A publicly verifiable privacy-preserving support vector machine classifier system

Abstract

The application provides a publicly verifiable privacy-preserving support vector machine classifier system based on a publicly verifiable homomorphic secret sharing technology, which has the characteristics of protecting the privacy of user input and model parameters and providing publicly verifiable classification results. The system provides scheme 1 and scheme 2, both of which include a trusted key generation authority, a user who provides data and obtains results, a model provider who provides specific parameters of a support vector machine model, a cloud server that does not need to communicate with each other, and a verifier who verifies the results in an arbitrary identity. Scheme 1 needs the user to interactively communicate with the cloud server to calculate the final result, and the non-interactive scheme 2 only needs the user to upload the input data to return the final result, but the cloud server needs to perform more complex calculation operations.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and more specifically to a publicly verifiable, privacy-preserving support vector machine classifier system. Background Technology

[0002] Support Vector Machines (SVMs) are a supervised learning algorithm widely used in text classification, image recognition, biometrics, and medical diagnosis. With the increasing prevalence of cloud computing and the widespread application of IoT devices, many model owners choose to outsource their SVM classification models. They delegate complex computational tasks to cloud servers, providing high-quality SVM classification services to users with limited resources. Cloud-based SVM classification service outsourcing primarily involves three entities: the model provider, the cloud server, and the user. The workflow of cloud-based SVM classification service outsourcing can be summarized as follows: First, the model provider pre-trains a domain-specific SVM classification model using an SVM training algorithm; then, the model provider transfers the model to a remote cloud server; finally, the cloud server processes the user's data classification request and provides classification results based on the user's input data and the outsourced SVM model provided by the model provider.

[0003] However, the sensitivity of Support Vector Machine (SVM) models and user input data presents significant challenges to outsourcing SVM classification services. From the user's perspective, input data often contains sensitive personal information, and the leakage of this private information could have a profound impact on their daily lives. On the other hand, model providers must invest substantial resources in data collection, preprocessing, and training to obtain high-quality SVM classification models. Therefore, ensuring the confidentiality of SVM model parameters and user data becomes a critical security issue in outsourcing SVM classification services. Furthermore, in cloud-based SVM classification service outsourcing, public verification of SVM classification results is also crucial. First, outsourcing SVM classification models carries the risk of malicious cloud servers returning incorrect classification results to save computing resources. Second, in certain scenarios, users may require third-party verification of classification results. For example, in medical diagnosis scenarios, health insurance companies may need to verify diagnostic results before processing insurance reimbursements.

[0004] Existing cloud server-based support vector machine (SVM) classification service outsourcing solutions cannot simultaneously provide publicly verifiable classification results while protecting the privacy of user input and model parameters. Therefore, designing an outsourced SVM classifier system that simultaneously satisfies the privacy of user input and model parameters as well as publicly verifiable results has significant application value. Summary of the Invention

[0005] The technical problem that this invention aims to solve is that existing cloud server-based support vector machine classification service outsourcing solutions cannot both provide publicly verifiable classification results and protect the privacy of user input and model parameters.

[0006] To solve the above-mentioned technical problems, the technical solution of the present invention is to provide a publicly verifiable privacy-preserving support vector machine classifier system, including Scheme 1 and Scheme 2. Scheme 1 is suitable for application scenarios where the client has certain computing and communication resources and the client needs to obtain the computing results of the cloud server as soon as possible. Scheme 2 is suitable for application scenarios where the client lacks computing and communication resources and does not need to return the computing results quickly. The support vector machine classifier system selects Scheme 1 or Scheme 2 according to the actual application scenario.

[0007] Both Scheme 1 and Scheme 2 include a trusted institution, a model provider, a user, cloud server S1, cloud server S2, and a validator.

[0008] The trusted institution initializes the support vector machine classifier system, generates a public key, a public verification key, and a private evaluation key according to the selected security parameters, publicly publishes the public key and the public verification key, and distributes the private evaluation key to cloud servers S1 and S2; it generates a public key pk, a public verification key pvk, and private evaluation keys ek1 and ek2 according to the security parameters, and publicly publishes the public key pk and the public verification key pvk in the authentication bulletin board, and sends the private evaluation keys ek1 and ek2 to cloud servers S1 and S2;

[0009] The model provider uses a public key to encrypt the parameters of the support vector machine classification model in the support vector machine classifier system, and uploads the encrypted support vector machine classification model to cloud server S1 and cloud server S2.

[0010] The user performs data classification through the support vector machine classification service. The user uses a public key to encrypt their input data to generate private data ciphertext, which is then submitted to cloud server S1 and cloud server S2.

[0011] The cloud server S1 and the cloud server S2 are equipped with a large amount of storage and computing power;

[0012] If Option 1 is selected, cloud servers S1 and S2 will use a private evaluation key to interact with the user, perform interactive calculations on the user data corresponding to the private data ciphertext to obtain a partial classification result of the encrypted support vector machine classification model, and send the partial classification result to the verifier.

[0013] If Option 2 is selected, cloud servers S1 and S2 use the private evaluation key to perform local calculations on the user data corresponding to the private data ciphertext to obtain the classification result of Option 2 of the encrypted support vector machine classification model, and send the classification result of Option 2 to the verifier.

[0014] The verifier reconstructs the final classification result using either part of the classification result from Scheme 1 or part of the classification result from Scheme 2, and verifies the final classification result using a public verification key. If the verification passes, the final classification result is returned; if the verification fails, an error symbol is returned indicating that the calculation result of cloud server S1 or cloud server S2 has not passed the verification. This is done without exposing the parameters of the support vector machine classification model or the user's private data, and only based on the public auxiliary parameters and key to verify the correctness of the classification result.

[0015] Preferably, the model provider completes the entire training process of the support vector machine classification model, including: data acquisition, preprocessing, and parameter tuning.

[0016] Preferably, during the operation of the support vector machine classifier system, there is no need for communication between the cloud server S1 and the cloud server S2.

[0017] This invention proposes a publicly verifiable privacy-preserving support vector machine (SVM) classifier system based on publicly verifiable homomorphic secret sharing technology. Its key feature is that while protecting the privacy of user input and model parameters, it provides publicly verifiable classification results. The system offers two schemes, Scheme 1 and Scheme 2, both including a trusted institution that generates various keys, several users who provide data and obtain results, a model provider that provides specific parameters for the support vector machine model, two cloud servers that do not need to communicate with each other, and a verifier of any identity who can verify the results. Scheme 1 requires interactive communication and computation between the user and the cloud server to obtain the final result, while the non-interactive Scheme 2 only requires the user to upload input data to return the final result, but its cloud server needs to perform more computational operations. Therefore, Scheme 1 is suitable for scenarios where the client has certain computing and communication resources and needs to obtain the cloud server's computation results as quickly as possible. Scheme 2 is suitable for scenarios where the client lacks computing and communication resources and does not need the cloud server to quickly return computation results. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of a publicly verifiable privacy-preserving support vector machine classifier system provided as an embodiment of the present invention. Detailed Implementation

[0019] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0020] like Figure 1 As shown, this embodiment of the invention provides a publicly verifiable privacy-preserving support vector machine (SVM) classifier system. The SVM classifier is trained by a model provider. This embodiment only discusses how to apply the corresponding SVM model to privacy-preserving data, providing publicly verifiable classification results while protecting the privacy of user input and model parameters. This embodiment primarily focuses on two kernel functions widely used in SVM classifiers: the multinomial kernel function and the radial basis function (RBF) kernel function.

[0021] The support vector machine classifier system includes Scheme 1, which supports the computation of the two kernel functions mentioned above, and Scheme 2, which only supports the evaluation of polynomial kernel functions due to the limitation of the underlying publicly verifiable homomorphic secret sharing.

[0022] Both Scheme 1 and Scheme 2 include a trusted institution that generates various keys, several users who provide data and obtain results, a model provider that provides specific parameters for the support vector machine model, two cloud servers that do not need to communicate with each other, and a verifier of any identity who can verify the results. Scheme 1 requires interactive communication and computation between the user and the cloud server to obtain the final result, while the non-interactive Scheme 2 only requires the user to upload input data to return the final result, but its cloud server needs to perform more complex computational operations. Therefore, Scheme 1 is suitable for scenarios where the client has certain computing and communication resources and needs to obtain the computational results from the cloud server as quickly as possible. Scheme 2 is suitable for scenarios where the client lacks computing and communication resources and does not need the cloud server to return computational results quickly.

[0023] The operation process of Scheme 1 is as follows:

[0024] The first step involves the trusted organization generating a public key pk, a public verification key pvk, and private evaluation keys ek1 and ek2 based on the security parameter k. The public key pk and the public verification key pvk are publicly published in the authentication bulletin board, while the private evaluation keys ek1 and ek2 are sent to cloud servers S1 and S2.

[0025] The second step involves the model provider using the public key pk to encrypt the support vector machine model parameters X into ciphertext CX and send it to various cloud servers.

[0026] The third step involves the user using the public key pk to encrypt their input data z into ciphertext Cz and sending it to various cloud servers.

[0027] In the fourth step, cloud servers S1 and S2 use private evaluation keys ek1 and ek2 respectively to obtain partial classification results u1 and u2 of the support vector machine classifier through interactive calculation with the user, and return the corresponding partial results to the verifier.

[0028] In the fifth step, the verifier uses the partial classification results u1 and u2 to reconstruct the final classification result y and uses the public verification key pvk to verify the classification result y. If the verification passes, y is returned; otherwise, an error symbol is returned indicating that the cloud server's calculation result has not passed the verification.

[0029] The only difference between Scheme 2 and Scheme 1 is in the fourth step. The following describes only the fourth step of Scheme 2's operation:

[0030] In the fourth step, cloud servers S1 and S2 use their private evaluation keys ek1 and ek2 respectively to calculate the partial classification results u1 and u2 of the support vector machine classifier with multinomial kernel function, and return the corresponding partial results to the verifier.

[0031] The beneficial effects of this invention are that it provides both public verifiability of classification results and protects the privacy of user input and model parameters. The system offers two solutions to meet the needs of different application scenarios and has strong application value.

[0032] Taking remote health monitoring services as an example, this paper further illustrates a publicly verifiable and privacy-protected support vector machine classifier system.

[0033] This scenario primarily involves five types of participants: trusted institutions, health monitoring centers, cloud servers, users, and verifiers of any identity. The trusted institution is responsible for initializing the system and generating and distributing corresponding keys. The health monitoring center uses medical datasets to train a support vector machine (SVM) model for clinical decision-making and outsources the SVM classifier computation to the cloud server by encrypting the model parameters. Users submit their medical feature data to the cloud server to initiate medical decision requests. The cloud server can interactively (Scheme 1) or independently (Scheme 2) complete the SVM classifier computation to obtain partial results u1 and u2 of the clinical decision result y. Subsequently, verifiers of any identity can reconstruct the clinical decision result y and verify its correctness. For example, an insurance company can verify the user's clinical diagnosis before deciding whether to proceed with the insurance claim process.

Claims

1. A publicly verifiable, privacy-preserving support vector machine classifier system, characterized in that, Including Scheme 1 and Scheme 2, Scheme 1 is suitable for application scenarios where the client has certain computing and communication resources and needs to obtain the computing results from the cloud server as soon as possible, while Scheme 2 is suitable for application scenarios where the client lacks computing and communication resources and does not need to return computing results quickly. The support vector machine classifier system selects Scheme 1 or Scheme 2 according to the actual application scenario. Both Scheme 1 and Scheme 2 include a trusted institution, a model provider, a user, cloud server S1, cloud server S2, and a validator. The trusted institution initializes the support vector machine classifier system, generates a public key, a public verification key, and a private evaluation key according to the selected security parameters, publicly publishes the public key and the public verification key, and distributes the private evaluation key to cloud server S1 and cloud server S2. The model provider uses a public key to encrypt the parameters of the support vector machine classification model in the support vector machine classifier system, and uploads the encrypted support vector machine classification model to cloud server S1 and cloud server S2. The user performs data classification through the support vector machine classification service. The user uses a public key to encrypt their input data to generate private data ciphertext, which is then submitted to cloud server S1 and cloud server S2. The cloud server S1 and the cloud server S2 are equipped with a large amount of storage and computing power and are responsible for hosting the encrypted support vector machine classification model. If Option 1 is selected, cloud servers S1 and S2 will use a private evaluation key to interact with the user, perform interactive calculations on the user data corresponding to the private data ciphertext to obtain a portion of the classification results of the encrypted support vector machine classification model, and send the portion of the classification results to the verifier. If Option 2 is selected, cloud servers S1 and S2 use a private evaluation key to perform local calculations on the user data corresponding to the private data ciphertext to obtain the classification result of Option 2 of the encrypted support vector machine classification model, and send the classification result of Option 2 to the verifier. The verifier reconstructs the final classification result using either part of the classification result from Scheme 1 or part of the classification result from Scheme 2, and verifies the final classification result using a public verification key. If the verification passes, the final classification result is returned; if the verification fails, an error symbol is returned indicating that the calculation result of cloud server S1 or cloud server S2 has not passed the verification. This is done without exposing the parameters of the support vector machine classification model or the user's private data, and only based on the public auxiliary parameters and key to verify the correctness of the classification result.

2. The publicly verifiable privacy-preserving support vector machine classifier system as described in claim 1, characterized in that, The model provider completes the entire training process of the support vector machine classification model, including: Data acquisition, preprocessing, and parameter tuning.

3. The publicly verifiable, privacy-preserving support vector machine classifier system as described in claim 1, characterized in that, During the operation of the support vector machine classifier system, there is no need for communication between the cloud server S1 and the cloud server S2.

Images