Target data prediction method and system

Abstract

The invention discloses a target data prediction method and system. According to the method, transverse federal model training and prediction are carried out through a homomorphic proxy re-encryption technology, target data of a model user are predicted, and privacy security of sensitive data such as a participant data set and model parameters is protected; through a safe two-party calculation protocol and a zero-knowledge proof protocol, the correctness of a prediction result is verified on the premise that a target model coefficient and feature data of a model user are not leaked. According to the method, the data privacy is protected, and meanwhile, the balance of system performance is realized.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology, and in particular to a target data prediction method and system. Background Art

[0002] At present, horizontal federated learning technology faces the problems of privacy protection of participant data sets and model parameters and system performance balance in the model training stage; and the problems of privacy protection of predicted user data and model parameters and verification of the correctness of inference results in the inference prediction stage. Existing technologies are insufficient in terms of privacy protection and performance balance, and it is difficult to meet the needs of efficient and secure federated learning applications.

[0003] There are still some deficiencies in existing technologies in terms of privacy protection and performance balance, and no effective solution has been proposed so far. Summary of the invention

[0004] The embodiments of the present invention provide a target data prediction method and system to solve the problem that the prior art is insufficient in terms of privacy protection and performance balance.

[0005] To achieve the above-mentioned object, on the one hand, the present invention provides a target data prediction method, which comprises: S1, multiple participants respectively perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include a task initiator, an aggregate ciphertext generator and other participants;

[0006] S2. Each participant performs homomorphic encryption on its own model coefficients to generate its own initial ciphertext vectors. S3. The aggregate ciphertext generator obtains the authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm. S4. The aggregate ciphertext generator generates the model aggregate ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm using its own initial ciphertext vector, authorization key, and the initial ciphertext vector sent by the task initiator, the initial ciphertext vector sent by other participants, and the authorization key, and sends it to the task initiator. The task initiator decrypts and calculates the average value based on the homomorphic authorization parsing sub-algorithm to obtain the aggregate mean of the model coefficients, and sends the model system to the task initiator. The aggregate mean of the numbers is sent to the aggregate ciphertext generator and other participants; S5. According to the aggregate mean of the model coefficients and the model coefficients of each participant, it is determined whether the model corresponding to the aggregate mean of the model coefficients converges; S6. If not, the aggregate mean of the model coefficients is used as the initial model coefficient to repeat S1 to S5 until the model converges; the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficient; S7. One of all the participants is regarded as the model owner, and the model owner uses the homomorphic proxy re-encryption algorithm to predict based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

[0007] Optionally, before S1, the step further includes: obtaining public parameters; and each participant generating their own public-private key pair based on the public parameters and a key generation algorithm.

[0008] Optionally, S7 includes: the model owner homomorphically encrypts its own target model coefficients to generate a first ciphertext vector, and sends it to the model user; the model user generates a homomorphic model inference ciphertext based on the homomorphic addition sub-algorithm using its own feature data and the first ciphertext vector; the model owner obtains the public key and homomorphic model inference ciphertext of the model user, and generates an authorized use key based on the homomorphic authorization key algorithm using the model user's public key and its own private key, and generates a model authorized use ciphertext based on the homomorphic authorization conversion sub-algorithm using the authorized use key and the homomorphic model inference ciphertext, and sends the model authorized inference ciphertext to the model user; the model user generates the model user's target data based on the model authorized inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

[0009] Optionally, after S7, it also includes: jointly calculating the target model coefficients of the model owner, the characteristic data of the model user and the target data of the model user based on a secure two-party computing protocol and a zero-knowledge proof protocol to generate a proof π that satisfies a preset relationship; the model user verifies the proof π based on the zero-knowledge proof protocol, and if the verification passes, the predicted target data of the model user is correct.

[0010] Optionally, S3 includes: the aggregate ciphertext generator and other participants respectively obtain the public key of the task initiator, and respectively generate their own authorization keys based on the homomorphic authorization key algorithm using the public key of the task initiator and their own private key, and the other participants send their own authorization keys to the aggregate ciphertext generator.

[0011] Optionally, S4 includes: the aggregate ciphertext generator uses its own initial ciphertext vector and its authorization key to generate its own authorized ciphertext based on the homomorphic authorization conversion sub-algorithm, and uses the initial ciphertext vector and its authorization key sent by other participants to generate the authorized ciphertext of other participants based on the homomorphic authorization conversion sub-algorithm; the aggregate ciphertext generator uses the initial ciphertext vector of the task initiator, the authorized ciphertext of the aggregate ciphertext generator and the authorized ciphertext of other participants based on the homomorphic addition sub-algorithm to generate a model aggregate ciphertext, and sends it to the task initiator; the task initiator decrypts the model aggregate ciphertext based on its own private key and the homomorphic authorization parsing sub-algorithm to obtain the aggregate sum of model coefficients; the task initiator averages the aggregate sum of model coefficients to obtain the aggregate mean of model coefficients, and sends the aggregate mean of model coefficients to the aggregate ciphertext generator and other participants.

[0012] Optionally, S5 includes: determining whether the Euclidean distance between the model coefficient of each participant and the aggregate mean of the model coefficients are both within a preset threshold; if so, determining that the model corresponding to the aggregate mean of the model coefficients converges, otherwise, it does not converge.

[0013] On the other hand, the present invention provides a target data prediction system, which includes: a model training unit, which is used for multiple participants to perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include a task initiator, an aggregate ciphertext generator, and other participants;

[0014] The homomorphic encryption unit is used for each participant to perform homomorphic encryption on its own model coefficients and generate its own initial ciphertext vectors respectively; the authorization key generation unit is used for the aggregate ciphertext generator to obtain the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm; the model coefficient aggregate mean generation unit is used for the aggregate ciphertext generator to use its own initial ciphertext vector, authorization key and the initial ciphertext vector sent by the task initiator, the initial ciphertext vector sent by other participants and the authorization key based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm to generate the model aggregate ciphertext and send it to the task initiator. The task initiator decrypts and calculates the average based on the homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregate mean, and sends the model coefficient aggregate mean to the aggregate ciphertext generator. The ciphertext generator and other participants; a judgment unit, used to judge whether the model corresponding to the aggregate mean of model coefficients has converged according to the aggregate mean of model coefficients and the model coefficients of each participant; an iteration unit, used to use the aggregate mean of model coefficients as the initial model coefficient to repeat the model training unit, homomorphic encryption unit, authorization key generation unit, model coefficient aggregate mean generation unit, and judgment unit until the model converges if it does not converge; the aggregate mean of model coefficients corresponding to the converged model is used as the target model coefficient; a prediction unit, used to take one of all the participants as the model owner, and the model owner uses the homomorphic proxy re-encryption algorithm to predict based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

[0015] Optionally, the prediction unit includes: a homomorphic encryption sub-unit, used for the model owner to homomorphically encrypt its own target model coefficients to generate a first ciphertext vector, and send it to the model user; a homomorphic addition sub-unit, used for the model user to generate a homomorphic model inference ciphertext based on the homomorphic addition sub-algorithm using its own feature data and the first ciphertext vector; a homomorphic authorization key sub-unit, used for the model owner to obtain the public key of the model user, and generate an authorization use key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key; a homomorphic authorization conversion sub-unit, used for the model owner to generate a model authorization inference ciphertext based on the homomorphic authorization conversion sub-algorithm using the authorization use key and the homomorphic model inference ciphertext, and send the model authorization inference ciphertext to the model user; a homomorphic authorization decryption sub-unit, used for the model user to generate the model user's target data based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

[0016] Optionally, it also includes: a verification unit, which is used to jointly calculate the target model coefficients of the model owner, the characteristic data of the model user and the target data of the model user based on a secure two-party computing protocol and a zero-knowledge proof protocol to generate a proof π that satisfies a preset relationship; the model user verifies the proof π based on the zero-knowledge proof protocol, and if the verification passes, the predicted target data of the model user is correct.

[0017] Beneficial effects of the present invention:

[0018] The present invention provides a target data prediction method and system. By introducing homomorphic proxy re-encryption technology, during the model training and reasoning process, there is no need to directly access the original data of the participants, which effectively avoids the risk of data leakage and ensures the privacy and security of the data of the participants. By adopting a secure two-party computing protocol and a zero-knowledge proof protocol, the correctness of the predicted target data of the model user can be verified without disclosing the model coefficients of the model owner and the characteristic data of the model user, thereby ensuring the credibility of the reasoning result. By using homomorphic encryption technology, the present invention can effectively execute distributed computing tasks while realizing data privacy protection, reducing the amount of data exchange between the parties and improving the overall performance and computing efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a flow chart of a target data prediction method provided by an embodiment of the present invention;

[0020] Figure 2 is a flow chart of generating target data of a model user provided by an embodiment of the present invention;

[0021] Figure 3 is a structural schematic diagram of a target data prediction system provided by an embodiment of the present invention;

[0022] Figure 4 It is a schematic diagram of the structure of the prediction unit provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] At present, horizontal federated learning technology faces the problems of privacy protection of participant data sets and model parameters and system performance balance in the model training stage; and the problems of privacy protection of predicted user data and model parameters and verification of the correctness of inference results in the inference prediction stage. Existing technologies are insufficient in terms of privacy protection and performance balance, and it is difficult to meet the needs of efficient and secure federated learning applications.

[0025] Therefore, the present invention proposes a target data prediction method based on homomorphic proxy re-encryption, secure two-party computation and zero-knowledge proof. By introducing homomorphic proxy re-encryption, secure two-party computation and zero-knowledge proof technology, the difficult problem of balancing data privacy protection and system performance is effectively solved.

[0026] The actual application scenarios of this application include but are not limited to: loan amount prediction, house price prediction, investment risk analysis, crop fertilizer analysis, student learning ability assessment, patient organ function prediction, etc. In order to more accurately explain the provided method and system, this application takes the widely used loan amount prediction scenario as an example for detailed description.

[0027] In the loan amount prediction scenario, it is assumed that a small lending bank P1, P2, and P3 are the first, second, and third participants respectively, and the data structure used for model training is: data = {age x1, gender x2, cumulative assets x3, credit score x4, loan amount y}, and the local data sets of the three participants are date1, date2, and date3, among which age x1, gender x2, cumulative assets x3, and credit score x4 are feature data, and loan amount y is the target data.

[0028] Figure 1 A target data prediction method provided by an embodiment of the present invention is as follows: Figure 1 As shown, the method includes:

[0029] S1. Multiple participants perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregate ciphertext generator and other participants; wherein the other participants may be one or more parties, and this application does not impose any restrictions on this.

[0030] Before the S1, it also includes:

[0031] Get public parameters;

[0032] In an optional embodiment, according to the security parameter λ, a public parameter pp={pp1, pp2, pp3} that meets the security level is selected; wherein the parameter subset pp1 is a public parameter set of the proxy re-encryption algorithm selected as needed, pp2 is a public parameter set of the secure two-party computing protocol selected as needed, and pp3 is a public parameter set of the zero-knowledge proof protocol selected as needed; different security parameters correspond to different security levels, that is, there is a corresponding mapping relationship between the security parameters and the security level. According to the security parameters, based on the mapping relationship, the security level corresponding to the security parameters is determined, and the public parameter pp under the security level is selected.

[0033] Each participant generates their own public-private key pair based on public parameters and key generation algorithm.

[0034] In an optional implementation, in order to illustrate the present application in more detail, take the task initiator in an actual application scenario as the first participant, the aggregate ciphertext generator as the second participant, and the other participants as one party, namely the third party as an example.

[0035] Task initiator P1: Generates the first key pair (sk1, pk1), i.e. the first public-private key pair, based on the public parameter pp and the key generation algorithm KeyGen;

[0036] Aggregate ciphertext generator P2: Generates a second key pair (sk2, pk2), i.e., a second public-private key pair, based on the public parameter pp and the key generation algorithm KeyGen;

[0037] Other participants P3: Based on the public parameters pp and the key generation algorithm KeyGen, generate a third key pair (sk3, pk3), that is, the third public-private key pair.

[0038] Task initiator P1: Perform model training based on the data set date1 and the initial model coefficients to generate the first model coefficient W1 = [w 11 , W 12 , W 13 , W 14 ];

[0039] Aggregate ciphertext generator P2: Perform model training based on data set date2 and initial model coefficients to generate the second model coefficient W2 = [w 21 , W 22 , W 23 , W 24 ];

[0040] Other participants P3: perform model training based on the data set date3 and the initial model coefficients to generate the third model coefficients W3 = [W 31 , W 32 , W 33 , W34 ].

[0041] S2. Each participant performs homomorphic encryption on its own model coefficients to generate its own initial ciphertext vector;

[0042] In an alternative embodiment,

[0043] Task initiator P1: Encrypt the first model coefficient W1 based on the first public key pk1 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm to obtain the first initial ciphertext vector C1 = [C 11 , C 12 , C 13 , C 14 ];

[0044] Aggregate ciphertext generator P2: Encrypt the second model coefficient W2 based on the second public key pk2 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm to obtain the second initial ciphertext vector C2 = [c 21 , c 22 , c 23 , c 24 ];

[0045] Other participants P3: Encrypt the third model coefficient W3 based on the third public key pk3 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm to obtain the third initial ciphertext vector C3 = [c 31 , c 32 , c 33 , C 34 ].

[0046] S3. The aggregate ciphertext generator obtains the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm;

[0047] Specifically, S3 includes:

[0048] The aggregate ciphertext generator and other participants respectively obtain the public key of the task initiator, and use the public key of the task initiator and their own private key to generate their own authorization keys based on the homomorphic authorization key algorithm. Other participants send their own authorization keys to the aggregate ciphertext generator.

[0049] Aggregate ciphertext generator P2: obtains the first public key pk1, and calculates the second authorization key ek2 = HE.EmK(pk1, sk2) based on the first public key pk1, the second private key sk2 and the homomorphic authorization key algorithm (i.e., the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm);

[0050] Other participants P3: obtain the first public key pk1, calculate the third authorization key ek3 = HE.EmK(pk1,sk3) based on the first public key pk1, the third private key sk3 and the homomorphic authorization key algorithm (that is, the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm), and send the third authorization key ek3 to the aggregate ciphertext generator.

[0051] S4. The aggregated ciphertext generator generates the model aggregated ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm using its own initial ciphertext vector, the authorization key, the initial ciphertext vector sent by the task initiator, the initial ciphertext vector and the authorization key sent by other participants. The aggregated ciphertext is sent to the task initiator. The task initiator decrypts and averages the model coefficients based on the homomorphic authorization parsing sub-algorithm to obtain the aggregated mean of the model coefficients, and sends the aggregated mean of the model coefficients to the aggregated ciphertext generator and other participants.

[0052] Specifically, the S4 includes:

[0053] The aggregated ciphertext generator generates its own authorized ciphertext using its own initial ciphertext vector and its authorization key based on the homomorphic authorization conversion sub-algorithm, and generates the authorized ciphertext of other participants using the initial ciphertext vector and its authorization key sent by other participants based on the homomorphic authorization conversion sub-algorithm;

[0054] Aggregate ciphertext generator P2: Based on the second initial ciphertext vector, the second authorization key and the homomorphic authorization conversion sub-algorithm (i.e., the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm), the second authorized ciphertext C′2=HE.EmC(C2,ek2) is calculated; the third initial ciphertext vector C3 and the third authorization key ek3 of other participants are obtained; based on the third initial ciphertext vector, the third authorization key and the homomorphic authorization conversion sub-algorithm (i.e., the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm), the third authorized ciphertext C′3=HE.EmC(C3,ek3) is calculated.

[0055] The aggregate ciphertext generator generates a model aggregate ciphertext based on the homomorphic addition sub-algorithm using the initial ciphertext vector of the task initiator, the authorized ciphertext of the aggregate ciphertext generator, and the authorized ciphertexts of other participants, and sends it to the task initiator;

[0056] Aggregate ciphertext generator P2: obtains the first initial ciphertext vector C1 of the task initiator, and based on the first initial ciphertext vector C1, the second authorized ciphertext C′2, the third authorized ciphertext C′3 and the homomorphic addition sub-algorithm (i.e., the addition sub-algorithm HE.Add of the homomorphic proxy re-encryption algorithm), calculates the model aggregate ciphertext (i.e., the aggregate sum ciphertext of the first, second and third model coefficients): C=HE.Add(C1,C′2,C′3), and sends the model aggregate ciphertext C to the task initiator.

[0057] The task initiator decrypts the model aggregation ciphertext based on its own private key and homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregation and value;

[0058] Task initiator P1: Decrypt the model aggregate ciphertext C based on the first private key sk1 and the homomorphic authorization parsing sub-algorithm (i.e., the authorization parsing sub-algorithm HE.EmDec of the homomorphic proxy re-encryption algorithm) to obtain the model coefficient aggregate sum value (i.e., the first, second, and third model coefficient aggregate sum value plaintext): W s =HE.EmDec(C)=W1+W2+W3.

[0059] The task initiator calculates the average value of the model coefficient aggregation and value to obtain the model coefficient aggregation mean value, and sends the model coefficient aggregation mean value to the aggregation ciphertext generator and other participants.

[0060] Task initiator P1: aggregate the model coefficients and value W s Find the average value to get the aggregate mean of the model coefficients: W = W s / 3, and send the aggregate mean W of the model coefficients to the aggregate ciphertext generator P2 and other participants P3.

[0061] S5. judging whether the model corresponding to the aggregate mean of the model coefficients has converged according to the aggregate mean of the model coefficients and the model coefficients of each participant;

[0062] Specifically, the S5 includes:

[0063] Determine whether the Euclidean distance (i.e., the two-norm) between the model coefficient of each participant and the aggregate mean of the model coefficients is within the preset threshold; if so, the model corresponding to the aggregate mean of the model coefficients is determined to converge, otherwise, it does not converge.

[0064] The specific formula is:

[0065] ‖W-W1‖2≤ε, ‖W-W2‖2≤ε, ‖W-W3‖2≤ε

[0066] Among them, ε is the preset threshold.

[0067] If the above three equations are true at the same time, the model corresponding to the aggregate mean of the model coefficients is determined to have converged and the model training is completed; otherwise, it does not converge.

[0068] S6. If it does not converge, the aggregate mean of the model coefficients is used as the initial model coefficients and S1 to S5 are repeated until the model converges; the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficients;

[0069] That is, the initial model coefficients are updated continuously, thereby continuously updating the first model coefficients, the second model coefficients, the third model coefficients and the aggregated mean of the model coefficients; until the model converges, no further updates are made.

[0070] S7. One of all the participants is regarded as the model owner (i.e., the model owner can be the task initiator, the aggregate ciphertext generator or other participant). The model owner uses a homomorphic proxy re-encryption algorithm to make predictions based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

[0071] Figure 2 is a flow chart of generating target data of a model user provided by an embodiment of the present invention; Figure 2 As shown, the S7 includes:

[0072] S71, the model owner performs homomorphic encryption on its own target model coefficients to generate a first ciphertext vector, and sends it to the model user;

[0073] Model owner H: based on its own private key sk H (If the model owner is the task initiator, then sk H is sk1; if it is the aggregate ciphertext generator, then sk H is sk2; if it is other participants, then sk H sk3) and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm for the target model coefficient Perform homomorphic encryption to generate the first ciphertext vector C′;

[0074]

[0075] Send the first ciphertext vector C′ to the model user U.

[0076] S72, the model user generates a homomorphic model inference ciphertext based on its own feature data and the first ciphertext vector based on the homomorphic addition sub-algorithm;

[0077] Model user U: The model user obtains the public parameters and generates a public-private key pair (sk U ,pk U ), based on the characteristic data F of the tested user A = The first ciphertext vector C′ and the homomorphic addition sub-algorithm (i.e., the addition sub-algorithm HE.Add of the homomorphic proxy re-encryption algorithm) are used to calculate the homomorphic model inference ciphertext

[0078] S73, the model owner obtains the public key and homomorphic model reasoning ciphertext of the model user, and generates an authorization use key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key, and generates a model authorization reasoning ciphertext based on the authorization use key and the homomorphic model reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm, and sends the model authorization reasoning ciphertext to the model user;

[0079] Model owner H: Get the public key pk of the model user U , homomorphic model reasoning ciphertext C″, based on its own private key sk H , the public key pk of the model user U and the homomorphic authorization key algorithm (i.e., the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm), the authorized use key eKey = HE.EmK (pk U ,sk H ), the authorization key eKey and the homomorphic model ciphertext reasoning ciphertext C″ are used based on the homomorphic authorization conversion sub-algorithm (i.e., the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm) to generate the model authorization reasoning ciphertext C em =HE.EmC(C″,eKey), the model authorization inference ciphertext C em Sent to the model user U.

[0080] S74. The model user generates the model user's target data based on the homomorphic authorization decryption sub-algorithm using the model authorization reasoning ciphertext and its own private key.

[0081] Model user U: Authorizes reasoning based on the model ciphertext C em , its own private key sk U and the homomorphic authorization decryption sub-algorithm (i.e., the authorization decryption sub-algorithm HE.EmDec of the homomorphic proxy re-encryption algorithm) to calculate the target data of the model user (i.e., the model reasoning plaintext: the loan amount of the tested user A) M = HE.EmDec (C em ,sk U ).

[0082] After S7, the method further includes:

[0083] The target model coefficients of the model owner, the feature data of the model user, and the target data of the model user are jointly calculated based on the secure two-party computing protocol and the zero-knowledge proof protocol to generate a proof π that satisfies the preset relationship;

[0084] Model owner H and model user U: Under the undisclosed "target model coefficients " and "the characteristic data of the predicted user A Based on the premise of predicting the loan amount M", a secure two-party computing protocol and a zero-knowledge proof protocol are used to jointly calculate and generate a solution that satisfies the preset relationship (i.e. )’s proof π; where zero-knowledge proof protocols include but are not limited to zkSNARKs, zkSTARKS, Bulletproofs, Plonk, and Groth6.

[0085] Furthermore, in an optional embodiment,

[0086] Model owner H: Encrypt target model coefficients Generate ciphertext Enc(W).

[0087] Model user U: Encrypts user A’s feature data Generate ciphertext Enc(F).

[0088] The two parties use a secure two-party computing protocol (such as the encrypted multi-party computing protocol MPC, Yao's encryption circuit, etc.) to calculate the encrypted linear combination

[0089] Construct a circuit K that takes inputs W and F and outputs M.

[0090] Model owner H: As the prover, he uses the zero-knowledge proof protocol (i.e., circuit K) to generate proof π based on the encrypted ciphertext Enc(W) and Enc(F). This proof π enables the verifier to confirm that the relationship holds without touching W and F.

[0091] The model user verifies the proof π based on the zero-knowledge proof protocol. If the verification passes, the predicted target data of the model user is correct.

[0092] Model user U: As a verifier, verify the If the verification is successful, the target data of the predicted model user is correct, that is, the predicted M result is correct.

[0093] Figure 3 is a schematic diagram of the structure of a target data prediction system provided by an embodiment of the present invention, such as Figure 3 As shown, the system includes:

[0094] Model training unit 201, used for multiple participants to perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregated ciphertext generator and other participants;

[0095] Homomorphic encryption unit 202, used for each participant to perform homomorphic encryption on its own model coefficients to generate its own initial ciphertext vector;

[0096] The authorization key generation unit 203 is used for the aggregate ciphertext generator to obtain the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm;

[0097] The model coefficient aggregate mean value generating unit 204 is used for the aggregate ciphertext generator to generate the model aggregate ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm using its own initial ciphertext vector, the authorization key and the initial ciphertext vector sent by the task initiator, the initial ciphertext vector and the authorization key sent by other participants, and send it to the task initiator. The task initiator decrypts and calculates the average based on the homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregate mean value, and sends the model coefficient aggregate mean value to the aggregate ciphertext generator and other participants.

[0098] A judging unit 205, configured to judge whether the model corresponding to the model coefficient aggregate mean value has converged according to the model coefficient aggregate mean value and the model coefficient of each participant;

[0099] Iteration unit 206, used for, if not converged, using the aggregate mean of model coefficients as the initial model coefficients to repeat the model training unit, homomorphic encryption unit, authorization key generation unit, model coefficient aggregate mean generation unit, and judgment unit until the model converges; using the aggregate mean of model coefficients corresponding to the converged model as the target model coefficients;

[0100] The prediction unit 207 is used to take one of all the participants as the model owner. The model owner uses a homomorphic proxy re-encryption algorithm to perform prediction based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

[0101] Figure 4 is a schematic diagram of the structure of the prediction unit provided by an embodiment of the present invention, such as Figure 4 As shown, the prediction unit 207 includes:

[0102] Homomorphic encryption subunit 2071, used for the model owner to perform homomorphic encryption on its own target model coefficients, generate a first ciphertext vector, and send it to the model user;

[0103] Homomorphic addition subunit 2072, used for the model user to generate homomorphic model inference ciphertext based on the homomorphic addition sub-algorithm by using its own feature data and the first ciphertext vector;

[0104] Homomorphic authorization key subunit 2073, used for the model owner to obtain the public key of the model user, and generate an authorization key based on the public key of the model user and its own private key based on the homomorphic authorization key algorithm;

[0105] Homomorphic authorization conversion subunit 2074, used for the model owner to generate model authorization reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm by using the authorization key and the homomorphic model reasoning ciphertext, and send the model authorization reasoning ciphertext to the model user;

[0106] The homomorphic authorization decryption sub-unit 2075 is used for the model user to generate the target data of the model user based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

[0107] The system also includes:

[0108] The verification unit is used to jointly calculate the target model coefficients of the model owner, the characteristic data of the model user and the target data of the model user based on the secure two-party computing protocol and the zero-knowledge proof protocol to generate a proof π that satisfies the preset relationship; the model user verifies the proof π based on the zero-knowledge proof protocol, and if the verification is successful, the predicted target data of the model user is correct.

[0109] The system of the present application corresponds to the method, and the specific implementation of the system will not be repeated here.

[0110] Beneficial effects of the present invention:

[0111] The present invention provides a target data prediction method and system. By introducing homomorphic proxy re-encryption technology, during the model training and reasoning process, there is no need to directly access the original data of the participants, which effectively avoids the risk of data leakage and ensures the privacy and security of the data of the participants. By adopting a secure two-party computing protocol and a zero-knowledge proof protocol, the correctness of the predicted target data of the model user can be verified without disclosing the model coefficients of the model owner and the characteristic data of the model user, thereby ensuring the credibility of the reasoning result. By using homomorphic encryption technology, the present invention can effectively execute distributed computing tasks while realizing data privacy protection, reducing the amount of data exchange between the parties and improving the overall performance and computing efficiency of the system.

[0112] The system and method of the present invention can be widely used in various scenarios that require federated learning, such as loan amount prediction, house price prediction, investment risk analysis, etc., and have strong adaptability and versatility. The model training process proposed in the present invention supports multiple rounds of iterations, and dynamically adjusts the model parameters according to the training results of each round, ensuring that the model can be continuously optimized until convergence, thereby improving the prediction accuracy of the model. By combining model training and reasoning of multiple participants, the present invention fully utilizes the advantages of different data sources, improves the prediction ability and synergy effect of the overall model, and helps to achieve more accurate analysis and decision-making.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A target data prediction method, characterized in that: include: S1. Multiple participants perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregate ciphertext generator and other participants; S2. Each participant performs homomorphic encryption on its own model coefficients to generate its own initial ciphertext vector; S3. The aggregate ciphertext generator obtains the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm; S4. The aggregated ciphertext generator generates the model aggregated ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm using its own initial ciphertext vector, the authorization key, the initial ciphertext vector sent by the task initiator, the initial ciphertext vector and the authorization key sent by other participants. The aggregated ciphertext is sent to the task initiator. The task initiator decrypts and averages the model coefficients based on the homomorphic authorization parsing sub-algorithm to obtain the aggregated mean of the model coefficients, and sends the aggregated mean of the model coefficients to the aggregated ciphertext generator and other participants. S5. judging whether the model corresponding to the aggregate mean of the model coefficients has converged according to the aggregate mean of the model coefficients and the model coefficients of each participant; S6. If it does not converge, the aggregate mean of the model coefficients is used as the initial model coefficients and S1 to S5 are repeated until the model converges; the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficients; S7. One of all the participants is regarded as the model owner. The model owner uses a homomorphic proxy re-encryption algorithm to make predictions based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

2. The method according to claim 1, characterized in that: Before the S1, it also includes: Get public parameters; Each participant generates their own public-private key pair based on public parameters and key generation algorithm.

3. The method according to claim 1, characterized in that The S7 includes: The model owner performs homomorphic encryption on its own target model coefficients to generate a first ciphertext vector, and sends it to the model user; The model user generates a homomorphic model reasoning ciphertext based on its own feature data and the first ciphertext vector based on a homomorphic addition sub-algorithm; The model owner obtains the public key and homomorphic model reasoning ciphertext of the model user, and generates an authorization use key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key, and generates a model authorization reasoning ciphertext based on the authorization use key and the homomorphic model reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm, and sends the model authorization reasoning ciphertext to the model user; The model user generates the model user's target data based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

4. The method according to claim 3, characterized in that After S7, the method further includes: The target model coefficients of the model owner, the feature data of the model user, and the target data of the model user are jointly calculated based on the secure two-party computing protocol and the zero-knowledge proof protocol to generate a proof π that satisfies the preset relationship; The model user verifies the proof π based on the zero-knowledge proof protocol. If the verification passes, the predicted target data of the model user is correct.

5. The method according to claim 2, characterized in that: The S3 includes: The aggregate ciphertext generator and other participants respectively obtain the public key of the task initiator, and use the public key of the task initiator and their own private key to generate their own authorization keys based on the homomorphic authorization key algorithm. Other participants then send their own authorization keys to the aggregate ciphertext generator.

6. The method according to claim 2, characterized in that The S4 includes: The aggregated ciphertext generator generates its own authorized ciphertext using its own initial ciphertext vector and its authorization key based on the homomorphic authorization conversion sub-algorithm, and generates the authorized ciphertext of other participants using the initial ciphertext vector and its authorization key sent by other participants based on the homomorphic authorization conversion sub-algorithm; The aggregate ciphertext generator generates a model aggregate ciphertext based on the homomorphic addition sub-algorithm using the initial ciphertext vector of the task initiator, the authorized ciphertext of the aggregate ciphertext generator, and the authorized ciphertexts of other participants, and sends it to the task initiator; The task initiator decrypts the model aggregation ciphertext based on its own private key and homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregation and value; The task initiator calculates the average value of the model coefficient aggregation and value to obtain the model coefficient aggregation mean value, and sends the model coefficient aggregation mean value to the aggregation ciphertext generator and other participants.

7. The method according to claim 1, characterized in that The S5 includes: Determine whether the Euclidean distance between the model coefficient of each participant and the aggregate mean of the model coefficients is within a preset threshold; if so, the model corresponding to the aggregate mean of the model coefficients is determined to be converged, otherwise, it is not converged.

8. A target data prediction system, characterized in that: include: A model training unit is used for multiple participants to perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregate ciphertext generator and other participants; Homomorphic encryption unit, used by each participant to perform homomorphic encryption on its own model coefficients and generate its own initial ciphertext vector; An authorization key generation unit, used for the aggregate ciphertext generator to obtain the authorization key generated by itself and other participants based on the homomorphic authorization key algorithm; The model coefficient aggregate mean generation unit is used for the aggregate ciphertext generator to generate the model aggregate ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm using its own initial ciphertext vector, the authorization key and the initial ciphertext vector sent by the task initiator, the initial ciphertext vector and the authorization key sent by other participants, and send it to the task initiator. The task initiator decrypts and calculates the average based on the homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregate mean, and sends the model coefficient aggregate mean to the aggregate ciphertext generator and other participants. A judgment unit, used to judge whether the model corresponding to the aggregate mean of the model coefficients has converged according to the aggregate mean of the model coefficients and the model coefficients of each participant; The iteration unit is used to use the aggregate mean of the model coefficients as the initial model coefficients to repeat the model training unit, homomorphic encryption unit, authorization key generation unit, model coefficient aggregate mean generation unit, and judgment unit until the model converges; the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficient; The prediction unit is used to take one of all the participants as the model owner. The model owner uses a homomorphic proxy re-encryption algorithm to perform prediction based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

9. The system according to claim 8, characterized in that The prediction unit comprises: A homomorphic encryption subunit, used for the model owner to perform homomorphic encryption on its own target model coefficients, generate a first ciphertext vector, and send it to the model user; A homomorphic addition subunit, used for the model user to generate a homomorphic model inference ciphertext by using its own feature data and the first ciphertext vector based on a homomorphic addition subalgorithm; A homomorphic authorization key subunit is used for the model owner to obtain the public key of the model user, and generate an authorization key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key; The homomorphic authorization conversion subunit is used for the model owner to generate a model authorization reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm by using the authorization key and the homomorphic model reasoning ciphertext, and send the model authorization reasoning ciphertext to the model user; The homomorphic authorization decryption sub-unit is used for the model user to generate the target data of the model user based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

10. The system according to claim 8, characterized in that Also includes: A verification unit is used to jointly calculate the target model coefficient of the model owner, the feature data of the model user, and the target data of the model user based on a secure two-party computing protocol and a zero-knowledge proof protocol to generate a proof π that satisfies a preset relationship; The model user verifies the proof π based on the zero-knowledge proof protocol. If the verification passes, the predicted target data of the model user is correct.

Images