A target data prediction method and system

Abstract

The application discloses a target data prediction method and system. The method is used for transverse federal model training and prediction through homomorphic proxy re-encryption technology, target data of a model user is predicted, and the privacy and security of sensitive data such as a participant data set and model parameters are protected; through a secure two-party computation protocol and a zero-knowledge proof protocol, the correctness of a prediction result is verified without leaking target model coefficients and feature data of the model user. The application balances system performance while protecting data privacy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy computing, in particular to a target data prediction method and system. BACKGROUND

[0002] At present, the transverse federated learning technology faces the problems of privacy protection of the data set and model parameters of the participants and the balance of system performance in the model training stage; in the inference prediction stage, it faces the problems of privacy protection of the predicted user data and model parameters and the correctness verification of the inference result. The prior art has deficiencies in privacy protection and performance balance, and it is difficult to meet the efficient and secure federated learning application requirements.

[0003] In view of the problem of the prior art that the privacy protection and performance balance are insufficient, an effective solution has not been proposed at present. SUMMARY

[0004] The present application provides a target data prediction method and system to solve the problem of insufficient privacy protection and performance balance in the prior art.

[0005] To achieve the above-mentioned purpose, on the one hand, the present application provides a target data prediction method, which comprises the following steps: S1, a plurality of participants respectively perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data set comprises feature data and target data; the plurality of participants comprise a task initiator, an aggregated ciphertext generator and other participants;

[0006] S2, each participant homomorphically encrypts the model coefficient of itself, and generates an initial ciphertext vector of itself respectively; S3, the aggregated ciphertext generating party obtains the authorization key of itself and other participants generated based on the homomorphic authorization key algorithm; S4, the aggregated ciphertext generating party generates the model aggregated ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm, and sends the model aggregated ciphertext to the task initiating party, where the task initiating party decrypts and averages based on the homomorphic authorization analysis sub-algorithm to obtain the model coefficient aggregated average, and sends the model coefficient aggregated average to the aggregated ciphertext generating party and other participants; S5, it is judged whether the model corresponding to the model coefficient aggregated average converges according to the model coefficient aggregated average and the model coefficient of each participant; S6, if not, the model coefficient aggregated average is taken as the initial model coefficient to repeat S1-S5 until the model converges; the model coefficient aggregated average corresponding to the converged model is taken as the target model coefficient; S7, one of all the participants is taken as the model owning party, and the model owning party uses the homomorphic proxy re-encryption algorithm to make a prediction based on the target model coefficient of itself and the feature data of the model using party to obtain the target data of the model using party.

[0007] Optionally, before the S1, there is further included: obtaining a public parameter; and each participant generates a public-private key pair of itself based on the public parameter and a key generation algorithm.

[0008] Optionally, the S7 includes: the model owning party homomorphically encrypts the target model coefficient of itself to generate a first ciphertext vector, and sends the first ciphertext vector to the model using party; the model using party generates a homomorphic model reasoning ciphertext based on the first ciphertext vector and the feature data of itself based on the homomorphic addition sub-algorithm; the model owning party obtains the public key of the model using party and the homomorphic model reasoning ciphertext, generates an authorization use key based on the homomorphic authorization key algorithm based on the public key of the model using party and the private key of itself, and generates a model authorization reasoning ciphertext based on the authorization use key and the homomorphic model reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm, and sends the model authorization reasoning ciphertext to the model using party; the model using party generates the target data of the model using party based on the model authorization reasoning ciphertext and the private key of itself based on the homomorphic authorization decryption sub-algorithm.

[0009] Optionally, after the S7, there is further included: the target model coefficient of the model owning party, the feature data of the model using party and the target data of the model using party are jointly calculated based on a secure two-party computation protocol and a zero-knowledge proof protocol to generate a proof π satisfying a preset relationship; the model using party verifies the proof π based on the zero-knowledge proof protocol, and if the verification is passed, the predicted target data of the model using party is correct.

[0010] Optionally, the S3 comprises: the aggregation ciphertext generation party and the other participants respectively obtaining the public key of the task initiator, and respectively generating respective authorization keys based on the homomorphic authorization key algorithm and the public key of the task initiator and the private key of the respective participant; and the other participants sending the respective authorization keys to the aggregation ciphertext generation party.

[0011] Optionally, the S4 comprises: the aggregation ciphertext generation party generating the authorization ciphertext of the aggregation ciphertext generation party based on the homomorphic authorization conversion sub-algorithm and the initial ciphertext vector and the authorization key of the aggregation ciphertext generation party, and generating the authorization ciphertext of the other participants based on the homomorphic authorization conversion sub-algorithm and the initial ciphertext vector and the authorization key of the other participants sent by the other participants; the aggregation ciphertext generation party generating the model aggregation ciphertext based on the homomorphic addition sub-algorithm and the initial ciphertext vector of the task initiator, the authorization ciphertext of the aggregation ciphertext generation party, and the authorization ciphertext of the other participants, and sending the model aggregation ciphertext to the task initiator; the task initiator decrypting the model aggregation ciphertext based on the homomorphic authorization resolution sub-algorithm and the private key of the task initiator to obtain the model coefficient aggregation sum; and the task initiator obtaining the model coefficient aggregation mean by averaging the model coefficient aggregation sum, and sending the model coefficient aggregation mean to the aggregation ciphertext generation party and the other participants.

[0012] Optionally, the S5 comprises: judging whether the Euclidean distance between the model coefficient of each participant and the model coefficient aggregation mean is within a preset threshold; if yes, it is determined that the model corresponding to the model coefficient aggregation mean converges, and if not, it is determined that the model does not converge.

[0013] In another aspect, the present application provides a target data prediction system, which comprises: a model training unit, configured to perform model training based on respective data sets and initial model coefficients by a plurality of participants to obtain respective model coefficients; the data set comprises feature data and target data; and the plurality of participants comprises a task initiator, an aggregation ciphertext generation party, and other participants.

[0014] The homomorphic encryption unit is configured to perform homomorphic encryption on the respective model coefficients of each participant to generate respective initial ciphertext vectors; the authorization key generation unit is configured to obtain, by the aggregated ciphertext generation party, respective authorization keys generated by other participants and the task initiator based on a homomorphic authorization key algorithm; the model coefficient aggregated mean generation unit is configured to perform, by the aggregated ciphertext generation party, homomorphic authorization conversion sub-algorithm and homomorphic addition sub-algorithm on the initial ciphertext vector of the aggregated ciphertext generation party, the authorization keys, and the initial ciphertext vectors and authorization keys sent by the task initiator and other participants to generate model aggregated ciphertext and send the model aggregated ciphertext to the task initiator; the task initiator decrypts and calculates the mean value based on the homomorphic authorization analysis sub-algorithm to obtain the model coefficient aggregated mean value, and sends the model coefficient aggregated mean value to the aggregated ciphertext generation party and other participants; the judgment unit is configured to determine whether the model corresponding to the model coefficient aggregated mean value converges according to the model coefficient aggregated mean value and the model coefficient of each participant; the iteration unit is configured to repeat the model training unit, the homomorphic encryption unit, the authorization key generation unit, the model coefficient aggregated mean generation unit, and the judgment unit if the model does not converge, with the model coefficient aggregated mean value as the initial model coefficient, until the model converges; the model coefficient aggregated mean value corresponding to the converged model is taken as the target model coefficient; and the prediction unit is configured to take one of all participants as a model owner, and the model owner performs prediction based on the target model coefficient of the model owner and the feature data of the model user by using a homomorphic proxy re-encryption algorithm to obtain target data of the model user.

[0015] Optionally, the prediction unit comprises: a homomorphic encryption sub-unit configured to perform homomorphic encryption on the target model coefficient of the model owner to generate a first ciphertext vector and send the first ciphertext vector to the model user; a homomorphic addition sub-unit configured to perform homomorphic addition on the feature data of the model user and the first ciphertext vector based on a homomorphic addition sub-algorithm to generate a homomorphic model inference ciphertext; a homomorphic authorization key sub-unit configured to obtain the public key of the model user by the model owner, and generate an authorized use key based on a homomorphic authorization key algorithm using the public key of the model user and the private key of the model owner; a homomorphic authorization conversion sub-unit configured to generate a model authorized inference ciphertext based on a homomorphic authorization conversion sub-algorithm using the authorized use key and the homomorphic model inference ciphertext by the model owner, and send the model authorized inference ciphertext to the model user; and a homomorphic authorization decryption sub-unit configured to generate the target data of the model user based on a homomorphic authorization decryption sub-algorithm using the model authorized inference ciphertext and the private key of the model user by the model user.

[0016] Optionally, further comprising: a verification unit configured to jointly calculate the target model coefficient of the model owner, the feature data of the model user and the target data of the model user based on a secure two-party computation protocol and a zero-knowledge proof protocol, and generate a proof pi satisfying a preset relationship; and the model user verifies the proof pi based on the zero-knowledge proof protocol, and if the verification is passed, the predicted target data of the model user is correct.

[0017] The present application has the following beneficial effects:

[0018] The present application provides a target data prediction method and system, which introduces homomorphic proxy re-encryption technology, so that the original data of the participants does not need to be directly accessed during model training and inference, effectively avoiding the risk of data leakage and ensuring the privacy and security of the data of the participants; by using the secure two-party computation protocol and the zero-knowledge proof protocol, the correctness of the predicted target data of the model user can be verified without disclosing the model coefficient of the model owner and the feature data of the model user, thereby ensuring the credibility of the inference result; by using the homomorphic encryption technology, the present application can effectively perform distributed computing tasks while protecting data privacy, reduce the amount of data exchange between parties, and improve the overall performance and computing efficiency of the system. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a flowchart of a target data prediction method provided by an embodiment of the present application;

[0020] Figure 2 is a flowchart of generating target data of a model user provided by an embodiment of the present application;

[0021] Figure 3 is a structural schematic diagram of a target data prediction system provided by an embodiment of the present application;

[0022] Figure 4 is a structural schematic diagram of a prediction unit provided by an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0024] Currently, the transverse federated learning technology faces the problems of privacy protection of participant data sets and model parameters and system performance balance in the model training stage; in the inference prediction stage, it faces the problems of privacy protection of predicted user data and model parameters and correctness verification of inference results. The existing technology has deficiencies in privacy protection and performance balance, and it is difficult to meet the efficient and secure federated learning application requirements.

[0025] Therefore, the present application proposes a target data prediction method based on homomorphic proxy re-encryption, secure two-party computation and zero-knowledge proof, which effectively solves the problem of data privacy protection and system performance balance by introducing homomorphic proxy re-encryption, secure two-party computation and zero-knowledge proof technology.

[0026] The practical application scenarios of the present application include but are not limited to: loan amount prediction, house price prediction, investment risk analysis, crop fertilizer application amount analysis, student learning ability evaluation, patient organ function prediction, etc. In order to more accurately describe the provided method and system, the present application takes the widely used loan amount prediction scenario as an example for detailed description.

[0027] In the loan amount prediction scenario, it is assumed that a small loan bank P1, P2 and P3 are the first, second and third participants, and the data structure used for model training is: data={age x1, gender x2, cumulative assets x3, credit score x4, loan amount y}, the local data sets of the three participants are date1, date2 and date3, wherein age x1, gender x2, cumulative assets x3 and credit score x4 are feature data, and loan amount y is target data.

[0028] Figure 1 A target data prediction method provided by an embodiment of the present application, as shown in Figure 1 The method comprises:

[0029] S1, a plurality of participants perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data set comprises feature data and target data; the plurality of participants comprise a task sender, an aggregated ciphertext generator and other participants; wherein the other participants can be one or more, and the present application does not limit this.

[0030] Before the S1, it further comprises:

[0031] Obtaining a public parameter;

[0032] In an optional embodiment, according to a security parameter λ, public parameters pp={pp1, pp2, pp3} conforming to a security level are selected; wherein, parameter subset pp1 is a public parameter set of a proxy re-encryption algorithm selected as needed, pp2 is a public parameter set of a secure two-party computation protocol selected as needed, and pp3 is a public parameter set of a zero-knowledge proof protocol selected as needed; different security parameters correspond to different security levels, that is, the security parameter and the security level have a corresponding mapping relationship. According to the security parameter, the security level corresponding to the security parameter is determined based on the mapping relationship, and the public parameters pp under the security level are selected.

[0033] Each participant generates a respective public-private key pair based on the public parameters and a key generation algorithm.

[0034] In an optional embodiment, in order to more specifically illustrate the present application, the task initiator is taken as the first participant, the aggregated ciphertext generation party is taken as the second participant, and the other participants are taken as the third participant.

[0035] The task initiator P1 generates a first key pair (sk1, pk1), that is, a first public-private key pair, based on the public parameters pp and a key generation algorithm KeyGen;

[0036] The aggregated ciphertext generation party P2 generates a second key pair (sk2, pk2), that is, a second public-private key pair, based on the public parameters pp and a key generation algorithm KeyGen;

[0037] The other participant P3 generates a third key pair (sk3, pk3), that is, a third public-private key pair, based on the public parameters pp and a key generation algorithm KeyGen.

[0038] The task initiator P1 performs model training based on a data set date1 and initial model coefficients to generate first model coefficients W1=[w 11 , w 12 , w 13 , w 14 ];

[0039] The aggregated ciphertext generation party P2 performs model training based on a data set date2 and initial model coefficients to generate second model coefficients W2=[w 21 , w 22 , w 23 , w 24 ];

[0040] The other participant P3 performs model training based on a data set date3 and initial model coefficients to generate third model coefficients W3=[w 31 , w 32 , w 33 , w34 ]。

[0041] S2, each participant homomorphically encrypts its respective model coefficient, respectively generating a respective initial ciphertext vector;

[0042] In an optional implementation,

[0043] Task initiator P1: encrypts the first model coefficient W1 based on the first public key pk1 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm, to obtain the first initial ciphertext vector C1 = [c 11 , c 12 , c 13 , c 14 ];

[0044] Aggregated ciphertext generation party P2: encrypts the second model coefficient W2 based on the second public key pk2 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm, to obtain the second initial ciphertext vector C2 = [c 21 , c 22 , c 23 , c 24 ];

[0045] Other participants P3: encrypt the third model coefficient W3 based on the third public key pk3 and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm, to obtain the third initial ciphertext vector C3 = [c 31 , c 32 , c 33 , c 34 ].

[0046] S3, the aggregated ciphertext generation party obtains the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm;

[0047] Specifically, the S3 includes:

[0048] The aggregated ciphertext generation party and other participants respectively obtain the public key of the task initiator, and respectively generate respective authorization keys based on the homomorphic authorization key algorithm using the public key of the task initiator and their own private keys. The other participants send their authorization keys to the aggregated ciphertext generation party.

[0049] Aggregated ciphertext generation party P2: obtains the first public key pk1, and calculates the second authorization key ek2 = HE.EmK(pk1, sk2) based on the first public key pk1, the second private key sk2, and the homomorphic authorization key algorithm (i.e., the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm);

[0050] The other participant P3: obtains the first public key pk1, calculates the third authorization key ek3=HE.EmK(pk1, sk3) based on the first public key pk1, the third private key sk3 and the homomorphic authorization key algorithm (i.e. the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm), and sends the third authorization key ek3 to the aggregated ciphertext generation party.

[0051] S4, the aggregated ciphertext generation party generates the model aggregated ciphertext based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm, and sends the model aggregated ciphertext to the task initiator, the task initiator decrypts and obtains the model coefficient aggregated mean value based on the homomorphic authorization analysis sub-algorithm, and sends the model coefficient aggregated mean value to the aggregated ciphertext generation party and the other participants;

[0052] Specifically, the S4 includes:

[0053] The aggregated ciphertext generation party generates the authorization ciphertext of the other participants based on the homomorphic authorization conversion sub-algorithm.

[0054] The aggregated ciphertext generation party P2: obtains the second initial ciphertext vector C2 and the second authorization key ek2, calculates the second authorization ciphertext C'2=HE.EmC(C2, ek2) based on the second initial ciphertext vector C2, the second authorization key ek2 and the homomorphic authorization conversion sub-algorithm (i.e. the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm), obtains the third initial ciphertext vector C3 and the third authorization key ek3 of the other participants, and calculates the third authorization ciphertext C'3=HE.EmC(C3, ek3) based on the third initial ciphertext vector C3, the third authorization key ek3 and the homomorphic authorization conversion sub-algorithm (i.e. the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm).

[0055] The aggregated ciphertext generation party generates the model aggregated ciphertext based on the homomorphic addition sub-algorithm, and sends the model aggregated ciphertext to the task initiator;

[0056] The aggregated ciphertext generation party P2: obtains the first initial ciphertext vector C1 of the task initiator, calculates the model aggregated ciphertext (i.e. the first, second and third model coefficient aggregated sum ciphertext) C=HE.Add(C1, C'2, C'3) based on the first initial ciphertext vector C1, the second authorization ciphertext C'2, the third authorization ciphertext C'3 and the homomorphic addition sub-algorithm (i.e. the addition sub-algorithm HE.Add of the homomorphic proxy re-encryption algorithm), and sends the model aggregated ciphertext C to the task initiator.

[0057] The task initiator decrypts the model aggregation ciphertext based on the private key of the task initiator and a homomorphic authorization analysis sub-algorithm to obtain a model coefficient aggregation sum value;

[0058] The task initiator P1 decrypts the model aggregation ciphertext C based on the first private key sk1 and a homomorphic authorization analysis sub-algorithm (i.e., an authorization analysis sub-algorithm of the homomorphic proxy re-encryption algorithm HE.EmDec) to obtain a model coefficient aggregation sum value (i.e., first, second and third model coefficient aggregation sum value plaintexts): W s = HE.EmDec(C) = W1 + W2 + W3.

[0059] The task initiator averages the model coefficient aggregation sum value to obtain a model coefficient aggregation average value, and sends the model coefficient aggregation average value to the aggregation ciphertext generator and other participants.

[0060] The task initiator P1 averages the model coefficient aggregation sum value W s to obtain a model coefficient aggregation average value: W = W s / 3, and sends the model coefficient aggregation average value W to the aggregation ciphertext generator P2 and other participants P3.

[0061] S5, determining whether the model corresponding to the model coefficient aggregation average value converges according to the model coefficient aggregation average value and the model coefficient of each participant;

[0062] Specifically, the S5 includes:

[0063] determining whether the Euclidean distance (i.e., two-norm) between the model coefficient of each participant and the model coefficient aggregation average value is within a preset threshold; if yes, it is determined that the model corresponding to the model coefficient aggregation average value converges, and otherwise, it does not converge.

[0064] The specific formula is:

[0065] ‖W-W1‖2≤ε、‖W-W2‖2≤ε、‖W-W3‖2≤ε

[0066] Wherein, ε is a preset threshold.

[0067] If the above three formulas are simultaneously established, it is determined that the model corresponding to the model coefficient aggregation average value converges, and the model training ends; otherwise, it does not converge.

[0068] S6, if it does not converge, repeating S1-S5 with the model coefficient aggregation average value as the initial model coefficient until the model converges; and taking the model coefficient aggregation average value corresponding to the converged model as the target model coefficient;

[0069] That is, the initial model coefficient is updated all the time, so that the first model coefficient, the second model coefficient, the third model coefficient and the model coefficient aggregation average value are updated all the time; until the model converges, and no longer updated.

[0070] S7, one of all participants is taken as a model owner (i.e. the model owner can be a task initiator or an aggregated ciphertext generation party or other participants), the model owner adopts a homomorphic proxy re-encryption algorithm to make a prediction based on the target model coefficient of the model owner and the feature data of the model user, and obtains the target data of the model user.

[0071] Figure 2 is a flowchart of generating target data of a model user provided by an embodiment of the present application; as shown in Figure 2 , the S7 includes:

[0072] S71, the model owner homomorphically encrypts the target model coefficient of the model owner to generate a first ciphertext vector and sends it to the model user;

[0073] The model owner H: based on the private key sk H of the model owner (if the model owner is a task initiator, then sk H is sk1; if it is an aggregated ciphertext generation party, then sk H is sk2; if it is other participants, then sk H is sk3) and the encryption sub-algorithm HE.Enc of the homomorphic proxy re-encryption algorithm, homomorphically encrypts the target model coefficient to generate a first ciphertext vector C';

[0074]

[0075] Send the first ciphertext vector C' to the model user U.

[0076] S72, the model user generates a homomorphic model inference ciphertext based on the feature data of the model user and the first ciphertext vector based on the homomorphic addition sub-algorithm;

[0077] The model user U: the model user obtains the public parameter and generates a public-private key pair (sk U , pk U ) based on the public parameter and the key generation algorithm, and calculates the homomorphic model inference ciphertext based on the feature data F of the user to be measured A, the first ciphertext vector C' and the homomorphic addition sub-algorithm (i.e. the addition sub-algorithm HE.Add of the homomorphic proxy re-encryption algorithm).

[0078] S73. The model owner obtains the public key and homomorphic model inference ciphertext of the model user, and generates an authorization use key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key. The authorization use key and the homomorphic model inference ciphertext are then used to generate a model authorization inference ciphertext based on the homomorphic authorization conversion sub-algorithm, and the model authorization inference ciphertext is sent to the model user.

[0079] Model owner H: Get the public key pk of the model user U , homomorphic model reasoning ciphertext C″, based on its own private key sk H , the public key pk of the model user U and the homomorphic authorization key algorithm (i.e. the authorization key algorithm HE.EmK of the homomorphic proxy re-encryption algorithm), the authorized use key eKey=HE.EmK(pk U ,sk H ), the authorization key eKey and the homomorphic model ciphertext inference ciphertext C″ are based on the homomorphic authorization conversion sub-algorithm (i.e., the authorization conversion sub-algorithm HE.EmC of the homomorphic proxy re-encryption algorithm) to generate the model authorization inference ciphertext C em =HE.EmC(C″,eKey), the model authorized inference ciphertext C em Sent to the model user U.

[0080] S74. The model user generates the model user's target data based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

[0081] Model user U: Authorizes reasoning based on the ciphertext C based on the model em , your own private key sk U The target data of the model user (i.e., the model reasoning plaintext: the loan amount of the tested user A) is calculated by the homomorphic authorization decryption sub-algorithm (i.e., the authorization decryption sub-algorithm HE.EmDec of the homomorphic proxy re-encryption algorithm) M = HE.EmDec (C em ,sk U ).

[0082] After S7, the method further includes:

[0083] The target model coefficients of the model owner, the feature data of the model user, and the target data of the model user are jointly calculated based on the secure two-party computing protocol and the zero-knowledge proof protocol to generate a proof π that satisfies the preset relationship.

[0084] Model owner H and model user U: Without disclosing the target model coefficients ” and “The characteristic data of the predicted user A Under the premise of predicting the loan amount M, based on the joint calculation of the secure two-party computation protocol and the zero-knowledge proof protocol, a proof π satisfying the preset relationship (i.e. ) is generated; wherein the zero-knowledge proof protocol includes but is not limited to zkSNARKs, zkSTARKS, Bulletproofs, Plonk and Groth6.

[0085] Further, in an optional embodiment,

[0086] Model owner H: encrypt the target model coefficients Generate ciphertext Enc(W).

[0087] Model user U: encrypt the feature data of user A Generate ciphertext Enc(F).

[0088] Both parties use a secure two-party computation protocol (such as an encrypted multi-party computation protocol MPC, Yao's encrypted circuit, etc.) to calculate the encrypted linear combination

[0089] Build a circuit K, which contains inputs W and F, and outputs M.

[0090] Model owner H: as a prover, use a zero-knowledge proof protocol (i.e. circuit K) to generate a proof π based on the encrypted ciphertexts Enc(W) and Enc(F), which can allow a verifier to confirm that the relationship holds without accessing W and F.

[0091] The model user checks the proof π based on the zero-knowledge proof protocol, and if the verification is passed, the predicted target data of the model user is correct.

[0092] Model user U: as a verifier, check the proof π about based on the zero-knowledge proof protocol, and if the verification is passed, the predicted target data of the model user is correct, i.e. the predicted M result is correct.

[0093] Figure 3 is a structural diagram of a target data prediction system provided by an embodiment of the present application, as shown in Figure 3 The system comprises:

[0094] A model training unit 201 for multiple participants to perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data set includes feature data and target data; the multiple participants include a task sender, an aggregated ciphertext generator and other participants;

[0095] Homomorphic encryption unit 202, used for each participant to perform homomorphic encryption on its own model coefficients to generate its own initial ciphertext vector;

[0096] The authorization key generation unit 203 is used for the aggregate ciphertext generator to obtain the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm;

[0097] The model coefficient aggregate mean generating unit 204 is configured to generate a model aggregate ciphertext by the aggregate ciphertext generator using its own initial ciphertext vector, the authorization key, the initial ciphertext vector sent by the task initiator, the initial ciphertext vectors sent by other participants, and the authorization keys based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm, and send the generated model aggregate ciphertext to the task initiator. The task initiator decrypts and averages the model coefficients based on the homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregate mean, and sends the model coefficient aggregate mean to the aggregate ciphertext generator and other participants.

[0098] A judging unit 205 is configured to judge whether the model corresponding to the model coefficient aggregate mean value has converged based on the model coefficient aggregate mean value and the model coefficient of each participant;

[0099] The iterative unit 206 is configured to use the aggregated mean of the model coefficients as the initial model coefficients to repeat the model training unit, homomorphic encryption unit, authorization key generation unit, model coefficient aggregated mean generation unit, and judgment unit until the model converges; and use the aggregated mean of the model coefficients corresponding to the converged model as the target model coefficients;

[0100] The prediction unit 207 is used to take one of all the participants as the model owner. The model owner uses the homomorphic proxy re-encryption algorithm to make predictions based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

[0101] Figure 4 is a schematic diagram of the structure of the prediction unit provided by an embodiment of the present invention, such as Figure 4 As shown, the prediction unit 207 includes:

[0102] Homomorphic encryption subunit 2071, configured for the model owner to perform homomorphic encryption on its own target model coefficients to generate a first ciphertext vector and send it to the model user;

[0103] Homomorphic addition sub-unit 2072, configured for the model user to generate homomorphic model inference ciphertext by applying its own feature data and the first ciphertext vector based on the homomorphic addition sub-algorithm;

[0104] The homomorphic authorization key subunit 2073 is used for the model owner to obtain the public key of the model user, and generate an authorized use key based on a homomorphic authorization key algorithm with the public key of the model user and the private key of the model owner.

[0105] The homomorphic authorization conversion subunit 2074 is used for the model owner to generate model authorized inference ciphertext based on a homomorphic authorization conversion sub-algorithm with the authorized use key and the homomorphic model inference ciphertext, and send the model authorized inference ciphertext to the model user.

[0106] The homomorphic authorization decryption subunit 2075 is used for the model user to generate the target data of the model user based on a homomorphic authorization decryption sub-algorithm with the model authorized inference ciphertext and the private key of the model user.

[0107] The system further comprises:

[0108] The verification unit is used for jointly calculating the target model coefficient of the model owner, the feature data of the model user and the target data of the model user based on a secure two-party computation protocol and a zero-knowledge proof protocol, and generating a proof π satisfying a preset relationship; and the model user verifies the proof π based on the zero-knowledge proof protocol, and if the verification is passed, the predicted target data of the model user is correct.

[0109] The system and method of the present application correspond, and the specific implementation of the system will not be repeated here.

[0110] The present application has the following beneficial effects:

[0111] The present application provides a target data prediction method and system, which introduces homomorphic proxy re-encryption technology, and does not need to directly access the original data of the participants in the model training and inference process, effectively avoiding the risk of data leakage and ensuring the privacy and security of the data of the participants; by using a secure two-party computation protocol and a zero-knowledge proof protocol, the correctness of the predicted target data of the model user can be verified without disclosing the model coefficient of the model owner and the feature data of the model user, thereby ensuring the credibility of the inference result; by using homomorphic encryption technology, the present application can effectively perform distributed computing tasks while protecting data privacy, reduce the amount of data exchange between parties, and improve the overall performance and computing efficiency of the system.

[0112] The system and method of the present application can be widely applied to various scenarios requiring federated learning, such as loan limit prediction, house price prediction, investment risk analysis, etc., and has strong adaptability and universality. The model training process proposed in the present application supports multiple rounds of iteration, and dynamically adjusts the model parameters according to the training results of each round to ensure that the model can be continuously optimized until convergence, thereby improving the prediction accuracy of the model. The present application fully utilizes the advantages of different data sources by jointly training and reasoning the models of multiple participants, improves the prediction ability and collaborative effect of the overall model, and helps to achieve more accurate analysis and decision-making.

[0113] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solution deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A target data prediction method, characterized in that: include: S1. Multiple participants perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregated ciphertext generator, and other participants; S2. Each participant performs homomorphic encryption on its own model coefficients to generate its own initial ciphertext vector; S3. The aggregate ciphertext generator obtains the respective authorization keys generated by itself and other participants based on the homomorphic authorization key algorithm; S4. The aggregate ciphertext generator uses its own initial ciphertext vector, authorization key, the initial ciphertext vector sent by the task initiator, the initial ciphertext vectors sent by other participants, and authorization keys based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm to generate a model aggregate ciphertext and send it to the task initiator. The task initiator decrypts and averages the model coefficients based on the homomorphic authorization parsing sub-algorithm to obtain the aggregate mean of the model coefficients, and sends the aggregate mean of the model coefficients to the aggregate ciphertext generator and other participants. S5. judging whether the model corresponding to the aggregate mean of the model coefficients has converged based on the aggregate mean of the model coefficients and the model coefficients of each participant; S6. If it does not converge, the aggregate mean of the model coefficients is used as the initial model coefficients and S1 to S5 are repeated until the model converges; the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficients; S7. One of all the participants is regarded as the model owner. The model owner uses a homomorphic proxy re-encryption algorithm to make predictions based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

2. The method according to claim 1, characterized in that Before the S1, it also includes: Get public parameters; Each participant generates their own public-private key pair based on public parameters and key generation algorithm.

3. The method according to claim 1, characterized in that The S7 includes: The model owner performs homomorphic encryption on its own target model coefficients to generate a first ciphertext vector, and sends it to the model user; The model user generates a homomorphic model inference ciphertext based on its own feature data and the first ciphertext vector based on the homomorphic addition sub-algorithm; The model owner obtains the public key and homomorphic model inference ciphertext of the model user, and generates an authorization use key based on the homomorphic authorization key algorithm using the public key of the model user and its own private key, and generates a model authorization inference ciphertext based on the homomorphic authorization conversion sub-algorithm using the authorization use key and the homomorphic model inference ciphertext, and sends the model authorization inference ciphertext to the model user; The model user generates the model user's target data based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

4. The method according to claim 3, characterized in that After S7, the method further includes: The target model coefficients of the model owner, the feature data of the model user, and the target data of the model user are jointly calculated based on the secure two-party computing protocol and the zero-knowledge proof protocol to generate a proof π that satisfies the preset relationship. The model user verifies the proof π based on the zero-knowledge proof protocol. If the verification is successful, the predicted target data of the model user is correct.

5. The method according to claim 2, characterized in that The S3 includes: The aggregate ciphertext generator and other participants respectively obtain the public key of the task initiator, and use the public key of the task initiator and their own private key to generate their own authorization keys based on the homomorphic authorization key algorithm. Other participants then send their own authorization keys to the aggregate ciphertext generator.

6. The method according to claim 2, characterized in that The S4 includes: The aggregated ciphertext generator uses its own initial ciphertext vector and authorization key based on the homomorphic authorization conversion sub-algorithm to generate its own authorized ciphertext, and uses the initial ciphertext vector and authorization key sent by other participants based on the homomorphic authorization conversion sub-algorithm to generate the authorized ciphertext of other participants; The aggregate ciphertext generator generates a model aggregate ciphertext based on the homomorphic addition sub-algorithm using the task initiator's initial ciphertext vector, the aggregate ciphertext generator's authorized ciphertext, and the authorized ciphertexts of other participants, and sends it to the task initiator. The task initiator decrypts the model aggregation ciphertext based on its own private key and homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregation and value; The task initiator calculates the average value of the model coefficient aggregation and the value to obtain the model coefficient aggregation mean, and sends the model coefficient aggregation mean to the aggregation ciphertext generator and other participants.

7. The method according to claim 1, characterized in that The S5 includes: Determine whether the Euclidean distance between the model coefficient of each participant and the aggregate mean of the model coefficients is within a preset threshold; if so, the model corresponding to the aggregate mean of the model coefficients is determined to have converged, otherwise, it is determined not to have converged.

8. A target data prediction system, characterized in that: include: A model training unit is configured for multiple participants to perform model training based on their respective data sets and initial model coefficients to obtain their respective model coefficients; the data sets include feature data and target data; the multiple participants include the task initiator, the aggregated ciphertext generator, and other participants; Homomorphic encryption unit, used by each participant to homomorphically encrypt their respective model coefficients and generate their own initial ciphertext vectors; An authorization key generation unit, configured for the aggregate ciphertext generator to obtain authorization keys generated by itself and other participants based on a homomorphic authorization key algorithm; The model coefficient aggregate mean generation unit is used for the aggregate ciphertext generator to use its own initial ciphertext vector, authorization key, the initial ciphertext vector sent by the task initiator, the initial ciphertext vectors sent by other participants, and the authorization key based on the homomorphic authorization conversion sub-algorithm and the homomorphic addition sub-algorithm to generate the model aggregate ciphertext and send it to the task initiator. The task initiator decrypts and calculates the average value based on the homomorphic authorization parsing sub-algorithm to obtain the model coefficient aggregate mean, and sends the model coefficient aggregate mean to the aggregate ciphertext generator and other participants. A judgment unit, configured to judge whether the model corresponding to the aggregate mean of the model coefficients has converged based on the aggregate mean of the model coefficients and the model coefficients of each participant; The iteration unit is used to use the aggregate mean of the model coefficients as the initial model coefficients to repeat the model training unit, homomorphic encryption unit, authorization key generation unit, model coefficient aggregate mean generation unit, and judgment unit until the model converges; and the aggregate mean of the model coefficients corresponding to the converged model is used as the target model coefficients; The prediction unit is used to treat one of all participants as the model owner. The model owner uses a homomorphic proxy re-encryption algorithm to make predictions based on its own target model coefficients and the characteristic data of the model user to obtain the target data of the model user.

9. The system according to claim 8, characterized in that The prediction unit includes: A homomorphic encryption subunit, configured for the model owner to homomorphically encrypt its own target model coefficients, generate a first ciphertext vector, and send the first ciphertext vector to the model user; A homomorphic addition subunit, configured for the model user to generate a homomorphic model inference ciphertext by applying its own feature data and the first ciphertext vector based on a homomorphic addition subalgorithm; The homomorphic authorization key subunit is used for the model owner to obtain the public key of the model user and generate an authorization key based on the model user's public key and its own private key based on the homomorphic authorization key algorithm; The homomorphic authorization conversion sub-unit is used for the model owner to generate the model authorization reasoning ciphertext based on the homomorphic authorization conversion sub-algorithm by using the authorization key and the homomorphic model reasoning ciphertext, and send the model authorization reasoning ciphertext to the model user; The homomorphic authorization decryption sub-unit is used for the model user to generate the target data of the model user based on the model authorization inference ciphertext and its own private key based on the homomorphic authorization decryption sub-algorithm.

10. The system according to claim 8, wherein: Also includes: A verification unit is used to jointly calculate the target model coefficients of the model owner, the feature data of the model user, and the target data of the model user based on a secure two-party computing protocol and a zero-knowledge proof protocol to generate a proof π that satisfies a preset relationship. The model user verifies the proof π based on the zero-knowledge proof protocol. If the verification is successful, the predicted target data of the model user is correct.

Images