Model reasoning method, device and equipment based on function encryption

Abstract

The embodiment of the invention relates to the technical field of data processing, in particular to a model reasoning method, device and equipment based on function encryption. The user side configures public parameters according to the security parameters and the classification set, generates a master key according to the public parameters and sends the master key to the data side and the model side; the model party judges a target function of the user party after receiving the master key sent by the user party, generates a model key according to the master key and the target function, and sends the model key to the user party; after the data party receives the master key sent by the user party, the demand of the user party is judged, a ciphertext is generated according to the master key and the demand and sent to the user party, and finally the user party obtains a classification result in the classification set according to the model key and the ciphertext. Therefore, the learning model of the model party and the data of the data party are respectively encrypted and respectively sent to the user party, and the model party and the data party only need to provide the ciphertext and the secret key without participating in the execution process.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of data processing technology, and in particular to a model reasoning method, device and equipment based on function encryption. Background Art

[0002] At present, big data plays an increasingly important role. Data sharing and trading have become a hot topic in current technology and business. Since data is quite different from traditional commodities, such as easy to lose, easy to copy, and need to be kept confidential, etc. Therefore, there are higher requirements for transaction processing capabilities, traceability of transaction processes, integrity and reliability of transaction data. For enterprises with limited data collection capabilities, data trading will be a mutually beneficial work that can promote the company's innovation. Compared with other traditional production factors, the uniqueness of data is that once it is used or seen, the information contained in the data will be leaked. Moreover, it can be disseminated or copied infinitely, resulting in a large amount of data dissemination, which reduces the value of data. The value of data and privacy protection have become a contradiction. When data is valuable, it will lead to data leakage. Once data is leaked and spread, it is difficult for the data source to use the data again to obtain value, which brings very unfavorable results. At the same time, since it is difficult to trace the source of data leakage, it is difficult to hold the leaker and the abuser accountable. In addition, the data of some institutions and enterprises also involve the privacy of users. In order to protect user privacy, the circulation and value of data are further restricted. Although homomorphic encryption technology has been proposed in this field to achieve the balance between data value mining and privacy protection. However, homomorphic encryption technology can only realize addition and multiplication operations at present, and its application scope is very limited. Therefore, it is necessary to continue to study the technology of privacy computing.

[0003] Existing solutions usually use homomorphic encryption solutions, but this solution has the following privacy and security issues that need to be urgently addressed: First, the private data held by the data party cannot be sent to the user party in plain text, otherwise it will violate relevant data privacy protection regulations. Secondly, the machine learning classifier held by the model party cannot be sent to the user party in plain text. Because the machine learning model is the confidential information of the model party, if the model is given directly to the user party, it may lead to model leakage. In addition, the data party and the model party tend to process the data or model (to ensure that the data and model are not leaked) and then hand it over to the user party for use, and do not want to participate in the subsequent complex model use process.

[0004] Currently, there is an urgent need for a model reasoning method based on function encryption, which can encrypt the learning model of the model party and the data of the data party respectively and send them to the user party separately, so that the model party and the data party only need to provide ciphertext and key, and do not need to participate in the execution process. Summary of the invention

[0005] In order to solve the problems of poor security and low efficiency in homomorphic encryption schemes in the prior art, the embodiments of this specification provide a model reasoning method, device and equipment based on function encryption, which ensures that the data party or the model party does not perform decryption operations and will not obtain classification results, thereby ensuring the information security of the user party; at the same time, the model party and the data party only need to generate keys and do not need to participate in the complex model usage process. The process of calculating the classification results with the largest computational effort is performed by the user himself, which improves the efficiency of function encryption.

[0006] The specific technical solutions of the embodiments of this specification are as follows:

[0007] On the one hand, the embodiments of this specification provide a model reasoning method based on function encryption, including:

[0008] The user party configures public parameters according to the security parameters and the classification set, generates a master key according to the public parameters and sends it to the data party and the model party;

[0009] After receiving the master key sent by the user, the model party determines the objective function of the user, generates a model key according to the master key and the objective function, and sends the model key to the user;

[0010] After receiving the master key sent by the user party, the data party determines the needs of the user party, generates a ciphertext according to the master key and the needs, and sends it to the user party;

[0011] The user obtains a classification result from the classification set according to the model key and the ciphertext.

[0012] Furthermore, the user configures the public parameters according to the security parameters and the classification set, further including:

[0013] The user party obtains security parameters and classification set S according to business requirements;

[0014] The public parameters are configured according to the security parameters and the classification set S as follows:

[0015] pp=(G1,G2,G T ,g1,g2,q,e,S),

[0016] Among them, G1, G2, G T is a cyclic group; g1 and g2 are generators of cyclic groups G1 and G2 respectively; q is a cyclic group G1, G2, G T The order of; e is the element in G1 and G2 mapped to G T The bilinear mapping of the elements in , S is a classified set.

[0017] Furthermore, generating a master key according to the public parameters further includes:

[0018] The master key generated according to the public parameter configuration is: msk = (pp, B, B * ),

[0019] Where B is a randomly selected reversible matrix B with n rows and n columns, whose elements all belong to the set Z q ={0,1,2,…,q-1}, B * =det(B)·(B -1 ) T , det(B) is the determinant of matrix B, B -1 is the inverse matrix of matrix B, (B -1 ) T Symbols in Represents the transpose of a matrix.

[0020] Further, determining the objective function of the user and generating the model key according to the master key and the objective function further includes:

[0021] The model party receives the master key msk=(pp,B,B * ) and then create a set Z based on the master key q And select a random element α;

[0022] Building a learning model Calculate the intermediate value X' = X·B, and is an n-dimensional vector;

[0023] The model key is calculated based on the learning model

[0024] Further, determining the needs of the user and generating ciphertext according to the master key and the needs further includes:

[0025] The data party receives the master key msk=(pp,B,B * ) and then create a set Z based on the master key q And select a random element β;

[0026] Building private data Calculate the intermediate value Y'=Y·B, and is an n-dimensional vector;

[0027] Generate ciphertext based on the private data

[0028] Furthermore, the user side obtains the classification result in the classification set according to the model key and the ciphertext further includes:

[0029] The user generates the formula according to the model key sk=(K1, K2) and the ciphertext ct=(C1, C2):

[0030]

[0031] Find such that (D1) s =D2 holds true for s∈S, which is the classification result.

[0032] On the other hand, the embodiment of this specification also provides a model reasoning device based on function encryption, the device comprising:

[0033] A master key generation unit, located at the user side, is used to configure public parameters according to the security parameters and the classification set, generate a master key according to the public parameters, and send it to the data side and the model side;

[0034] The model side unit is used to determine the objective function of the user side after receiving the master key sent by the user side, generate a model key according to the master key and the objective function, and send the model key to the user side;

[0035] The data party unit is used to determine the needs of the user party after receiving the master key sent by the user party, generate a ciphertext according to the master key and the needs, and send it to the user party;

[0036] A classification result generating unit is located at the user side and is used to obtain a classification result in the classification set according to the model key and the ciphertext.

[0037] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, and the processor implements the above method when executing the computer program.

[0038] On the other hand, an embodiment of the present specification further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0039] Finally, the embodiments of this specification also provide a computer program product, wherein the computer program product includes a computer program, and the computer program implements the above method when executed by a processor.

[0040] By using the embodiment of this specification, a model reasoning method is provided that realizes three-party encryption without privacy data sharing through function encryption. First, the user configures the public parameters according to the security parameters and the classification set, generates the master key according to the public parameters and sends it to the data party and the model party; after the model party receives the master key sent by the user party, it determines the user's objective function, and generates the model key according to the master key and the objective function and sends it to the user party; at the same time, after the data party receives the master key sent by the user party, it determines the data required by the user party, encrypts the data by the algorithm generated by the master key to generate ciphertext, and sends it to the user party; finally, the user party obtains the classification result in the classification set according to the model key and the ciphertext. It is achieved to ensure that the data party or the model party does not perform the decryption operation and will not obtain the classification result, thereby ensuring the information security of the user party; at the same time, the model party and the data party only need to generate the key, and do not need to participate in the complex model use process. The process of calculating the classification result with the largest amount of calculation is performed by the user party itself, which improves the efficiency of model reasoning. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 The figure shows a schematic diagram of an implementation system of a model reasoning method based on function encryption in an embodiment of this specification;

[0043] Figure 2 The figure is a flow chart of a model reasoning method based on function encryption in an embodiment of this specification;

[0044] Figure 3 The figure is a schematic diagram of the process of generating a model key in the embodiment of this specification;

[0045] Figure 4 The figure shows a schematic diagram of an implementation system of a model reasoning method based on function encryption in an embodiment of this specification;

[0046] Figure 5 The figure shows a specific structural diagram of the model reasoning device based on function encryption in this embodiment;

[0047] Figure 6 The figure is a schematic diagram of the structure of a computer device in an embodiment of the present specification.

[0048]

Description of reference numerals

[0049] 101. User side;

[0050] 102. Model side;

[0051] 103. Data Cube;

[0052] 501. Master key generation unit;

[0053] 502, model square unit;

[0054] 503, data cube unit;

[0055] 504. Classification result generating unit;

[0056] 602. Computer equipment;

[0057] 604. Processing equipment;

[0058] 606. Storage resources;

[0059] 608. Drive system;

[0060] 610, input / output module;

[0061] 612. Input devices;

[0062] 614. Output devices;

[0063] 616. Presentation equipment;

[0064] 618. Graphical user interface;

[0065] 620, network interface;

[0066] 622, communication link;

[0067] 624. Communication bus. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of this specification.

[0069] It should be noted that the terms "first", "second", etc. in the description and claims of the embodiments of this specification and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of this specification described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0070] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification comply with the relevant provisions of national laws and regulations.

[0071] It should be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0072] like Figure 1 The diagram shows a schematic diagram of an implementation system of a model reasoning method based on function encryption in an embodiment of the specification, including a user party 101, a model party 102 and a data party 103. The user party 101, the model party 102 and the data party 103 can communicate through a network, and the network may include a local area network (Local Area Network, referred to as LAN), a wide area network (Wide Area Network, referred to as WAN), the Internet or a combination thereof, and is connected to a website, a user device (such as a computing device) and a back-end system. Optionally, the model party 102 and the data party 103 can be nodes of a cloud computing system, or each server can be a separate cloud computing system, including multiple computers interconnected by a network and working as a distributed processing system.

[0073] The user party 101 configures the public parameters according to the security parameters and the classification set, generates a master key according to the public parameters and sends it to the model party 102 and the data party 103. The model party 102 generates a model key using the master key and the objective function. The data party 103 generates a ciphertext according to the master key and user requirements, and returns the model key and ciphertext to the user party 101 for model inference.

[0074] In addition, it should be noted that Figure 1What is shown is only one application environment provided by the embodiment of this specification. In actual application, other application environments may also be included, and this specification does not limit it.

[0075] In view of the problems existing in the prior art, the embodiments of this specification provide a model reasoning method based on function encryption. Through the triangular privacy calculation method and function encryption, it is ensured that the model party and the data party only need to encrypt the data and then host it to the user party, and do not participate in other complex calculations. The process of calculating the classification result with the largest amount of calculation (i.e., the decryption algorithm) is executed by the user himself.

[0076] Figure 2 The figure shows a flow chart of the model reasoning method based on function encryption in the embodiment of this specification. The model reasoning process based on function encryption is described in this figure. The order of steps listed in the embodiment is only one way of executing the order of many steps, and does not represent the only execution order. When the system or device product is executed in practice, it can be executed in the order of the method shown in the embodiment or the accompanying drawings or in parallel.

[0077] Specific as Figure 2 As shown, the method may include:

[0078] Step 201: The user configures public parameters according to security parameters and classification sets, generates a master key according to the public parameters, and sends it to the data party and the model party;

[0079] Step 202: After receiving the master key sent by the user, the model side determines the user's objective function, generates a model key according to the master key and the objective function, and sends the model key to the user;

[0080] Step 203: After receiving the master key sent by the user party, the data party determines the needs of the user party, generates a ciphertext according to the master key and the needs, and sends it to the user party;

[0081] Step 204: The user obtains a classification result from the classification set according to the model key and the ciphertext.

[0082] By using the embodiment of this specification, a model reasoning method is provided that realizes three-party encryption without privacy data sharing through function encryption. First, the user configures the public parameters according to the security parameters and the classification set, generates the master key according to the public parameters and sends it to the data party and the model party; after the model party receives the master key sent by the user party, it determines the user's objective function, and generates the model key according to the master key and the objective function and sends it to the user party; at the same time, after the data party receives the master key sent by the user party, it determines the data required by the user party, encrypts the data by the algorithm generated by the master key to generate ciphertext, and sends it to the user party; finally, the user party obtains the classification result in the classification set according to the model key and the ciphertext. It is achieved to ensure that the data party or the model party does not perform the decryption operation and will not obtain the classification result, thereby ensuring the information security of the user party; at the same time, the model party and the data party only need to generate the key, and do not need to participate in the complex model use process. The process of calculating the classification result with the largest amount of calculation is performed by the user party itself, which improves the efficiency of model reasoning.

[0083] In the embodiments of this specification, the data party or the model party does not perform the decryption operation, so no classification result is obtained; the result of decrypting the model key and ciphertext on the user side is not the original private data, but the classification result of a machine learning model on the private data, which ensures that the process will not expose the information of the private data and the machine learning model, and the process of calculating the classification result with the largest computational effort (i.e., the decryption algorithm) is performed by the user side itself. The privacy data security problem existing in the prior art is solved: the solution of this specification does not require special hardware support, avoiding additional human and material investment in hardware facilities.

[0084] According to one embodiment of this specification, Figure 3 As shown, in order to obtain public parameters and provide them to the data party and the model party at the same time, the user party configures the public parameters according to the security parameters and the classification set, further including:

[0085] Step 301: The user obtains security parameters and a classification set S according to business requirements;

[0086] Step 302: configure public parameters according to the security parameters and the classification set S.

[0087] The public parameters are expressed as: pp = (G1, G2, GT, g1, g2, q, e, S),

[0088] Among them, G1, G2, G T is a cyclic group; g1 and g2 are generators of cyclic groups G1 and G2 respectively; q is a cyclic group G1, G2, G T The order of; e is the element in G1 and G2 mapped to G TThe bilinear mapping of the elements in , S is a classified set.

[0089] Specifically, the user executes the configuration algorithm to generate the master key msk. First, the public parameters configured by the user according to the security parameters and the classification set S are expressed as pp = (G1, G2, G T ,g1,g2,q,e,S). Among them, S is a classification set composed of classification results involved in business needs.

[0090] In one embodiment of the present specification, generating a master key according to the public parameters further includes generating a master key according to the public parameter configuration as follows: msk = (pp, B, B * ), where B is a randomly selected reversible matrix B with n rows and n columns, whose elements all belong to the set Z q ={0,1,2,…,q-1}, B * =det(B)·(B -1 ) T , det(B) is the determinant of matrix B, B -1 is the inverse matrix of matrix B, (B -1 ) T Symbols in Represents the transpose of a matrix.

[0091] Specifically, the user configures the master key msk=(pp,B,B * ). Where B is a randomly selected reversible matrix B with n rows and n columns, whose elements all belong to the set Z q ={0,1,2,…,q-1}, B * =det(B)·(B -1 ) T , det(B) is the determinant of matrix B, B -1 is the inverse matrix of matrix B, (B -1 ) T Symbols in Represents the transpose of the matrix. The user sends the master key msk to the data party and the model party.

[0092] In another embodiment of the present specification, the user can also configure the master key as msk=(pp,U,U * ,V,V * ), where U,U * It is a 2n-dimensional vector space A set of dual orthogonal bases, V, V * It is a 2-dimensional vector space Specifically, U=(u1,u2,...,u 2n ), V=(v1,v2), The user sends the master key msk to the data party and the model party.

[0093] In the embodiment of the present specification, in order to determine the model key required by the user, generating the model key according to the master key and the objective function further includes:

[0094] The model party receives the master key msk=(pp,B,B * ) then, from the set Z q Select a random element α from ;

[0095] Building a learning model Calculate the intermediate value X' = X·b, and is an n-dimensional vector;

[0096] The model key is calculated based on the learning model

[0097] Specifically, the model executes the algorithm and receives the master key msk=(pp,B,B * ), from the set Z q Choose a random element α from . Build a machine learning model that is essentially an n-dimensional vector Calculate the intermediate value X' = X·B, and The model side then calculates and sends the key based on the learning model To the user side.

[0098] In another embodiment of the present specification, upon receiving the master key msk=(pp,U,U * ,V,V * ), from the set Z q Select 2 random elements α1 and α2 from . Build a machine learning model that is essentially an n-dimensional vector The model side then calculates and sends the key based on the learning model To the user side.

[0099] In the embodiment of this specification, in order to obtain the data of the data party, it is also necessary to determine the needs of the user party, and generating the ciphertext according to the master key and the needs further includes:

[0100] The data party receives the master key msk=(pp,B,B * ) then, from the set Z q Select a random element β from ;

[0101] Building private data Calculate the intermediate value Y'=Y·B, and is an n-dimensional vector;

[0102] Generate ciphertext based on the private data

[0103] Specifically, the data party executes the encryption algorithm. After receiving the master key msk=(pp,B,B * ), from the set Z q Select a random element β from (essentially an n-dimensional vector), calculate the intermediate value Y' = Y·B, and is an n-dimensional vector. The data party calculates and sends the ciphertext To the user side.

[0104] In another embodiment of the present specification, the data party executes the encryption algorithm and can also receive the master key msk=(pp,U,U * ,V,V * ), from the set Z q Select two random elements β1 and β2 from the . (Essentially an n-dimensional vector), the data party calculates and sends the ciphertext To the user side.

[0105] In the embodiment of the present specification, in order to obtain the final classification result, the user side obtains the classification result in the classification set according to the model key and the ciphertext further includes:

[0106] The user generates the formula according to the model key sk=(K1, K2) and the ciphertext ct=(C1, C2):

[0107] Find such that (D1) s =D2 holds true for s∈S, which is the classification result.

[0108] Specifically, the user side runs the decryption algorithm. After receiving the key sk=(K1, K2) sent by the model side and the ciphertext ct=(C1, C2) sent by the data side, the user side calculates:

[0109] The user checks all the values ​​in the classification result set S and finds the value such that (D1) s =S∈S where D2 holds is the classification result.

[0111] In another embodiment of the present specification, the user side runs the decryption algorithm. After receiving the key sk = (K1, K2) sent by the model side and the ciphertext ct = (C1, C2) sent by the data side, the user side calculates:

[0112]

[0113] The user checks all the values ​​in the classification result set S and finds the value such that (D1) s =S∈S where D2 holds is the classification result.

[0114] For example, Figure 4 As shown, the function encryption in the embodiment of this specification includes four algorithms, namely, the configuration algorithm Setup, which is used to generate the master key msk; the key generation algorithm KeyGen, which uses the master key msk and the data vector X to generate the key sk; the encryption algorithm Encrypt, which encrypts the data vector Y with the key sk to generate the ciphertext ct; the decryption algorithm Decrypt, which decrypts the ciphertext ct with the key sk to obtain the result<X,Y> , where <,> represents the inner product. Compared with general symmetric encryption and asymmetric encryption algorithms, the characteristic of function encryption algorithms is that their classification results are not original data, but the result of a certain original function acting on this data, thus ensuring that the machine learning model of the model party and the privacy data information of the data party will not be exposed during the function encryption process.

[0115] As an example of this specification, please refer to Figure 5 FIG. 4 is a schematic diagram showing the specific structure of the salary calculation result verification device based on the clustering algorithm in this embodiment.

[0116] A master key generation unit 501 is located at the user side and is used to configure public parameters according to security parameters and classification sets, generate a master key according to the public parameters, and send it to the data side and the model side;

[0117] The model side unit 502 is used to determine the objective function of the user side after receiving the master key sent by the user side, generate a model key according to the master key and the objective function, and send the model key to the user side;

[0118] The data party unit 503 is used to determine the needs of the user party after receiving the master key sent by the user party, generate a ciphertext according to the master key and the needs, and send it to the user party;

[0119] The classification result generating unit 504 is located at the user side and is used to obtain the classification result in the classification set according to the model key and the ciphertext.

[0120] Since the principle of solving the problem by the above device is similar to that of the above method, the implementation of the above system can refer to the implementation of the above method, and the repeated parts will not be repeated.

[0121] like Figure 6 The figure is a schematic diagram of the structure of a computer device according to an embodiment of the present specification. The computer device according to the embodiment of the present specification can run the method according to the embodiment of the present specification.

[0122] The computer device 602 may include one or more processing devices 604, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. The computer device 602 may also include any storage resources 606 for storing any type of information such as code, settings, data, etc. Without limitation, for example, the storage resources 606 may include any one or more combinations of the following: any type of RAM, any type of ROM, a flash memory device, a hard disk, an optical disk, etc. More generally, any storage resource may use any technology to store information.

[0123] Further, any storage resource may provide volatile or non-volatile retention of information.

[0124] Further, any storage resource may represent a fixed or removable component of the computer device 602. In one case, when the processing device 604 executes the associated instructions stored in any storage resource or combination of storage resources, the computer device 602 may perform any operation of the associated instructions. The computer device 602 also includes one or more drive systems 608 for interacting with any storage resource, such as a hard disk drive system, an optical disk drive system, etc.

[0125] The computer device 602 may also include an input / output module 610 (I / O) for receiving various inputs (via input device 612) and for providing various outputs (via output device 614). A specific output mechanism may include a presentation device 616 and an associated graphical user interface 618 (GUI). In other embodiments, the input / output module 610 (I / O), input device 612, and output device 614 may not be included, and the computer device 602 may be used as a computer device in a network. The computer device 602 may also include one or more network interfaces 620 for exchanging data with other devices via one or more communication links 622. One or more communication buses 624 couple the components described above together.

[0126] The communication link 622 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 622 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0127] The embodiments of the present specification also provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0128] The embodiments of the present specification also provide a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to execute the above method.

[0129] It should be understood that in the various embodiments of the present specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present specification.

[0130] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the embodiments of this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0131] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of this specification can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of this specification.

[0132] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0133] In the several embodiments provided in the embodiments of this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0134] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0135] In addition, each functional unit in each embodiment of the present specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0136] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0137] The embodiments of this specification use specific embodiments to illustrate the principles and implementation methods of the embodiments of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of the embodiments of this specification. At the same time, for those skilled in the art, according to the ideas of the embodiments of this specification, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the embodiments of this specification.

Claims

1. A model reasoning method based on function encryption, characterized in that: The method comprises: The user party configures public parameters according to the security parameters and the classification set, generates a master key according to the public parameters and sends it to the data party and the model party; After receiving the master key sent by the user, the model party determines the objective function of the user, generates a model key according to the master key and the objective function, and sends the model key to the user; After receiving the master key sent by the user party, the data party determines the needs of the user party, generates a ciphertext according to the master key and the needs, and sends it to the user party; The user obtains a classification result from the classification set according to the model key and the ciphertext.

2. The model reasoning method based on function encryption according to claim 1 is characterized in that: The user configures the public parameters according to the security parameters and the classification set, further including: The user party obtains security parameters and classification set S according to business requirements; The public parameters are configured according to the security parameters and the classification set S as follows: pp=(G1,G2,G T ,g1,g2,q,e,S), Among them, G1, G2, G T is a cyclic group; g1 and g2 are generators of cyclic groups G1 and G2 respectively; q is a cyclic group G1, G2, G T The order of; e is the element in G1 and G2 mapped to G T The bilinear mapping of the elements in , S is a classified set.

3. The model reasoning method based on function encryption according to claim 2 is characterized in that: Generating a master key according to the public parameters further comprises, The master key generated according to the public parameter configuration is: msk = (pp, B, B * ), Where B is a randomly selected reversible matrix B with n rows and n columns, whose elements all belong to the set Z q ={0,1,2,...,q-1},B * =det(B)·(B -1 ) T , det(B) is the determinant of matrix B, B -1 is the inverse matrix of matrix B, (B -1 ) T Symbols in Represents the transpose of a matrix.

4. The model reasoning method based on function encryption according to claim 3 is characterized in that: Determining the objective function of the user side and generating the model key according to the master key and the objective function further includes: the model side receives the master key msk=(pp, B, B * ) and then create a set Z based on the master key q and select a random element α, where Z q It is a finite field where the encryption algorithm is located and has no real meaning; Building a learning model Calculate the intermediate value X' = X·B, and is an n-dimensional vector, where x1,x2,…,x n It is a metaphor, without real meaning; The model key is calculated based on the learning model Among them, K1K2 is used to refer to the two values ​​after the equation and has no real meaning.

5. The model reasoning method based on function encryption according to claim 4 is characterized in that: Determining the needs of the user and generating ciphertext according to the master key and the needs further includes: The data party receives the master key msk=(pp,B,B * ) and then create a set Z based on the master key q And select a random element β; Building private data Calculate the intermediate value Y'=Y·B, and is an n-dimensional vector; Generate ciphertext based on the private data Among them, C1C2 is used to refer to the two values ​​after the equation and has no real meaning.

6. The model reasoning method based on function encryption according to claim 5 is characterized in that: The user side further obtains the classification result in the classification set according to the model key and the ciphertext, The user generates the formula according to the model key sk=(K1, K2) and the ciphertext ct=(C1, C2): Find such that (D1) s =D2 holds true for s∈S, which is the classification result, where D1 D2 is used to refer to the two values ​​after the equation and has no real meaning; Det(B) is the determinant of matrix B.

7. A model reasoning device based on function encryption, characterized in that: The device comprises: A master key generation unit, located at the user side, is used to configure public parameters according to the security parameters and the classification set, generate a master key according to the public parameters, and send it to the data side and the model side; The model side unit is used to determine the objective function of the user side after receiving the master key sent by the user side, generate a model key according to the master key and the objective function, and send the model key to the user side; The data party unit is used to determine the needs of the user party after receiving the master key sent by the user party, generate a ciphertext according to the master key and the needs, and send it to the user party; A classification result generating unit is located at the user side and is used to obtain a classification result in the classification set according to the model key and the ciphertext.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images