Multi-party privacy protection decision tree training method and system with privileged party

Abstract

The invention discloses a multi-party privacy protection decision tree training method and system with a privileged party, and the method comprises the steps: enabling a participant P to comprise a privileged party P0 and two auxiliary parties P1 and P2, and enabling the privileged party P0 and the auxiliary parties P1 and P2 to participate in training together; six operation protocols, namely a secret sharing protocol pishr, a secret reconstruction protocol pirec, a security multiplication protocol pimul, a security division protocol pidiv, a security multiplication expansion protocol piextmul and a security comparison protocol picomp, are utilized, and multi-party privacy protection decision tree training considering privacy and high efficiency is realized by combining basic operation protocols. According to the method, a security division protocol is designed by using a random mask, a security comparison protocol is designed by using function secret sharing, and a security multiplication extension protocol in which a privileged party does not need to share original data is given, so that the efficiency is improved and the communication overhead is reduced compared with the existing similar scheme on the premise of meeting privacy.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and relates to a decision tree training method and system, in particular to a decision tree training method and system in a multi-party environment with privileged parties. Background Art

[0002] A decision tree is a non-parametric supervised learning algorithm that can summarize decision rules from a series of data with features and labels, and can use a tree structure to draw the decision process to solve regression and classification problems. The core idea of ​​the decision process is to divide the data based on the tree structure and construct a decision tree by querying each feature. As an efficient and explainable machine learning algorithm, decision trees are used in various fields, such as financial risk management, medical diagnosis, and stock trading. In actual scenarios, the construction and application of decision trees face two challenges. First, the training data is usually distributed vertically, that is, each party has non-overlapping features of the same sample. Second, the training data is also privacy-sensitive.

[0003] There are already a lot of studies on privacy-preserving data mining, which usually focus on training and classification processes, among which training is usually implemented through classic algorithms such as ID3, C4.5 and CART. These works can be divided into two categories: one is leakage-tolerant, that is, at the expense of some privacy, such as leaking sample labels, the best division of internal nodes or evaluation paths, etc., to reduce cryptographic overhead and improve scheme efficiency. However, this kind of leakage violates the requirements of privacy protection. The second is no privacy leakage, but the computational and communication overhead of this scheme is usually large. In addition, most of the existing privacy-preserving decision tree schemes are based on a single type of framework, that is, two or more participants with equal power, and cannot handle more complex application scenarios.

[0004] There is a robust multi-party learning framework pMPL with privileged parties. The framework distinguishes the powers of the participants and divides them into two roles: privileged parties and auxiliary parties. The privileged party is the initiator of the machine learning task, will not be disconnected, will not collude with other participants, and will obtain the final model; the auxiliary party is mainly used to provide more data, and may be disconnected, collude, etc. Therefore, pMPL can be used to handle more complex scenarios. For example, in the scenario of financial risk control, a financial professional company hopes to cooperate with multiple Internet service providers with a large amount of user data to train an accurate model for financial risk control by paying for the data they provide for training. However, due to privacy protection regulations and laws (such as GDPR), financial professional companies and multiple Internet service providers cannot directly exchange raw data. In addition, Internet service providers may intentionally withdraw from the machine learning training process due to system or network failures or for commercial purposes. The use of pMPL can tolerate the withdrawal of an auxiliary party (Internet service provider) and complete the training process normally. pMPL has given some basic operation protocols, namely the secret sharing protocol, reconstruction protocol, secure addition protocol and secure multiplication protocol, but it does not provide secure interaction protocols for other basic operations such as secure comparison protocol and secure division protocol. Summary of the invention

[0005] In order to solve the privacy and efficiency problems existing in the current multi-party decision tree training, the present invention provides a multi-party privacy protection decision tree training method and system with privileged parties, which meets the privacy, robustness and efficiency requirements in the decision tree training process.

[0006] The technical solution adopted by the method of the present invention is: a multi-party privacy protection decision tree training method with privileged parties, in which the participants P include a privileged party P0 and two auxiliary parties P1 and P2 to participate in the training, using six operation protocols: secret sharing protocol Π shr , Secret Reconstruction Protocol Π rec 、Secure Multiplication Protocol Π mul , Secure Division Protocol Π div , Secure Multiplication Extension Protocol Π extmul and the secure comparison protocol Π comp ,By combining basic computing protocols, multi-party privacy-preserving decision tree training that takes into account both privacy and efficiency is achieved.

[0007] Preferably, the secret sharing protocol II shr , used to realize vector space secret sharing; the specific implementation process is: the data holder P i Construct a three-dimensional vector s = (x, s1, s2) for data x T , where s1 and s2 are random numbers, and x represents scalar data; calculate in, <x> j represents the jth secret share generated after vector space secret sharing of data x, Take l = 64 and make P0 get <x> 0， <x>3. P1 holds <x>1. P2 holds <x>2.

[0008] Preferably, the secret reconstruction protocol II rec , which is used to reconstruct the secret sharing share of the vector space; the specific implementation process is: the participants exchange shares and calculate x = c0· <x> 0+c1· <x> 1+c2· <x>2 or x = c0′· <x> 0+c1′· <x> 1+c3′· <x>3 or x = c0" <x> 0+c2″· <x> 2+c3″· <x>3. Reconstruct the true value of x; where <x> j represents the jth secret share generated after vector space secret sharing of the data x, j∈{0, 1, 2, 3}; c0, c1, c2, c0′, c1′, c3′, c0″, c2″, c3″ represent the public parameters used for reconstruction.

[0009] Preferably, the secure multiplication protocol II mul , which is used to realize the multiplication of two numbers in the form of secret shares, and the multiplication results are all in the form of secret shares; the specific implementation process is: for P0 input <x> j ， <y> j , P1 input <x> 1， <y>1, P2 input <x> 2， <y>2. Three-way output <z>0=<x·y> 0 and <z>3=<x·y>3、 <z>1=<x·y>1、 <z>2=<x·y> 2; among them, <x> j 、 <y> j Respectively represent the jth secret share generated after vector space secret sharing of data x and y, j∈{0,1,2,3}; use Implement key generation for function secret sharing; use Realize the generation of function shared secret shares, where when x < α, [f]0 + [f]1 = f = β, otherwise [f]0 + [f]1 = f = 0; k i Represents the generated key, i∈{0,1}.

[0010] Preferably, the secure division protocol II div , including the protocol preprocessing process and the interaction process of each party in the protocol;

[0011] In the secure division protocol, the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <x> 1， <y>1. Auxiliary party P2 holds the secret share <x> 2， <y>2. By jointly participating in the implementation of the safe division protocol, each participant P i Get the secret share of the division result respectively i ＝ <x y> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3＝ <x y>3; where x and y represent data;

[0012] The protocol preprocessing process comprises the following steps:

[0013] (1)P i Generate a random number r respectively i , where i∈{0, 1, 2};

[0014] (2)P i Execute the secret sharing protocol Π separately shr (P i , r i ), therefore, P0 holds <r i >0, <r i >3, P1 holds <r i >1, P2 holds <r i >2;

[0015] (3)P i Local calculation <r> i ＝ <r0> i + <r1> i + <r2> i , P0 additional calculation <r> 3＝ <r0> 3+ <r1> 3+ <r2>3;

[0016] The interaction process of the parties involved in the protocol includes the following steps:

[0017] (1) Participants jointly execute the secure multiplication protocol Π mul (P, <r> ， <y>), P i get<r·y> i , P0 gets an additional share<r·y> 3; among them, <r>express <r> i A collection of <y>express <y> i gather;

[0018] (2) The parties jointly execute the reconstruction agreement Π rec (P,<r·y> ), both get r·y;

[0019] (3) Participants jointly execute the secure multiplication protocol Π mul (P, <r> ， <x>), P i get<r·x> i , P0 gets an additional share<r·x> 3;

[0020] (4)P i Local calculation i =<r·x> i / r·y, P0 additional calculation 3=<r·x> 3 / r·y.

[0021] Preferably, the secure multiplication extension protocol II extmul , including the protocol preprocessing process and the interaction process of each party in the protocol;

[0022] The secure multiplication extension protocol, the privileged party P0 holds x and the secret share <y> 0， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the secure multiplication extension protocol, each participant P i Get the secret share of the multiplication result respectively <z> i =<x·y> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share <z>3=<x·y> 3; among them, <x> j 、 <y> j Respectively represent the,th vector space secret sharing share of data x,y;

[0023] In the protocol preprocessing process, the participants execute the vector multiplication triples to generate the protocol Π vmtgtm (P), therefore, P0 holds 0， <v> 0， <h>0 and 3， <v> 3， <h>3. P1 holds 1， <v> 1， <h>1. P2 holds 2， <v>2, <h)2, where h = u·v; h, u, v form a multiplication triple, satisfying h = u × v;

[0024] The interaction process of each party involved in the protocol includes the following steps:

[0025] (1) If there is no auxiliary party dropping out, then P0 receives from P i of i , i∈{1,2}, and by calculating u=c0· 0+c1· 1+c2· 2Reconstruct the true value of u;

[0026] If a helper P2 is offline, P0 receives a 1, and by calculating u = c0′· 0+c1′· 1+c3′· 3 reconstructs the true value of u; where c0′, c1′, c3′ represent the common parameters used for reconstruction;

[0027] (2) P0 locally calculates e = x + u and sends e to the auxiliary party P i , i∈{1,2};

[0028] (3)P i Local calculation <d> i ＝ <y> i + <v> i , i∈{0, 1, 2}, P0 additional calculation <d> 3＝ <y> 3+ <v>3;

[0029] (4) Participants jointly execute rec (P, <d>), we get d=y+v;

[0030] (5)P i Local calculation <z> i ＝ <h> i - <v> i ·e, i∈{1,2}; at the same time, P0 locally calculates <z>0=x·d / c0+ <h> 0- <v>0·e and <z> 3＝ <h> 3- <v>3·e.

[0031] Preferably, the security comparison protocol II comp , the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3=<1{x>y}>3; where, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;

[0032] If there is no auxiliary party offline, the interaction process of each participant in the security comparison protocol includes the following steps:

[0033] (1) P0 execution Generate a secret key and pass the secret key k i Send to P i , where i∈{1,2}; where N=2 l , l represents the uniform bit length of the data in the method, k1, k2 represent the generated FSS keys, and the auxiliary party P i Will hold the secret key k i , i∈{1,2};

[0034] (2) P0 generates a random number r;

[0035] (3)P i Local calculation <x-y> i ＝ <x> i - <y> i , i∈{0, 1, 2};

[0036] (4) Participants jointly execute extmul (P, r, <x-y>), so that P0 gets<r·(x-y)> 0,<r·(x-y)> 3. P1 gets<r·(x-y)> 1, P2 gets<r·(x-y)> 2;

[0037] (5) P0 will<r·(x-y)> 0 is sent to P1 and P2, and P1 and P2 send to each other<r·(x-y)> i , i∈{1,2};

[0038] (6) P1 and P2 calculate r·(xy)=c0·<r·(x-y)> 0+c1<r·(x-y)> 1+c2<r·(x-y)> 2, the values ​​of r·(xy) are obtained; where c0, c1, c2 represent the common parameters used for reconstruction;

[0039] (7) Auxiliary Party P i Execute separately Get [f] i , where i∈{1,2}; where [f] i represents the secret sharing share of the function;

[0040] (8) Auxiliary Party P i By exchanging [f] i , i∈{1,2}, calculate f=[f]1+[f]2 to get the value of f, and execute Π shr (P i , f), so that P0 gets <f> 0， <f>3. P1 gets <f>1, P2 gets <f>2;Π shr for secret sharing protocols;

[0041] (9) P0 calculation P i calculate <z> i ＝ <f> i , i∈{1,2}; where MSB(r) represents the highest bit of r, Represents bitwise exclusive OR.

[0042] Preferably, the security comparison protocol II comp , the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3=<1{x>y}>3; where, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;

[0043] If the auxiliary party P2 is offline, the interaction process of the participants in the security comparison protocol includes the following steps:

[0044] (1)P i Generate random numbers r respectively i , i∈{0,1};

[0045] (2) P0 and P1 use the function secret sharing technology to obtain the secret information of each other without leaking sensitive information. Get k0, k1 respectively; where N = 2 l , l represents the uniform bit length of data in the method; k0, k1 represent the key pair used for function secret sharing;

[0046] (3)P i Local calculation <y> i - <x> i +r i / c i ′, i∈{0,1}, P0 additional calculation <y> 3- <x>3; among them, c i ′ represents the common parameters used for reconstruction;

[0047] (4) P0 and P1 exchange secret shares and calculate c0′·( <y> 0- <x>0+r0 / c0′)+c1′·( <y> 1- <x>1+r1 / c1′)+c3′·( <y> 3- <x>3), reconstruct y-x+r0+r1;

[0048] (5)P i Execute separately where i∈{0,1}; where [f] i represents the secret sharing share of the function;

[0049] (6)P i Execute Π separately shr (P i , [f] i ), so that P0 obtains <[f] i >0,<[f] i >3, P1 gets <[f] i >1, P2 gets <[f] i >2, where i∈{0,1};

[0050] (7)P i Local calculation <z> i =<[f]0> i +<[f]1> i , i∈{0, 1, 2}, P0 additional calculation <z>3=<[f]0>3+<[f]1>3.

[0051] Preferably, the method comprises the following steps:

[0052] Step 1: P i The data set is represented in vector form according to its features: P0 divides the samples into M categories according to the labels, denoted as L μ ;in, is represented by the k-th partition vector of the j-th feature; L μ is a vector used to represent samples belonging to the μth category, L μ =(1, 0, ...), μ = 1, ..., M, where 1 indicates that the corresponding row of data belongs to the category, and 0 indicates that it does not;

[0053] Step 2: P0 initializes γ and executes Π shr (P0, γ); auxiliary square P i Execute separately in Wherein, γ represents the vector of currently available samples, which is initialized to γ ​​= (1, 1, ..., 1), where 1 indicates that the sample is available and 0 indicates that it is unavailable. The length of the vector is the total number of samples; m (i) Indicated by P i The number of features held; Indicated by P i The number of partitions held for the jth feature;

[0054] Step 3: Determine whether the conditions for being a leaf node are met. If so, return the result; otherwise, continue execution;

[0055] Step 4: For μ∈<1, 2, .., M}, the participants perform Π on the elements in the vector one by one extmul (P, <L μ >, <γ>)→ <C μ >; Among them, <x>Represents the secret sharing share of the vector space of data x;

[0056] Step 5: For The participants jointly perform element-by-element execution on the input vector as well as for Participants execute element by element as well as in, <d r > indicates that the variable and the following are intermediate variables used to calculate Gini impurity;

[0057] Step 6: For When i=0, the participants jointly execute element by element as well as When i∈{1,2}, the participants execute element by element as well as Among them, C μ is a vector representing the available samples belonging to the μth class, <lc μ > and <rc μ > indicates that the variables and the following are the second and third intermediate variables used to calculate the Gini impurity;

[0058] Step 7: Initialize two iteration variables <lc> ＝0， <rc>=0, for each <lc μ >With <rc μ >, the participants execute and And local calculation and

[0059] Step 8: For Participants jointly execute div (P, <lc> ，<d l >)→ <lp>With P div (P, <rc>, <d r >)→, and calculate locally in, Indicated by P i The Gini impurity corresponding to the k-th partition of the j-th feature; <lp>and represent the two sum terms used to calculate the Gini impurity;

[0060] Step 9: For Participants jointly implement Joint implementation And in the same way get <k * >, <j * >, * >; Among them, The best partition corresponding to the best feature of this round value;

[0061] Step 10: P0 receives the signal from P i ,of <k * > i′ , <j * > i′ , * > i′ , i′∈{1,2}, and calculate and reconstruct the best feature And the best partition among them, that is, the kth * divisions; among them, Indicated by The data set corresponding to the j*th feature held;

[0062] Step 11: The participants jointly perform the operation on each element of the vector. and The decision tree model update is completed and returns to step 3; where γ l Represents the available samples of the left child node; γ r Represents the available samples for the right child node.

[0063] The technical solution adopted by the system of the present invention is: a multi-party privacy protection decision tree training system with privileged parties, comprising:

[0064] one or more processors;

[0065] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-party privacy protection decision tree training method with privileged parties.

[0066] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0067] (1) In the present invention, when there is a privileged party and two auxiliary parties participating in the training, even if one auxiliary party colludes or goes offline, the remaining participants can still complete the decision tree training;

[0068] ​​(2) Based on the pMPL framework, the present invention designs a secure division protocol using random masks and a secure comparison protocol using function secret sharing technology, thereby realizing a multi-party privacy-preserving decision tree solution that takes into account both privacy and efficiency by combining basic operation protocols.

[0069] (3) The present invention further improves the robust multi-party learning framework with privileged parties.

[0070] (4) The privacy-preserving decision tree scheme with privileged parties proposed in the present invention is more efficient than existing similar schemes. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0072] Figure 1 The secure multiplication extension protocol II of the embodiment of the present invention div Schematic diagram of the process (taking the disconnection of the non-assisted party as an example);

[0073] Figure 2 The secure multiplication extension protocol II of the embodiment of the present invention extmul Schematic diagram of the process (taking the disconnection of the non-assisted party as an example);

[0074] Figure 3 The secure multiplication extension protocol II of the embodiment of the present invention comp Schematic diagram of the process (taking the disconnection of the non-assisted party as an example). DETAILED DESCRIPTION

[0075] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0076] This embodiment provides a multi-party privacy protection decision tree training method with privileged parties. During the training, the participants P include a privileged party P0 and two auxiliary parties P1 and P2 to participate in the training together, using six operation protocols: secret sharing protocol Π shr , Secret Reconstruction Protocol Π rec 、Secure Multiplication Protocol Π mul , Secure Division Protocol Π div , Secure Multiplication Extension Protocol Π extmul and the secure comparison protocol Π comp ,By combining basic computing protocols, multi-party privacy-preserving decision tree training that takes into account both privacy and efficiency is achieved.

[0077] In one embodiment, the set of participants is Among them, P0 is a professional company in the financial field, as a privileged party that does not lose connection, does not collude, and finally obtains the training results; P1 and P2 are Internet service providers, as auxiliary parties that may lose connection, collude, and will not obtain the final training model. P0 hopes to combine the feature data sets held by P1 and P2 to jointly train a decision tree model that can classify financial risks. The specific steps for the three parties to jointly complete the privacy protection decision tree training are as follows.

[0078] In one embodiment, a secret sharing protocol PI is used. shr Realize vector space secret sharing, that is, data holder P i Construct a three-dimensional vector s = (x, s1, s2) for the data x T , where s1 and s2 are both random numbers, calculate in, Take l = 64 and make P0 get <x> 0， <x>3. P1 holds <x>1. P2 holds <x>2. Among them, <x> j Represents the jth secret share generated after vector space secret sharing of data x.

[0079] In one embodiment, a secret reconstruction protocol II is used. rec Reconstruct the secret sharing share of the vector space, that is, the participants exchange shares and calculate x = c0· <x> 0+c1· <x> 1+c2· <x>2 or x = c0′· <x> 0+c1′· <x> 1+c3′· <x>3 or x = c0" <x> 0+c2″· <x> 2+c3″· <x>3. Reconstruct the true value of x. <x> j represents the jth secret share generated after vector space secret sharing of the data x, j∈{0, 1, 2, 3}; c0, c1, c2, c0′, c1′, c3′, c0″, c2″, c3″ represent the public parameters used for reconstruction.

[0080] In one embodiment, the secure multiplication protocol PI is used mul The multiplication of two numbers in the form of secret shares is realized, and the multiplication results are all in the form of secret shares, that is, for P0 input <x> i ， <y> i , i∈{0,3}, P1 input <x> 1， <y>1, P2 input <x> 2， <y>2. Three-way output <z>0=<x·y> 0 and <z>3=<x·y>3、 <z>1=<x·y>1、 <z>2=<x·y> 2. Among them, <x> j 、 <y> j Respectively represent the jth secret share generated after vector space secret sharing of data x and y, j∈{0,1,2,3}; use Implement key generation for function secret sharing; use Realize the generation of function shared secret shares, where when x < α, [f]0 + [f]1 = f = β, otherwise [f]0 + [f]1 = f = 0; k i Represents the generated key, i∈{0,1}.

[0081] Please see Figure 1 In one embodiment, the secure division protocol II div , including the protocol preprocessing process and the interaction process of each party in the protocol;

[0082] In the secure division protocol, the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <x> 1， <y>1. Auxiliary party P2 holds the secret share <x> 2， <y>2. By jointly participating in the implementation of the safe division protocol, each participant P i Get the secret share of the division result respectively i ＝ <x y> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3＝ <x y>3; where x and y represent data;

[0083] The protocol preprocessing process comprises the following steps:

[0084] (1)P i Generate a random number r respectively i , where i∈{0, 1, 2};

[0085] (2)P i Execute the secret sharing protocol Π separately shr (P i , r i ), therefore, P0 holds <r i >0, <r i >3, P1 holds <r i >1, P2 holds <r i >2;

[0086] (3)P i Local calculation <r> i ＝ <r0> i + <r1> i + <r2> i , P0 additional calculation <r> 3＝ <r0> 3+<r1)3+ <r2>3;

[0087] The interaction process of the parties involved in the protocol includes the following steps:

[0088] (1) Participants jointly execute the secure multiplication protocol Π mul (P, <r> ， <y>), P i get<r·y> i , P0 gets an additional share<r·y> 3; among them, <r>express <r> i A collection of <y>express <y> i gather;

[0089] (2) The parties jointly execute the reconstruction agreement Π rec (P,<r·y> ), both get r·y;

[0090] (3) Participants jointly execute the secure multiplication protocol Π mul (P, <r> ， <x>), P i get<r·x> i , P0 gets an additional share<r·x> 3;

[0091] (4)P i Local calculation i =<r·x> i / r·y, P0 additional calculation 3=<r·x> 3 / r·y.

[0092] Please see Figure 2 In one embodiment, the secure multiplication extension protocol II extmul , including the protocol preprocessing process and the interaction process of each party in the protocol;

[0093] The secure multiplication extension protocol, the privileged party P0 holds x and the secret share <y> 0， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the secure multiplication extension protocol, each participant P i Get the secret share of the multiplication result respectively <z> i =<x·y> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share <z>3=<x·y> 3; among them, <x> j 、 <y> j Respectively represent the,th vector space secret sharing share of data x,y;

[0094] In the protocol preprocessing process, the participants execute the vector multiplication triples to generate the protocol Π vmtgtm (P), therefore, P0 holds 0， <v> 0， <h>0 and 3， <v> 3， <h>3. P1 holds 1， <v> 1， <h>1. P2 holds 2， <v> 2， <h>2, where h = u·v; h, u, v form a multiplication triplet, satisfying h = u×v;

[0095] The interaction process of the parties involved in the protocol includes the following steps:

[0096] (1) If there is no auxiliary party offline, P0 receives a i of i , i∈{1,2}, and by calculating u=c0· 0+c1· 1+c2· 2Reconstruct the true value of u;

[0097] If a helper P2 is offline, P0 receives a 1, and by calculating u = c0′· 0+c1′· 1+c3′· 3 reconstructs the true value of u; where c0′, c1′, c3′ represent the common parameters used for reconstruction;

[0098] (2) P0 locally calculates e = x + u and sends e to the auxiliary party P i , i∈{1,2};

[0099] (3)P i Local calculation <d> i ＝ <y> i + <v> i , i∈{0, 1, 2}, P0 additional calculation <d> 3＝ <y> 3+ <v>3;

[0100] (4) Participants jointly execute rec (P, <d>), we get d=y+v;

[0101] (5)P i Local calculation <z> i ＝ <h> i - <v> i ·e, i∈{1,2}; at the same time, P0 locally calculates <z>0=x·d / c0+ <h> 0- <v>0·e and <z> 3＝ <h> 3- <v>3·e.

[0102] Please see Figure 3 In one embodiment, the security comparison protocol Π comp , the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3=<1{x>y}>3; where, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;

[0103] If there is no auxiliary party offline, the interaction process of each participant in the security comparison protocol includes the following steps:

[0104] (1) P0 execution Generate a secret key and pass the secret key k i Send to P i , where i∈{1,2}; where N=2 l , l represents the uniform bit length of the data in the method, k1, k2 represent the generated FSS keys, and the auxiliary party P i Will hold the secret key k i , i∈{1,2};

[0105] (2) P0 generates a random number r;

[0106] (3)P i Local calculation <x-y> i ＝ <x> i - <y> i , i∈{0, 1, 2};

[0107] (4) Participants jointly execute extmul (P, r, <x-y>), so that P0 gets<r·(x-y)> 0,<r·(x-y)> 3. P1 gets<r·(x-y)> 1, P2 gets<r·(x-y)> 2;

[0108] (5) P0 will<r·(x-y)> 0 is sent to P1 and P2, and P1 and P2 send to each other<r·(x-y)> i , i∈{1,2};

[0109] (6) P1 and P2 calculate r·(xy)=c0·<r·(x-y)> 0+c1<r·(x-y)> 1+c2<r·(x-y)> 2, the values ​​of r·(xy) are obtained; where c0, c1, c2 represent the common parameters used for reconstruction;

[0110] (7) Auxiliary Party P i Execute separately Get [f] i , where i∈{1,2}; where [f] i represents the secret sharing share of the function;

[0111] (8) Auxiliary Party P i By exchanging [f] i , i∈{1,2}, calculate f=[f]1+[f]2 to get the value of f, and execute Π shr (P i , f), so that P0 gets <f> 0， <f>3. P1 gets <f>1, P2 gets <f>2;Π shr for secret sharing protocols;

[0112] (9) P0 calculation P i calculate <z> i ＝ <f> i , i∈{1,2}; where MSB(r) represents the highest bit of r, Represents bitwise exclusive OR.

[0113] In one embodiment, the security comparison protocol II comp , the privileged party P0 holds the secret share <x> 0， <y> 0， <x> 3， <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i , i∈{0, 1, 2}, in addition, the privileged party P0 gets an additional share 3=<1{x>y}>3; where, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;

[0114] If the auxiliary party P2 is offline, the interaction process of the participants in the security comparison protocol includes the following steps:

[0115] (1)P i Generate random numbers r respectively i , i∈{0,1};

[0116] (2) P0 and P1 use the function secret sharing technology to obtain the secret information of each other without leaking sensitive information. Get k0, k1 respectively; where N = 2 l , l represents the uniform bit length of data in the method; k0, k1 represent the key pair used for function secret sharing;

[0117] (3)P i Local calculation <y> i - <x> i +r i / c i ′, i∈{0,1}, P0 additional calculation <y> 3- <x>3; among them, c i ′ represents the common parameters used for reconstruction;

[0118] (4) P0 and P1 exchange secret shares and calculate c0′·( <y> 0- <x>0+r0 / c0′)+c1′·( <y> 1- <x>1+r1 / c1′)+c3′·( <y> 3- <x>3), reconstruct y-x+r0+r1;

[0119] (5)P i Execute separately where i∈{0,1}; where [f] i represents the secret sharing share of the function;

[0120] (6)P i Execute Π separately shr (P i , [f] i ), so that P0 obtains <[f] i >0,<[f] i >3, P1 gets <[f] i >1, P2 gets <[f] i >2, where i∈{0,1};

[0121] (7)P i Local calculation <z> i =<[f]0> i +<[f]1> i , i∈{0, 1, 2}, P0 additional calculation <z>3=<[f]0>3+<[f]1>3.

[0122] In one implementation, this embodiment provides a multi-party privacy-preserving decision tree training method with privileged parties, comprising the following steps:

[0123] Step 1: P i The data set is represented in vector form according to its features: P0 divides the samples into M categories according to the labels, denoted as Lμ; among them, is represented by the kth partitioned vector of the jth feature; Lμ is the vector used to represent the samples belonging to the μth category, L μ =(1, 0v....), μ=1,...,M, where 1 means the corresponding row of data belongs to the category, and 0 means it does not;

[0124] Step 2: P0 initializes γ and executes Π shr (P0, γ); auxiliary square P i Execute separately in Wherein, γ represents the vector of currently available samples, which is initialized to γ ​​= (1, 1, ..., 1), where 1 indicates that the sample is available and 0 indicates that it is unavailable. The length of the vector is the total number of samples; m (i) Indicated by P i The number of features held; Indicated by P i The number of partitions held for the jth feature;

[0125] Step 3: Determine whether the conditions for being a leaf node are met. If so, return the result; otherwise, continue execution;

[0126] Step 4: For μ∈{1, 2, .., M}, the participants perform Π on the elements in the vector one by one extmul (P, <L μ >, <γ>)→ <C μ >; Among them, <x>Represents the secret sharing share of the vector space of data x;

[0127] Step 5: For The participants jointly perform element-by-element execution on the input vector as well as for Participants execute element by element as well as in, <d r > indicates that the variable and the following are intermediate variables used to calculate Gini impurity;

[0128] Step 6: For When i=0, the participants jointly execute element by element as well as When i∈{1,2}, the participants execute element by element as well as Among them, C μ is a vector representing the available samples belonging to the μth class, <lc μ > and <rc μ > indicates that the variables and the following are the second and third intermediate variables used to calculate the Gini impurity;

[0129] Step 7: Initialize two iteration variables <lc> ＝0， <rc>=0, for each <lc μ >With <rc μ >, the participants execute and And local calculation and

[0130] Step 8: For Participants jointly execute div (P, <lc> ，<d l >)→ <lp>With P div (P, <rc>, <d r >)→, and calculate locally in, Indicated by P i The Gini impurity corresponding to the k-th partition of the j-th feature; <lp>and represent the two sum terms used to calculate the Gini impurity;

[0131] Step 9: For Participants jointly implement Joint implementation And in the same way get <k * >, <j * >, * >; Among them, The best partition corresponding to the best feature of this round value;

[0132] Step 10: P0 receives the signal from P i ,of <k * > i′ , <j * > i′ , * > i′ , i′∈{1,2}, and calculate and reconstruct the best feature And the best partition among them, that is, the kth * divisions; among them, Indicated by The jth * The dataset corresponding to the features;

[0133] Step 11: The participants jointly perform the operation on each element of the vector. and The decision tree model update is completed and returns to step 3; where γ l Represents the available samples of the left child node; γ r Represents the available samples for the right child node.

[0134] This embodiment also provides a multi-party privacy protection decision tree training system with privileged parties, including:

[0135] one or more processors;

[0136] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the multi-party privacy protection decision tree training method with privileged parties.

[0137] ​​The present invention provides a multi-party privacy protection decision tree training method and system with privileged parties, in which one privileged party and two auxiliary parties jointly participate in the training of the decision tree. Even if one auxiliary party is disconnected or conspires in the middle, the privileged party can complete the decision tree training with the remaining auxiliary parties and obtain the training results. In order to support the implementation of the privacy protection decision tree scheme, on the basis of the original pMPL framework (a robust multi-party learning framework with privileged parties), a secure division protocol is designed using random masks, a secure comparison protocol is designed using function secret sharing, and an extended protocol for secure multiplication is given in which the privileged party does not need to share its original data, thereby improving efficiency and reducing communication overhead compared with existing similar schemes while meeting privacy. The present invention is a decision tree training scheme with privileged parties and multi-party participation that meets privacy, robustness and efficiency.

[0138] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0139] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.< / lp> < / rc> < / lp> < / lc> < / rc> < / lc> < / x> < / z> < / z> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / y> < / x> < / y> < / y> < / y> < / x> < / y> < / x> < / f> < / z> < / f> < / f> < / f> < / f> < / y> < / x> < / x-y> < / y> < / x> < / y> < / y> < / y> < / x> < / y> < / x> < / v> < / h> < / z> < / v> < / h> < / z> < / v> < / h> < / z> < / d> < / v> < / y> < / d> < / v> < / y> < / d> < / h> < / v> < / h> < / v> < / h> < / v> < / h> < / v> < / y> < / x> < / z> < / z> < / y> < / y> < / y> < / y> < / x> < / r> < / y> < / y> < / r> < / r> < / y> < / r> < / r0> < / r> < / r1> < / r0> < / r> < / x> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / z> < / z> < / z> < / z> < / y> < / x> < / y> < / x> < / y> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / lp> < / rc> < / lp> < / lc> < / rc> < / lc> < / x> < / z> < / z> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / y> < / x> < / y> < / y> < / y> < / x> < / y> < / x> < / f> < / z> < / f> < / f> < / f> < / f> < / y> < / x> < / x-y> < / y> < / x> < / y> < / y> < / y> < / x> < / y> < / x> < / v> < / h> < / z> < / v> < / h> < / z> < / v> < / h> < / z> < / d> < / v> < / y> < / d> < / v> < / y> < / d> < / v> < / h> < / v> < / h> < / v> < / h> < / v> < / y> < / x> < / z> < / z> < / y> < / y> < / y> < / y> < / x> < / r> < / y> < / y> < / r> < / r> < / y> < / r> < / r1> < / r0> < / r> < / r1> < / r0> < / r> < / x> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / z> < / z> < / z> < / z> < / y> < / x> < / y> < / x> < / y> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A multi-party privacy-preserving decision tree training method with privileged parties, characterized by: During the training, the participants P include a privileged party P0 and two auxiliary parties P1 and P2, using six operation protocols: secret sharing protocol Π shr , Secret Reconstruction Protocol Π rec 、Secure Multiplication Protocol Π mul , Secure Division Protocol Π div , Secure Multiplication Extension Protocol Π extmul and the secure comparison protocol Π comp , by combining basic computing protocols, multi-party privacy-preserving decision tree training that takes into account both privacy and efficiency is achieved.

2. The multi-party privacy-preserving decision tree training method with privileged parties according to claim 1, characterized in that: The secret sharing protocol II shr , used to realize vector space secret sharing; the specific implementation process is: the data holder P i Construct a three-dimensional vector s = (x, s1, s2) for data x T , where s1 and s2 are random numbers, and x represents scalar data; calculate in, <x> j represents the jth secret share generated after vector space secret sharing of data x, Take l = 64 and make P0 get <x> 0, <x>3. P1 holds <x>1. P2 holds <x> 2。< / x> < / x> < / x> < / x> < / x> 3. The multi-party privacy-preserving decision tree training method with privileged parties according to claim 1, characterized in that: The secret reconstruction protocol II rec , which is used to reconstruct the secret sharing share of the vector space; the specific implementation process is: the participants exchange shares and calculate x = c0· <x> 0+c1· <x> 1+c2· <x>2 or x = c0′· <x> 0+c1′· <x> 1+x3′· <x>3 or x = c0" <x> 0+c2″· <x> 2+c3″· <x>3. Reconstruct the true value of x; where <x> j represents the jth secret share generated after vector space secret sharing of the data x, j∈{0,1,2,3}; c0,c1,c2,c0′,c1′,c3′,c0″,c2″,c3″ represent the public parameters used for reconstruction.< / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> 4. The multi-party privacy-preserving decision tree training method with privileged parties according to claim 1, characterized in that: The secure multiplication protocol Π mul , which is used to realize the multiplication of two numbers in the form of secret shares, and the multiplication results are all in the form of secret shares; the specific implementation process is: for P0 input <x> j , <y> j ,P1 input <x> 1, <y>1, P2 input <x> 2, <y>2. Three-way output <z>0=<x·y> 0 and <z>3=<x·y>3、 <z>1=<x·y>1、 <z>2=<x·y> 2;< / z> < / z> < / z> < / z> < / y> < / x> < / y> < / x> < / y> < / x> in, <x> j 、 <y> j Respectively represent the jth secret share generated after vector space secret sharing of data x and y, j∈{0,1,2,3}; use Implement key generation for function secret sharing; use Realize the generation of function shared secret shares, where when x < α, [f]0 + [f]1 = f = β, otherwise [f]0 + [f]1 = f = 0; k i Represents the generated key, u∈{0,1}.< / y> < / x> 5. The multi-party privacy-preserving decision tree training method with privileged parties according to claim 1, characterized in that: The secure division protocol II div , including the protocol preprocessing process and the interaction process of each party in the protocol; In the secure division protocol, the privileged party P0 holds the secret share <x> 0, <y> 0, <x> 3, <y>3. Auxiliary party P1 holds the secret share <x> 1, <y>1. Auxiliary party P2 holds the secret share <x> 2, <y>2. By jointly participating in the implementation of the safe division protocol, each participant P i Get the secret share of the division result respectively i ＝ <x y> i ,i∈{0,1,2}, in addition, the privileged party P0 gets an additional share 3＝ <x y> 3; where x and y represent data;< / x> The protocol preprocessing process comprises the following steps: (1)P i Generate a random number r respectively i , where i∈{0,1,2}; (2)P i Execute the secret sharing protocol Π separately shr (P i ,r o ), therefore, P0 holds <r i >0, <r i >3, P1 holds <r i >1, P2 holds <r i >2; (3)P i Local calculation <r> i ＝ <r0> i + <r1> i + <r2> i , P0 additional calculation <r> 3＝ <r0> 3+ <r1> 3+ <r2> 3；< / r2> < / r1> < / r0> < / r> < / r1> < / r0> < / r> The interaction process of the parties involved in the protocol includes the following steps: (1) Participants jointly execute the secure multiplication protocol Π mul (P, <r> , <y>), P i get<r·y> i , P0 gets an additional share<r·y> 3; among them, <r>express <r> i A collection of <y>express <y> i gather;< / y> < / y> < / r> < / r> < / y> < / r> (2) The parties jointly execute the reconstruction agreement Π rec (P,<r·y> ), both get r·y; (3) Participants jointly execute the secure multiplication protocol Π mul (P, <r> , <x>), P i get<r·x> i , P0 gets an additional share<r·x> 3;< / x> < / r> (4)P i Local calculation i =<r·x> i / r·y, P0 additional calculation 3=<r·x> 3 / r·y.

6. The method for training multi-party privacy-preserving decision trees with privileged parties according to claim 1, characterized in that: The secure multiplication extension protocol II extmul , including the protocol preprocessing process and the interaction process of each party in the protocol; The secure multiplication extension protocol, the privileged party P0 holds x and the secret share <y> 0, <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the secure multiplication extension protocol, each participant P i Get the secret share of the multiplication result respectively <z> i =<x·y> i ,i∈{0,1,2}, in addition, the privileged party P0 gets an additional share <z> 3=<x·y> 3;< / z> < / z> < / y> < / y> < / y> < / y> in, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;< / y> < / x> In the protocol preprocessing process, the participants execute the vector multiplication triples to generate the protocol Π vmtgen (P), therefore, P0 holds 0, <v> 0, <h>0 and 3, <v> 3, <h>3. P1 holds 1, <v> 1, <h>1. P2 holds 2, <v> 2, <h> 2, where h = u·v; h, u, v form a multiplication triplet, satisfying h = u×v;< / h> < / v> < / h> < / v> < / h> < / v> < / h> < / v> The interaction process of the parties involved in the protocol includes the following steps: (1) If there is no auxiliary party offline, P0 receives a i of i ,i∈{1,2}, and by calculating u=c0· 0+c1· 1+c2· 2Reconstruct the true value of u; If a helper P2 is offline, P0 receives a 1, and by calculating u = c0′· 0+c1′· 1+c3′· 3 reconstructs the true value of u; where c0′, c1′, c3′ represent the common parameters used for reconstruction; (2) P0 locally calculates e = x + u and sends e to the auxiliary party P i ,i∈{1,2}; (3)P i Local calculation <d> i ＝ <y> i + <v> i ,i∈{0,1,2}, P0 additional calculation <d> 3＝ <y> 3+ <v> 3；< / v> < / y> < / d> < / v> < / y> < / d> (4) Participants jointly execute rec (P, <d> ), we get d=y+v;< / d> (5)P i Local calculation <z> i ＝ <h> i - <v> i ·e,i∈{1,2}; at the same time, P0 locally calculates <z>0=x·d / c0+ <h> 0- <v>0·e and <z> 3＝ <h> 3- <v> 3·e。< / v> < / h> < / z> < / v> < / h> < / z> < / v> < / h> < / z> 7. The method for training multi-party privacy-preserving decision trees with privileged parties according to claim 1, characterized in that: The secure comparison protocol II comp , the privileged party P0 holds the secret share <x> 0, <y> 0, <x> 3, <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i ,i∈{0,1,2}, in addition, the privileged party P0 gets an additional share 3 = <1{x>y}>3; < / y> < / y> < / y> < / x> < / y> < / x> in, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;< / y> < / x> If there is no auxiliary party offline, the interaction process of each participant in the security comparison protocol includes the following steps: (1) P0 execution Generate a secret key and pass the secret key k i Send to P i , where i∈{1,2}; where N=2 l , l represents the uniform bit length of the data in the method, k1, k2 represent the generated FSS keys, and the auxiliary party P i Will hold the secret key k i , i∈{1,2}; (2) P0 generates a random number r; (3)P i Local calculation <x-y> i ＝ <x> i - <y> i ,i∈{0,1,2}；< / y> < / x> < / x-y> (4) Participants jointly execute extmul (p,r, <x-y> ), so that P0 gets<r·(x-y)> 0,<r·(x-y)> 3, p1 gets<r·(x-y)> 1, P2 gets<r(x-y)> 2;< / x-y> (5) P0 will<r·(x-y)> 0 is sent to P1 and P2, and P1 and P2 send to each other<r·(x-y)> i ,i∈{1,2}; (6) P1 and P2 calculate r·(xy)=c0·<r·(x-y)> 0+c1<r·(x-y)> t +c2<r·(x-y)> 2, the values ​​of r·(xy) are obtained; where c0, c1, c2 represent the common parameters used for reconstruction; (7) Auxiliary Party P i Execute separately Get [f] i , where i∈{1,2}; where [f] i represents the secret sharing share of the function; (8) Auxiliary Party P i By exchanging [f] i ,i∈{1,2}, calculate f=[f]1+[f]2 to get the value of f, and execute Π shr (P i ,f), so that P0 gets <f> 0, <f>3. P1 gets <f>1, P2 gets <f>2;Π shr for secret sharing protocols;< / f> < / f> < / f> < / f> (9) P0 calculation P i calculate <z> i ＝ <f> i ,i∈{1,2}; where MSB(r) represents the highest bit of r, Represents bitwise exclusive OR.< / f> < / z> 8. The method for training multi-party privacy-preserving decision trees with privileged parties according to claim 1, characterized in that: The secure comparison protocol II comp , the privileged party P0 holds the secret share <x> 0, <y> 0, <x> 3, <y>3. Auxiliary party P1 holds the secret share <y>1. Auxiliary party P2 holds the secret share <y>2. By jointly participating in the execution of the security comparison protocol, each participant P i Get the secret shares of the comparison results respectively i =<1{x>y}> i ,i∈{0,1,2}, in addition, the privileged party P0 gets an additional share 3 = <1{x>y}>3; < / y> < / y> < / y> < / x> < / y> < / x> in, <x> j 、 <y> j Represent the j-th vector space secret sharing share of data x and y respectively;< / y> < / x> If the auxiliary party P2 is offline, the interaction process of the participants in the security comparison protocol includes the following steps: (1)P i Generate random numbers r respectively i ,i∈{0,1}; (2) P0 and P1 use the function secret sharing technology to obtain the secret information of each other without leaking sensitive information. Get k0, k1 respectively; where N = 2 l , l represents the uniform bit length of data in the method; k0, k1 represent the key pair used for function secret sharing; (3)P i Local calculation <y> i - <x> i +r i / c i ′,i∈{0,1}, P0 additional calculation <y> 3- <x>3; among them, c i ′ represents the common parameters used for reconstruction;< / x> < / y> < / x> < / y> (4) P0 and P1 exchange secret shares and calculate c0′·( <y> 0- <x>0+r0 / c0′)+c1′·( <y> 1- <x>1+r1 / c1′)+c3′·( <y> 3- <x> 3), reconstruct y-x+r0+r1;< / x> < / y> < / x> < / y> < / x> < / y> (5)P i Execute separately where i∈{0,1}; where [f] i represents the secret sharing share of the function; (6)P i Execute Π separately shr (P i ,[f] i ), so that P0 obtains <[f] i >0,<[f] i >3, P1 gets <[f] i >1, P2 gets <[f] i >2, where i∈{0,1}; (7)P i Local calculation <z> i =<[f]0> i +<[f]1> i ,i∈{0,1,2}, P0 additional calculation <z> 3=<[f]0>3+<[f]1>3.< / z> < / z> 9. The method for training a multi-party privacy-preserving decision tree with privileged parties according to any one of claims 1 to 8, characterized in that: The following steps are involved: Step 1: P i The data set is represented in vector form according to its features: P0 divides the samples into M categories according to the labels, denoted as L μ ;in, is represented by the Kth partition vector of the jth feature; L μ is a vector used to represent samples belonging to the μth category, L μ =(1,0,…),μ=1,…,Μ, where 1 means the corresponding row of data belongs to the category, and 0 means it does not; Step 2: P0 initializes γ and executes Π shr (P0,γ); auxiliary party P i Execute separately in Where γ represents the vector of currently available samples, which is initialized to γ ​​= (1, 1, ..., 1), where 1 indicates that the sample is available and 0 indicates that it is unavailable. The length of the vector is the total number of samples; m (i) Indicated by P i The number of features held; Indicated by P i The number of partitions held for the jth feature; Step 3: Determine whether the conditions for being a leaf node are met. If so, return the result; otherwise, continue execution; Step 4: For μ∈{1,2,..,Μ}, the participants execute Π on the elements in the vector one by one extmul (P, <L μ >,<γ>)→ <C μ >; Among them, <x> Represents the secret sharing share of the vector space of data x;< / x> Step 5: For The participants jointly perform element-by-element execution on the input vector as well as for Participants execute element by element as well as in, <d r > indicates that the variable and the following are intermediate variables used to calculate Gini impurity; Step 6: For When i=0, the participants jointly execute element by element as well as When i∈{1,2}, the participants execute element by element as well as Among them, C μ is a vector representing the available samples belonging to the μth class, <lc μ > and <rc μ > indicates that the variables and the following are the second and third intermediate variables used to calculate the Gini impurity; Step 7: Initialize two iteration variables <lc> ＝0, <rc>=0, for each <lc μ >With <rc μ >, the participants execute and And local calculation and < / rc> < / lc> Step 8: For Participants jointly execute div (P, <lc> ,<d l >)→ <lp>With P div (P, <rc>, <d r >)→, and calculate locally in, Indicated by P i The Gini impurity corresponding to the k-th partition of the j-th feature; <lp> and represent the two sum terms used to calculate the Gini impurity;< / lp> < / rc> < / lp> < / lc> Step 9: For Participants jointly implement Joint implementation And in the same way get <k * >, <j * >, * >; Among them, k * ,j * ,i * The best partition corresponding to the best feature of this round k,j,i values;​ Step 10: P0 receives the signal from P i′ of <k * > i′ , <j * > i′ , * > i ′,i′∈{1,2}, and calculate and reconstruct the best feature And the best partition among them, that is, the kth * divisions; among them, Indicated by The jth * The dataset corresponding to the features;​ Step 11: The participants jointly perform the operation on the vector element by element and The decision tree model update is completed and returns to step 3; where γ l Represents the available samples of the left child node; γ r Represents the available samples for the right child node.

10. A multi-party privacy-preserving decision tree training system with privileged parties, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the multi-party privacy-preserving decision tree training method with privileged parties as described in any one of claims 1 to 9. < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x>

Images