data owner is represented as:

[0053]

[0054] Wherein, m represents the number of participants providing private data; is a label vector, P m and T m are the multiplication encryption factor matrix and the column encryption data and factor multiplication matrix received by the label data owner from the first participant or the other participants; and the multiplication encryption linear regression coefficient vector satisfies the following relationship with the linear regression coefficient vector of the m participants:

[0055]

[0056] Wherein, Ξ i is the multiplication encryption mask matrix of the i-th participant providing private data.

[0057] In order to facilitate the understanding of Figure 1 ​With the deep understanding of the data privacy protection scheme shown, the following will be based on the steps S11 and S12 given in embodiment one, combined with two different decomposition methods that will be used in actual applications to the inverse matrix of the regularized symmetric matrix of the column-encrypted data matrix taking the original data matrix as a sub-matrix constructed by the first participant according to the original data matrix formed by the private original data, to elaborate the specific implementation process of the linear regression method based on privacy protection provided by the present application. It should be noted that in the following embodiments, the following unified expressions will be used: for i = 1, 2, …, m, the private original data matrix of the i-th participant is denoted as X i , the i-th participant uses its own private original data matrix X i to participate in the vertical federated learning, and ensures that its own private original data matrix X i is not disclosed to other participants.

[0058] As shown in Figure 2 , the linear regression method based on privacy protection provided by the second embodiment of the present application is the specific implementation process in the scenario of using square root decomposition to calculate the inverse matrix of the regularized symmetric matrix of the column-encrypted data matrix taking the original data matrix as a sub-matrix constructed by the first participant according to the original data matrix formed by the private original data; in this embodiment, the encryption influence matrix in step S11 includes column-encrypted data and factor multiplication matrix and multiplication encryption factor matrix, and the column-encrypted data and factor multiplication matrix can be understood as the product of the column-encrypted data matrix and the square root matrix of the inverse matrix of the regularized symmetric matrix of the column-encrypted data matrix, and the corresponding multiplication encryption factor matrix is the product of the multiplication encryption mask matrix and the square root matrix of the inverse matrix of the regularized symmetric matrix of the column-encrypted data matrix; step S11 in the specific implementation process includes steps S111 to S112, step S111 includes sub-steps S111-a to S111-e, and step S112 includes sub-steps S112-a to S112-f; the following first introduces the sub-steps S111-a to S111-e included in step S111:

[0059] Sub-step S111-a: This sub-step is an optional sub-step of adding a mask column. In this sub-step, the first participant adds one or more columns of masks to the rear of its own original data matrix X1, which is an optional step. If the first participant wants to achieve better privacy protection effect, it will choose this step. Usually, 1 column of mask vector can achieve the privacy protection effect, and the first participant can also use multiple columns of masks to achieve better privacy protection effect by increasing the number of columns of masks. The first participant generates the data matrix with added mask columns , which is also referred to as column-encrypted data matrix

[0060] Specifically, the column-encrypted data matrix is the data matrix with added column(s) of encryption mask where the original data matrix X1 of the first participant has τ1 columns containing τ1 features, and the added column-encrypted mask matrix Δ1 has The column(s) can be generated by the first participant, and usually the added column-encrypted mask matrix Δ1 is randomly generated. represents that the original data matrix X1 with τ1 columns is followed by the added column-encrypted mask matrix Δ1 with columns to obtain the column-encrypted data matrix with columns Note that may be equal to 0, which means that the first participant does not add the added column-encrypted mask matrix Δ1 to encrypt the original data; in addition, usually is equal to 1 to have a good encryption effect, in which case the added column-encrypted mask matrix Δ1 with columns is actually an added column-encrypted mask column vector with only 1 column. When the first participant does not select this optional added mask column step, there is

[0061] Sub-step S111-b: In this sub-step, the square root matrix F1 is obtained. Specifically, the first participant calculates the inverse matrix of the regularized symmetric matrix of the matrix (i.e., the column-encrypted data matrix) containing the original data matrix X1 of the first participant as a sub-matrix, and the square root matrix F1 of the matrix satisfies Here I represents the identity matrix, and λ represents a scalar, referred to as a regularization coefficient. In this application, (·) T represents the transpose of a real matrix (including a vector), or the conjugate transpose of a complex matrix (including a vector), such as in the above and in the above Two matrices are placed together, or a scalar and a matrix are placed together, to represent multiplication, such as in the above represents multiplication , and λI represents λ multiplication I. Note that the regularized symmetric matrix λI is a matrix related to regularization, and in some cases, λI can be a diagonal matrix of the form , where the items on the diagonal can take different values; or λI can be an arbitrary matrix.

[0062] For simplicity of description, hereinafter, F1, i.e., the column-encrypted data matrix The square root matrix of the inverse of a regularized symmetric matrix is ​​simply called the square root matrix.

[0063] Specifically, the first participant calculates the square root matrix F1 such that it satisfies To enhance secrecy, it is typically required that F1 is not a triangular matrix. If the inverse Cholesky decomposition algorithm is used to obtain the regularized symmetric matrix... If the inverse of the Cholesky decomposition matrix is ​​taken as F1, then F1 is a triangular matrix. In this case, an arbitrary orthogonal matrix Θ1 is typically used to right-multiply F1 to obtain an updated F1 = F1Θ1, making F1 non-triangular. To achieve encryption in this step, even if F1 is no longer triangular, the first participant, after obtaining an F1, will also right-multiply F1 with an orthogonal matrix Θ1 known only to the first participant to obtain an updated F1 = F1Θ1.

[0064] The constraints on the square root matrix obtained by the first participant are:

[0065]

[0066] in, The column-encrypted data matrix for the first participant, also known as a concatenated matrix containing the column-encrypted data of one participant or a column-encrypted data matrix containing the data of one participant. for The transpose or conjugate transpose of , λ is a regularization coefficient greater than or equal to zero, and I is the identity matrix; it should be noted that the detailed explanation of "concatenation matrix" and "column encrypted data matrix with i (i greater than or equal to 1) participants" is described below.

[0067] Sub-step S111-c: In this sub-step, the first participant calculates the product T1 of the column-encrypted data and the square root matrix, and then sends T1 to the second participant. T1 is an intermediate variable, which is the column-encrypted data matrix containing the original data matrix X1 of the first participant as a submatrix. Encrypted data matrix with columns The product T1 of the square root matrix F1 of the inverse of the regularized symmetric matrix, i.e. In the following text, the first participant's column encryption data matrix The product T1 of the square root matrix F1 is simply referred to as the column encrypted data and factor product matrix T1 of the first participant, also known as the intermediate variable T1.

[0068] Sub-step S111-d: In this sub-step, the first participant sends the multiplication encrypted factor matrix P1 = Ξ1F1 to the second participant, where P1 can be equal to the square root matrix F1. The first participant left multiplies the square root matrix F1 of the first participant by a multiplication encryption mask matrix Ξ1 to obtain the multiplication encrypted factor matrix P1 = Ξ1F1, which is a multiplication of a matrix and the square root matrix F1. The multiplication encryption mask matrix Ξ1 is a square matrix and is also a reversible matrix, i.e., there exists an inverse matrix. Generally, the multiplication encryption mask matrix Ξ1 is unknown to users other than the first participant, so that the encryption effect is achieved; correspondingly, the multiplication encryption mask matrix Ξ1 can be a matrix generated by the first participant, which is generally randomly generated by the first participant. When the first participant has a low requirement for protection of his own privacy data, multiplication encryption can not be performed, in which case the square root matrix F1 is sent, which is equivalent to the multiplication encrypted factor matrix P1 = F1, or Ξ1 is equal to the unit matrix I in P1 = Ξ1F1.

[0069] The encryption effect of the present application is described below by taking the data privacy protection of the first participant (the first data owner) as an example: because And Therefore, each column of T1 is the sum of each column of [X1 Δ1] multiplied by a coefficient, so each column of T1 is a linear combination of each column of the original data matrix X1 plus a linear combination of each column of the augmented column encryption mask matrix Δ1, which can also be expressed as each column of T1 adds the interference of each column of the augmented column encryption mask matrix Δ1 to achieve the effect of protecting the original data matrix X1 (original data); because the other participants including the second participant do not know Δ1, the other participants including the second participant generally cannot deduce the original data matrix X1 from each column of T1, so that the effect of encrypting the original data is achieved. On the other hand, it is easy to see that the square root matrix F1 of the first participant satisfies:

[0070]

[0071] Moreover, as described above, the first participant right multiplies F1 by an orthogonal matrix Θ1 known only to himself to obtain the updated F1 = F1Θ1, so each column of the square root matrix F1 also adds the interference of each column of the augmented column encryption mask matrix Δ1 to achieve the effect of protecting the original data matrix X1 constructed from the original data; in addition, P1 = Ξ1F1 ensures that F1 is further encrypted, because the other participants including the second participant do not know the matrix Ξ1, so they cannot deduce the matrix F1 from the received matrix P1.

[0072] In summary, there are augmented column encryption mask matrix Δ1, which can also be regarded in the embodiment of the present application as containing The interference data of the feature is added because the interference of the interference data of the feature is added in the subsequent calculation of the square root matrix F1 and each column of the column encryption data and the square root matrix product T1 is added with the interference of each column of the column encryption mask matrix Δ1.

[0073] Sub-step S111-e: the control variable i corresponding to the first participant (the first data owner) is equal to 1, in this sub-step, the value of i is first increased by 1; then, if the value of i is greater than m, it enters step S12, if the value of i is less than or equal to m, it enters step S112. As described above, there are m participants who own their own private original data, also known as m data owners, and m is an integer greater than or equal to 1; in addition, there is a participant who is called a label owner, which is the (m+1)th participant. This step is explained as follows: the value of m determines the characteristics of the second participant described above, and also determines which step to enter next. When m is equal to 1, the second participant described above is the label data owner, and accordingly enters step S12; when m is greater than or equal to 2, the second participant described above is the second data owner, and accordingly enters step S112.

[0074] The splicing matrix of the column encryption data of the i (i is less than or equal to m) participants in the present application The column encryption data matrix of the i participants is abbreviated as the column encryption data matrix of the i participants, and it is noted that the column encryption data matrix of the jth participant (j is greater than or equal to 1 and less than or equal to i) is The original data matrix X is composed of the private original data of the jth participant j The column encryption mask matrix Δ is added at the back j The column encryption mask matrix Δ is not added, and the column encryption data matrix of the i participants is obtained j Thus, It can be easily seen that the column encryption data matrix of the i participants used in step S11 is It can also be expressed as That is, the column encryption data matrix of the i participants This representation method also covers the aforementioned step S111.

[0075] The participant i equivalently calculates the multiplication encryption factor matrix P of the i participants i It is the square root matrix F of the i participants i The multiplication encryption factor matrix P is obtained after multiplication encryption by multiplying a matrix on the left The square root matrix F of the i participants i The column encryption data matrix of the i participants The regularization symmetric matrix of the column encryption data matrix of the i participants The inverse matrix of the regularization symmetric matrix of the column encryption data matrix of the i participants The square root matrix of the regularization symmetric matrix of the column encryption data matrix of the i participants, which satisfies On the other hand, the participant i also equivalently calculates the column encryption data matrix of the i participants The square root matrix F of the above i participating parties i product The above matrix T i This is called the product of the column-encrypted data matrix and the square root matrix of the i participants. To protect the data privacy of participants 1, 2, ..., i-1, participant i does not receive the data X1, X2, ... X from participants 1, 2, ..., i-1. i-1 Only P was received. i-1 and T i-1 The following sub-steps S112-a to S112-e describe how participant i uses the received P i-1 and T i-1 and its own data matrix X i P was calculated. i and T i The method then sends the data to the next participant (participant i+1). It should be noted that the column-encrypted data matrix contains data for participants 1, 2, ..., i (a total of i participants). It is also the original data matrix X containing the i-th participant. i As a submatrix of a matrix. In summary, the above F... i P is called the square root matrix of the i participating parties. i Simply put, it is the encryption factor matrix multiplied by i participants, and T i It is simply referred to as the encrypted data and factor product matrix of i participants.

[0076] In step S112, the i-th participant (i ≥ 2 ≤ m), i.e., the i-th data owner, receives the encrypted data and factor product matrix T from a total of i-1 participants. i-1 And the encryption factor matrix P of the above i-1 participants. i-1 The i-th participant uses its own column to encrypt the data matrix. (Note Δ) i It can be an empty matrix (as a special case), let T i-1 and P i-1 Updated to T respectively i and P i Then put T i and P i Send to the (i+1)th participant; here T i It is the product of the column-encrypted data matrix of i participants, including the i-th participant, and the square root matrix, while P i It is the product of the encryption mask matrix and the square root matrix of the i participating parties mentioned above.

[0077] Step S112 above includes the following sub-steps S112-a to S112-f, a total of 6 sub-steps:

[0078] Sub-step S112-a: The i-th participant, i.e., the i-th data owner, receives the encrypted data and factor product matrix T from a total of i-1 participants. i-1 And the encryption factor matrix P of the above i-1 participants. i-1 .

[0079] Sub-step S112-b: This sub-step is optional and involves adding a mask column. In this sub-step, the data matrix X is... i The i-th participant in its own data matrix X i Adding one or more columns of masking is an optional step. The data matrix X constructed by the i-th participant based on its private original data... i and the addition of an encryption mask matrix Δ i The generated data matrix with added mask columns This will also be referred to as column-encrypted data matrix for short.

[0080] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. Where the data matrix X of the i-th participant i There is τ i The column contains τ i The original data of each feature, and the added encryption mask matrix Δ i have The column can be generated by the i-th participant, usually by adding an encryption mask matrix Δ. i It is randomly generated. Indicates that there is τ i Column data matrix X i Added later Column-adding encryption mask matrix Δ i To obtain shared ownership Column-wise encrypted data matrix in It can be equal to 0, which is equivalent to the i-th participant not adding an additional column to the encryption mask matrix Δ. i To encrypt the original data; in addition, it is usually made A value of 1 provides excellent encryption; in this case, there is... Column-adding encryption mask matrix Δ i In reality, it's a single-column incrementing encryption mask column vector. If the i-th participant doesn't choose this optional incrementing mask column step, then the following steps will be used...

[0081] Sub-step S112-c: In this sub-step, the square root matrix F of the i participating parties is obtained. i submatrix G in i The i-th participant computes matrix G.i It is the square root matrix F of i participating parties. i A submatrix, such as As shown, × represents a submatrix that is not currently of interest. Calculate matrix G. i It is to find G i Make it satisfy It is easy to see from this that the square root matrix F i submatrix G in i It is also a regularized symmetric matrix inverse matrix The square root matrix. If the G of the triangle is obtained using inverse Cholesky decomposition... i Then use an orthogonal matrix Θ i Right multiply by G i Get G i =G i Θ i This makes G i It's not triangular. In this step, to achieve encryption, user i typically obtains a G. i After that, even if G i Even if it's not a triangle, use an orthogonal matrix Θ that only you know. i Right multiply by G i Get G i =G i Θ i .

[0082] Sub-step S112-d: In this sub-step, the i-th participant multiplies the encrypted data of the columns of i-1 participants with the square root matrix (encrypted data and factor product matrix) T. i-1 Updated to encrypted data and factor product matrix T of i participants. i Then put T i It is sent to the next participant, i.e., the (i+1)th participant. As mentioned before, T i It is a column-encrypted data matrix with i participants. With the square root matrix F i The product of, i.e. And the square root matrix F i It is a column-encrypted data matrix with i participants. Regularized symmetric matrix inverse matrix The square root matrix, i.e., the square root matrix F i satisfy A specific implementation method could be to use encrypted data and factor product matrix T i-1 Adding several columns to the right results in T. i We can prove Therefore, in practice, only the matrix G obtained by sub-step S112-c is needed. i Calculate the matrix Then add it to T i-1 To the right, you can get T. i .

[0083] Sub-step S112-e: In this sub-step, the i-th participant multiplies the product of the encryption mask matrix and the square root matrix of the i-1 participants (multiplying the encryption factor matrix) P. i-1 Updated to a encryption factor matrix P multiplied by i participants. i Then put P i It is sent to the next participant, i.e., the (i+1)th participant. As mentioned before, P i It is the square root matrix F of i participants. i The left side is multiplied by a matrix and then encrypted to obtain the encryption factor matrix, while the square root matrix F of the i participants is... i satisfy A specific implementation could be that the i-th data owner uses an invertible square matrix Ξ i ,pass In P i-1 Add multiple columns to the right of In P i-1 Add a submatrix consisting entirely of zeros directly below P. i-1 Add a submatrix Ξ to the lower right. i G i This allows the encryption factor matrix P to be multiplied by the i-1 participating parties. i-1 Updated to a encryption factor matrix P multiplied by i participants. i Typically, only the i-th participant knows the aforementioned invertible square matrix Ξ. i To achieve the effect of encryption, and Ξ i It can be randomly generated by the i-th participant; Ξ i This can be referred to as the encryption mask matrix multiplied by the i-th participant. The i-th participant may also omit Ξ. i Encryption, which is equivalent to Ξ i It is the identity matrix I, and correspondingly, P i-1 Updated to P i Through That is, P i-1 The submatrix added in the lower right corner becomes G. i When all Ξ1,Ξ2,…,Ξ i All are identity matrices, and the encryption factor matrix P is multiplied by i participants. i It is the square root matrix F of i participants. i That is, P i A special case is P i =Fi .

[0084] Sub-step S112-f (sub-step of iteration control): if the value of i is less than or equal to m-1, let the value of i increase by 1, and then return to sub-step S112-a to start the next iteration; otherwise, when the value of i is equal to m, go to the following step S12.

[0085] When the value of i is equal to m, the mth participant sends T m and P m to the m+1th participant, which is the label data owner. As mentioned above, the label data owner can be any one of the above m participants, or a participant other than the above m participants. In particular, the m+1th participant, i.e., the label data owner, can be exactly the mth participant, in which case the mth participant sends P m and T m to the m+1th participant, i.e., the mth participant sends P m and T m to itself, which actually does not require any sending operation.

[0086] In step S12, the label data owner, i.e., the m+1th participant, calculates the multiplication-encryption linear regression coefficient vector m , i.e., the product of the multiplication-encryption mask matrix and the linear regression coefficient vector, according to the private label column vector, the received encrypted data of the m participants, and the factor product matrix T m and the multiplication-encryption factor matrix P If there are several participants among the participants 1 to m who use non-zero column augmented encryption mask matrices, the several participants successively at least partially eliminate the influence of their augmented encryption mask matrices Δ in the multiplication-encryption linear regression coefficient vector m and the multiplication-encryption factor matrix P When each participant who uses a non-zero column augmented encryption mask matrix has at least partially eliminated the influence of the participant's augmented encryption mask matrix Δ in the multiplication-encryption linear regression coefficient vector , or when there is no participant who uses a non-zero column augmented encryption mask matrix, the participant who has the most recently updated multiplication-encryption linear regression coefficient vector sends the several items in corresponding to the participant i (here i is greater than or equal to 1 and less than or equal to m) to the participant i, which decrypts the several items corresponding to the participant i in the linear regression coefficient vector using its own private multiplication-encryption mask matrix Ξ i .

[0087] Specifically, as mentioned above, the label data owner can be any one of the above m participants, or a participant other than the above m participants. In particular, the m+1th participant, i.e., the label data owner, can be exactly the mth participant, in which case the mth participant sends P m and T m to the m+1th participant, i.e., the mth participant sends P m and T m to itself, which actually does not require any sending operation.Figure 3 As shown, the step S12 includes steps S121 to S125. The tag data owner sends the multiplication-encrypted factor matrix P = P m and the multiplication-encrypted linear regression coefficient vector to the ith participant, where i is a positive integer less than or equal to m-1, or i is a positive integer less than or equal to m, and the value of i is determined by the following step S121 -selection 1 or step S121 -selection 2. If the tag data owner is the mth participant, go to the following (step S121 -selection 1), otherwise, that is, if the tag data owner is not the mth participant, go to the following (step S121 -selection 2):

[0088] (step S121 -selection 1) When the tag data owner is the mth participant, the mth participant sends P m and T m to the m+1th participant who owns the tag, which is equivalent to sending to oneself, and actually does not need to be executed, and accordingly, the mth participant does not need to add a mask column to protect its own privacy data X m . The tag data owner, that is, the mth participant, obtains the multiplication-encrypted linear regression coefficient vector afterwards, and sends the multiplication-encrypted factor matrix P = P and the multiplication-encrypted linear regression coefficient vector to the ith participant, where i is a positive integer less than or equal to m-1. Generally, the participants m-1, m-2,..., 1 all use the non-zero column augmented encryption mask matrix, that is, the augmented encryption mask matrix Δ i has a column number greater than or equal to 1 for all i = m-1, m-2,..., 1, so generally i is equal to m-1; more generally, considering that there may be participants who do not add a mask column, the value of i is determined by: among the participants m-1, m-2,..., 1, finding the participant with the largest sequence number value who uses the non-zero column augmented encryption mask matrix, and the sequence number is taken as the value of i. In rare specific cases, the m-1 participants m-1, m-2,..., 1 all do not use the non-zero column augmented encryption mask matrix, so let i be equal to 0.

[0089] (step S121 -selection 2) When the tag data owner is not the mth participant, the tag data owner obtains the multiplication-encrypted linear regression coefficient vector afterwards, and sends the multiplication-encrypted factor matrix P = P m and the multiplication-encrypted linear regression coefficient vector Send this to the i-th participant, where i is a positive integer less than or equal to m. Typically, participants m, m-1, ..., 1 all use an increasing-column encryption mask matrix with non-zero columns, so i is usually equal to m. In this case, because the tag owner sends the encryption factor matrix P = P... m The m-th participant already possesses P m Similarly, the owner of the tag data can omit P=P m The step of sending to the m-th participant; more generally, considering that some participants may not have used an ascending column encryption mask matrix with non-zero columns, the value of i is determined by: finding the participant with the largest index value among participants m, m-1, ..., 1 that uses an ascending column encryption mask matrix with non-zero columns, and using its index as the value of i. In rare, specific cases, none of the m participants m, m-1, ..., 1 use an ascending column encryption mask matrix with non-zero columns, then i is set to 0.

[0090] As mentioned earlier, the vertical federated learning involves a column-encrypted data matrix with m participants. Among them For i = 1, 2, ..., m, the column-encrypted data matrix of the i-th participant. The original data matrix X i It is a column-encrypted data matrix with m participants. The ρth i-1 +1 column to kth i Columns, these numbers are represented by the subscript ρ i-1 +1:k i This indicates that the mask matrix Δ in the column encrypted data matrix of the i-th participant is... i It is a splicing matrix The kth i +1 column to ρ i Columns, these numbers are indicated by the subscript k i +1:ρ i This represents the original data matrix X of the i-th participant. i There is τ i =k i -ρ i-1 The column, and its mask matrix Δ i have The column, and the column encryption data matrix of the i-th participant. Total Column. Note that we assume ρ0 = 0. As a special case, when an additional column is added to the encryption mask matrix Δ i The number of columns is 0, meaning no additional columns are added to the encryption mask matrix Δ. i At that time, the original data matrix X i From the ρth i-1 +1 column to ρ i Column, total τ i= p i - p i-1 Column, column-encrypted encryption mask matrix Δ i There are Column. Note that at this time k i = p i , indicates the i-th user without the scrambled random pseudo-information attribute. The above-mentioned subscripts are also used in the following to represent the terms of the multiplication encryption linear regression coefficient vector , and the rows and columns of the multiplication encryption factor matrix P m , and the terms, rows and columns of other related matrices and vectors.

[0091] In the present application, for the sake of simplicity of description, it is assumed that the columns of the column-encrypted data matrix X of the i-th participant are arranged in the following order: The first τ i columns of X i are the original data matrix X i , and the latter columns are the mask matrix Δ i ; in practice, the columns of X may also be arranged in other ways, and the corresponding specific embodiments of the present application can be slightly modified, which is well known to those skilled in the art.

[0092] At the end of step S121, if the above-mentioned set i value is equal to 0, then all m participants do not have the column-encrypted encryption mask matrix Δ i , or it can also be expressed that for all m participants, the number of columns of the column-encrypted encryption mask matrix Δ i is 0 Then the subsequent step S122 can be skipped and directly enter the final step S125; on the other hand, if the i value set in step S121 is not equal to 0, that is, greater than or equal to 1, then enter the subsequent step S122.

[0093] In step S122, the i-th participant uses the private multiplication encryption mask matrix Ξ i to at least partially eliminate the influence of the column-encrypted encryption mask matrix Δ i of the i-th participant on the multiplication encryption factor matrix P of the total m participants, to obtain a reduced-size multiplication encryption factor matrix P. Ideally, it is desired to completely eliminate the above-mentioned influence; in specific implementation, there are often various errors and other factors affecting performance, so the effect of step S122 is at least partially to eliminate the above-mentioned influence, which includes the case that the above-mentioned influence cannot be completely eliminated. There are many specific implementation ways to achieve the above-mentioned effect of step S122, and one specific implementation way of step S122 includes the following sub-steps:

[0094] Sub-step S122-a: The i-th participant receives the encryption factor matrix P from all m participants. Sub-step S122-b: The i-th participant calculates the matrix Π needed to construct the orthogonal transformation. i Specifically, multiply by the encryption mask matrix Ξ i The inverse matrix Γ i After Act immediately And P from ρ i-1 +1 row to ρ i line ξ i From ρ in the row i-1 The non-zero submatrix from column +1 to the last column is Calculate the product of the two. Obviously, Π i have OK.

[0095] Note that the above "P from ρ" i-1 +1 row to ρ i line ξ i "Line", that is, in the multiplication of the encryption factor matrix P, the i-th participant uses its own multiplication of the encryption mask matrix Ξ. i The encrypted lines; and in the above P's ξ i Take from ρ in the row i-1 +1 column to the last column, because of ξ in P above. i In the row, the fact that matrix P is a block of triangles causes the ρth row to be... i-1 All elements in the columns before column +1 are 0.

[0096] In sub-step S122-c, the i-th participant constructs an orthogonal transformation for multiplying the encryption factor matrix P, and extracts the η to be used subsequently from P. i Then reduce P and multiply by the encryption mask matrix Ξ i Specifically, it starts with Π i Find the satisfying The orthogonal transformation Ωi and the orthogonal transformation obtained OK non-zero sub-blocks of the column That is, in Π i Ω i In the middle, except for the last one Except for column P, all other columns have a value of 0; then P is multiplied by an orthogonal transformation. To update P to here Represents ρ i-1 row ρ i-1 The identity matrix is ​​a column matrix, and 0 represents the zero matrix of the corresponding size, with ρ rows. i-1 And the number of its columns is equal to the number of columns of Ωi; update the last column in P. Column storage as η i Used for subsequent calculations, and then the above-mentioned values ​​are deleted from the updated P. Column and delete from kth i +1 row to the ρth row i OK Okay, we get the reduced P.

[0097] Notice: It can also be by The calculation yielded, where yes( The column of the matrix η from the ρth i-1 +1 row to the ρth row i All right Okay, and It is multiplied by the encryption mask matrix Ξ i The inverse matrix Γ i After , as mentioned before. Furthermore, when i equals 1, ρ i-1 =ρ0=0, therefore It is an empty matrix, and the corresponding orthogonal transformations mentioned above

[0098] In sub-step S122-c, the i-th participant updates η. i For use in subsequent step S123. Specifically, in η i Delete from the first Reaching the ρth row i OK Okay, they are the i-th participant in the multiplication of the encryption factor matrix P by multiplying the encryption mask matrix Ξ. i The last of the encrypted lines Okay. Then, calculate. in Indicates η i From the ρth i-1 +1 row to kth row i τ of the line i =k i -ρ i-1 Okay, and the above calculation is to update η. i From the ρth i-1 +1 row to kth row i τ of the line i =k i -ρ i-1 Okay, they are the i-th participant in the multiplication of the encryption factor matrix P by multiplying the encryption mask matrix Ξ. i The first τ in those encrypted lines i Okay. Note η i The other terms remain unchanged, that is, the same as the original η. i Same, only update the above τ. iThe row, thus obtaining the updated η i Now, η i may be called the result of the sub-matrix update part of the post-orthogonal transformation multiplication-encryption factor matrix.

[0099] After step S122 is executed, the following step S123 is entered.

[0100] In step S123, the i-th participant at least partially eliminates the i-th participant's added multiplication-encryption mask matrix Δ i on the multiplication-encryption linear regression coefficient vector of the m participants, obtaining a reduced-size multiplication-encryption linear regression coefficient vector Ideally, it is desirable to completely eliminate the above-mentioned influence; in specific implementations, various errors and other factors affecting performance often exist, so the effect of step S123 is at least partially eliminating the above-mentioned influence, which includes the case that the above-mentioned influence cannot be completely eliminated. Step S123 to achieve the above-mentioned effect can have multiple specific implementation manners, and one specific implementation manner of step S123 is to use η i (i.e., the result of the sub-matrix update part of the post-orthogonal transformation multiplication-encryption factor matrix) obtained in step S122, which includes the following respective sub-steps:

[0101] Sub-step S123-a: the i-th participant receives the multiplication-encryption linear regression coefficient vector

[0102] In sub-step S123-b, the i-th participant calculates the regression coefficient corresponding to its interference data. Specifically, the i-th participant calculates the τ linear regression coefficients corresponding to the interference data added by the i-th participant containing ρ , by calculating wherein is the post-ρ i +1 row of the inverse matrix Γ i of the multiplication-encryption mask matrix Ξ , as described above, and is the ρ i-1 +1 item to the ρ i item of the τ i = ρ i - ρ i-1 items of the multiplication-encryption linear regression coefficient vector . Note that the calculated is the ρ item to the ρ i item of the τ items of the linear regression coefficient vector , which corresponds to the added multiplication-encryption mask matrix Δ iof The column, that is, the column added corresponding to the i-th participant, includes... Disturbance data for each feature.

[0103] In sub-step S123-c, the i-th participant processes... The i-th participant multiplies the encrypted terms, deletes some terms, and updates others. Specifically, it multiplies the encrypted linear regression coefficient vector. The encryption mask matrix Ξ is multiplied by the i-th participant. i The ρth encryption i-1 +1 term to the ρth term i The total of items The item is processed as follows: Where the following... Item, that is From the middle Item to ρ i The total of items Item, was from Deleted from , while the preceding τ i Item, that is From the ρth i-1 +1 terms up to the kth term i The total τ of the terms i Item, that is It is obtained using sub-step S123-b. Update, through calculation here Represents multiplication by the encryption mask matrix Ξ i Middle τ i OK The submatrix of the column is Ξ i The first τ i The last one in the line The sequence. Subsequently, the i-th participant multiplies the encryption mask matrix Ξ. i Updated to It includes the original Ξ i The first τ i row and τ i List.

[0104] In sub-step S123-d, the i-th participant updates the entire... Specifically, the i-th participant uses the non-zero sub-block obtained by orthogonal transformation in step S122. inverse matrix And the result η of updating partial terms by multiplying the submatrix of the encryption factor matrix after orthogonal transformation. i In addition, the regression coefficients of the interference data of the i-th participant obtained in sub-step S123-b are added. Update the entire multiplicative encrypted linear regression coefficient vector Through calculation

[0105] Sub-step S123-e is an optional step and can be omitted. After both P and Ξ are updated, to enhance the encryption effect, user i can update the encryption mask matrix they use, changing the encryption mask matrix Ξ to... i Update to another matrix By letting And the corresponding update vector The corresponding terms and the corresponding rows of matrix P; specifically, first use the previously updated Ξ i Inverse matrix multiplication The corresponding terms and corresponding rows of P are used to obtain the result without multiplying the mask matrix, and then multiplied. Obtain the new encryption mask matrix using multiplication. Encrypted And P.

[0106] Step S124 controls whether the iteration ends or continues. In this step, the j-th participant is first determined, where j is a positive integer less than or equal to i-1. Typically, participants i-1, i-2, ..., 1 all use an increasing-column encryption mask matrix with non-zero columns, so j is usually equal to i-1. More generally, considering that some participants may not use an increasing-column encryption mask matrix with non-zero columns, the value of j is determined by: finding the participant with the largest index value among participants i-1, i-2, ..., 1 that uses an increasing-column encryption mask matrix with non-zero columns, and using that index as the value of j; if there is no participant among participants i-1, i-2, ..., 1 that uses an increasing-column encryption mask matrix with non-zero columns, then j is set to 0. Then, when j is greater than or equal to 1, the i-th participant sends the multiplied encryption factor matrix P updated in step S122 above to the j-th participant, and also sends the multiplied encryption linear regression coefficient vector updated in step S123 above. Send the message to the j-th participant, then set i to j, return to step S122, and start the next iteration; otherwise, when j equals 0, set i to j and end the iteration, then proceed to the final step S125.

[0107] Step S125: At this point, the encrypted linear regression coefficient vector is multiplied by the total number of participants (m). In this process, each participant using an incrementing encryption mask matrix with non-zero columns at least partially eliminates the influence of that participant's incrementing encryption mask matrix Δ. Ideally, at this point... Includes only the original data matrix X for each participant. i Each column represents the result of multiplying the coefficient vectors of each feature by the encrypted result, i.e., multiplying the encryption mask matrix by the aforementioned coefficient vectors on the left. First, let's... In Part, that is, from the kth i-1+1 to the kth i The total number of items k i -k i-1 The item is sent to the i-th participant (where i = 1, 2, 3, ..., m, and the participant currently possessing the entire linear regression coefficient vector is removed). The sequence number corresponding to that participant). Secondly, the i-th participant (here i = 1, 2, 3, ..., m) is determined by... In Part, that is, from the kth i-1 +1 to the kth i The total number of items k i -k i-1 Item, then use its own encryption matrix Ξ i inverse matrix Left multiplication, that is, from Calculated It is the original data matrix X of the i-th participant. i Each column represents a set of linear regression coefficients corresponding to a specific feature. Finally, the linear regression coefficients for each feature of the original data for the i-th participant (here, i = 1, 2, 3, ..., m) are... This is sent to the party requesting the linear regression coefficients. Typically, the party needing the linear regression coefficients is the node performing the linear regression calculation. This can be a single node or a collaborative effort by multiple users; for example, if there is a new test data set, i.e., a column vector. The attribute that corresponds to the attribute of the i-th participant The partial linear regression coefficients are given to the i-th participant. For i = 1, 2, ..., m, the i-th participant uses its own partial linear regression coefficients. Find part of Finally, one party summarizes yPart1, yPart2, ..., yPart m The predicted value of linear regression is y = yPart1 + yPart2 + ... + yPart m One party can be any of the m parties, or it can be any of the other parties.

[0108] It should be noted that the embodiments given in this example... Figure 2 and Figure 3 This is merely a simple application example of vertical federated learning with three participants (some optional steps are omitted). In practical applications, the specific implementation method described above can be used to present some optional steps, or... Figure 2 and Figure 3 The given implementation process combination results in a... Figure 4The diagram illustrates a more complete application flow. Furthermore, the specific number of participants involved in the actual implementation can be determined based on the actual needs of the vertical federated learning, as long as m≥1 is satisfied. Implementation methods for other numbers of participants can be found in [reference needed]. Figures 2-4 The illustrated process yields corresponding implementation schemes, which will not be elaborated upon here.

[0109] Based on the implementation method of using square root decomposition to obtain the inverse matrix of the regularized symmetric matrix of the first participant's column encryption data matrix in Embodiment 2 of the present invention, another commonly used LDL can be easily obtained. T Implementation methods for decomposition. For example, the above satisfies FF. T =(X T X+λI) -1 The matrix F is the inverse matrix (X) T X+λI) -1 The square root matrix can be viewed as a symmetric matrix (X). T X+λI) -1 One method of factorization matrix; the corresponding symmetric matrix can also be derived using another commonly used LDL method. T LDL in decomposition T Factor matrix replacement, and LDL T The factor matrix includes a triangular L-factor matrix and a diagonal D-factor matrix. The L-factor matrix can be extended to a general square matrix; that is, the L-factor matrix can be either triangular or not. The D-factor matrix remains a diagonal matrix. Based on this extended LDL... T The factor matrix can be slightly modified from Embodiment 2 of the present invention to obtain an LDL-based... T Specific implementation of the factor matrix decomposition. The main difference between this embodiment and Embodiment 2 is that the encrypted influence matrix sent by one participant to another is different, and the specific processing steps of the encrypted influence matrix by the participants and the tag data owner are different.

[0110] like Figure 5 As shown, the privacy-preserving linear regression method provided in Embodiment 3 of the present invention is a specific implementation process in which the inverse matrix of the regularized symmetric matrix of the column-encrypted data matrix, which is constructed by the first participant based on the original data matrix formed from the private original data, and uses the original data matrix as a submatrix, is calculated using LDLT decomposition. In this embodiment, the encrypted influence matrix in step S11 includes the column-encrypted data and factor product matrix, the encrypted factor matrix, and the LDL corresponding to the L factor matrix. T The decomposed D-factor matrix, and the encrypted data and factor product matrix can be understood as the LDL of the inverse matrix of the column encrypted data matrix and the regularized symmetric matrix of the column encrypted data matrix. TThe product of the decomposed L factor matrix, the corresponding multiplication-addition encryption factor matrix is the multiplication-addition encryption mask matrix and the inverse matrix of the regular symmetric matrix of the column encryption data matrix LDL T The product of the decomposed L factor matrix.

[0111] The decomposed factor matrix of the inverse matrix of the regular symmetric matrix of the column encryption data matrix used in the second embodiment is a square root matrix F i , and satisfies For i greater than or equal to 1 and less than or equal to m. Obviously, there is another kind of LDLT factor matrix as the decomposed factor matrix, i.e. L i and D i satisfy Where the D factor matrix D i is a diagonal matrix, and the L factor matrix L i is a general square matrix, which can be a triangular matrix or a non-triangular matrix. In practical applications, a simple method to obtain the above L i and D i is to set the matrix F i in the second embodiment as L i , i.e. L i = F i , and let D i equal to the unit matrix, then the second embodiment becomes the embodiment based on the decomposed factor matrix L i and D i . The following will give a more general detailed implementation based on the LDL T factor matrix L i and D i , where D i may not equal to the unit matrix. In the following embodiment design, the derived and will be used, where is a diagonal matrix, each item on the diagonal is the square root of the item at the same position on the diagonal of D i , and is the inverse matrix of , each item on the diagonal is the inverse of the item at the same position on the diagonal of . Since some steps in this embodiment are repeated with the steps in the second embodiment, the following will give a detailed description of the entire implementation process by introducing the specific modifications required compared with the second embodiment based on steps S11 and S12.

[0112] The foregoing step S11 in the second embodiment includes steps S111 and S112, and step S12 includes steps S121, S122, S123, S124 and S125. In order to modify the second embodiment to be based on the LDLT The embodiment of the decomposition of the decomposition factor matrix requires that the steps Slll and S112 included in the step Sll are modified to steps Slll' and S112' described below, respectively, and that the steps S121, S122 and S124 included in the step S12 are modified to steps S121', S122' and S124' described below, respectively, and that the steps S123 and S125 included in the step S12 remain unchanged. The steps Slll' and S112' included in the step Sll and the steps S121', S122' and S124' included in the step S12 obtained by the above modifications are introduced below, respectively.

[0113] The step Slll' is obtained by keeping the sub-steps Slll-a, Slll-b and Slll-e of the step Slll of the embodiment two unchanged, and modifying the sub-steps Slll-c and Slll-d to the sub-step Slll'-c and the sub-step Slll'-d, respectively. Accordingly, the step Slll' includes the above sub-steps Slll-a, Slll-b, Slll'-c, Slll'-d and Slll-e in turn, in which the sub-steps Slll-c' and Slll-d' are described as follows:

[0114] The sub-step Slll-c' is that the first participant obtains the product T1 of the column-encrypted data matrix and the square root matrix by using the sub-step Slll-c of the embodiment two; then, the first participant sets a diagonal matrix D1 as the D factor matrix, and each item on the diagonal line of D1 can take any positive number; finally, the first participant obtains the matrix containing the original data matrix X1 of the first participant as a sub-matrix, i.e., the column-encrypted data matrix and the L factor matrix L1 (the column-encrypted data and factor product matrix T'1) The first participant sends the column-encrypted data matrix and the L factor matrix product (the column-encrypted data and factor product matrix T'1) T'1 to the second participant. It is noted that T'1 defined by is obtained by calculation.

[0115] The sub-step Slll-d' is that the first participant obtains the product P1 of the multiplication-encrypted mask matrix and the square root matrix by using the sub-step Slll-d of the embodiment two; then, the first participant obtains the multiplication-encrypted factor matrix The first participant sends the multiplication-encrypted factor matrix P'1 and the D factor matrix D1 to the second participant. It is noted that P'1 defined by P'1 = Ξ1L1 is obtained by calculation.

[0116] Step S112': To obtain step S112', in the sub-steps S112-a, S112-b, S112-c, S112-d, S112-e, and S112-f included in step S112 of Embodiment 2, sub-steps S112-b, S112-c, and S112-f remain unchanged, while sub-steps S112-a, S112-d, and S112-e are modified into sub-steps S112-a', S112-d', and S112-e', respectively. Accordingly, step S112' sequentially includes the aforementioned sub-steps S112-a', S112-b, S112-c, S112-d', S112-e', and S112-f, wherein sub-steps S112-a', S112-d', and S112-e' are described as follows:

[0117] Sub-step S112'-a: The i-th participant, i.e., the i-th data owner, receives the product of the column-encrypted data and the L-factor matrix (column-encrypted data and factor product matrix) T′ from a total of i-1 participants. i-1 The encryption factor matrix P′ of the above i-1 participants. i-1 and the D factor matrix D i-1 The i-th participant uses the received T′ i-1 、P′ i-1 and D i-1 Calculate the product of the column-encrypted data matrix and the square root matrix for i-1 participating parties. The product of the encryption mask matrix and the square root matrix of i-1 participants.

[0118] Sub-step S112-d': The i-th participant uses sub-step S112-d from Example 2 to obtain the product T of the column encrypted data matrix and the square root matrix of the i participants. i Then, the i-th participant sets up a diagonal matrix D. i As a D-factor matrix, D i The terms on the diagonal can take any positive value; finally, the i-th participant uses D i The product T of the column-encrypted data matrix and the square root matrix of i participating parties. i Calculate the product of the column encrypted data matrix and the L factor matrix for all i participants (column encrypted data and factor product matrix). Then multiply the column-encrypted data matrix of the i participants with the L factor matrix (column-encrypted data and factor product matrix) T′ i It is sent to the next participant, i.e., the (i+1)th participant. Note that... Defined T′ i Through Calculated.

[0119] Sub-step S112-e': The i-th participant uses sub-step S112-e from Example 2 to obtain the product P of the encryption mask matrix and the square root matrix for all i participants. i Then, the i-th participant uses the product P of the encryption mask matrix and the square root matrix. i Find the encryption factor matrix multiplied by i participants. Then, the D-factor matrix D of the i participating parties... i The product of the encryption factor matrix P′ and the result is sent to the next participant, i.e., the (i+1)th participant. Note that... Defined P′ i Through Calculated.

[0120] In this embodiment, step S12 includes steps S121', S122', S123, S124', and S125, wherein steps S123 and S125 are the same as steps S123 and S125 in the embodiment. S121', S122', and S124' are described in detail below:

[0121] Step S121': The tag data owner receives column-encrypted data and factor product matrix (product of column-encrypted data and L factor matrix) T′ from m participants. m D factor matrix D m Multiply the encrypted L-factor matrix P′ m This allows us to calculate the product of the column-encrypted data matrix and the square root matrix for a total of m participants. The product of the encryption mask matrix and the square root matrix. Then, the steps of S121 in Embodiment 2 are followed, except that in step S121, the product P = P of the encryption mask matrix and the square root matrix is ​​multiplied. m The operation of sending data to the i-th participant is modified to: the tag data owner sets a diagonal matrix D. m As a D-factor matrix, D m The terms on the diagonal can take any positive value, and then the label data owner uses D m The product of the encryption mask matrix and the square root matrix is ​​P = P m Calculate the encryption factor matrix Then factor the D factor matrix D = D m Multiply the encryption factor matrix P′=P′ m Send to the i-th participant.

[0122] Step S122': the sub-step S122-a included in step S122 in Embodiment 2 is modified to sub-step S122-a', and after the execution of sub-step S122-a', the sub-steps S122-b and S122-c included in step S122 in Embodiment 1 are followed. The sub-step S122-a' obtained by modifying the above sub-step S122-a is described as follows:

[0123] Sub-step S122-a': the ith participant receives the D-factor matrix D and the multiplication-encryption factor matrix P', and then calculates to obtain the multiplication-encryption mask matrix P of the m participants and the square root matrix.

[0124] Step S124': this step follows step S124 in Embodiment 2, except that the "the ith participant sends the multiplication-encryption mask matrix P updated in the above step S122 to the jth participant" in step S124 in Embodiment 2 is modified to: the ith participant sets a diagonal matrix D as the D-factor matrix, and each item on the diagonal line of D can take any positive number; then, the ith participant calculates the multiplication-encryption factor matrix P' by using D and the multiplication-encryption mask matrix P of the m participants and the square root matrix obtained in the above step S122'. and sends the D-factor matrix D and the multiplication-encryption factor matrix P' to the jth participant.

[0125] Based on the above modified method flow, the detailed implementation process under the scenario of the vertical federated learning based on LDL T decomposition can be obtained; it should be noted that the above Figure 5 is only a simple application example of the vertical federated learning with 3 participants (some optional steps are omitted), and in actual applications, some optional steps can be presented by referring to the detailed description of the above specific embodiment; in addition, the number of participants involved in actual implementation can be determined according to the actual demand of the vertical federated learning, and only needs to satisfy m≥1, and the implementation mode corresponding to other number of participants can be obtained by referring to the flowchart shown in Figure 5 , and the corresponding implementation scheme can be obtained, which will not be described one by one here.

[0126] In Embodiment 2, the information sending mode can have a more general implementation, and accordingly, Embodiment 2 of the present application can be slightly modified to obtain a specific embodiment. For example, Figure 6As shown, the embodiment four of the present application gives a more general implementation of the way of sending information. Since some steps in the embodiment four are repeated in the embodiment two, the following will give a detailed description of the whole implementation process by introducing the specific modifications needed to be made in the embodiment two based on the steps Sll and S12. The step Sll in the embodiment two includes the steps Slll and S112, and the step S12 includes the steps S121, S122, S123, S124 and S125. The embodiment four only modifies the step Sll in the embodiment two to include the steps Slll and S112, and completely follows the step S12 to include the steps S121, S122, S123, S124 and S125.

[0127] The following will introduce the steps Slll" and S112" included in the step Sll modified above. The step Slll" in the embodiment four includes the sub-steps Slll-a" to Slll-e", and the step S112" in the embodiment four includes the sub-steps S112-a" to S112-f"; the following will first introduce the sub-steps Slll-a" to Slll-e" included in the step Slll" in the embodiment four:

[0128] The sub-step Slll-a" is the same as the sub-step Slll-a" in the embodiment two.

[0129] The sub-step Slll-b" is the same as the sub-step Slll-b" in the embodiment two.

[0130] The sub-step Slll-c" is that the first participant obtains the product of the column encryption data and the square root matrix Tl, and then sends Tl to the m participants from the second participant to the m+1th participant. The sending can be in the form of broadcasting or other forms. The sending of Tl to the m participants from the second participant to the m+1th participant can be in the form of broadcasting or other forms. As described in the sub-step Slll-c". It should be noted that the sending of Tl from the first participant to the second participant includes that the first participant sends Tl to the second participant directly, or the first participant sends Tl to the second participant through the forwarding of a plurality of nodes, and the plurality of nodes can be the nodes described in the present application or not. Thus, the embodiment two gives a specific example of the sending described above, which is that the first participant sends Tl to the ith participant (i is greater than or equal to 2 and less than or equal to m+1), and the sending is through the forwarding of the second, third, i-1th, etc. participants in turn, and more nodes can also participate in the forwarding.

[0131] Sub-step S111-d": In this sub-step, the first participant sends the encryption factor matrix P1 = Ξ1F1 to m participants from the second participant to the (m+1)th participant. Here, P1 can be equal to the square root matrix F1. The sending can be done by broadcasting or other methods. The sending includes sending through forwarding. Thus, Embodiment 2 provides a special case of the above sending, in which the first participant sends P1 to the i-th participant (i is greater than or equal to 2 and less than or equal to m+1). The sending is forwarded sequentially through the second, third, ..., i-1 participants, and it is not excluded that more nodes may participate in the above forwarding.

[0132] Sub-step S111-e”: Same as sub-step S111-e in Example 2.

[0133] In the following embodiment, sub-steps S112-a" to S112-e" of step S112" describe how participant i uses the received P i-1 and T i-1 and its own data matrix X i , put P i Relative to P i-1 Several additional columns, and T i relative to T i-1 The added columns are sent, or equivalently sent, to a total of m-i+1 participants from the (i+1)th participant to the (m+1)th participant. This sending, or equivalent sending, can be done via broadcast or other methods. The aforementioned equivalent sending refers to sending to P... i Relative to P i-1 Add several columns or T i relative to T i-1 The recipient calculates P by adding several related intermediate variables. i Relative to P i-1 Add several columns or T i relative to T i-1 Several additional columns; the aforementioned participant i receives P i-1 and T i-1 One possible implementation is that participant i receives P sequentially from participants 1, 2, ..., i-1. i-1 and T i-1 A portion or related intermediate variable, from which the entire P is obtained. i-1 and T i-1 However, when the relevant intermediate variables are received, the corresponding P needs to be calculated from the intermediate variables. i-1 or T i-1 Part of it. In summary, the above-mentioned F... i The matrix P is called the square root matrix of the i participating parties. iSimply put, it is the encryption factor matrix multiplied by i participants, and T i This is simply referred to as the encrypted data and factor product matrix of i participants. Transmission includes transmission via forwarding; therefore, Example 2 provides a special case of the above transmission, specifically for P. i Relative to P i-1 Several additional columns, and T i relative to T i-1 The added columns are sent from the i-th participant (i ≥ 2 and ≤ m) to the j-th participant (j ≥ i+1 and ≤ m+1). This sending is done sequentially through the (i+1), (i+2), ..., (j-1)-th participants, and it is possible that more nodes may participate in this forwarding process. Furthermore, during this forwarding process, any participating node can perform corresponding data processing. For example, a node receiving relevant intermediate variables can calculate P from these intermediate variables. i Relative to P i-1 Add several columns or T i relative to T i-1 Add several columns, and then put P i Relative to P i-1 Add several columns or T i relative to T i-1 The added columns are sent to the next node participating in the forwarding or to the j-th participant (j is greater than or equal to i+1 and less than or equal to m+1).

[0134] In step S112” of Example 4, the i-th participant (i greater than or equal to 2 and less than or equal to m), i.e., the i-th data owner, receives encrypted data and the factor product matrix T from a total of i-1 participants. i-1 And the encryption factor matrix P of the above i-1 participants. i-1 The i-th participant uses its own column to encrypt the data matrix. (Note Δ) i It can be an empty matrix (as a special case), let P i Relative to P i-1 Several additional columns, and T i relative to T i-1 The added columns are sent, or equivalently sent, to a total of m-i+1 participants from the (i+1)th participant to the (m+1)th participant. This sending, or equivalent sending, can be done via broadcast or other methods; here, T... i It is the product of the column-encrypted data matrix of i participants, including the i-th participant, and the square root matrix, while P i It is the product of the encryption mask matrix and the square root matrix of the aforementioned i participants. The equivalent transmission mentioned above refers to the transmission of P... i Relative to P i-1increased number of columns or T i relative to T i-1 increased number of columns related intermediate variables, from which the receiver calculates P i relative to P i-1 increased number of columns or T i relative to T i-1 increased number of columns.

[0135] The step S112" of the above-mentioned embodiment four comprises the following sub-steps S112-a" to S112-f", totally 6 sub-steps:

[0136] Sub-step S112-a": the i-th participant, i.e. the i-th data owner, receives the encrypted data and factor product matrix T i-1 of the above-mentioned i-1 participants, and the multiplication encrypted factor matrix P i-1 of the above-mentioned i-1 participants.The i-th participant receives P i-1 and T i-1 A possible implementation is that the participant i receives P i-1 and T i-1 from the participants 1, 2, … i-1 in turn, and obtains the whole P i-1 and T i-1 from the received parts or related intermediate variables; and when receiving the related intermediate variables, the corresponding P i-1 or T i-1 part is also calculated from the intermediate variables.

[0137] Sub-step S112-b": same as the sub-step S112-b of the embodiment two.

[0138] Sub-step S112-c": same as the sub-step S112-c of the embodiment two.

[0139] Sub-step S112-d": in this sub-step, the i-th participant sends or equivalently sends the encrypted data and factor product matrix (encrypted data and factor product matrix) T i relative to the column encrypted data and square root matrix of the i-1 participants to the m-i+1 participants from the i+1 participant to the m+1 participant. The sending or equivalently sending can be in the form of broadcast or other forms. The equivalently sending refers to sending the T i-1 relative to T i increased number of columns related intermediate variables, from which the receiver calculates T i-1 relative to T i increased number of columns. i-1

[0140] As mentioned above, Ti It is a column-encrypted data matrix with i participants. With the square root matrix F i The product of, i.e. On the other hand, as mentioned earlier, it is possible to encrypt data and factor product matrix T i-1 Adding several columns to the right results in T. i :because Therefore, in practice, only the matrix G obtained by sub-step S112-c” is needed. i Calculate the matrix Then add it to T i-1 To the right, you can get T. i Correspondingly, the i-th participant will put the matrix... Send to a total of m-i+1 participants, from the (i+1)th participant to the (m+1)th participant, in a matrix. The description is that the above matrix is ​​added to T. i-1 To the right, you can get T. i Alternatively, the i-th participant can equivalently convert the matrix... Send to m-i+1 participants from the (i+1)th participant to the (m+1)th participant, by actually sending... It is sent to m-i+1 participants from the (i+1)th participant to the (m+1)th participant, and these m-i+1 participants use the T they received. i-1 Calculations yielded

[0141] Sending includes sending via forwarding, thus Example 2 provides a special case of the above-described sending, which is such a special case as: for T i relative to T i-1 The added columns are sent from the i-th participant to the j-th participant (j is greater than or equal to i+1 and less than or equal to m+1). This sending is done sequentially through the i+1, i+2, ..., j-1 participants, and it is possible that more nodes will participate in this forwarding process. The aforementioned sending may include a forwarding process, during which any participating node can perform corresponding processing on the data. For example, if a node receives T... i relative to T i-1 The added columns of related intermediate variables are used to calculate T. i relative to T i-1 Add several columns, and then put T i relative to T i-1 The added columns are sent to the next node participating in the forwarding or to the j-th participant (j is greater than or equal to i+1 and less than or equal to m+1).

[0142] Sub-step S112-e": In this sub-step, the i-th participant sends to the co-m-i+1 participants from the i+1-th participant to the m+1-th participant the product of the multiplication-addition encryption mask matrix of the co-i participants and the square root matrix (the multiplication-addition encryption factor matrix) P i The multiplication-addition encryption factor matrix P i-1 of the co-i-1 participants is increased by a number of columns i The multiplication-addition encryption factor matrix P i-1 of the co-i-1 participants is increased by a number of columns i The multiplication-addition encryption factor matrix P i-1 of the co-i-1 participants is increased by a number of columns

[0143] As mentioned above, the P i-1 is updated to P i is updated to P That is, the P i-1 is increased by a number of columns on the right side of P The P i-1 is increased by a zero matrix on the right side of P i-1 The P i is increased by a zero matrix on the right side of P i , so that the multiplication-addition encryption factor matrix P i-1 of the co-i-1 participants is updated to the multiplication-addition encryption factor matrix P i of the co-i participants. Correspondingly, the i-th participant sends to the co-m-i+1 participants from the i+1-th participant to the m+1-th participant the matrix , which is described as follows: the P i-1 is increased by a zero matrix on the right side of P The above matrix is added to the right side of P , so that the P is obtained. Alternatively, the i-th participant sends to the co-m-i+1 participants from the i+1-th participant to the m+1-th participant the matrix equivalently, by actually sending the P and Ξ i G i to the co-m-i+1 participants from the i+1-th participant to the m+1-th participant, the co-m-i+1 participants calculate the P i-1 and T i-1 from the P and Ξ i G i , and obtain the P Note that if the i-th participant sends to the co-m-i+1 participants from the i+1-th participant to the m+1-th participant the T i is equivalent to the T i-1 relative to Ti-1 the increased number of columns, i.e. the matrix to the m-i+1 participants from the i+1th participant to the m+1th participant, thus actually sending to the m-i+1 participants from the i+1th participant to the m+1th participant, then in this sub-step the matrix In the equivalent implementation method of sending to the m-i+1 participants from the i+1th participant to the m+1th participant, the repeated sending is only needed to send i G i This can further save the resource of information transmission.

[0144] The sending includes sending by forwarding, thus embodiment two gives a specific example of such sending: for P i relative to P i-1 the increased number of columns, sent by the ith participant to the jth participant (j is greater than or equal to i+1 and less than or equal to m+1), the sending is forwarded through the i+1th, i+2th, …, j-1th participants in turn, and more nodes participating in the above forwarding are not excluded. The above sending can include the forwarding process, and in the forwarding process, any participant forwarding node can make corresponding processing on the data, for example: a node receives P i relative to P i-1 the increased number of columns, calculated from the related intermediate variable i relative to P i-1 the increased number of columns, and then sends P i relative to P i-1 the increased number of columns to the next participant forwarding node or the jth participant (j is greater than or equal to i+1 and less than or equal to m+1).

[0145] Sub-step S112-f”: the same as sub-step S112-f of embodiment two.

[0146] When the value of i is equal to m, the mth participant sends T i relative to T i-1 the increased number of columns, i.e. and P i relative to P i-1 the increased number of columns, i.e. to the m+1th participant, and the m+1th participant is the tag data owner. As described above, the tag data owner can be any one of the above m participants, or a participant other than the above m participants. In particular, the m+1th participant, i.e. the tag data owner, can be exactly the mth participant, in which case the mth participant sends Pm Relative to P m-1 Increased number of columns and T m Relative to T m-1 Increased number of columns sent or equivalently sent to the m+1 participant, that is, the m participant sends P m Relative to P m-1 Increased number of columns and T m Relative to T m-1 Increased number of columns sent or equivalently sent to oneself, which actually does not require any sending operation.

[0147] As described above, the step S12 of the embodiment four completely follows the steps S121, S122, S123, S124 and S125 of the step S12 of the embodiment two, and the steps of the step S12 of the embodiment two will not be repeated here.

[0148] The privacy protection based linear regression method, the first participant constructs the original data matrix as a column encryption data matrix of a sub-matrix according to the original data matrix formed by the private original data, and after the decomposition factor matrix of the inverse matrix of the regularized symmetric matrix of the column encryption data matrix is calculated, the encryption influence matrix corresponding to the decomposition factor matrix including the column encryption data and the factor multiplication matrix and the multiplication encryption factor matrix is sent to the label data owner or forwarded to the label data owner by other participants according to the preset encryption transmission order; the label data owner calculates the multiplication encryption linear regression coefficient vector according to the private label column vector and the received encryption influence matrix. Compared with the prior art, the trusted initializer and the encryption service provider do not need to be introduced, and the complex confusion circuit does not need to be implemented, so that the implementation complexity can be reduced, and the actual application requirements can be met.

[0149] It should be understood that although each step in the above flowchart is displayed in sequence according to the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise specified herein, the execution of these steps has no strict order limitation, and these steps can be executed in other orders. Moreover, at least part of the steps in the above flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or sub-steps or stages of other steps.

[0150] Referring to Figure 7 The present application also provides a privacy protection based linear regression system, which comprises:

[0151] The first data encryption module 21 is used to enable the first participant to construct a column-encrypted data matrix with the original data matrix as a submatrix based on the original data matrix formed by the private original data, and after calculating the factor matrix of the inverse of the regularized symmetric matrix of the column-encrypted data matrix, send the encrypted influence matrix corresponding to the factor matrix to the tag data owner or have it forwarded to the tag data owner by other participants according to a preset encrypted transmission order; the encrypted influence matrix includes a column-encrypted data and factor product matrix and a multiplied encryption factor matrix; the column-encrypted data and factor product matrix is ​​the product of the column-encrypted data matrix and the factor matrix; the multiplied encryption factor matrix is ​​the product of the multiplied encryption mask matrix and the factor matrix; the other participants are any other participants that provide private data other than the first participant.

[0152] The factorization matrix is ​​a square root matrix and an LDL matrix. T One of the L-factor matrices in decomposition;

[0153] When the decomposition factor matrix is ​​LDL T When decomposing the L-factor matrix, the encryption influence matrix also includes the LDL corresponding to the L-factor matrix. T The D-factor matrix of the decomposition.

[0154] The constraints on the square root matrix obtained by the first participant are:

[0155]

[0156] Where F1 is the square root matrix, It is the transpose of F1. Encrypted data matrix for the first participant's columns. for The transpose of , λ is the regularization coefficient greater than or equal to zero, and I is the identity matrix;

[0157] The constraints on the L-factor matrix and D-factor matrix obtained by the first participant are as follows:

[0158]

[0159] Where D1 is the D-factor matrix, which is a diagonal matrix; L1 is the L-factor matrix, which is a square matrix;

[0160] Furthermore, after sending the encrypted influence matrix corresponding to the decomposition factor matrix to other participants, the first data encryption module 21 also includes:

[0161] a third data encryption module, configured to make the other participant encrypt a column encryption data matrix formed according to the original data matrix containing the private original data of the other participant as a sub-matrix, update the encryption influence matrix to an encryption influence matrix with the column encryption data matrix of the other participant added, and send the updated encryption influence matrix to the next participant providing private data or the label data owner.

[0162] The column encryption data matrix is one of an original data matrix of the participant, a matrix composed of the original data matrix of the participant and an added column encryption mask matrix; and the added column encryption mask matrix contains one column or multiple columns.

[0163] a second data encryption module 22, configured to make the label data owner calculate a multiplication encryption linear regression coefficient vector according to the private label column vector and the received encryption influence matrix.

[0164] Further, when the column encryption data matrix of the first participant is the matrix composed of the original data matrix of the first participant and the added column encryption mask matrix, after the multiplication encryption linear regression coefficient vector is calculated, the second data encryption module 22 is further configured to:

[0165] The label data owner sends the multiplication encryption linear regression coefficient vector to the first participant or forwards the multiplication encryption linear regression coefficient vector to the first participant by any other participant, so that the first participant at least partially eliminates the influence of the added column encryption mask matrix of the first participant on the multiplication encryption linear regression coefficient vector according to the private multiplication encryption mask matrix of the first participant, and updates the multiplication encryption linear regression coefficient vector.

[0166] Further, when the column encryption data matrix of the other participant is the matrix composed of the original data matrix of the other participant and the added column encryption mask matrix, after the multiplication encryption linear regression coefficient vector is calculated, the second data encryption module 22 is further configured to:

[0167] The label data owner sends the multiplication encryption linear regression coefficient vector to the other participant or forwards the multiplication encryption linear regression coefficient vector to the other participant by any participant other than the other participant, so that the other participant at least partially eliminates the influence of the added column encryption mask matrix of the other participant on the multiplication encryption linear regression coefficient vector according to the private multiplication encryption mask matrix of the other participant, and updates the multiplication encryption linear regression coefficient vector.

[0168] Further, the second data encryption module 22, the first data encryption module 21 and the third data encryption module are further configured to:

[0169] The label data owner, the first participant or the other participant sends a plurality of multiplication and addition encryption linear regression coefficients corresponding to a plurality of data features to the corresponding participant, so that the corresponding participant decrypts the received plurality of multiplication and addition encryption linear regression coefficients according to the multiplication and addition encryption mask matrix of the corresponding participant, and obtains a plurality of linear regression coefficients corresponding to the corresponding participant.

[0170] The privacy protection based linear regression system provided by the embodiment of the application, the first participant constructs the original data matrix formed by the private original data as a column encryption data matrix of the original data matrix, and after calculating the decomposition factor matrix of the inverse matrix of the regularized symmetric matrix of the column encryption data matrix, sends the encryption influence matrix corresponding to the decomposition factor matrix, including the column encryption data and the factor product matrix and the multiplication and addition encryption factor matrix, to the label data owner or forwards to the label data owner in a preset encryption transmission order by the other participant; the label data owner calculates the multiplication and addition encryption linear regression coefficient vector according to the private label column vector and the received encryption influence matrix. Compared with the prior art, the application does not need to introduce a trusted initializer and an encryption service provider, and does not need to implement a very complex confusion circuit, so that the implementation complexity can be reduced, and the actual application requirements can be met.

[0171] The embodiment of the application also provides a computer readable storage medium, which comprises a stored computer program; wherein the computer program controls a device where the computer readable storage medium is located to execute the privacy protection based linear regression method as described above when the computer program is run.

[0172] The embodiment of the application also provides a terminal device, as shown in Figure 8 The terminal device comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the privacy protection based linear regression method as described above when the computer program is executed.

[0173] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, …), which are stored in the memory and executed by the processor to complete the application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the terminal device.

[0174] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor can also be any conventional processor. The processor is a control center of the terminal device, and connects various parts of the terminal device through various interfaces and lines.

[0175] The memory mainly includes a program storage area and a data storage area. The program storage area can store an operating system, at least one application required by a function, etc., and the data storage area can store related data, etc. In addition, the memory can be a high-speed random access memory, and can also be a non-volatile memory such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., or the memory can also be other volatile solid-state storage devices.

[0176] It should be noted that the terminal device can include, but is not limited to, the processor and the memory, and those skilled in the art can understand that the terminal device can also include other components, which are not listed here for brevity. Figure 7 The structural block diagram is only an example of the terminal device, and does not constitute a limitation on the terminal device. The terminal device can include more or fewer components than those shown in the figure, or combine certain components, or different components.

[0177] In summary, the privacy protection based linear regression method, system, storage medium and terminal device provided by the present application, the first participant constructs an original data matrix according to the private original data, calculates the column encryption data matrix of the original data matrix as a sub-matrix, and the square root matrix of the inverse matrix of the regularization symmetric matrix of the column encryption matrix, and sends the product of the column encryption data matrix and the square root matrix, and the product of the square root matrix or the multiplication encryption mask matrix and the square root matrix to the second participant; the second participant calculates the multiplication encryption linear regression coefficient vector or the product of the encryption matrix and the linear regression coefficient vector according to the private label column vector, the product of the column encryption data matrix and the square root matrix, and the product of the square root matrix or the multiplication encryption mask matrix and the square root matrix, and sends it to the first participant or forwards it to the first participant by other participants. Compared with the prior art, the present application does not need to introduce a trusted initializer and an encryption service provider, and does not need to implement a very complex confusion circuit, so that the implementation complexity can be reduced, and the actual application requirements can be met.

[0178] The above only describes the preferred embodiments of the present application, and it should be pointed out that for ordinary skilled persons in the art, several improvements and modifications can be made without departing from the technical principles of the present application, and these improvements and modifications should also be considered as the protection scope of the present application.

Claims

1. A privacy preserving based linear regression method, characterized in that, The method comprises the following steps: The first participant constructs the original data matrix formed by the private original data as a column-encrypted data matrix of sub-matrices, and after calculating a decomposition factor matrix of an inverse matrix of a regular symmetric matrix of the column-encrypted data matrix, sends an encrypted influence matrix corresponding to the decomposition factor matrix to a label data owner or forwards the encrypted influence matrix to the label data owner in a preset encrypted transmission order by other participants; the encrypted influence matrix comprises column-encrypted data and factor product matrix and multiplication encrypted factor matrix; the column-encrypted data and factor product matrix is the product of the column-encrypted data matrix and the decomposition factor matrix; the multiplication encrypted factor matrix is the product of multiplication encrypted mask matrix and the decomposition factor matrix; the other participants are any other participants providing private data except the first participant; The label data owner calculates a multiplication encrypted linear regression coefficient vector according to the private label column vector and the received encrypted influence matrix.

2. The privacy preserving based linear regression method of claim 1, wherein, The decomposition factor matrix is a square root matrix and LDL T One of the decomposed L factor matrices when the factorized matrix is LDL T when the factorized L factor matrix is LDL T decomposition.

3. The privacy preserving based linear regression method of claim 2, wherein, The constraint of the square root matrix obtained by the first participant is: wherein F1 is a square root matrix, is the transpose of F1, is a column encryption data matrix of the first participant, is the transpose of is the transpose of is a regularization coefficient greater than or equal to zero, and I is an identity matrix. The constraint of the L factor matrix and the D factor matrix obtained by the first participant is: Wherein, D1 is the D factor matrix, which is a diagonal matrix; L1 is the L factor matrix, which is a square matrix. 4.The privacy-preserving based linear regression method according to claim 1, wherein, After sending the encrypted influence matrix corresponding to the decomposition factor matrix to the other participants, the method further comprises: The other participants update the encrypted influence matrix to an encrypted influence matrix increasing the influence of the column-encrypted data matrix of the other participants according to the original data matrix formed by the private original data of the other participants as a column-encrypted data matrix of sub-matrices, and send the updated encrypted influence matrix to the next participant providing private data or the label data owner.

5. The privacy-preserving based linear regression method according to claim 4, characterized in that, The column-encrypted data matrix is one of the original data matrix of the participant, the matrix composed of the original data matrix of the participant and the increased column-encrypted mask matrix; the increased column-encrypted mask matrix contains one column or multiple columns.

6. The privacy preserving based linear regression method of claim 5, wherein, When the column-encrypted data matrix of the first participant is the matrix composed of the original data matrix of the first participant and the increased column-encrypted mask matrix, after the multiplication encrypted linear regression coefficient vector is calculated, the method further comprises: The label data owner sends the multiplication encrypted linear regression coefficient vector to the first participant or forwards the multiplication encrypted linear regression coefficient vector to the first participant by the other participants, so that the first participant at least partially eliminates the influence of the increased column-encrypted mask matrix of the first participant on the multiplication encrypted linear regression coefficient vector according to the private multiplication encrypted mask matrix of the first participant, and updates the multiplication encrypted linear regression coefficient vector.

7. The privacy preserving based linear regression method of claim 5, wherein, When the column-encrypted data matrix of the other participant is the matrix composed of the original data matrix of the other participant and the increased column-encrypted mask matrix, after the multiplication encrypted linear regression coefficient vector is calculated, the method further comprises: The label data owner sends the multiplied encrypted linear regression coefficient vector to the other participants or forwards the multiplied encrypted linear regression coefficient vector to the other participants by any participant other than the other participants, so that the other participants at least partially eliminate the influence of their own multiplied encrypted mask matrix on the multiplied encrypted linear regression coefficient vector according to their own multiplied encrypted mask matrix, and update the multiplied encrypted linear regression coefficient vector.

8. The privacy preserving based linear regression method according to claim 1, 6 or 7, characterized in that, The method further comprises: The label data owner, the first participant or the other participants send a plurality of multiplied encrypted linear regression coefficients corresponding to a plurality of data features to the corresponding participants, so that the corresponding participants decrypt the received plurality of multiplied encrypted linear regression coefficients according to their own multiplied encrypted mask matrix to obtain a plurality of corresponding linear regression coefficients.

9. The privacy-preserving based linear regression method according to claim 8, characterized in that, The calculation formula of the multiplied encrypted linear regression coefficient vector is: where m represents the number of participants providing private data; is a label vector, P m and T m are respectively a multiplication encryption factor matrix and column encryption data and factor product matrix received by the label data owner from the first participant or other participants. the multiply-add encrypted linear regression coefficient vector satisfies between the linear regression coefficient vector ​ where Ξ i is the multiplication encryption mask matrix of the ith participant providing private data.

10. A privacy-preserving linear regression system, comprising: The system comprises: The first data encryption module is configured to enable the first participant to construct a column encrypted data matrix with the original data matrix formed by the private original data as a sub-matrix according to the original data matrix formed by the private original data, and after calculating the decomposition factor matrix of the inverse matrix of the regularized symmetric matrix of the column encrypted data matrix, send an encrypted influence matrix corresponding to the decomposition factor matrix to the label data owner or forward the encrypted influence matrix to the label data owner by the other participants according to a preset encryption transmission order; the encrypted influence matrix comprises column encrypted data and factor product matrix and multiplied encrypted factor matrix; the column encrypted data and factor product matrix is the product of the column encrypted data matrix and the decomposition factor matrix; the multiplied encrypted factor matrix is the product of the multiplied encrypted mask matrix and the decomposition factor matrix; the other participants are any other participants providing private data except the first participant; The second data encryption module is configured to enable the label data owner to calculate a multiplied encrypted linear regression coefficient vector according to the private label column vector and the received encrypted influence matrix.

11. A computer readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program; wherein the computer program, when running, controls the device where the computer readable storage medium is located to execute the privacy protection based linear regression method according to any one of claims 1-7, 9.

12. A terminal device, comprising: The processor, the memory and the computer program stored in the memory and configured to be executed by the processor are included, and the processor implements the privacy protection based linear regression method according to any one of claims 1-7, 9 when executing the computer program. The processor, the memory and the computer program stored in the memory and configured to be executed by the processor are included, and the processor implements the privacy protection based linear regression method according to any one of claims 1-7, 9 when executing the computer program.

Images