Data processing method and device for security computing, medium, equipment and product

Abstract

The invention relates to a data processing method and device for secure computing, a medium, equipment and a product. The security calculation is used for a first participant and a second participant to cooperatively calculate a product of a target matrix and a target column vector. The method comprises the following steps: encoding the target matrix into N polynomials; generating a second ciphertext polynomial according to the N polynomials and a first ciphertext polynomial sent by a second participant; generating an N-dimensional random column vector, performing masking processing on the second ciphertext polynomial by using the random column vector, and sending a masking polynomial obtained after the masking processing to a second participant; and taking the random column vector as a second fragment of the product, and executing the target data processing task based on the second fragment. Therefore, the product of the matrix and the vector can be safely calculated by utilizing the property of the operator ring, so that the scheme can be suitable for safely calculating the product of the matrix and the vector on the ring with any modulus. In addition, through the scheme, the data security can be protected in a model training scene, and the applicability is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of secure multi-party computing, and in particular, to a data processing method, apparatus, medium, equipment and product for secure computing. Background Art

[0002] Secure multi-party computing is also known as multi-party secure computing (MPC). It allows multiple parties to jointly calculate the result of a function without disclosing the input data of each party in the function, and the result of the calculation is open to one or more of the parties. Typical applications of secure multi-party computing include joint statistical analysis of multi-party data with privacy protection, machine learning, etc. Among them, multi-party secure computing technology can be used to protect privacy data during the training stage of machine learning models, mainly involving the protection of model parameters and the protection of data of each participant during the training process.

[0003] During the training of machine learning models, model loss is usually used to update model parameters, where the calculation of model loss usually involves the secure calculation of the product of a matrix and a column vector. At present, a homomorphic encryption mechanism based on Number Theoretic Transform (NTT) coding is usually used to securely calculate the product of a matrix and a column vector. Since NTT coding converts a polynomial on a modulo prime ring into the coefficient representation of another polynomial, NTT coding relies on the specific properties of modulo prime numbers. Therefore, the homomorphic encryption mechanism based on NTT coding is only applicable to the secure calculation of the product of a matrix and a vector on a modulo prime ring, and its scope of application is relatively limited. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a data processing method for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate a target matrix of N*N and a target column vector of N dimensions, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the method is applied to the first participant, comprising:

[0006] Encoding the target matrix into N polynomials, wherein coefficients of the N polynomials are determined based on elements in the target matrix;

[0007] In response to receiving the first ciphertext polynomial sent by the second participant, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial;

[0008] Generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial;

[0009] The random column vector is used as a second slice of the product, and a target data processing task is performed based on the second slice.

[0010] In a second aspect, the present disclosure provides a data processing method for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the method is applied to the second participant, comprising:

[0011] Using the target column vector as a coefficient vector, generating a first plaintext polynomial;

[0012] Performing homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial;

[0013] Sending the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant;

[0014] generating a first fragment of the product based on the masking polynomial sent by the first party;

[0015] Execute a target data processing task based on the first shard.

[0016] In a third aspect, the present disclosure provides a data processing device for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the device is applied to the first participant, comprising:

[0017] An encoding module, used for encoding the target matrix into N polynomials, wherein coefficients of the N polynomials are determined based on elements in the target matrix;

[0018] A first generating module is configured to generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in response to receiving the first ciphertext polynomial sent by the second participant, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial;

[0019] a masking processing module, configured to generate an N-dimensional random column vector, perform masking processing on the second ciphertext polynomial using the random column vector to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial;

[0020] The first execution module is used to use the random column vector as a second slice of the product and execute a target data processing task based on the second slice.

[0021] In a fourth aspect, the present disclosure provides a data processing device for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the device is applied to the second participant, comprising:

[0022] A second generating module, configured to generate a first plaintext polynomial using the target column vector as a coefficient vector;

[0023] An encryption module, used for performing homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial;

[0024] A sending module, configured to send the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant;

[0025] A third generating module, configured to generate a first fragment of the product based on the masking polynomial sent by the first participant;

[0026] A second execution module is used to execute a target data processing task based on the first slice.

[0027] In a fifth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the data processing method for secure computing provided in the first aspect of the present disclosure or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure.

[0028] In a sixth aspect, the present disclosure provides an electronic device, including:

[0029] a storage device having a computer program stored thereon;

[0030] A processing device is used to execute the computer program in the storage device to implement the steps of the data processing method for secure computing provided in the first aspect of the present disclosure or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure.

[0031] In a seventh aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the data processing method for secure computing provided in the first aspect of the present disclosure or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure.

[0032] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial; next, the first participant uses the locally generated random column vector to mask the second ciphertext polynomial, and sends the masked polynomial obtained after the masking to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masked polynomial, and the first participant uses the random column vector as the second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform the target data processing task based on the slices they hold. In this way, the properties of the operator ring can be used to securely calculate the product of the target matrix and the target column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of NTT coding. Therefore, this solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, this solution can protect data security in the model training scenario and improve applicability.

[0033] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0035] Figure 1The invention is a flowchart showing a data processing method for secure computing applied to a first party according to an exemplary embodiment.

[0036] Figure 2 The invention is a flowchart showing a data processing method for secure computing applied to a second party according to an exemplary embodiment.

[0037] Figure 3 The invention is a block diagram showing a data processing device for secure computing applied to a first party according to an exemplary embodiment.

[0038] Figure 4 The invention is a block diagram showing a data processing device for secure computing applied to a second party according to an exemplary embodiment.

[0039] Figure 5 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0040] Before introducing the specific embodiments of the present disclosure, the specific application scenarios of multi-party secure computing and the terms involved in the present disclosure are first introduced and explained.

[0041] Ring: refers to a set that defines two operations, addition and multiplication, and forms a commutative group (i.e., Abelian group) for addition, a semigroup for multiplication for elements other than 0, and multiplication satisfies the distributive law for addition.

[0042] In the field of secure computing, especially in MPC, an operator ring usually refers to a set of operators that support secure computing between multiple parties. These operators can include basic arithmetic operations (such as addition, multiplication), logical operations, comparison operations, etc., which are the basis for building more complex secure computing protocols.

[0043] The ring of addition and multiplication is defined above. is the ring of integers, where addition is defined as integer addition modulo (mod) N, and multiplication is defined as integer multiplication mod N, where N is an integer greater than 1.

[0044] It is a ring consisting of equivalence classes obtained by taking integers modulo 2N, namely {0, 1, 2, ..., 2N-1}.

[0045] is the multiplication group modulo 2N, which is The set of all elements in that are coprime to 2N, that is, those elements that have multiplicative inverses modulo 2N, namely {1, 3, …, 2N-1}.

[0046] Secret Sharing is also called secret splitting or secret sharing. Its basic principle is to split secrets (such as keys, private data, etc.) into multiple shares (Shares) and give them to different data parties for safekeeping. Only when parties exceeding a threshold number merge their shards can the secret be restored; Shares obtained from parties less than the threshold number cannot restore any information of the secret. In multi-party secure computing, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called shards. Among them, private data is the data that you do not want other parties to know in multi-party secure computing.

[0047] Homomorphic encryption is a technology that allows calculations to be performed on encrypted data (i.e., ciphertext) and then decrypted to obtain the result. The result of the homomorphic encryption calculation is the same as the result of direct calculation on the original data (i.e., plaintext), but the entire calculation process is performed on the encrypted data.

[0048] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0049] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0050] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0051] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0052] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0053] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0054] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0055] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0056] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0057] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0058] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0059] Figure 1 FIG. 1 is a flow chart showing a data processing method for secure computing applied to a first participant according to an exemplary embodiment. Figure 1 As shown, the method may include S101 to S104.

[0060] In S101 , a target matrix is ​​encoded into N polynomials.

[0061] In the present disclosure, secure computing is used for the first participant and the second participant to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector. It is understandable that the target matrix and target column vector in the present disclosure may be any data that the holder is not convenient to disclose.

[0062] The target matrix is ​​held by the first participant alone, and the target column vector is held by the second participant alone.N,N (R), that is, the target matrix M is an N-dimensional square matrix on the R ring, and the target column vector α∈R (N) , that is, the target column vector is an N-dimensional column vector on the R ring, where R is any commutative ring containing 1.

[0063] The target matrix is ​​a square matrix. If the matrix used for security calculation is not initially a square matrix, it can be reconstructed into a square matrix by padding with zeros or cutting.

[0064] Additionally, the coefficients of the N polynomials are determined based on the elements in the target matrix.

[0065] For example, the target matrix can be encoded as a polynomial as shown in equation (1):

[0066]

[0067] Among them, p k (x) is the (k+1) / 2th polynomial among the N polynomials, That is, k = 1, 3, ..., 2N-1; m i,j is the element in the i-th row and j-th column of the target matrix; x is the independent variable of the polynomial.

[0068] In S102, in response to receiving the first ciphertext polynomial sent by the second party, a second ciphertext polynomial is generated according to the N polynomials and the first ciphertext polynomial.

[0069] In the present disclosure, the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial.

[0070] Specifically, when calculating the product of the target matrix and the target column vector, the first participant encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial; then, the second participant uses the homomorphic encryption public key to homomorphically encrypt the first plaintext polynomial, and sends the first ciphertext polynomial obtained by the homomorphic encryption to the first participant; after receiving the first ciphertext polynomial, the first participant generates a second ciphertext polynomial based on the N polynomials obtained by encoding the target matrix and the first ciphertext polynomial.

[0071] The second participant can use the target column vector it holds as the coefficient vector to generate the first plaintext polynomial m1 through the following equation (2):

[0072] m1=(1,x,…,x N-1 )α (2)

[0073] Among them, α is the target column vector.

[0074] In S103, an N-dimensional random column vector is generated, and the second ciphertext polynomial is masked using the random column vector to obtain a masked polynomial, which is sent to the second participant so that the second participant generates a first fragment of the product based on the masked polynomial.

[0075] In S104, the random column vector is used as a second slice of the product, and the target data processing task is performed based on the second slice.

[0076] In this disclosure, the random column vector β0∈R (N) , that is, the random column vector is an N-dimensional column vector on the randomly generated R ring.

[0077] After the first participant generates the random column vector, it can use it as a slice of the product of the target matrix and the target column vector, that is, the second slice. At the same time, the second ciphertext polynomial is masked using the random column vector, and the masked polynomial obtained after the masking process is sent to the second participant. After receiving the masked polynomial, the second participant generates another slice of the product of the target matrix and the target column vector based on the masked polynomial, that is, the first slice. Afterwards, the first participant and the second participant can share the slices of the product results generated by each party, and aggregate and merge the slices generated by the two parties to obtain the final calculation result (that is, the product of the target matrix and the target column vector). Among them, the result of the product of the target matrix and the target column vector includes the first slice and the second slice, that is, the target matrix*target column vector=first slice+second slice.

[0078] In addition, the above-mentioned target data processing task can be a machine learning model training task, wherein the machine learning model can be, for example, a neural network model, a logistic regression model, etc. The first participant can perform machine learning model training in an MPC manner based on the target matrix held by itself, and the second participant can perform machine learning model training based on the target column vector held by itself, so as to obtain a slice of the product of the target matrix and the target column vector respectively, and then calculate the model loss based on the slice of the product held by each of the two, and update the model parameters of the machine learning model according to the model loss. Among them, the target matrix can be a feature matrix, and the target column vector can be a vector composed of model parameters.

[0079] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial; next, the first participant uses the locally generated random column vector to mask the second ciphertext polynomial, and sends the masked polynomial obtained after the masking to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masked polynomial, and the first participant uses the random column vector as the second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform the target data processing task based on the slices they hold. In this way, the properties of the operator ring can be used to securely calculate the product of the target matrix and the target column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of NTT coding. Therefore, this solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, this solution can protect data security in the model training scenario and improve applicability.

[0080] The following is a detailed description of the specific implementation method of generating the second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in the above S102. Specifically, it can be achieved by the following steps (a1) and (a2):

[0081] Step (a1): Perform N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials.

[0082] In one embodiment, step (a1) may include the following steps:

[0083] Step (a11): receiving the Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on the homomorphic encryption private key.

[0084] In the present disclosure, the second party can generate a Galois key based on the homomorphic encryption private key and send it to the first party, wherein the Galois key is usually an element in the Galois group and is used to rotate the ciphertext; after the first party receives the Galois key, it uses the Galois key to rotate the corresponding ciphertext polynomial.

[0085] It should be noted that the specific method of generating a Galois key using a homomorphic encryption private key is well known to those skilled in the art and will not be described in detail in this disclosure.

[0086] Step (a12): For each element of the modulo 2N multiplication group, use the element and the Galois key to perform a rotation operation on the first ciphertext polynomial to obtain a third ciphertext polynomial.

[0087] In the present disclosure, the modulo 2N multiplication group Elements in That is, k = 1, 3, ..., 2N-1. Among them, the Galois key does not directly act on the transformation formula. Its role is to ensure that the first participant can make a transformation on the ciphertext (that is, the first ciphertext polynomial) so that the plaintext polynomial obtained after subsequent decryption (that is, a0+a1x k +…+a N-1 x k(N-1) mod(x N +1)) is equal to the polynomial obtained by directly performing k transformations on the first plaintext polynomial m1, that is:

[0088] Dec(sk,σ k (ct))=σ k (m1)=a0+a1x k +…+a N-1 x k(N-1) mod(x N +1)

[0089] Among them, σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials; the first ciphertext polynomial ct = Enc(a0+a1x+…+a N-1 x N-1 ), Enc represents encryption, that is, ct is the first plaintext polynomial m1=a0+a1x+…+a N- 1x N-1 The target column vector is Dec represents decryption, sk is the homomorphic encryption private key;

[0090] Here, performing k transformation refers to applying k to the power of the first ciphertext polynomial.

[0091] Step (a2): Generate a second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials.

[0092] For example, the second ciphertext polynomial can be generated according to the N polynomials and the N third ciphertext polynomials by the following equation (3):

[0093]

[0094] Wherein, ct(β) is the second ciphertext polynomial.

[0095] The following is a detailed description of the specific implementation method of using the random column vector to mask the second ciphertext polynomial in the above S103 to obtain the masked polynomial. Specifically, it can be achieved by the following steps (b1) to (b3):

[0096] Step (b1): Generate a second plaintext polynomial using the random column vector as the coefficient vector.

[0097] For example, the second plaintext polynomial m2 can be generated by using the following equation (4) with the random column vector as the coefficient vector:

[0098] m2=(1,x,…,x N-1 )β0 (4)

[0099] Among them, β0 is a random column vector.

[0100] Step (b2): Perform homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial.

[0101] Step (b3): ​​Determine the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as a masking polynomial, that is, masking polynomial ct(β1)=ct(β)-ct(β0), where ct(β0) is the fourth ciphertext polynomial.

[0102] The correctness of the above target matrix * target column vector = first slice + second slice, that is, Mα = β = β0 + β1, is explained below, where β1 is the second slice.

[0103] If β=Mα, where β∈R (N) ,but

[0104]

[0105] The above equation (5) can be deduced through the following process:

[0106] make

[0107] in, is a compound operation; tr A / R is a mapping from ring A to ring R, where ring A is the quotient ring of the univariate polynomial ring on ring R, tr A / R =1+σ3+…+σ 2N-1 ,σ3,…,σ 2N-1 is an element in the Galois group, and an element in the Galois group is a mapping of a ring A to itself, tr A / R and P are both operators.

[0108] then, Then we have:

[0109] (1,x,...,x N-1 )β=P(1,x,…,x N-1 )α

[0110] Among them, the above equation (3)

[0111]

[0112] Figure 2 FIG. 1 is a flow chart showing a data processing method for secure computing applied to a first participant according to an exemplary embodiment. Figure 2 As shown, the method may include S201 to S205.

[0113] In S201, a first plaintext polynomial is generated using the target column vector as a coefficient vector.

[0114] In the present disclosure, secure computing is used for a first party and a second party to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector.

[0115] In S202, homomorphic encryption is performed on the first plaintext polynomial to obtain a first ciphertext polynomial.

[0116] In S203, the first ciphertext polynomial is sent to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant.

[0117] In S204, a first fragment of the product is generated based on the masking polynomial sent by the first party.

[0118] In S205, the target data processing task is executed based on the first slice.

[0119] In the present disclosure, the above-mentioned target data processing task can be a machine learning model training task. The above-mentioned target data processing task can be a machine learning model training task, wherein the machine learning model can be, for example, a neural network model, a logistic regression model, etc. The first participant can perform machine learning model training in an MPC manner based on the target matrix held by itself, and the second participant can perform machine learning model training in an MPC manner based on the target column vector held by itself, so as to obtain a slice of the product of the target matrix and the target column vector respectively, and then calculate the model loss based on the slice of the product held by each of the two, and update the model parameters of the machine learning model according to the model loss. Among them, the target matrix can be a feature matrix, and the target column vector can be a vector composed of model parameters.

[0120] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial; next, the first participant uses the locally generated random column vector to mask the second ciphertext polynomial, and sends the masked polynomial obtained after the masking to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masked polynomial, and the first participant uses the random column vector as the second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform the target data processing task based on the slices they hold. In this way, the properties of the operator ring can be used to securely calculate the product of the target matrix and the target column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of NTT coding. Therefore, this solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, this solution can protect data security in the model training scenario and improve applicability.

[0121] The following is a detailed description of the specific implementation scheme of generating the first fragment of the product based on the masking polynomial sent by the first participant in the above S204. Specifically, it can be implemented by the following steps (c1) and (c2):

[0122] Step (c1): Perform homomorphic decryption on the masking polynomial to obtain the third plaintext polynomial.

[0123] Step (c2): Determine the coefficient vector of the third plaintext polynomial as the first fragment.

[0124] After receiving the masking polynomial sent by the first participant, the second participant uses the local homomorphic encryption private key to homomorphically decrypt the masking polynomial to obtain the third plaintext polynomial, and then determines the coefficient vector (column vector) of the third plaintext polynomial as the first slice of the product of the target matrix and the target column vector.

[0125] In a possible implementation manner, the data processing method for secure computing applied to the second party may further include:

[0126] Generate Galois key based on homomorphic encryption private key;

[0127] Send the Galois key to the first party.

[0128] The specific implementation methods of each step in the data processing method for secure computing applied to the second participant according to the embodiment of the present disclosure have been described in detail in the data processing method for secure computing applied to the first participant according to the embodiment of the present disclosure, and will not be repeated here.

[0129] Figure 3 is a block diagram of a data processing device for secure computing applied to a first participant according to an exemplary embodiment. The secure computing is used by the first participant and the second participant to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held by the first participant alone, and the target column vector is held by the second participant alone, such as Figure 3 As shown, the data processing device 300 for secure computing applied to the first participant includes:

[0130] An encoding module 301, configured to encode the target matrix into N polynomials, where coefficients of the N polynomials are determined based on elements in the target matrix;

[0131] A first generating module 302 is configured to generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in response to receiving the first ciphertext polynomial sent by the second participant, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial;

[0132] A masking processing module 303 is used to generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial;

[0133] The first execution module 304 is configured to use the random column vector as a second slice of the product and execute a target data processing task based on the second slice.

[0134] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial; next, the first participant uses the locally generated random column vector to mask the second ciphertext polynomial, and sends the masked polynomial obtained after the masking to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masked polynomial, and the first participant uses the random column vector as the second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform the target data processing task based on the slices they hold. In this way, the properties of the operator ring can be used to securely calculate the product of the target matrix and the target column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of NTT coding. Therefore, this solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, this solution can protect data security in the model training scenario and improve applicability.

[0135] Optionally, the encoding module 301 is used to encode the target matrix into a polynomial as shown in the following formula:

[0136]

[0137] Among them, p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; m i,j is the element in the i-th row and j-th column in the target matrix; x is the independent variable of the polynomial.

[0138] Optionally, the first generating module 302 includes:

[0139] A first rotation submodule, configured to perform N types of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials;

[0140] The first generating submodule is used to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials.

[0141] Optionally, the first rotation submodule includes:

[0142] A receiving submodule, configured to receive a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key;

[0143] The second selection submodule is used to perform a rotation operation on the first ciphertext polynomial using each element of the modulo 2N multiplication group and the Galois key to obtain a third ciphertext polynomial.

[0144] Optionally, the first generating submodule is used to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials by using the following formula:

[0145]

[0146] Wherein, ct(β) is the second ciphertext polynomial; p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

[0147] Optionally, the masking processing module 303 includes:

[0148] A second generating submodule, used to generate a second plaintext polynomial using the random column vector as a coefficient vector;

[0149] An encryption submodule, used for performing homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial;

[0150] The first determining submodule is configured to determine a difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masking polynomial.

[0151] Optionally, the target data processing task is a machine learning model training task.

[0152] Figure 4 is a block diagram of a data processing device for secure computing applied to a second participant according to an exemplary embodiment. The secure computing is used by a first participant and a second participant to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. Figure 4 As shown, the data processing device 400 for secure computing applied to the second participant includes:

[0153] A second generating module 401 is used to generate a first plaintext polynomial using the target column vector as a coefficient vector;

[0154] An encryption module 402 is used to perform homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial;

[0155] A sending module 403 is used to send the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant;

[0156] A third generating module 404, configured to generate a first fragment of the product based on the masking polynomial sent by the first participant;

[0157] The second execution module 405 is used to execute the target data processing task based on the first slice.

[0158] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix it holds into N polynomials. At the same time, the second participant uses the target column vector it holds as the coefficient vector to generate a first plaintext polynomial, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial; next, the first participant uses the locally generated random column vector to mask the second ciphertext polynomial, and sends the masked polynomial obtained after the masking to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masked polynomial, and the first participant uses the random column vector as the second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform the target data processing task based on the slices they hold. In this way, the properties of the operator ring can be used to securely calculate the product of the target matrix and the target column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of NTT coding. Therefore, this solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, this solution can protect data security in the model training scenario and improve applicability.

[0159] Optionally, the third generating module 404 includes:

[0160] A decryption submodule, used for performing homomorphic decryption on the masking polynomial to obtain a third plaintext polynomial;

[0161] The second determining submodule is used to determine the coefficient vector of the third plaintext polynomial as the first fragment.

[0162] Optionally, the data processing device 400 for secure computing applied to the second participant further includes:

[0163] A fourth generation module, used to generate a Galois key based on the homomorphic encryption private key;

[0164] The sending module 403 is further configured to send the Galois key to the first party.

[0165] Optionally, the target data processing task is a machine learning model training task.

[0166] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0167] like Figure 5 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0168] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0169] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0170] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0171] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0172] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0173] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: encodes the target matrix into N polynomials, the coefficients of the N polynomials are determined based on the elements in the target matrix, and securely calculates the product of the N*N target matrix and the N-dimensional target column vector for the first participant and the second participant to jointly calculate, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant; in response to receiving the first ciphertext polynomial sent by the second participant, generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of the first plaintext polynomial corresponding to the first ciphertext polynomial; generates an N-dimensional random column vector, uses the random column vector to mask the second ciphertext polynomial to obtain a masked polynomial, and sends the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial; uses the random column vector as the second shard of the product, and performs a target data processing task based on the second shard.

[0174] Alternatively, the computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: generates a first plaintext polynomial with a target column vector as a coefficient vector, and securely calculates the product of an N*N target matrix and an N-dimensional target column vector for a first participant and a second participant to collaboratively calculate, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant; performs homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial; sends the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant; generates a first shard of the product based on the masking polynomial sent by the first participant; and executes a target data processing task based on the first shard.

[0175] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0176] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0177] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the second execution module may also be described as a "module for executing the target data processing task based on the first shard".

[0178] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0179] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0180] According to one or more embodiments of the present disclosure, Example 1 provides a data processing method for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the method is applied to the first participant, and includes: encoding the target matrix into N polynomials, wherein coefficients of the N polynomials are determined based on elements in the target matrix; in response to receiving a first ciphertext polynomial sent by the second participant, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; generating an N-dimensional random column vector, masking the second ciphertext polynomial using the random column vector to obtain a masked polynomial, and sending the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial; using the random column vector as a second shard of the product, and performing a target data processing task based on the second shard.

[0181] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein encoding the target matrix into N polynomials includes:

[0182] The target matrix is ​​encoded as a polynomial as shown in the following formula:

[0183]

[0184] Among them, p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; m i,j is the element in the i-th row and j-th column in the target matrix; x is the independent variable of the polynomial.

[0185] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 1, wherein generating a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial includes: performing N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials; generating a second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials.

[0186] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 3, wherein N rotation operations are performed on the first ciphertext polynomial to obtain N third ciphertext polynomials, including: receiving a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key; for each element of a modulo 2N multiplication group, performing a rotation operation on the first ciphertext polynomial using the element and the Galois key to obtain a third ciphertext polynomial.

[0187] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 3, wherein generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials includes:

[0188] According to the N polynomials and the N third ciphertext polynomials, a second ciphertext polynomial is generated by the following formula:

[0189]

[0190] Wherein, ct(β) is the second ciphertext polynomial; p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

[0191] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 1, wherein the second ciphertext polynomial is masked using the random column vector to obtain a masked polynomial, including: generating a second plaintext polynomial using the random column vector as a coefficient vector; performing homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial; and determining the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masked polynomial.

[0192] According to one or more embodiments of the present disclosure, Example 7 provides the method of any one of Examples 1-6, wherein the target data processing task is a machine learning model training task.

[0193] According to one or more embodiments of the present disclosure, Example 8 provides a data processing method for secure computing, wherein the secure computing is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the method is applied to the second participant, including: generating a first plaintext polynomial using the target column vector as a coefficient vector; homomorphically encrypting the first plaintext polynomial to obtain a first ciphertext polynomial; sending the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sending the masking polynomial to the second participant; generating a first shard of the product based on the masking polynomial sent by the first participant; and executing a target data processing task based on the first shard.

[0194] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 8, wherein the first fragment of the product is generated based on the masking polynomial sent by the first participant, comprising: performing homomorphic decryption on the masking polynomial to obtain a third plaintext polynomial; and determining the coefficient vector of the third plaintext polynomial as the first fragment.

[0195] According to one or more embodiments of the present disclosure, Example 10 provides the method of Example 8, which further includes: generating a Galois key based on a homomorphic encryption private key; and sending the Galois key to the first participant.

[0196] According to one or more embodiments of the present disclosure, Example 11 provides the method of any one of Examples 8-10, wherein the target data processing task is a machine learning model training task.

[0197] According to one or more embodiments of the present disclosure, Example 12 provides a data processing device for secure computing, wherein the secure computing is used for a first participant and a second participant to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the device is applied to the first participant, comprising: an encoding module for encoding the target matrix into N polynomials, wherein the coefficients of the N polynomials are determined based on the elements in the target matrix; a first generation module for generating a first ciphertext polynomial in response to receiving a first ciphertext polynomial sent by the second participant; , generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; a masking processing module, used to generate an N-dimensional random column vector, mask the second ciphertext polynomial using the random column vector to obtain a masked polynomial, and send the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial; a first execution module, used to use the random column vector as a second shard of the product, and execute a target data processing task based on the second shard.

[0198] According to one or more embodiments of the present disclosure, Example 13 provides a data processing device for secure computing, wherein the secure computing is used for a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, wherein the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant, and the device is applied to the second participant, comprising: a second generation module, used to generate a first plaintext polynomial using the target column vector as a coefficient vector; an encryption module, used to homomorphically encrypt the first plaintext polynomial to obtain a first ciphertext polynomial; a sending module, used to send the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant; a third generation module, used to generate a first shard of the product based on the masking polynomial sent by the first participant; and a second execution module, used to execute a target data processing task based on the first shard.

[0199] According to one or more embodiments of the present disclosure, Example 14 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-11 when executed by a processing device.

[0200] According to one or more embodiments of the present disclosure, Example 15 provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-11.

[0201] According to one or more embodiments of the present disclosure, Example 16 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-11 when executed by a processor.

[0202] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0203] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0204] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A data processing method for secure computing, characterized in that: The secure calculation is used for a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The method is applied to the first participant, and includes: Encoding the target matrix into N polynomials, wherein coefficients of the N polynomials are determined based on elements in the target matrix; In response to receiving the first ciphertext polynomial sent by the second participant, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; Generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial; The random column vector is used as a second slice of the product, and a target data processing task is performed based on the second slice.

2. The method according to claim 1, characterized in that The encoding of the target matrix into N polynomials comprises: The target matrix is ​​encoded as a polynomial as shown in the following formula: Among them, p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; m i,j is the element in the i-th row and j-th column in the target matrix; x is the independent variable of the polynomial.

3. The method according to claim 1, characterized in that The step of generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial includes: Performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials; A second ciphertext polynomial is generated according to the N polynomials and the N third ciphertext polynomials.

4. The method according to claim 3, characterized in that The performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials includes: Receiving a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key; For each element of the modulo 2N multiplication group, the first ciphertext polynomial is rotated using the element and the Galois key to obtain a third ciphertext polynomial.

5. The method according to claim 3, characterized in that: Generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials includes: According to the N polynomials and the N third ciphertext polynomials, a second ciphertext polynomial is generated by the following formula: Wherein, ct(β) is the second ciphertext polynomial; p k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

6. The method according to claim 1, characterized in that The step of masking the second ciphertext polynomial using the random column vector to obtain a masked polynomial includes: Using the random column vector as a coefficient vector, generating a second plaintext polynomial; Performing homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial; A difference between the second ciphertext polynomial and the fourth ciphertext polynomial is determined as the masking polynomial.

7. The method according to any one of claims 1 to 6, characterized in that The target data processing task is a machine learning model training task.

8. A data processing method for secure computing, characterized in that: The secure calculation is used for a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The method is applied to the second participant, and includes: Using the target column vector as a coefficient vector, generating a first plaintext polynomial; Performing homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial; Sending the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant; generating a first fragment of the product based on the masking polynomial sent by the first party; Execute a target data processing task based on the first shard.

9. The method according to claim 8, characterized in that The generating a first fragment of the product based on the masking polynomial sent by the first party comprises: Performing homomorphic decryption on the masking polynomial to obtain a third plaintext polynomial; A coefficient vector of the third plaintext polynomial is determined as the first fragment.

10. The method according to claim 8, characterized in that The method further comprises: Generate Galois key based on homomorphic encryption private key; The Galois key is sent to the first party.

11. The method according to any one of claims 8 to 10, characterized in that: The target data processing task is a machine learning model training task.

12. A data processing device for secure computing, characterized in that: The secure calculation is used for a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The device is applied to the first participant and includes: An encoding module, used for encoding the target matrix into N polynomials, wherein coefficients of the N polynomials are determined based on elements in the target matrix; A first generating module is configured to generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in response to receiving the first ciphertext polynomial sent by the second participant, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; a masking processing module, configured to generate an N-dimensional random column vector, perform masking processing on the second ciphertext polynomial using the random column vector to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial; The first execution module is used to use the random column vector as a second slice of the product and execute a target data processing task based on the second slice.

13. A data processing device for secure computing, characterized in that: The secure calculation is used for a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector, the target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The device is applied to the second participant and includes: A second generating module, configured to generate a first plaintext polynomial using the target column vector as a coefficient vector; An encryption module, used for performing homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial; A sending module, configured to send the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the target matrix, and sends the masking polynomial to the second participant; A third generating module, configured to generate a first fragment of the product based on the masking polynomial sent by the first participant; A second execution module is used to execute a target data processing task based on the first slice.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 11 are implemented.

15. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 11.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images