Data processing method, device, medium, equipment and product for secure computation

Abstract

The present disclosure relates to a data processing method, device, medium, equipment and product for secure computation. The secure computation is used for a first participant and a second participant to cooperatively compute the product of a target matrix and a target column vector. The method comprises the following steps: encoding the target matrix into N polynomials; generating a second ciphertext polynomial according to the N polynomials and a first ciphertext polynomial sent by the second participant; generating an N-dimensional random column vector, performing a masking process on the second ciphertext polynomial by using the random column vector, and sending the obtained masking polynomial after the masking process to the second participant; taking the random column vector as a second shard of the product, and performing a target data processing task based on the second shard. In this way, the product of the matrix and the vector can be securely computed by using the properties of the operator ring, and the present scheme can be applied to the secure computation of the product of the matrix and the vector on the ring of any modulus. In addition, the data security can be protected and the applicability can be improved in the model training scene by the present scheme.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of secure multi-party computation, and in particular, to a data processing method, device, medium, equipment and product for secure computation. BACKGROUND

[0002] Secure multi-party computation, also known as multi-party secure computation (MPC), can be used to jointly compute the result of a function by multiple parties without leaking the input data of each party in the function. The result of the computation is disclosed to one or more parties. Typical applications of secure multi-party computation include, for example, joint statistical analysis of multi-party data with privacy protection, machine learning, etc. Among them, the multi-party secure computation technology can be used to protect privacy data in the training phase of a machine learning model, mainly involving the protection of model parameters and the protection of data of each participant in the training process.

[0003] In the training process of a machine learning model, the model loss is usually used to update the model parameters, wherein the model loss calculation usually involves secure computation of the product of a matrix and a column vector. At present, a homomorphic encryption mechanism based on Number Theoretic Transform (NTT) encoding is usually used to securely compute the product of a matrix and a column vector. Since NTT encoding is to convert a polynomial in a modulus prime ring into another polynomial coefficient representation, NTT encoding relies on the specific properties of a modulus prime, and therefore, the homomorphic encryption mechanism based on NTT encoding is only applicable to secure computation of the product of a matrix and a vector in a modulus prime ring, and the scope of application is relatively limited. SUMMARY

[0004] This summary is provided to introduce a selection of concepts, which are further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0005] In a first aspect, the present disclosure provides a data processing method for secure computation, the secure computation being used for a first participant and a second participant to jointly compute the product of an N*N target matrix and an N-dimensional target column vector, the target matrix being held by the first participant alone, and the target column vector being held by the second participant alone, the method being applied to the first participant and comprising:

[0006] encoding the target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix;

[0007] In response to receiving the first ciphertext polynomial sent by the second participant, a second ciphertext polynomial is generated according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial;

[0008] A random column vector of N dimensions is generated, the second ciphertext polynomial is masked by using the random column vector to obtain a masked polynomial, and the masked polynomial is sent to the second participant, so that the first shard of the product is generated by the second participant based on the masked polynomial;

[0009] The random column vector is taken as the second shard of the product, and a target data processing task is performed based on the second shard.

[0010] In a second aspect, the present disclosure provides a data processing method for secure computation, the secure computation being used for a first participant and a second participant to collaboratively compute a product of an N*N target matrix and an N-dimensional target column vector, the target matrix being held by the first participant alone, and the target column vector being held by the second participant alone, the method being applied to the second participant, and comprising:

[0011] A first plaintext polynomial is generated with the target column vector as a coefficient vector;

[0012] The first plaintext polynomial is homomorphically encrypted to obtain a first ciphertext polynomial;

[0013] The first ciphertext polynomial is sent to the first participant, so that a masked polynomial is generated by the first participant based on the first ciphertext polynomial and the target matrix, and the masked polynomial is sent to the second participant;

[0014] A first shard of the product is generated based on the masked polynomial sent by the first participant;

[0015] A target data processing task is performed based on the first shard.

[0016] In a third aspect, the present disclosure provides a data processing apparatus for secure computation, the secure computation being used for a first participant and a second participant to collaboratively compute a product of an N*N target matrix and an N-dimensional target column vector, the target matrix being held by the first participant alone, and the target column vector being held by the second participant alone, the apparatus being applied to the first participant, and comprising:

[0017] An encoding module is configured to encode the target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix;

[0018] The first generating module is configured to, in response to receiving the first ciphertext polynomial sent by the second participant, generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial.

[0019] The masking processing module is configured to generate an N-dimensional random column vector, mask the second ciphertext polynomial by using the random column vector to obtain a masked polynomial, and send the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial.

[0020] The first executing module is configured to take the random column vector as a second shard of the product, and execute a target data processing task based on the second shard.

[0021] In a fourth aspect, the present disclosure provides a data processing apparatus for secure computation, the secure computation being used for a first participant and a second participant to collaboratively compute a product of an N*N target matrix and an N-dimensional target column vector, the target matrix being held by the first participant alone, and the target column vector being held by the second participant alone, the apparatus being applied to the second participant, and comprising:

[0022] The second generating module is configured to generate a first plaintext polynomial with the target column vector as a coefficient vector.

[0023] The encrypting module is configured to homomorphically encrypt the first plaintext polynomial to obtain a first ciphertext polynomial.

[0024] The sending module is configured to send the first ciphertext polynomial to the first participant, so that the first participant generates a masked polynomial based on the first ciphertext polynomial and the target matrix, and sends the masked polynomial to the second participant.

[0025] The third generating module is configured to generate a first shard of the product based on the masked polynomial sent by the first participant.

[0026] The second executing module is configured to execute a target data processing task based on the first shard.

[0027] In a fifth aspect, the present disclosure provides a computer readable medium having a computer program stored thereon, the computer program being executed by a processing apparatus to implement steps of the data processing method for secure computation provided in the first aspect of the present disclosure or steps of the data processing method for secure computation provided in the second aspect of the present disclosure.

[0028] In a sixth aspect, the present disclosure provides an electronic device, comprising:

[0029] a storage device having stored thereon a computer program;

[0030] a processing device configured to execute the computer program in the storage device to implement the steps of the data processing method for secure computation according to the first aspect of the present disclosure or the steps of the data processing method for secure computation according to the second aspect of the present disclosure.

[0031] In a seventh aspect, the present disclosure provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the data processing method for secure computation according to the first aspect of the present disclosure or the steps of the data processing method for secure computation according to the second aspect of the present disclosure.

[0032] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix held by it into N polynomials, at the same time, the second participant generates a first plaintext polynomial with the target column vector held by it as the coefficient vector, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial; next, the first participant performs masking processing on the second ciphertext polynomial by using the locally generated random column vector, and sends the masking polynomial obtained after the masking processing to the second participant; the second participant generates a first slice of the product of the target matrix and the target column vector based on the masking polynomial, and the first participant takes the random column vector as a second slice of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform a target data processing task based on the slice held by themselves. In this way, the product of the target matrix and the target column vector can be securely calculated by using the properties of the operator ring, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector only applies to the prime modulus ring due to the use of NTT encoding, so that the present solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the present solution can protect data security and improve applicability in the model training scenario.

[0033] Other features and advantages of the present disclosure will be described in detail in the following detailed description section. BRIEF DESCRIPTION OF DRAWINGS

[0034] The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by describing in detail the following specific embodiments thereof with reference to the attached drawings. The same or similar elements are denoted by the same or similar reference numerals throughout the drawings. It is to be understood that the drawings are schematic, and the sizes of the components and elements are not necessarily drawn to scale. In the drawings:

[0035] Figure 1This is a flowchart illustrating a data processing method for secure computation applied to a first participant, according to an exemplary embodiment.

[0036] Figure 2 This is a flowchart illustrating a data processing method for secure computation applied to a second participant, according to an exemplary embodiment.

[0037] Figure 3 This is a block diagram illustrating a data processing apparatus for secure computation applied to a first participant, according to an exemplary embodiment.

[0038] Figure 4 This is a block diagram illustrating a data processing apparatus for secure computation applied to a second participant, according to an exemplary embodiment.

[0039] Figure 5 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0040] Before introducing specific embodiments of this disclosure, the specific application scenarios of multi-party secure computation and the terms involved in this disclosure will be explained.

[0041] A ring is a set that defines two operations: addition and multiplication. It forms an abelian group for addition and a semigroup for multiplication for all elements except zero. Multiplication satisfies the distributive property of addition.

[0042] In the field of secure computing, particularly in multi-party computation (MPC), an operator ring typically refers to a set of operators that support secure computation between multiple parties. These operators can include basic arithmetic operations (such as addition and multiplication), logical operations, comparison operations, etc., and they form the basis for building more complex secure computing protocols.

[0043] The ring consisting of addition and multiplication is defined above. It is an integer ring. Addition is defined as integer addition modulo N, and multiplication is defined as integer multiplication modulo N, where N is an integer greater than 1.

[0044] It is a ring consisting of equivalence classes obtained by taking the modulo of integers with respect to 2N, namely {0, 1, 2, ..., 2N-1}.

[0045] It is a modulo 2N multiplicative group. The set of all elements coprime to 2N, i.e., these elements have multiplicative inverses modulo 2N, i.e., {1, 3, ..., 2N-1}.

[0046] Secret Sharing, also known as secret split, secret sharing, the basic principle is to split the secret (such as key, private data, etc.) into multiple shares (Share), respectively, to different data parties. Only more than the threshold number of parties will merge their fragments, and the secret can be restored; the Share obtained from less than the threshold number of parties cannot restore any information of the secret. In multi-party secure computation, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called fragments. Among them, the private data is the data that the other parties do not want to know in multi-party secure computation.

[0047] Homomorphic encryption is a technology that allows calculation on encrypted data (i.e., ciphertext) and then decryption to obtain the result. The calculation result of homomorphic encryption is the same as the result of direct calculation on the original data (i.e., plaintext), but the entire calculation process is performed on encrypted data.

[0048] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms, and should not be interpreted as being limited to the embodiments set forth herein, but rather these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes, and are not intended to limit the scope of protection of the present disclosure.

[0049] It should be understood that each step described in the method embodiments of the present disclosure can be performed in different order and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0050] The term "comprising" and variations thereof as used herein are open-ended, that is "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related definitions of other terms will be given in the description below.

[0051] It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not intended to limit the order or interdependence of the functions performed by these devices, modules or units.

[0052] It should be noted that the modification of "one" or "multiple" mentioned in the present disclosure is illustrative and not limiting, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0053] Names of messages or information exchanged between multiple devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0054] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0055] For example, in response to receiving an active request of a user, prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using personal information of the user. Thus, the user can voluntarily choose whether to provide personal information to the software or hardware such as an electronic device, an application program, a server or a storage medium, etc. that performs the operation of the technical solutions of the present disclosure according to the prompt information.

[0056] As an optional but non-limiting implementation manner, in response to receiving an active request of a user, the manner of sending prompt information to the user may, for example, be a pop-up window manner, and the prompt information may be presented in the form of text in the pop-up window. In addition, the pop-up window may also carry selection controls for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0057] It can be understood that the above notification and user authorization process is only illustrative, and does not limit the implementation manners of the present disclosure, and other manners that meet relevant laws and regulations can also be applied to the implementation manners of the present disclosure.

[0058] At the same time, it can be understood that the data involved in the technical solutions (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of relevant laws and regulations and relevant provisions.

[0059] Figure 1 is a flowchart of a data processing method for secure computation applied to a first participant according to an example embodiment. As shown in Figure 1 , the method can include S101-S104.

[0060] In S101, a target matrix is encoded into N polynomials.

[0061] In the present disclosure, secure computation is used for the first participant and the second participant to collaboratively compute the product of an N*N target matrix and an N-dimensional target column vector. It can be understood that the target matrix and the target column vector in the present disclosure can be any data that the holder is inconvenient to disclose.

[0062] The target matrix is held by the first participant alone, and the target column vector is held by the second participant alone. Wherein, the target matrix M ∈ MN,N (R), i.e. the target matrix M is an N-dimensional square matrix over the ring R, and the target column vector a is an N-dimensional column vector over the ring R (N) , i.e. the target column vector is an N-dimensional column vector over the ring R, and R is an arbitrary commutative ring containing 1.

[0063] The target matrix is a square matrix. If the matrix used for secure calculation is not initially a square matrix, it can be reconstructed into a square matrix by zero padding or cutting.

[0064] In addition, the coefficients of the N polynomials are determined based on the elements in the target matrix.

[0065] For example, the target matrix can be encoded as a polynomial shown in the following equation (1):

[0066]

[0067] where p k (x) is the (k+1) / 2-th polynomial in the N polynomials, i.e. k = 1, 3,..., 2N-1; m i,j is the element in the i-th row and j-th column of the target matrix; and x is the independent variable of the polynomial.

[0068] In S102, in response to receiving the first ciphertext polynomial sent by the second participant, a second ciphertext polynomial is generated according to the N polynomials and the first ciphertext polynomial.

[0069] In the present disclosure, the target column vector is the coefficient vector of the first plaintext polynomial corresponding to the first ciphertext polynomial.

[0070] Specifically, when calculating the product of the target matrix and the target column vector, the first participant encodes the target matrix held by it into N polynomials, and at the same time, the second participant generates a first plaintext polynomial with the target column vector held by it as the coefficient vector; then, the second participant homomorphically encrypts the first plaintext polynomial using the homomorphic encryption public key, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; after receiving the first ciphertext polynomial, the first participant generates a second ciphertext polynomial according to the N polynomials obtained by encoding the target matrix and the first ciphertext polynomial.

[0071] where the second participant can generate a first plaintext polynomial m1 with the target column vector held by it as the coefficient vector by the following equation (2):

[0072] m1 = (1, x,..., x N-1 )α (2)

[0073] where a is the target column vector.

[0074] In S103, a random column vector in N dimensions is generated, the second ciphertext polynomial is masked using the random column vector to obtain a masked polynomial, and the masked polynomial is sent to the second participant to generate a first shard of the product based on the masked polynomial by the second participant.

[0075] In S104, the random column vector is taken as a second shard of the product, and a target data processing task is performed based on the second shard.

[0076] In the present disclosure, the random column vector β0∈R (N) That is, the random column vector is an N-dimensional column vector in the R ring generated randomly.

[0077] After the first participant generates the random column vector, it can take it as one shard of the product of the target matrix and the target column vector, i.e., the second shard, at the same time, mask the second ciphertext polynomial using the random column vector, and send the masked polynomial obtained after the masking to the second participant; after the second participant receives the masked polynomial, it generates another shard of the product of the target matrix and the target column vector based on the masked polynomial, i.e., the first shard. Then, the first participant and the second participant can share the shards of the product results generated by each other in a shared manner, and combine the shards generated by both to obtain the final calculation result (i.e., the product of the target matrix and the target column vector). Wherein, the result of the product of the target matrix and the target column vector includes the first shard and the second shard, i.e., target matrix * target column vector = first shard + second shard.

[0078] In addition, the above-mentioned target data processing task can be a machine learning model training task, wherein the machine learning model can be, for example, a neural network model, a logistic regression model, etc. The first participant can perform machine learning model training based on the target matrix held by itself, and the second participant can perform machine learning model training based on the target column vector held by itself in an MPC manner, to obtain one shard of the product of the target matrix and the target column vector respectively, and then calculate the model loss based on the shards of the product held by both, and update the model parameters of the machine learning model according to the model loss. Wherein, the target matrix can be a feature matrix, and the target column vector can be a vector composed of model parameters.

[0079] In the technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix held by the first participant into N polynomials, and meanwhile, the second participant generates a first plaintext polynomial with the target column vector held by the second participant as a coefficient vector, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained through the homomorphic encryption to the first participant. Then, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial. Next, the first participant performs a masking process on the second ciphertext polynomial by using a locally generated random column vector, and sends the masking polynomial obtained through the masking process to the second participant. The second participant generates a first shard of the product of the target matrix and the target column vector based on the masking polynomial, and the first participant takes the random column vector as a second shard of the product of the target matrix and the target column vector. Finally, the first participant and the second participant respectively perform a target data processing task based on the shards held by the first participant and the second participant. In this way, the product of the target matrix and the target column vector can be securely calculated by using the properties of the operator ring, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector caused by the NTT encoding is only applicable to the prime modulus ring. Therefore, the present solution can be applied to the secure calculation of the product of the matrix and the vector on a ring with an arbitrary modulus. In addition, the present solution can protect data security and improve applicability in a model training scenario.

[0080] The following describes the specific implementation of generating the second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in S102 in detail. Specifically, the following steps (a1) and (a2) can be used to achieve this.

[0081] Step (a1): performing N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials.

[0082] In an embodiment, step (a1) can include the following steps:

[0083] Step (a11): receiving the Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on the homomorphic encryption private key.

[0084] In the present disclosure, the second participant can generate the Galois key based on the homomorphic encryption private key and send it to the first participant, wherein the Galois key is usually an element in the Galois group and is used for rotation transformation of the ciphertext. After receiving the Galois key, the first participant performs a rotation operation on the corresponding ciphertext polynomial by using the Galois key.

[0085] It should be noted that the specific way of generating the Galois key by using the homomorphic encryption private key is known to those skilled in the art, and the present disclosure will not be described in detail.

[0086] Step (a12): For each element of the modulo 2N multiplicative group, perform a rotation operation on the first ciphertext polynomial using that element and the Galois key to obtain the third ciphertext polynomial.

[0087] In this disclosure, the modular 2N multiplication group elements in That is, k = 1, 3, ..., 2N-1. The Galois key does not directly affect the transformation formula; its role is to ensure that the first participant can perform transformations on the ciphertext (i.e., the first ciphertext polynomial) so that the plaintext polynomial obtained after subsequent decryption (i.e., a0 + a1x) is... k +…+a N-1 x k(N-1) mod(x N +1)) is equal to the polynomial obtained by performing a k-transformation directly on the first plaintext polynomial m1, that is:

[0088] Dec(sk,σ k (ct))=σ k (m1)=a0+a1x k +…+a N-1 x k(N-1) mod(x N +1)

[0089] Where, σ k (ct) is the (k+1) / 2th ciphertext polynomial among N third ciphertext polynomials; the first ciphertext polynomial ct = Enc(a0 + a1x + ... + a N-1 x N-1 Enc represents encryption, that is, ct is the first plaintext polynomial m1 = a0 + a1x + ... + a N- 1x N-1 The ciphertext; the target column vector is Dec represents decryption, and sk is the homomorphic encryption private key;

[0090] Here, performing the k-transformation means applying k to the power of the first ciphertext polynomial.

[0091] Step (a2): Generate the second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials.

[0092] For example, the second ciphertext polynomial can be generated from N polynomials and N third ciphertext polynomials using the following equation (3):

[0093]

[0094] Where ct(β) is the second ciphertext polynomial.

[0095] The following detailed description is made with respect to the above-mentioned step S103 of performing a masking process on the second ciphertext polynomial using the random column vector to obtain a masked polynomial. Specifically, the masking process can be implemented through the following steps (b1) to (b3):

[0096] Step (b1): generating the second plaintext polynomial with the random column vector as the coefficient vector.

[0097] By way of example, the second plaintext polynomial m2 can be generated with the random column vector as the coefficient vector through the following equation (4):

[0098] m2 = (1, x, …, x N-1 ) β0 (4)

[0099] where β0 is the random column vector.

[0100] Step (b2): homomorphically encrypting the second plaintext polynomial to obtain a fourth ciphertext polynomial.

[0101] Step (b3): determining the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masked polynomial, i.e., the masked polynomial ct(β1) = ct(β) - ct(β0), where ct(β0) is the fourth ciphertext polynomial.

[0102] The following describes the correctness of the above target matrix * target column vector = first slice + second slice, i.e., Mα = β = β0 + β1, where β1 is the second slice.

[0103] If β = Mα, where β ∈ R (N) , then

[0104]

[0105] The above equation (5) can be derived through the following process:

[0106] Let

[0107] where is a composite operation; tr A / R is a mapping from ring A to ring R, ring A is a quotient ring of a monomial ring over ring R, tr A / R = 1 + σ3 + … + σ 2N-1 , σ3, …, σ 2N-1 are elements in a Galois group, elements in the Galois group are mappings from ring A to itself, and tr A / R and P are both operators.

[0108] Therefore, and we have:

[0109] (1,x,...,x N-1 )β=P(1,x,...,x N-1 )α

[0110] wherein the

[0111]

[0112] Figure 2 is a flow chart of a data processing method for secure computation applied to a first participant according to an exemplary embodiment. As shown in Figure 2 , the method can include S201-S205.

[0113] In S201, a first plaintext polynomial is generated with a target column vector as a coefficient vector.

[0114] In the present disclosure, secure computation is used for the first participant and the second participant to collaboratively compute the product of the target matrix of N*N and the target column vector of N dimensions.

[0115] In S202, the first plaintext polynomial is homomorphically encrypted to obtain a first ciphertext polynomial.

[0116] In S203, the first ciphertext polynomial is sent to the first participant to generate a masked polynomial based on the first ciphertext polynomial and the target matrix by the first participant, and the masked polynomial is sent to the second participant.

[0117] In S204, the first shard of the product is generated based on the masked polynomial sent by the first participant.

[0118] In S205, the target data processing task is executed based on the first shard.

[0119] In the present disclosure, the above-mentioned target data processing task can be a machine learning model training task. The above-mentioned target data processing task can be a machine learning model training task, wherein the machine learning model can be, for example, a neural network model, a logistic regression model, etc. The first participant can perform machine learning model training based on the target matrix held by itself, and the second participant can perform machine learning model training based on the target column vector held by itself in an MPC manner, to obtain a shard of the product of the target matrix and the target column vector respectively, and then based on the shard of the product held by each of them, the model loss is calculated, and the model parameters of the machine learning model are updated according to the model loss. Wherein the target matrix can be a feature matrix, and the target column vector can be a vector composed of model parameters.

[0120] In the technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix held by the first participant into N polynomials, and the second participant generates a first plaintext polynomial with the target column vector held by the second participant as a coefficient vector, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant. Then, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial. Next, the first participant performs masking processing on the second ciphertext polynomial by using a locally generated random column vector, and sends the obtained masking polynomial to the second participant. The second participant generates a first shard of the product of the target matrix and the target column vector based on the masking polynomial, and the first participant takes the random column vector as a second shard of the product of the target matrix and the target column vector. Finally, the first participant and the second participant respectively perform a target data processing task based on the shards held by the first participant and the second participant. In this way, the product of the target matrix and the target column vector can be securely calculated by using the properties of the operator ring, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector caused by the NTT encoding is only applicable to the prime modulus ring. Therefore, the present solution can be applied to the secure calculation of the product of the matrix and the vector on a ring with any modulus. In addition, the present solution can protect data security and improve applicability in a model training scenario.

[0121] The following describes a specific implementation of the first shard of the product generated based on the masking polynomial sent by the first participant in S204 in detail. Specifically, the following steps (c1) and (c2) can be used to achieve this:

[0122] Step (c1): Homomorphically decrypt the masking polynomial to obtain a third plaintext polynomial.

[0123] Step (c2): Determine the coefficient vector of the third plaintext polynomial as the first shard.

[0124] After receiving the masking polynomial sent by the first participant, the second participant homomorphically decrypts the masking polynomial by using a local homomorphic encryption private key to obtain a third plaintext polynomial, and then determines the coefficient vector (column vector) of the third plaintext polynomial as the first shard of the product of the target matrix and the target column vector.

[0125] In one possible implementation, the data processing method for secure calculation applied to the second participant can further include:

[0126] Generating a Galois key based on the homomorphic encryption private key;

[0127] Sending the Galois key to the first participant.

[0128] The specific implementation manners of the steps in the data processing method for secure computation applied to the second participant according to the embodiments of the present disclosure have been described in detail in the data processing method for secure computation applied to the first participant according to the embodiments of the present disclosure, and will not be repeated here.

[0129] Figure 3 is a block diagram of a data processing apparatus for secure computation applied to a first participant according to an exemplary embodiment. The secure computation is used for the first participant to collaboratively compute a product of a target matrix of N*N and a target column vector of N dimensions with a second participant, the target matrix is solely held by the first participant, and the target column vector is solely held by the second participant, as shown in Figure 3 The data processing apparatus for secure computation applied to the first participant 300 includes:

[0130] The encoding module 301 is configured to encode the target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix.

[0131] The first generating module 302 is configured to, in response to receiving the first ciphertext polynomial sent by the second participant, generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial.

[0132] The masking processing module 303 is configured to generate a random column vector of N dimensions, mask the second ciphertext polynomial by using the random column vector to obtain a masked polynomial, and send the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial.

[0133] The first executing module 304 is configured to take the random column vector as a second shard of the product, and execute a target data processing task based on the second shard.

[0134] In the technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix held by the first participant into N polynomials, and meanwhile, the second participant generates a first plaintext polynomial with the target column vector held by the second participant as a coefficient vector, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial; next, the first participant performs masking processing on the second ciphertext polynomial by using a locally generated random column vector, and sends the masking polynomial obtained after the masking processing to the second participant; the second participant generates a first shard of the product of the target matrix and the target column vector based on the masking polynomial, and the first participant takes the random column vector as a second shard of the product of the target matrix and the target column vector; finally, the first participant and the second participant respectively perform a target data processing task based on the shards held by the first participant and the second participant. In this way, the product of the target matrix and the target column vector can be securely calculated by using the properties of the operator ring, so that the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the prime modulus ring due to the use of NTT encoding can be avoided, and thus the present solution can be applied to the secure calculation of the product of the matrix and the vector on a ring of any modulus. In addition, the present solution can protect data security and improve applicability in a model training scenario.

[0135] Optionally, the encoding module 301 is configured to encode the target matrix into a polynomial shown in the following formula:

[0136]

[0137] wherein p k is the (k+1) / 2th polynomial in the N polynomials, is an integer ring; m i,j is an element in the i-th row and the j-th column of the target matrix; and x is an independent variable of the polynomial.

[0138] Optionally, the first generating module 302 includes:

[0139] a first rotating submodule configured to perform N rotating operations on the first ciphertext polynomial to obtain N third ciphertext polynomials;

[0140] a first generating submodule configured to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials.

[0141] Optionally, the first rotating submodule includes:

[0142] receive a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key;

[0143] The second selection sub-module is configured to, for each element of the modulo-2N multiplication group, perform a rotation operation on the first ciphertext polynomial by using the element and the Galois key, to obtain a third ciphertext polynomial.

[0144] Optionally, the first generation sub-module is configured to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials, by the following formula:

[0145]

[0146] wherein ct(β) is the second ciphertext polynomial; p k (x) is a (k+1) / 2-th polynomial in the N polynomials, is an integer ring; σ k (ct) is a (k+1) / 2-th ciphertext polynomial in the N third ciphertext polynomials.

[0147] Optionally, the masking processing module 303 includes:

[0148] The second generation sub-module is configured to generate a second plaintext polynomial with the random column vector as a coefficient vector;

[0149] The encryption sub-module is configured to perform homomorphic encryption on the second plaintext polynomial, to obtain a fourth ciphertext polynomial;

[0150] The first determination sub-module is configured to determine a difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masking polynomial.

[0151] Optionally, the target data processing task is a machine learning model training task.

[0152] Figure 4 is a block diagram of a data processing apparatus for secure computation applied to a second participant according to an exemplary embodiment. The secure computation is used for the first participant and the second participant to cooperatively compute a product of an N*N target matrix and an N-dimensional target column vector, the target matrix is held by the first participant alone, and the target column vector is held by the second participant alone. As shown in the figure, Figure 4 The data processing apparatus for secure computation applied to the second participant 400 includes:

[0153] The second generation module 401 is configured to generate a first plaintext polynomial with the target column vector as a coefficient vector;

[0154] The encryption module 402 is configured to homomorphically encrypt the first plaintext polynomial to obtain a first ciphertext polynomial;

[0155] The sending module 403 is configured to send the first ciphertext polynomial to the first participant, so that the first participant generates a cover polynomial based on the first ciphertext polynomial and the target matrix, and sends the cover polynomial to the second participant;

[0156] The third generation module 404 is configured to generate the first shard of the product based on the cover polynomial sent by the first participant;

[0157] The second execution module 405 is configured to execute a target data processing task based on the first shard.

[0158] In the above technical solution, when calculating the product of the target matrix and the target column vector, the first participant first encodes the target matrix held by it into N polynomials, and at the same time, the second participant generates a first plaintext polynomial with the target column vector held by it as a coefficient vector, homomorphically encrypts the first plaintext polynomial, and sends the first ciphertext polynomial obtained by homomorphic encryption to the first participant; then, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial; next, the first participant performs cover processing on the second ciphertext polynomial using a locally generated random column vector, and sends the cover polynomial obtained after cover processing to the second participant; the second participant generates the first shard of the product of the target matrix and the target column vector based on the cover polynomial, and the first participant takes the random column vector as the second shard of the product of the target matrix and the target column vector; finally, the first participant and the second participant execute a target data processing task based on the shard held by themselves respectively. In this way, the product of the target matrix and the target column vector can be securely calculated by using the properties of the operator ring, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector only applies to the prime modulus ring due to the use of NTT encoding, so that the present solution can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the present solution can protect data security and improve applicability in the model training scenario.

[0159] Optionally, the third generation module 404 comprises:

[0160] The decryption submodule is configured to homomorphically decrypt the cover polynomial to obtain a third plaintext polynomial;

[0161] The second determination submodule is configured to determine the coefficient vector of the third plaintext polynomial as the first shard.

[0162] Optionally, the data processing apparatus 400 for secure computation applied to the second participant further comprises:

[0163] a fourth generating module configured to generate a Galois key based on the homomorphic encryption private key;

[0164] The sending module 403 is further configured to send the Galois key to the first participant.

[0165] Optionally, the target data processing task is a machine learning model training task.

[0166] Reference will be made to the following description Figure 5 , which shows a structural schematic diagram of an electronic device (e.g., a terminal device or a server) 600 suitable for implementing embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure can include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet Personal Computer), a PMP (Portable Multimedia Player), a vehicle terminal (e.g., a car navigation terminal), and the like, as well as a fixed terminal such as a digital TV, a desktop computer, and the like. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0167] As shown in Figure 5 , the electronic device 600 can include a processing apparatus (e.g., a central processor, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded into a random access memory (RAM) 603 from a storage apparatus 608. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing apparatus 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0168] Generally, the following apparatuses can be connected to the I / O interface 605: an input apparatus 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and the like; an output apparatus 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; a storage apparatus 608 including, for example, a magnetic tape, a hard disk, and the like; and a communication apparatus 609. The communication apparatus 609 can allow the electronic device 600 to perform wireless or wired communication with other devices to exchange data. Although Figure 5 The electronic device 600 is shown with various apparatuses, but it should be understood that all of the shown apparatuses are not required to be implemented or possessed. More or fewer apparatuses can be alternatively implemented or possessed.

[0169] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the methods of embodiments of the present disclosure are performed.

[0170] It should be noted that the computer-readable medium described above in the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, the computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave in a propagated data signal, in which the computer-readable program code is carried. Such a propagated data signal can take a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium that can be used to carry or store program code for use by or in connection with an instruction execution system, apparatus, or device. The program code contained in the computer-readable medium can be transmitted by any suitable medium, including but not limited to wire, cable, RF (radio frequency), or any suitable combination thereof.

[0171] In some embodiments, the client, server, and / or other components or devices can utilize any known and / or future developed network protocols for communication, including but not limited to HTTP (HyperText Transfer Protocol), TCP / IP (Transmission Control Protocol / Internet Protocol), UDP (User Datagram Protocol), RDP (Remote Desktop Protocol), and / or the like. In some embodiments, the client, server, and / or other components or devices can be interconnected and / or communicate in a networked environment including an intranet, local area network (LAN), wide area network (WAN), the Internet, and / or the like.

[0172] The computer readable medium described above can be included in the electronic device described above; or can exist separately from the electronic device and be not assembled into the electronic device.

[0173] The computer readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, cause the electronic device to: encode a target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix, securely compute a product of the target matrix of N*N and a target column vector of N dimensions in collaboration with a second participant, the target matrix being held by a first participant alone, the target column vector being held by the second participant alone; in response to receiving a first ciphertext polynomial sent by the second participant, generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; generate a random column vector of N dimensions, mask the second ciphertext polynomial using the random column vector to obtain a masked polynomial, and send the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial; take the random column vector as a second shard of the product, and perform a target data processing task based on the second shard.

[0174] Alternatively, the computer readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device is caused to: generate a first plaintext polynomial with a target column vector as a coefficient vector, securely compute a product of a target matrix of N*N and the target column vector of N dimensions for the first participant and the second participant to collaboratively compute, the target matrix being held by the first participant alone, and the target column vector being held by the second participant alone; homomorphically encrypt the first plaintext polynomial to obtain a first ciphertext polynomial; send the first ciphertext polynomial to the first participant, so that the first participant generates a cover polynomial based on the first ciphertext polynomial and the target matrix, and sends the cover polynomial to the second participant; generate a first shard of the product based on the cover polynomial sent by the first participant; and perform a target data processing task based on the first shard.

[0175] Computer program code for carrying out operations of the present disclosure can be written in any of one or more programming languages or combinations of languages including object or visual programming languages such as Java, Smalltalk, C++ or conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0176] The flow and block diagrams in the drawings show architectural, functional, and operational architectures of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow and block diagrams can represent a module, a segment, or a portion of code that comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0177] The modules described in the embodiments of the present disclosure can be implemented in the form of software, or can be implemented in the form of hardware. Among them, the name of the module does not constitute a limitation of the module itself in some cases, for example, the second execution module can also be described as "a module for performing a target data processing task based on the first fragment".

[0178] The functions described above herein can be executed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that can be used include: field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-chips (SOCs), complex programmable logic devices (CPLDs), and so on.

[0179] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the above. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0180] According to one or more embodiments of the present disclosure, example 1 provides a data processing method for secure computation, the secure computation being used for a first participant and a second participant to collaboratively compute a product of a target matrix of N*N and a target column vector of N dimensions, the target matrix being solely held by the first participant, the target column vector being solely held by the second participant, the method being applied to the first participant and comprising: encoding the target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix; in response to receiving a first ciphertext polynomial sent by the second participant, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; generating a random column vector of N dimensions, performing a masking process on the second ciphertext polynomial by using the random column vector to obtain a masked polynomial, and sending the masked polynomial to the second participant, so that the second participant generates a first shard of the product based on the masked polynomial; taking the random column vector as a second shard of the product, and performing a target data processing task based on the second shard.

[0181] According to one or more embodiments of the present disclosure, example 2 provides the method of example 1, and the encoding of the target matrix into N polynomials comprises:

[0182] The target matrix is encoded into a polynomial as shown in the following formula:

[0183]

[0184] wherein p k (x) is the (k+1) / 2th polynomial in the N polynomials, is an integer ring; m i,j is an element in the target matrix at the i-th row and the j-th column; and x is an independent variable of the polynomial.

[0185] According to one or more embodiments of the present disclosure, example 3 provides the method of example 1, and the generating of the second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial comprises: performing N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials; and generating the second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials.

[0186] According to one or more embodiments of the present disclosure, example 4 provides the method of example 3, wherein the N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials comprises: receiving a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key; performing a rotation operation on the first ciphertext polynomial with each element of a modulo 2N multiplication group and the Galois key to obtain a third ciphertext polynomial.

[0187] According to one or more embodiments of the present disclosure, example 5 provides the method of example 3, wherein the generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials comprises:

[0188] According to one or more embodiments of the present disclosure, example 5 provides the method of example 3, wherein the generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials comprises:

[0189]

[0190] wherein ct(β) is the second ciphertext polynomial; p k (x) is the (k+1) / 2-th polynomial in the N polynomials, is an integer ring; σ k (ct) is the (k+1) / 2-th ciphertext polynomial in the N third ciphertext polynomials.

[0191] According to one or more embodiments of the present disclosure, example 6 provides the method of example 1, wherein the masking the second ciphertext polynomial with the random column vector to obtain a masked polynomial comprises: generating a second plaintext polynomial with the random column vector as a coefficient vector; homomorphic encrypting the second plaintext polynomial to obtain a fourth ciphertext polynomial; and determining a difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masked polynomial.

[0192] According to one or more embodiments of the present disclosure, example 7 provides the method of any one of examples 1-6, wherein the target data processing task is a machine learning model training task.

[0193] According to one or more embodiments of the present disclosure, example 8 provides a data processing method for secure computation, the secure computation being for a first participant and a second participant to collaboratively compute a product of a target matrix of N*N and a target column vector of N dimensions, the target matrix being solely held by the first participant, the target column vector being solely held by the second participant, the method being applied to the second participant, comprising: generating a first plaintext polynomial with the target column vector as a coefficient vector; homomorphically encrypting the first plaintext polynomial to obtain a first ciphertext polynomial; sending the first ciphertext polynomial to the first participant, so that the first participant generates a masked polynomial based on the first ciphertext polynomial and the target matrix, and sends the masked polynomial to the second participant; generating a first shard of the product based on the masked polynomial sent by the first participant; and performing a target data processing task based on the first shard.

[0194] According to one or more embodiments of the present disclosure, example 9 provides the method of example 8, and the generating the first shard of the product based on the masked polynomial sent by the first participant comprises: homomorphically decrypting the masked polynomial to obtain a third plaintext polynomial; and determining a coefficient vector of the third plaintext polynomial as the first shard.

[0195] According to one or more embodiments of the present disclosure, example 10 provides the method of example 8, and the method further comprises: generating a Galois key based on a homomorphic encryption private key; and sending the Galois key to the first participant.

[0196] According to one or more embodiments of the present disclosure, example 11 provides the method of any one of examples 8-10, and the target data processing task is a machine learning model training task.

[0197] According to one or more embodiments of the present disclosure, example 12 provides a data processing apparatus for secure computation, the secure computation being for a first participant and a second participant to collaboratively compute a product of a target matrix of N*N and a target column vector of N dimensions, the target matrix being solely held by the first participant, the target column vector being solely held by the second participant, the apparatus being applied to the first participant, comprising: an encoding module configured to encode the target matrix into N polynomials, coefficients of the N polynomials being determined based on elements in the target matrix; a first generating module configured to, in response to receiving a first ciphertext polynomial sent by the second participant, generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the target column vector is a coefficient vector of a first plaintext polynomial corresponding to the first ciphertext polynomial; a masking processing module configured to generate a random column vector of N dimensions, mask the second ciphertext polynomial by using the random column vector to obtain a masked polynomial, and send the masked polynomial to the second participant, so as to enable the second participant to generate a first shard of the product based on the masked polynomial; and a first executing module configured to take the random column vector as a second shard of the product, and execute a target data processing task based on the second shard.

[0198] According to one or more embodiments of the present disclosure, example 13 provides a data processing apparatus for secure computation, the secure computation being for a first participant and a second participant to collaboratively compute a product of a target matrix of N*N and a target column vector of N dimensions, the target matrix being solely held by the first participant, the target column vector being solely held by the second participant, the apparatus being applied to the second participant, comprising: a second generating module configured to generate a first plaintext polynomial with the target column vector as a coefficient vector; an encrypting module configured to homomorphically encrypt the first plaintext polynomial to obtain a first ciphertext polynomial; a sending module configured to send the first ciphertext polynomial to the first participant, so as to enable the first participant to generate a masked polynomial based on the first ciphertext polynomial and the target matrix, and send the masked polynomial to the second participant; a third generating module configured to generate a first shard of the product based on the masked polynomial sent by the first participant; and a second executing module configured to execute a target data processing task based on the first shard.

[0199] According to one or more embodiments of the present disclosure, example 14 provides a computer readable medium having stored thereon a computer program, which, when executed by a processing apparatus, implements the steps of the method of any one of examples 1-11.

[0200] According to one or more embodiments of the present disclosure, example 15 provides an electronic device comprising: a storage device having stored thereon a computer program; and a processing device configured to execute the computer program in the storage device to implement the steps of the method of any one of examples 1-11.

[0201] According to one or more embodiments of the present disclosure, example 16 provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of any one of examples 1-11.

[0202] The above description merely provides preferred embodiments of the present disclosure and a principle of applied technology. It should be understood by those skilled in the art that the disclosed scope of the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by the combinations of the above technical features or equivalent features thereof without departing from the above disclosed concept. For example, the technical solutions formed by the mutual replacement of the above features and the technical features disclosed in the present disclosure (but not limited to) having similar functions.

[0203] In addition, although each operation is depicted in a particular order, this should not be understood as requiring the operations to be performed in the particular order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing can be advantageous. Similarly, although several implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be combined in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented separately or in any suitable sub-combination.

[0204] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims. With respect to the devices in the above-described embodiments, the specific manner in which the various modules perform operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

Claims

1. A data processing method for secure computing, characterized in that, The secure computation is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector. The target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The method is applied to the first participant and includes: The target matrix is ​​encoded into N polynomials, the coefficients of which are determined based on the elements of the target matrix; In response to receiving the first ciphertext polynomial sent by the second participant, a second ciphertext polynomial is generated based on the N polynomials and the first ciphertext polynomial, wherein the target column vector is the coefficient vector of the first plaintext polynomial corresponding to the first ciphertext polynomial; Generate an N-dimensional random column vector, and use the random column vector as a coefficient vector to generate a second plaintext polynomial; The second plaintext polynomial is homomorphically encrypted to obtain the fourth ciphertext polynomial. The difference between the second ciphertext polynomial and the fourth ciphertext polynomial is determined as the masking polynomial, and the masking polynomial is sent to the second participant so that the second participant can generate the first slice of the product based on the masking polynomial. The random column vector is used as the second slice of the product, and the target data processing task is performed based on the second slice.

2. The method according to claim 1, characterized in that, Encoding the target matrix into N polynomials includes: The target matrix is ​​encoded as a polynomial as shown in the following formula: Where, p k (x) is the (k+1) / 2th polynomial among the N polynomials. It is an integer ring; m i,j Let x be the element in the i-th row and j-th column of the target matrix; x is the independent variable of the polynomial.

3. The method according to claim 1, characterized in that, The step of generating the second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial includes: Perform N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials; Generate the second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials.

4. The method according to claim 3, characterized in that, The step of performing N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials includes: Receive the Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on the homomorphic encryption private key; For each element of the modulo-2N multiplication group, the first ciphertext polynomial is rotated using that element and the Galois key to obtain the third ciphertext polynomial.

5. The method according to claim 3, characterized in that, The step of generating the second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials includes: Based on the N polynomials and the N third ciphertext polynomials, the second ciphertext polynomial is generated using the following formula: Where ct(β) is the second ciphertext polynomial; p k (x) is the (k+1) / 2th polynomial among the N polynomials. It is an integer ring; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

6. The method according to any one of claims 1-5, characterized in that, The target data processing task is a machine learning model training task.

7. A data processing method for secure computing, characterized in that, The secure computation is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector. The target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The method is applied to the second participant and includes: Using the target column vector as the coefficient vector, generate the first plaintext polynomial; The first plaintext polynomial is homomorphically encrypted to obtain the first ciphertext polynomial; The first ciphertext polynomial is sent to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial, the target matrix, and the second plaintext polynomial, and sends the masking polynomial to the second participant, wherein the second plaintext polynomial uses an N-dimensional random column vector as the coefficient vector; The first slice of the product is generated based on the masking polynomial sent by the first participant; The target data processing task is executed based on the first slice.

8. The method according to claim 7, characterized in that, The step of generating the first fragment of the product based on the masking polynomial sent by the first participant includes: Homomorphic decryption of the masking polynomial yields the third plaintext polynomial; The coefficient vector of the third plaintext polynomial is determined as the first slice.

9. The method according to claim 7, characterized in that, The method further includes: Generate a Galois key based on a homomorphic encryption private key; The Galois key is sent to the first participant.

10. The method according to any one of claims 7-9, characterized in that, The target data processing task is a machine learning model training task.

11. A data processing apparatus for secure computing, characterized in that, The secure computation is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector. The target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The device is applied to the first participant and includes: An encoding module is used to encode the target matrix into N polynomials, wherein the coefficients of the N polynomials are determined based on the elements in the target matrix; The first generation module is configured to, in response to receiving the first ciphertext polynomial sent by the second participant, generate a second ciphertext polynomial based on the N polynomials and the first ciphertext polynomial, wherein the target column vector is the coefficient vector of the first plaintext polynomial corresponding to the first ciphertext polynomial; The masking module is used to generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masked polynomial, and send the masked polynomial to the second participant so that the second participant can generate the first slice of the product based on the masked polynomial. The first execution module is used to take the random column vector as the second slice of the product and execute the target data processing task based on the second slice; The masking processing module includes: The second generation submodule is used to generate a second plaintext polynomial using the random column vector as the coefficient vector; The encryption submodule is used to perform homomorphic encryption on the second plaintext polynomial to obtain the fourth ciphertext polynomial; The first determining submodule is used to determine the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masking polynomial.

12. A data processing apparatus for secure computing, characterized in that, The secure computation is used by a first participant and a second participant to collaboratively calculate the product of an N*N target matrix and an N-dimensional target column vector. The target matrix is ​​held solely by the first participant, and the target column vector is held solely by the second participant. The device is applied to the second participant and includes: The second generation module is used to generate a first plaintext polynomial using the target column vector as the coefficient vector; An encryption module is used to perform homomorphic encryption on the first plaintext polynomial to obtain the first ciphertext polynomial; The sending module is configured to send the first ciphertext polynomial to the first participant, so that the first participant can generate a masking polynomial based on the first ciphertext polynomial, the target matrix and the second plaintext polynomial, and send the masking polynomial to the second participant, wherein the second plaintext polynomial uses an N-dimensional random column vector as the coefficient vector; The third generation module is used to generate the first slice of the product based on the masking polynomial sent by the first participant; The second execution module is used to execute target data processing tasks based on the first slice.

13. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method described in any one of claims 1-10.

14. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-10.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-10.

Images