Privacy-protecting index operation method and device by combining two parties

Abstract

The embodiment of the invention discloses a privacy-protecting method and device for performing index operation by combining two parties. The method is executed by any one party, and comprises the following steps: firstly, based on a first local-party fragment corresponding to a target index held by the local party, obtaining a second local-party fragment corresponding to a target operation result between the target index and a base number 2 through local calculation and interaction with the other party; wherein the first local fragment and the second local fragment belong to a first fixed-point number ring and a second fixed-point number ring respectively, and the modulus q of the later fixed-point number ring is smaller than the modulus 2L of the former fixed-point number ring. Then, the second local fragment is converted back to a first fixed point number ring, specifically, based on a result obtained by negation operation on the first bit of the second local fragment and a result obtained by peer-to-peer operation of the other party, safe multiplication calculation is carried out, and a third local fragment is obtained; performing negation operation on the fragment to obtain a bit fragment for the carry bit; and updating the second local fragment based on the bit fragment, the modulus q and the digit L.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of data security processing technology, and more particularly, to a method and apparatus for jointly performing exponential calculations between two parties to protect privacy. Background Art

[0002] Secure Multi-party Computation (MPC) is a secure computing technology that enables collaborative computing among multiple parties. Under the framework of MPC technology, multiple parties can complete a computing task or jointly calculate an agreed function without leaking their private data. This technology has a wide range of applications in protecting data privacy and secure computing, especially in fields involving sensitive data such as finance and healthcare.

[0003] With the development of MPC technology and the increase in application scenarios, participants need to jointly perform complex mathematical operations in certain specific business scenarios, such as exponential operations. Exponential operations are a basic operation frequently used in many encryption algorithms and data processing scenarios, and are particularly common in cryptographic protocols. For multiple parties, how to perform exponential operations safely and efficiently has become an important requirement in the application of MPC technology.

[0004] However, the existing MPC protocols face challenges in terms of computational efficiency and communication overhead when performing exponential operations. For example, the applicant found that in the scenario of auto insurance business, when multiple parties jointly use the Secret Sharing Generalized Linear Model (SS-GLM) algorithm to model, the bottleneck of the algorithm's running speed lies in the calculation of the exponential function.

[0005] Therefore, the embodiments of this specification propose an improved MPC protocol for implementing exponential operations, which can better meet the needs of actual applications, for example, improve computing efficiency, reduce communication overhead, etc. Summary of the invention

[0006] The embodiments of this specification describe a method and device for jointly performing exponential calculations between two parties to protect privacy, which can better meet practical application needs.

[0007] According to a first aspect, a method for two parties to jointly perform exponential calculations for privacy protection is provided. The method is performed by either party and includes:

[0008] First, based on the first local shard corresponding to the target index held by the party, a second local shard corresponding to the target operation result between the target index and the target base 2 is obtained through local calculation and interaction with the other party; the first and second local shards belong to the first and second fixed-point number rings respectively, and the modulus q of the second fixed-point number ring is less than the modulus 2 of the first fixed-point number ring L Then, the second local slice is converted back to the first fixed-point number ring, specifically including: based on the result of negating the first bit of the second local slice, a secure multiplication calculation is performed with the result obtained by the other party through the equivalent operation to obtain a third local slice; negating the third local slice to obtain a fourth local slice corresponding to the carry bit; based on the fourth local slice, the modulus q and the number of bits L, the second local slice is updated.

[0009] In a possible implementation, the secure multiplication calculation is implemented based on the Beaver multiplication triplet protocol.

[0010] In a possible implementation, the target exponent includes an integer part and a decimal part, and the modulus q is a Mersenne prime number; wherein the local calculation and the interaction with the other party include:

[0011] The first local slice is split into a first sub-slice corresponding to the integer part and a second sub-slice corresponding to the fractional part; the second sub-slice is a double-precision floating point number. After converting the first sub-slice to a fixed-point number ring with a modulus of q-1, a first power operation result with the first sub-slice as the exponent and a base of 2 is calculated. A second power operation result with the second sub-slice as the exponent and a base of 2 is calculated, the second power operation result is shifted left by f bits and converted to a single-precision floating point number, and then rounded. Based on the first power operation result and the result of the rounding operation, the second local slice is interacted with the other party to obtain the second local slice.

[0012] Further, in one embodiment, the target operation result is: a result of left-shifting the target base 2 to the target exponent power by f bits; wherein, based on the first power operation result and the result of the rounding operation, interacting with the other party to obtain the second own-party fragmentation includes:

[0013] The first power operation result and the result of the rounding operation are multiplied to obtain a local multiplication slice corresponding to the target operation result. The local multiplication slice is interacted with another multiplication slice held by the other party to obtain a second local slice, which belongs to an addition slice.

[0014] Furthermore, in one example, based on the fourth own slice, the modulus q and the number of bits L, the second own slice is updated, including: right-shifting the second own slice and the modulus q by f bits respectively, to obtain the first and second right-shifted slices respectively; subtracting the product between the second right-shifted slice and the fourth own slice from the first right-shifted slice, and calculating the result of taking the product modulo 2 raised to the power of L, to obtain the updated second own slice.

[0015] In another embodiment, the target operation result is a target exponent power of the target base 2; wherein, based on the first power operation result and the result of the rounding operation, interacting with the other party to obtain the second own-party fragmentation includes:

[0016] The first power operation result and the result of the rounding operation are multiplied to obtain the local multiplication shard corresponding to the target operation result after being left-shifted by f bits. Based on the local multiplication shard, the other multiplication shard held by the other party is interacted with to obtain the local addition shard. Based on the local addition shard and the number of bits f, a privacy division calculation is performed to obtain the second local shard.

[0017] In a possible implementation, determining the first own fragment includes: based on the original base, converting the fifth own fragment corresponding to the original exponent into the first own fragment; the original exponent power of the original base is equal to the target exponent power of the target base.

[0018] According to a second aspect, a device for two parties to jointly perform exponential calculations to protect privacy is provided, which is integrated into either party. The device includes the following functional modules:

[0019] The shard calculation unit is configured to obtain, based on a first shard of the party corresponding to the target index held by the party, a second shard of the party corresponding to the target operation result between the target index and the target base 2 through local calculation and interaction with the other party; the first and second shards of the party belong to a first and a second fixed-point number ring respectively, and the modulus q of the second fixed-point number ring is less than the modulus 2 of the first fixed-point number ring L The ring conversion unit is configured to convert the second local slice back to the first fixed-point number ring, specifically comprising: performing a secure multiplication calculation based on a result of negating the first bit of the second local slice and a result obtained by the other party through a peer operation to obtain a third local slice; performing a negation operation on the third local slice to obtain a fourth local slice corresponding to the carry bit; and updating the second local slice based on the fourth local slice, the modulus q and the number of bits L.

[0020] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method provided in the first aspect.

[0021] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0022] In summary, the above method and device disclosed in the embodiments of this specification can improve the computational efficiency of exponential calculations performed by multiple parties, reduce communication overhead, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 Schematic diagram of the framework of the MPC protocol for joint execution of exponential operations by two parties;

[0025] Figure 2 The embodiment disclosed in this specification is Figure 1 Schematic diagram of the two-party interaction after the refinement of stage 1 of the MPC protocol;

[0026] Figure 3 The embodiment disclosed in this specification is Figure 1 Schematic diagram of the interaction between the two parties after the refinement of the second stage of the MPC protocol;

[0027] Figure 4 This is a schematic diagram of the structure of a device for jointly performing exponential calculations by two parties to protect privacy disclosed in an embodiment of this specification, wherein the device is integrated into either of the two parties. DETAILED DESCRIPTION

[0028] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0029] As mentioned above, the existing MPC protocol faces challenges in terms of computational efficiency and communication overhead when performing exponential operations. Based on this, the embodiments of this specification propose an improved MPC protocol that can better cope with the challenges. For the sake of simplicity, the existing MPC protocol may be referred to as the old protocol, the improved MPC protocol may be referred to as the new protocol, and when there is no need to distinguish between the old and new protocols, the two are collectively referred to as the protocol.

[0030] The new protocol is based on the old protocol. Specifically, the new protocol uses the framework of the old protocol (see Figure 1 ), and improved the two execution stages of the framework respectively.

[0031] To help with understanding, the following is a brief introduction to the protocol framework, followed by a detailed introduction to the specific implementation steps of the new protocol at different stages, with a particular focus on the improvements.

[0032] like Figure 1 As shown, the protocol participants include two parties, which are respectively recorded as P0 and P1 for distinguishing description. It should be understood that each party can be implemented as any device, server, platform or device cluster with computing and processing capabilities, such as a group of computing nodes. In addition, if there are more than two parties, they can be reduced to two to execute the protocol. Since the reduction method can be implemented using existing related technologies and is not the focus of the solution, it will not be described in detail.

[0033] The protocol can be used to calculate exponential functions with a base of 2, where the base 2 exists in plain text. The exponent z (≥ 0) is distributed to party P0 and party P1 in the form of additive secret sharing shards (or simply additive shards), denoted as Understandably, The well-known modulo operation that does not need to be emphasized is omitted in this paper; in addition, the shards in this paper are secret sharing shards.

[0034] It should be understood that the protocol supports the calculation of exponential functions whose base is not limited to 2, but before or during the execution of the protocol, the original exponential function k x It is equivalent to converting into an exponential function with base 2, that is, The calculation is performed again to match the binary inside the computer, so that the performance can be optimized by using the hardware characteristics of the computer. To distinguish the description, k and x are called the original base and original exponent respectively, and 2 and xlog2(k) are called the target base and target exponent respectively. It can be understood that in actual applications, x may be 2 or not. For example, the value of x can be the natural constant e.

[0035] In addition, for equivalent conversion, it is based on the addition slice of x After execution, the corresponding Furthermore, in the process of equivalent conversion, an offset A can be added to ensure that the target index z>0, and the offset A can be eliminated during or after the execution of the protocol. Equivalent conversion can be implemented using existing technologies such as homomorphic addition and homomorphic multiplication as needed, which will not be described in detail.

[0036] Based on the above, the input of the protocol includes the index shards provided by P0 and P1 respectively. The output of the protocol includes the result fragments provided to P0 and P1 Understandably, In addition, since the input, output, and operations performed by P0 and P1 in the protocol are symmetrical (or equivalent), i Fang refers to any one of the parties for a concise description.

[0037] exist Figure 1 In the first stage shown, the input of the protocol is P i The index sharding provided by the party (where i∈{0,1}) Index Sharding The modulus is 2 L The (or L-bit) fixed-point number ring can be written as Output to P i The square is located in another fixed-point number ring The initial result shard It should be understood that the conversion of the fixed-point number ring is involved in order to avoid overflow and improve calculation accuracy.

[0038] In the subsequent stage 2, the initial results need to be sharded From the fixed point loop Convert back So as to obtain the final result fragment

[0039] The above introduces the basic framework of the protocol. The following will briefly introduce the improvements involved in Phase 1 and Phase 2, and then further introduce the specific implementation steps of each phase.

[0040] In phase 1, the improvements that can be made include: The selection of the modulus q can be optimized to a Mersenne prime number, and for the rounding operation involved in stage 1, instead of directly rounding the double-precision floating point number, the double-precision floating point number is first converted to a single-precision floating point number before the rounding operation is performed. In this way, the effective range of exponential operations can be expanded and the practicality of the new protocol can be improved.

[0041] In phase 2, possible improvements include: for the calculation of the wrap bit in the fixed-point number loop conversion, a new calculation method can be designed to achieve smaller CPU consumption, less communication bandwidth and communication rounds, thereby saving computing and communication resources and improving computing and communication efficiency.

[0042] It should be noted that the improvements in phase 1 and phase 2 can be implemented separately or in combination. Next, the specific implementation steps of phase 1 and phase 2 in the new protocol are introduced in turn.

[0043] like Figure 2 As shown, when the two parties are executing the first phase of the new agreement, the interaction process includes the following steps:

[0044] Step S21, P i The first shard held by the party for the target index z Split into the integer part z corresponding to the target index z int The first subshard and the corresponding decimal part z frac The second subshard

[0045] It should be noted that the "first" in the first main slice and the first sub-slice, the "second" in the second sub-slice, and similar terms elsewhere in the text are only used to distinguish similar things and do not have other limiting functions such as sorting.

[0046] Understandably, in Belongs to the first fixed-point ring The f bits in L are used to represent real numbers The fractional part of , at least a portion of the remaining digits (e.g., Lf digits) is used to represent the real number The integer part of . In this paper, the hat symbol ~ is used to represent the real number corresponding to the value in the fixed-point number ring. For example, L = 128, f = 24.

[0047] Above belongs to the third fixed-point number ring (for example, ), the second sub-shard A double-precision floating point number.

[0048] Specifically, the splitting operation in this step can be written as:

[0049]

[0050]

[0051] In the above formula (1), the symbol It represents the rounding down operation. The operations of formula (1) and (2) can be completed locally and will not be introduced in detail.

[0052] From above, P i The party can obtain the first local shard through local calculation Two sub-shards of Therefore, the two sub-shards can be processed separately in the future, thereby reducing the overall complexity of the power operation and reducing the calculation error.

[0053] Step S22, P i The first subshard Convert to a fixed-point number loop modulo q-1 Then, calculate the result of the first power operation with 2 as the base.

[0054] For will Convert to It can be simply written as The ring conversion algorithm RingChange(·) can be implemented locally using an existing algorithm. It should be understood that this conversion is from a fixed-point number ring with a smaller modulus to a fixed-point number ring with a larger modulus, and the implementation is relatively simple.

[0055] Regarding the selection of q, in a conventional implementation, the value of q can be set to be in the interval (2 L-1 ,2 L ), obviously, the first sub-shard From the third fixed-point number ring (whose modulus is no greater than 2 L-f ), is converted to a higher modulus fixed-point loop This can avoid overflow of subsequent power operations and reduce precision loss.

[0056] In the improved implementation, the value of q can be further limited to a Mersenne prime to expand the effective range of the power operation simulation. It should be understood that a Mersenne prime is both a Mersenne number and a prime number, where a Mersenne number is a number in the form of M n =2 n -1, where n is also a positive integer. Preferably, the value of q is limited to less than 2 L For example, assuming L = 128, we can set q = 2 127 -1.

[0057] Regarding the simulation validity range, assume that the input of the power operation is x and the output is k x (k can be any base number), if in the interval a<x<b, |f(x)-k x |<tolerable error, then the function f(·) is said to simulate k x The effective range of is (a,b). The larger the effective range of simulation, the more practical the calculation. As for why further limiting q to Mersenne primes can achieve the expansion of the effective range of simulation, please refer to the relevant mathematical proof in the following text.

[0058] Further, based on the conversion to fixed-point number loop After The following calculations can be performed:

[0059]

[0060] Need to understand, The implementation of formula (3) can be realized by local operation, which will not be described in detail. In addition, the first power operation result is calculated as Belongs to the second fixed-point number ring with modulus q

[0061] Before, after or at the same time as step S22, step S23 may be performed. i The calculation is based on the second sub-shard The result of the second power operation with the exponent as base 2 Thus based on A rounding operation is performed, thereby converting the second power operation result from a floating point number back to a fixed point number.

[0062] It should be understood that the result of the second power operation can be The calculation process is recorded as:

[0063]

[0064] in, The implementation of formula (4) can be realized by local operation, which will not be described in detail. In addition, the second power operation result calculated is Still a double precision floating point number.

[0065] Furthermore, in order to seamlessly combine the power calculation results obtained based on the integer part and the decimal part of the exponent, further calculation is required The symbol It means round down, and the reason for introducing an extra multiplication factor of 2 f Because it is observed that: By introducing the factor 2 f It can effectively reduce the error caused by truncation in the rounding operation. After the integration is completed, the additional factor 2 can be introduced. f To be removed.

[0066] Understandable, calculation Equivalent to Perform a left shift operation of f bits. In addition, the calculated It is still a double-precision floating point number, and the conventional method will directly Perform rounding operation.

[0067] In the improved method, it is proposed to first The calculation result is converted into a single-precision floating point number, and then rounded, which can be recorded as The rounding operation is not limited to rounding down, but can also be rounding up, rounding off, etc. By combining the improvement here with the aforementioned improvement of selecting q as a Mersenne prime number, the effective range of the simulation of exponential operations can be effectively expanded. For details, please refer to the relevant mathematical proof in the following text.

[0068] For the sake of simplicity, the following symbols are used Indicates based on The result of the rounding operation.

[0069] By executing the above steps S22 and S23, P i Fang holds the result of the first power operation And based on the result of the second power operation The result obtained by rounding operation. It can be observed that: Therefore, it is necessary to Perform an integration operation (see the next step S24) so ​​that P i The result of the power operation (y or 2 f *y)'s second local fragment ( or Need to understand, and the second fragment belongs to the second fixed-point number ring

[0070] Step S24, P i The square is based on the result of the first power operation. and the result of the rounding operation Interact with the other party to obtain the second shard

[0071] In a conventional implementation of this step, P i The following three sub-steps can be performed:

[0072] ① First and rounded results Perform product processing to obtain the corresponding target operation result 2 f *y's own multiplication slice Understandable and satisfying:

[0073]

[0074] ② Then shard based on our own multiplication Interact with the multiplication shard obtained by the other party through peer operation to obtain the addition shard of the party Understandable and satisfying:

[0075]

[0076] ③After that, P i The party adds a shard locally to itself Perform a right shift of f bits to obtain the second local slice

[0077] It should be understood that the implementation details of each sub-step in the above conventional implementation method can be implemented using existing technologies and will not be described in detail.

[0078] In the improved implementation, it is proposed that ③ can be omitted, that is, directly adding the slices As the second shard, it should be understood that this improvement requires adaptive design of the second stage, and the effect achieved is to reduce the overall amount of calculation.

[0079] Combination of the above Figure 2 ,right Figure 1 From the above, we can see that the first stage can be implemented completely by the existing method, or it can be implemented by the improved method. The specific improvement includes: The modulus q is optimized to a Mersenne prime, and the operand is converted from a double-precision floating point number to a single-precision floating point number before performing the rounding operation. In this way, the effective range of the exponential operation can be expanded and the practicality of the new protocol can be improved. Alternatively, it can also include: removing sub-step ③ in step S24, thereby reducing the overall amount of calculation.

[0080] Next, let’s introduce Figure 1 The specific implementation steps of the second stage. To clarify the improvement points, the conventional implementation method of the second stage is first introduced. Specifically, it is known that:

[0081]

[0082] Request calculation So that:

[0083]

[0084] Because q<2 L , then the conversion problem of the fixed-point number ring becomes a shard extension (Share Extension, SExt for short) problem. The conventional implementation method includes the following steps:

[0085] Step 1: P i Based on the second shard held by the party Combine the MPC calculation for determining the wrap-bit with the peer shard held by the other party, and obtain the Boolean shard for the wrap-bit w

[0086] It is important to understand that:

[0087]

[0088] Formula (9) is actually an indicator function. When the conditions in {} are met, the value of w is 1, otherwise it is 0.

[0089] in addition, in represents the exclusive OR operation, Boolean Share of w.

[0090] Step 2: P i Based on the Boolean shards held by the party Perform MPC calculations for shard type conversion in conjunction with the peer shard held by the other party to obtain an additive shard The shard type conversion converts the Boolean type (Boolean) secret sharing shard into the addition type (Addition) secret sharing shard, which can be abbreviated as B2A operation.

[0091] It is important to understand that:

[0092]

[0093] Step 3: P i Based on the addition slice for the carry bit w Modulus q and the number of bits L, the second local fragment held from Updated to The calculation formula is as follows:

[0094]

[0095] In view of the above conventional implementation, the present specification discloses an improved implementation. Specifically, it is observed that the conventional method uses the first and second steps to calculate Two rounds of communication are required, so it is proposed to improve this so that the two parties only need one round of communication to obtain This effectively reduces the amount of calculation. Figure 3 As shown, the improved implementation method includes the following steps:

[0096] Step S31, P i The second party shard is determined The first bit b i , and negate it to get For example, for b i The determination of can be done using the following formula:

[0097]

[0098] It should be understood that when the conditions of {} in formula (10) are met, b i The value of is 1, otherwise it is 0.

[0099] Step S32, P i Based on Perform secure multiplication with the peer shard held by the other party to obtain the third shard u i . Need to understand and meet:

[0100]

[0101] In addition, the above secure multiplication calculation is conventionally implemented by homomorphic encryption HE or oblivious transmission OT. As a further improvement, the embodiments of this specification propose that beaver triples can be used for multiplication operations, thereby effectively reducing the consumption of CPU and network bandwidth for secure multiplication.

[0102] Specifically, P i The beaver server (trusted server) can obtain the beaver triplet obtained by random sampling. Satisfies γ=αβmod2 L In order to calculate P i Fang first calculates locally Then, δ and η are reconstructed by communicating their fragments with each other. Thus, P i It can be calculated This operation implements

[0103] Step S33, P i The third party's fragment u i Perform the inversion operation to obtain the fourth local fragment for the carry bit w That is to say

[0104] From the above, in the improved method, by executing the above steps S31-S33, only one round of communication interaction is required in step S32 to complete the carry bit w in the fixed-point number loop. The calculation of the addition slice on . Prove it:

[0105] First, we can prove This is transformed into the proof w = b0ORb1, where OR represents the logical OR operation. Specifically, the proof That is to prove According to the above formula (13), it can be further transformed into proof Based on: It can be converted to prove w = b0ORb1, where AND represents the logical AND operation.

[0106] Then, the proof process for w=b0ORb1 is as follows:

[0107] Given:

[0108]

[0109] For this, please refer to the above formulas (7), (9) and (12).

[0110] Further, assuming that y<q / 2, then:

[0111] like Since y<q / 2, we have thereby Where n≥1, then we have This means that if b0=1, w=1.

[0112] Similarly, it can be deduced that if b1=1, then w=1.

[0113] In addition, if Then there is This means that if b0=0 and b1=0, then w=0.

[0114] According to the truth table obtained above, we can know that w=b0ORb1.

[0115] For the case of y≥q / 2, a similar inference can be made.

[0116] The above proves that w=b0ORb1, which also proves the result obtained in step S33. That is, the slice for the carry bit w It is located at modulus 2 L The first fixed-point number ring

[0117] Step S34, P i Based on the fourth party shard The modulus q and the number of bits L will hold the second shard of the party from Updated to

[0118] In one implementation, the calculation in this step can be completed using the above formula (11).

[0119] In another implementation, assuming that sub-step ③ in step S24 is removed in stage 1, then P i The second shard initially held by the party is Accordingly, in this step it needs to be updated to In this regard, it is proposed to improve the above formula (11) into the following formula:

[0120]

[0121] Therefore, in this step, the additional factor 2 is also completed. f The removal of can effectively reduce the overall computational complexity. In addition, if the target index shard is obtained before The offset A is introduced when , so it can be removed in this step, that is, the 2 in formula (14) f Replace with 2 f+A .

[0122] The above introduces the specific implementation steps of Phase 2.

[0123] The above introduces the execution process of the new protocol. Next, we give the improvements in stage 1, in short, including the relevant mathematical proofs of the beneficial effects brought about by using Mersenne primes and performing roundf operations.

[0124] 1. It can expand the effective range of simulation of exponential operations.

[0125] 1. The range of the exp exponential function simulated by Mersenne primes and roundf operation is:

[0126]

[0127] Wherein, f represents the number of digits used to represent decimals in the first fixed-point number ring, q represents the modulus of the second fixed-point number ring, which is also a Mersenne prime in formula (15), and A represents the offset used to ensure that the target exponent is a positive number. For an introduction to these parameters, please refer to the previous text.

[0128] 2. The range of the exp exponential function without Mersenne primes or roundf operations is:

[0129]

[0130] Comparing the endpoint values ​​on the left side of formula (15) and (16), it can be seen that the length of the negative effective simulation range in formula (15) is 2(f-23) compared with that in (16).

[0131] 2. The accuracy of the ring conversion operation involved in step S22 in stage 1 is improved.

[0132] In the above step S22, the first sub-slice belonging to the third fixed-point number ring is Convert to a fixed-point number loop modulo q-1 For the sake of simplicity, z is used in the following proofs. int Simplify it as x, denote the number of digits of the third fixed-point number ring as k, and simplify q-1 as p.

[0133] Assume that the protocol used for ring switching operation is:

[0134] Given a fixed-point ring The slices x0 and x1 on the same grid satisfy x0+x1=xmod2 k ; Convert it to a fixed-point loop The slices h0 and h1 on the same grid satisfy h0+h1=xmod p, where p>2 k .

[0135] Local probabilistic transformation of each party: h0 = x0 mod p; h1 = x1-2 k mod p.

[0136] 1. When Mersenne primes or roundf operations are not used, the probability of correctly obtaining h0 and h1 after executing the above ring conversion protocol is: Pr(h0+h1=xmod p)=1-|x| / 2 k .

[0137] 2. When using Mersenne primes and roundf operations, the error analysis is as follows:

[0138] remember in m is an integer,

[0139] If w=0, then x=x0+x1, so:

[0140] h0=x0mod p=x0 (17)

[0141] h1=x1-2 k mod p=x1+(p-2 k ) (18)

[0142] h0+h1=(x-2 k )+p mod p (19)

[0143] If w = 1, then x = x0 + x1 - 2 k ,then:

[0144] h0+h1=(x)+p mod p (20)

[0145] when At this time for In At this time, formula (19) is Right now Next

[0146] when At this time for In At this time, formula (20) is Right now Next

[0147] Further, the analysis of the error probability is as follows:

[0148] The error occurs if and only if w = 0, so the probability is

[0149] The error occurs only when w = 1, so the probability is

[0150] In general, as long as m is not large, the probability of error is always very small.

[0151] 3. After using the Mersenne primes and performing the roundf operation in stage 1, the result of integrating the power operation slices corresponding to the integer part and the decimal part in step S24 is still correct with a high probability. In other words:

[0152]

[0153] It is still likely to be correct. The meanings of f and z can be found in the previous text. It is necessary to understand that is a floating point number, Refers to the floating-point number corresponding to the fixed-point number z.

[0154] To simplify the following proof, we first Simplified as h i , and, Simplified notation Therefore, the above formula (21) becomes:

[0155]

[0156] The correctness of formula (22) is proved as follows:

[0157] First, if q = 2 127 -1 is a Mersenne prime number, i is a positive integer, then 2 -i mod q = 2 127-iIn other words, there are 127-i in the binary representation (so if the integer part is separated as -i, then There are 127-i zeros at the end of ).

[0158] If in encoding When converting to a floating point number, it is first rounded to a floating point number and then converted to an unsigned 128-bit integer (uint128). Since the mantissa of a single-precision floating point number is 23 bits, There are at least 2 (f-23) zeros at the end of .

[0159] therefore, There are at least 127-i+2(f-23) zeros at the end of .

[0160] Easy to prove: for z = 2 127 m1+m2, where m1, If m2 = 0 (i.e., there are 127 zeros at the end), then z mod p = m1; this explains why part of can be calculated correctly.

[0161] If m2>0, let k be Starting from the least significant bit (LSB), the first position with a 1 is 2 127-i 2 k <2 127 , and the remaining m1 part and 2 127-i Since modp will "rotate" to the lower bit position, this will cause the entire product calculation to be wrong (this situation corresponds to either Too small, either in encoding When performing rounding operations directly on double-precision floating-point numbers.

[0162] The above provides mathematical proof for the beneficial effects of the improvements in Phase 1.

[0163] In summary, the improved MPC protocol for exponential operations disclosed in the embodiments of this specification can be used to improve the performance of fixed-point number loops. The selection of the modulus q can be optimized to a Mersenne prime number, and for the rounding operation involved in stage 1, instead of directly rounding the double-precision floating point number, the double-precision floating point number is first converted to a single-precision floating point number before the rounding operation is performed. In this way, the effective range of exponential operations can be expanded and the practicality of the new protocol can be improved.

[0164] On the other hand, a new calculation method is used to calculate the wrap bit in the fixed-point number loop conversion, thereby achieving smaller CPU consumption, less communication bandwidth and communication rounds, thereby saving computing and communication resources and improving computing and communication efficiency.

[0165] Corresponding to the above-mentioned method for jointly performing exponential calculation, the embodiment of this specification also provides an exponential calculation device, which is integrated into either of the two parties. Figure 4 As shown, the device 400 includes the following functional modules:

[0166] The shard calculation unit 410 is configured to obtain a second shard of the party corresponding to the target index and the target base 2 based on the first shard of the party held by the party, through local calculation and interaction with the other party; the first and second shards of the party belong to the first and second fixed-point number rings respectively, and the modulus q of the second fixed-point number ring is less than the modulus 2 of the first fixed-point number ring L .

[0167] The ring conversion unit 420 is configured to convert the second own slice back to the first fixed-point number ring, specifically including: based on the result of negating the first bit of the second own slice, performing a secure multiplication calculation with the result obtained by the other party through the equivalent operation to obtain a third own slice; negating the third own slice to obtain a fourth own slice corresponding to the carry bit; and updating the second own slice based on the fourth own slice, the modulus q and the number of bits L.

[0168] In one possible design, the secure multiplication calculation is implemented based on the Beaver multiplication triplet protocol.

[0169] In a possible design, the target exponent includes an integer part and a decimal part, and the modulus q is a Mersenne prime number; the shard calculation unit 410 is specifically configured as follows:

[0170] The first local slice is split into a first sub-slice corresponding to the integer part and a second sub-slice corresponding to the fractional part; the second sub-slice is a double-precision floating point number. After converting the first sub-slice to a fixed-point number ring with a modulus of q-1, a first power operation result with the first sub-slice as the exponent and a base of 2 is calculated. A second power operation result with the second sub-slice as the exponent and a base of 2 is calculated, the second power operation result is shifted left by f bits and converted to a single-precision floating point number, and then rounded. Based on the first power operation result and the result of the rounding operation, the second local slice is interacted with the other party to obtain the second local slice.

[0171] Further, in one embodiment, the target operation result is: a result of left-shifting the target base 2 to the target exponent power by f bits; wherein, based on the first power operation result and the result of the rounding operation, interacting with the other party to obtain the second own-party fragmentation includes:

[0172] The first power operation result and the result of the rounding operation are multiplied to obtain a local multiplication slice corresponding to the target operation result; based on the interaction between the local multiplication slice and another multiplication slice held by the other party, a second local slice is obtained, and the second local slice belongs to an addition slice.

[0173] Furthermore, in one example, updating the second own slice based on the fourth own slice, the modulus q and the number of bits L includes: performing a right shift operation on the second own slice and the modulus q by f bits respectively, and obtaining first and second right-shifted slices accordingly. Subtracting the product of the second right-shifted slice and the fourth own slice from the first right-shifted slice, and calculating the result of taking the product modulo 2 raised to the power of L, to obtain the updated second own slice.

[0174] In another embodiment, the target operation result is a target exponent power of the target base 2; wherein, based on the first power operation result and the result of the rounding operation, interacting with the other party to obtain the second own-party fragmentation includes:

[0175] The first power operation result and the result of the rounding operation are multiplied to obtain the local multiplication shard corresponding to the target operation result after being left-shifted by f bits. Based on the local multiplication shard, the other multiplication shard held by the other party is interacted with to obtain the local addition shard. Based on the local addition shard and the number of bits f, a privacy division calculation is performed to obtain the second local shard.

[0176] In one embodiment, the device 400 further includes: an exponent conversion unit configured to convert the fifth own fragment corresponding to the original exponent into the first own fragment based on the original base; the original exponent power of the original base is equal to the target exponent power of the target base.

[0177] It should be noted that for the functional implementation of the above-mentioned device 400, reference can also be made to the above-mentioned description of the method embodiment, and no further details are given here.

[0178] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 2 or Figure 3 The method described.

[0179] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, Figure 2 or Figure 3 The method described.

[0180] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0181] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for jointly performing an exponential operation between two parties to preserve privacy, performed by either party, comprising: Based on the first own shard corresponding to the target index held by the own party, through local calculation and interaction with the other party, a second own shard corresponding to the target operation result between the target index and the target base 2 is obtained; the first and second own shards belong to the first and second fixed-point number rings respectively, and the modulus q of the second fixed-point number ring is less than the modulus 2 of the first fixed-point number ring L ; Converting the second own slice back to the first fixed-point number ring specifically includes: performing a secure multiplication calculation based on the result of negating the first bit of the second own slice and the result obtained by the other party through the equivalent operation to obtain a third own slice; negating the third own slice to obtain a fourth own slice corresponding to the carry bit; and updating the second own slice based on the fourth own slice, the modulus q and the number of bits L.

2. The method according to claim 1, wherein: The implementation of the secure multiplication calculation is based on the Beaver multiplication triplet protocol.

3. The method according to claim 1, wherein: The target exponent includes an integer part and a decimal part, and the modulus q is a Mersenne prime number; wherein the local calculation and the interaction with the other party include: Splitting the first local slice into a first sub-slice corresponding to the integer part and a second sub-slice corresponding to the decimal part; the second sub-slice is a double-precision floating point number; After converting the first sub-slice into a fixed-point number ring with a modulus of q-1, calculating a first power operation result with the first sub-slice as the exponent and 2 as the base; Calculate a second power operation result with the second sub-slice as the exponent and 2 as the base, shift the second power operation result left by f bits, convert it into a single-precision floating point number, and then perform a rounding operation; Based on the result of the first power operation and the result of the rounding operation, interact with the other party to obtain the second own-party fragment.

4. The method according to claim 3, wherein: The target operation result is: the result of left shifting the target base 2 to the target exponent power by f bits; wherein, based on the first power operation result and the result of the rounding operation, the second own-party fragment is obtained by interacting with the other party, including: Performing a product process on the first power operation result and the result of the rounding operation to obtain a local multiplication slice corresponding to the target operation result; Based on the interaction between the local multiplication shard and another corresponding multiplication shard held by the other party, a second local shard is obtained, and the second local shard belongs to the addition shard.

5. The method according to claim 4, wherein: Updating the second local fragment based on the fourth local fragment, the modulus q and the number of bits L includes: Perform a right shift operation of f positions on the second local slice and the modulus q respectively, to obtain the first and second right-shifted slices respectively; The product of the second right-shifted slice and the fourth own slice is subtracted from the first right-shifted slice, and the result of taking the product modulo 2 raised to the power of L is calculated to obtain an updated second own slice.

6. The method according to claim 3, wherein: The target operation result is the target exponent power of the target base 2; wherein, based on the first power operation result and the result of the rounding operation, interacting with the other party to obtain the second own-party fragmentation includes: Performing a product process on the first power operation result and the result of the rounding operation to obtain the local multiplication slice corresponding to the target operation result after being left-shifted by f bits; Based on the interaction between the multiplication shard of the party and another multiplication shard held by the other party, the addition shard of the party is obtained; A privacy division calculation is performed based on the local addition shard and the number of bits f to obtain the second local shard.

7. The method according to claim 1, wherein: The determination of the first local shard includes: Based on an original base, a fifth local fragment corresponding to an original exponent is converted into the first local fragment; the original exponent power of the original base is equal to the target exponent power of the target base.

8. A device for two parties to jointly perform exponential calculations to protect privacy, integrated in either party, comprising: The shard calculation unit is configured to obtain, based on a first shard of the party corresponding to the target index held by the party, a second shard of the party corresponding to the target operation result between the target index and the target base 2 through local calculation and interaction with the other party; the first and second shards of the party belong to a first and a second fixed-point number ring respectively, and the modulus q of the second fixed-point number ring is less than the modulus 2 of the first fixed-point number ring L ; The ring conversion unit is configured to convert the second own slice back to the first fixed-point number ring, specifically comprising: based on the result of negating the first bit of the second own slice, performing a secure multiplication calculation with the result obtained by the other party through the equivalent operation to obtain a third own slice; negating the third own slice to obtain a fourth own slice corresponding to the carry bit; and updating the second own slice based on the fourth own slice, the modulus q and the number of bits L.

9. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device comprising a memory and a processor, wherein: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images