Rapid calculation method for ciphertext matrix continuous multiplication based on homomorphic encryption

Abstract

The invention relates to a rapid calculation method for ciphertext matrix continuous multiplication based on homomorphic encryption, which belongs to the field of information security, and comprises the following steps: S1, setting a homomorphic encryption scheme and parameters; s2, the client generates a public and private key pair and an operation key; s3, the client performs factorization on the continuous multiplication equation of the plaintext matrix; s4, the client encrypts the factors one by one to obtain ciphertext vectors; s5, the server performs ciphertext matrix multiplication calculation on all the factors to obtain a ciphertext result matrix of all the factors; s6, repeating the steps S3 to S5 until a ciphertext result matrix of the continuous multiplication equation of the plaintext matrix is calculated; s7, the server sends the ciphertext result matrix to the client; and S8, the client decrypts the ciphertext result matrix. According to the method, diagonal element ciphertext vectors are constructed in a ciphertext rotation multiplication mode, so that the calculation complexity is greatly reduced; the method is matched with the ciphertext calculation of the transform network, the ciphertext prediction of the transform network can be directly realized, and the calculation efficiency is greatly improved.

Description

Technical Field

[0001] The present invention relates to a fast calculation method for ciphertext matrix multiplication based on homomorphic encryption, belongs to the field of information security, and is particularly suitable for the fast calculation of ciphertext matrix multiplication based on homomorphic encryption. Background Art

[0002] With the vigorous development of the field of machine learning, it has been widely used in many fields such as computers, information security, and data analysis. Although machine learning has made great progress in improving social productivity, a large number of shared data sets have also brought serious privacy and security issues. Therefore, privacy computing technology has been proposed to better serve various fields under the condition of protecting data privacy. At the same time, the field of machine learning involves a large number of matrix multiplication calculations, and the efficiency of matrix multiplication directly affects the performance of the overall model. Therefore, in the field of privacy computing, the importance of optimizing matrix multiplication operations has increased significantly, especially optimizing the ciphertext matrix multiplication operations encrypted by homomorphic encryption technology, which has gradually become a research hotspot.

[0003] Homomorphic encryption is an encryption scheme that allows direct computation on ciphertext, and the decryption result matches the result of the corresponding plaintext operation. It can perform effective data analysis and processing while protecting data privacy, and can provide quantum security, so it is considered one of the most promising privacy protection solutions. At present, homomorphic encryption technology has become an important way to solve privacy security in fields such as outsourced computing, bioinformatics, Internet of Vehicles, and machine learning. In many applications of privacy-preserving computing based on homomorphic encryption, matrix operations are the most basic operations. Therefore, improving the efficiency of ciphertext matrix operations can promote the application of homomorphic encryption in various fields. In the calculation of plaintext matrix-ciphertext matrix multiplication, in order to improve the efficiency of homomorphic schemes, reference [1] proposed to introduce single instruction multiple data (SIMD) batch processing technology in homomorphic encryption to process data in parallel, but this also makes it difficult to calculate the inner product of vectors, reducing the computational efficiency of ciphertext matrix multiplication. To this end, reference [2] linearly transforms the encrypted vector in reference [1] to achieve efficient matrix multiplication.

[0004] For the multiplication of ciphertext matrices, current research is limited to the case of multiplying two matrices. The multiplication of multiple ciphertext matrices is also implemented by splitting them into multi-layer matrices and multiplying them two by two. For example, in the currently widely used neural network structure transformer, ciphertext calculations need to be performed in the multi-head attention part of the transformer, and the multiplication of the three matrices Q, K, and V needs to be calculated. The algorithm in the literature [1,2] can be directly applied to this scenario, but the calculation efficiency is not ideal. Especially in scenarios such as the dense state calculation of large language models, a large number of multiplications of multiple ciphertext matrices need to be performed.

[0005] In summary, for scenarios where the sender needs to perform data encryption protection and the calculator has a model for calculation, there is an urgent need to improve the fast calculation method of ciphertext matrix multiplication.

[0006] [1]HALEVI S, SHOUP V. Algorithms in helib; proceedings of the Advances in Cryptology–CRYPTO 2014:34th Annual Cryptology Conference, Santa Barbara, CA, USA, August 17-21, 2014, Proceedings, Part I 34, F, 2014.

[0007] [2] Halevi, S., Shoup, V. (2015). Bootstrapping for HElib. In: Oswald, E., Fischlin, M. (eds) Advances in Cryptology--EUROCRYPT 2015. EUROCRYPT 2015. Lecture Notes in Computer Science (), vol 9056. Springer, Berlin, Heidelberg.

[0008] [3]Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) fullyhomomorphic encryption without bootstrapping. ACM Transactions on ComputationTheory 6(3),13:1–13:36(2014).https: / / doi.org / 10.1145 / 2633600.

[0009] [4] Junfeng Fan and Frederik Vercauteren. Somewhat Practical Fully Homomorphic Encryption. Cryptology ePrint Archive, Report 2012 / 144, 2012. https: / / eprint.iacr.org / 2012 / 144.

[0010] [5] CHEON J H, KIM A, KIM M, et al. Homomorphic encryption for arithmetic of approximate numbers;proceedings of the Advances in Cryptology–ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3 - 7, 2017, Proceedings, Part I23, F, 2017[C]. Springer. https: / / doi.org / 10.1007 / 978 - 3 - 319 - 70694 - 8_15.

[0011] [6] Xiaoqian Jiang, Miran Kim, Kristin Lauter, and Yongsoo Song. Secure outsourced matrix computation and application to neural networks. In David Lie, Mohammad Mannan, Michael Backes, and XiaoFeng Wang, editors, Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (October 15–19, 2018, Toronto, Canada), pages 1209–1222. ACM, New York, 2018. Summary of the Invention

[0012] In view of this, in view of the situation where multiple ciphertext matrices are continuously multiplied on the computing side, the present invention proposes a fast calculation method for ciphertext matrix multiplication based on homomorphic encryption. Under the matrix multiplication framework of rotational coding, the rotation preprocessing of the diagonal vector ciphertext is achieved through preprocessing, which can greatly reduce the calculation time and improve the calculation efficiency.

[0013] In order to achieve the above objectives, the symbols involved in the present invention are first defined as follows:

[0014] (1) Let the plaintext space be The ciphertext space is Enc is used to represent encryption algorithm operation, Dec is used to represent decryption algorithm operation; Encode is used to represent data encoding operation, Decode is used to represent data decoding operation; [] k Indicates that the calculation value needs to be a non-negative remainder modulo k, ⊙ represents the Hadamard Product of the vector; Indicates rounding up. Indicates rounding down.

[0015] (2)d ciphertexts The addition operation is The output ciphertext c satisfies Dec(c1)+Dec(c2)+…+Dec(c d )=Dec(c), where d is a positive integer.

[0016] (3) The multiplication operation of ciphertext c1 and c2 is The output ciphertext c satisfies Dec(c1)⊙Dec(c2)=Dec(c).

[0017] (4) The rotation operation of the ciphertext c is: Input ciphertext c=(c0,c1,…,c n-1 ) and an integer Output ciphertext That is, rotate each component of c to the left once The new plaintext obtained by the ciphertext slot is A negative number indicates a right rotation; each component of c is called a ciphertext slot, for a total of n ciphertext slots.

[0018] Combination Figure 1 In view of the situation where the client encrypted data is sent to the computing party for continuous multiplication of multiple ciphertext matrices, the present invention provides a "fast calculation method for continuous multiplication of ciphertext matrices based on homomorphic encryption", which includes the following steps:

[0019] S1: The user sets the security parameter λ of the homomorphic encryption scheme ε=(Enc,Dec) on the client, and generates the relevant encryption and decryption parameters of the homomorphic encryption scheme according to the security parameter λ;

[0020] S2: The client generates a private key sk, a public key pk and an operation key ek based on the encryption and decryption parameters;

[0021] S3: The client factors the plaintext matrix multiplication formula and extracts the factors of the three matrix multiplications and the factors of the two matrix multiplications.

[0022] S4: The client uses the public key pk to encrypt the plaintext matrix in the factor one by one according to the vector to obtain the ciphertext vector; and packages the ciphertext matrix, the public key pk and the operation key ek and sends them to the server;

[0023] S5: The server uses parallel computing to perform ciphertext matrix multiplication on all factors to obtain the ciphertext result matrix of all factors, and uses it to replace the factors of the corresponding plaintext matrix multiplication formula;

[0024] S6: Repeat steps S3 to S5 until the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix is ​​calculated;

[0025] S7: The server sends the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix to the client;

[0026] S8: The client uses the private key sk to decrypt the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix.

[0027] Further, the step S1 is specifically as follows:

[0028] S101: Determine the security parameter λ, which can at least defend against 2 λ Adversaries with sub-bit computing power;

[0029] S102: The client selects a SIMD homomorphic encryption method according to requirements, and determines the size q of the number of ciphertext slots in the ciphertext homomorphic scheme;

[0030] S103: The client selects an integer p based on the sample data, and the value will not exceed p / 2 during the ciphertext calculation process;

[0031] S104: The user uses the security parameter λ and the Homomorphic Encryption Security Standard ( http: / / homomorphicencryption.org / ), select the parameters m and q, and determine the plaintext space of the homomorphic encryption scheme as The ring of polynomials with integer coefficients Modulo the m-th degree cyclotomic polynomial φm (X) and the integer p generate the ideal to obtain the residual class ring, the ciphertext space is

[0032] Preferably, the homomorphic encryption scheme described in step S1 can be any scheme using SIMD technology, including: BGV scheme [3], B / FV scheme [4] and CKKS scheme [5].

[0033] Preferably, the safety parameter λ is taken as λ=128 or 256; and the error distribution χ is taken as a discrete Gaussian distribution.

[0034] Further, the step S2 is specifically as follows:

[0035] S201: The client generates a coefficient and randomly selects an undetermined element X from the set {-1, 0, 1} with a probability no greater than A random polynomial f, where represents the number of elements in the set {1,2,...,m} that are relatively prime to m, then the private key sk=(1,f);

[0036] S202: Client from R q A polynomial a with an indeterminate variable X is randomly selected from a uniform distribution. A noise polynomial e about the indeterminate variable X is randomly selected from the error distribution χ, then the public key pk=(-[(a·f+e)] q ,a), where [·] q It represents the polynomial obtained by applying the coefficients of the polynomial in square brackets to q;

[0037] S203: The client generates the operation key ek required for noise control during the ciphertext operation according to the selected homomorphic encryption scheme.

[0038] Furthermore, the factorization described in step S3 is specifically as follows: the continuous multiplication formula of the plaintext matrix is ​​sequentially extracted with three matrices as one factor, and a number of factors of three-matrix continuous multiplication are preferentially extracted, and a factor of two-matrix multiplication or a single matrix remains.

[0039] Furthermore, the factors of the multiplication of the two matrices are encrypted by columns using the method described in reference [6].

[0040] Further, for the factors Q·K·V of the three matrix multiplications, the step S4 is specifically as follows:

[0041] S401: The client adds 0 column vectors to matrix K and 0 row vectors to matrix V, respectively, so that

[0042] S402: The client uses the public key pk to sort the plaintext vectors q by column, K by row, and V by column. j , k j 、v j Encrypt to get the corresponding ciphertext c q,j =Enc pk (q j ),c k,j =Enc pk (k j ),c v,j =Enc pk (v j ); where Q = [q j ] 0≤j≤m-1 , V=[v j ] 0≤j≤m-1 , j = 0, ..., m-1;

[0043] S403: The client sends the ciphertext vector {c q,j} 0≤j＜m 、{c k,j} 0≤j＜m 、{c v,j} 0≤j＜m , public key pk and operation key ek are packaged and sent to the server.

[0044] Furthermore, the factors of the multiplication of the two matrices are directly calculated by ciphertext matrix multiplication using the method in document [6] in step S5 to obtain the ciphertext result matrix of the factors, and the ciphertext result matrix of the factors is used to replace the factors of the multiplication of the two matrices in the continuous multiplication formula of the plaintext matrix.

[0045] Further, for any three matrix multiplication factors Q·K·V, step S5 is specifically as follows:

[0046] S501: The server determines the outer loop number l and the inner loop number k according to the column number m of the matrix K, and requires that m≤l·k, where l and k are positive integers;

[0047] S502: The server calculates the diagonal element ciphertext vector of Q·K Where 0≤i <l,0≤j<k;

[0048] S503: Server calculates Q·K·v s The ciphertext result column vector Where 0≤s <d;

[0049] S504: Repeat step S503, traverse all column vectors of V, and calculate the ciphertext result matrix [c s ] 0≤s＜m , and use [cs ] 0≤s＜m Replace Q·K·V in the multiplication formula of the plaintext matrix.

[0050] Preferably, in order to reduce the computational complexity, the distance |lk| corresponding to the outer loop number l and the inner loop number k in step S501 is as small as possible.

[0051] Preferably, in order to improve computational efficiency, the calculations of the diagonal element ciphertext vectors of Q·K in step S502 are independent of each other and can be implemented by parallel computing.

[0052] Preferably, in the process of replacing the plaintext matrix multiplication formula described in step S504, the intermediate matrix K of the factors Q·K·V of the three matrix multiplications appearing in the next round of calculation needs to be transposed.

[0053] A transformer neural network for homomorphic ciphertext data applied to a fast calculation method for ciphertext matrix multiplication based on homomorphic encryption, characterized in that the transformer neural network for homomorphic ciphertext data is a multi-layer transformer neural network trained with a plaintext data set, the input is ciphertext data, the output is ciphertext prediction data, and no decryption is required in the intermediate links; each layer of the transformer neural network is composed of a multi-head attention mechanism, an Add&Norm layer, a feedforward neural network layer (Feed Forward), a pooling layer (Pooling) and a Softmax layer; the multi-head attention mechanism is processed as factors of three matrix multiplications.

[0054] The beneficial effects of the present invention are as follows: the present invention provides a fast calculation method for ciphertext matrix multiplication based on homomorphic encryption, and for the factors of three matrix multiplications, the method of ciphertext rotation multiplication is adopted, and the optimization of ciphertext matrix multiplication is realized by constructing diagonal element ciphertext vectors, which greatly reduces the calculation complexity; it can naturally fit into the ciphertext calculation of the transformer neural network, and there is no need for decryption in the intermediate links, and the ciphertext prediction of the transformer neural network can be directly realized, which greatly improves the calculation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to make the purpose and technical solution of the present invention, the present invention provides the following drawings for explanation:

[0056] Figure 1 This is a diagram of the model reasoning framework based on two-party privacy protection;

[0057] Figure 2 This is a flow chart of Embodiment 1 of the present invention;

[0058] Figure 3This is a diagram of the single-layer transformer neural network architecture of Example 2 of the present invention. DETAILED DESCRIPTION

[0059] Example 1: The client wants to calculate the matrix multiplication formula, but due to insufficient computing power, it needs to rely on the server to perform the calculation. In order to achieve the purpose of data privacy protection, under the model reasoning framework based on two-party privacy protection, the client encrypts the matrix and sends the ciphertext to the server of the computing service provider. The server completes the calculation and sends it back to the client, and the client decrypts the ciphertext to obtain the calculation result. For this scenario, the present invention provides a "fast calculation method for ciphertext matrix multiplication based on homomorphic encryption".

[0060] In this embodiment, in order to better demonstrate the method of the present invention, it is assumed that the customer needs to calculate Y = Q·K·V·A·B, where the plaintext matrix The calculation needs to be completed on the server side while protecting the plaintext data.

[0061] The preferred application examples of the present invention will be described in detail below with reference to the accompanying drawings.

[0062] like Figure 2 As shown, the following steps are included:

[0063] Step 1: The user sets the security parameter λ of the CKKS homomorphic encryption scheme ε=(Enc,Dec) on the client, and generates the relevant encryption and decryption parameters of the homomorphic encryption scheme based on the security parameter λ.

[0064] (1) The client sets the security parameter λ = 128 according to the selected homomorphic encryption scheme;

[0065] (2) Determine the number of ciphertext slots in the ciphertext homomorphic scheme q = 4;

[0066] (2) Select a prime number p = 40;

[0067] (3) According to the homomorphic encryption standard, the parameter q is the product of four randomly selected odd prime numbers with a bit length between 40 and 60. The bit length of q is about 200.

[0068] Step 2: The client generates a key based on security parameters.

[0069] (1) From coefficients {-1,0,1} and times not exceeding A polynomial f is uniformly randomly selected from the set of univariate polynomials, and the private key sk = (1, f);

[0070] (2) A polynomial a is uniformly randomly selected from the set of univariate polynomials with coefficients {0, 1, 2, …, q-1} and degree not exceeding 8192, and a noise polynomial e is selected from a discrete Gaussian distribution with a standard deviation of 3.2 on the set of polynomials with integer coefficients and degree not exceeding 8192. Let the public key pk = (-[(a·f+e)] q ,a);

[0071] (3) Generate the operation key ek for ciphertext operation noise control based on the private key sk and the public key pk.

[0072] Step 3: The client factors the plaintext matrix multiplication formula Y=Q·K·V·A·B, and extracts the factor Y1=Q·K·V of the three-matrix multiplication and the factor Y2=A·B of the two-matrix multiplication.

[0073] Step 4: For the factor Y2=A·B of the multiplication of two matrices, the client encrypts it by column and sends it directly to the server. The server uses the method in reference [6] to implement the ciphertext matrix multiplication calculation to obtain the ciphertext result matrix C of the factor, and uses the ciphertext result matrix C of the factor to replace the factor A·B of the multiplication of two matrices in the continuous multiplication formula of the plaintext matrix.

[0074] Step 5: For the factor Y1=Q·K·V of the three matrix multiplications, the client uses the public key pk to encrypt the plaintext matrix by vector to obtain the ciphertext vector; and packages the ciphertext matrix, the public key pk and the operation key ek and sends them to the server. Specifically:

[0075] (1) The client adds a zero column vector after the last column of matrix K and a zero row vector after the last row of matrix V, so that

[0076] (2) The client uses the public key pk to sort the plaintext vectors q by column, K by row, and V by column. j , k j 、v j Encrypt to get the corresponding ciphertext c q,j =Enc pk (q j ),c k,j =Enc pk (k j ),c v,j =Enc pk (v j ); where Q = [q j ] 0≤j≤5 , V=[v j ] 0≤j≤5 , j = 0,…,5;

[0077] (3) The client sends the ciphertext vector {c q,j} 0≤j＜m 、{c k,j} 0≤j＜m 、{c v,j} 0≤j＜m , public key pk and operation key ek are packaged and sent to the server.

[0078] In order to illustrate the specific calculation process of the method of the present invention, this embodiment assumes that the ciphertext vector is:

[0079]

[0080] Step 5: The server performs ciphertext matrix multiplication on the factor Y1=Q·K·V of the three matrix multiplications to obtain the ciphertext result matrix of all factors. Specifically:

[0081] (1) The server determines the outer loop number l=3 and the inner loop number k=2 based on the column number 6 of the matrix K.

[0082] (2) The server calculates the diagonal ciphertext vectors of Q and K in parallel Among them, 0≤i<3, 0≤j<2;

[0083] Among them, D 1,1 =[3,4,2,7,2,4]⊙[2,5,1,3,6,3]+[5,1,3,4,4,3]⊙[6,7,2,2,1,2]+[6,5,1,3,6,7]⊙

[0084] [2,2,1,6,7,3]+[4,3,6,1,3,1]⊙[6,3,2,7,2,4]+[1,6,4,2,2,3]⊙[7,2,3,1,2,3]=[50,67,76,35,64,73], D 1,2 =

[0085] [72,64,30,71,42,48],D 2,1 =[51,64,63,28,84,78], D 2,2 =[88,76,28,70,75,59], D 3,1 =

[0086] [56,84,59,26,73,84],D 3,2 =[79,58,33,56,68,52].

[0087] (3) The server calculates Q·K·v s The ciphertext result column vector Among them, 0≤s<1;

[0088] Among them, c0=[582,530,272,495,362,217]+[238,462,495,255,681,536]+[433,240,642,620,250,384]=[1253,1232,1409,1370,1293,1137].

[0089] (4) Since V has only one column vector, the ciphertext of Q·K·V is a one-dimensional column vector c0.

[0090] Step 6: Repeat steps 3 to 5, and use the method in reference [6] to calculate the ciphertext matrix c = c0·C of the plaintext matrix multiplication formula. Three columns of 0 elements need to be filled so that

[0091] Step 7: The server sends c to the client.

[0092] Step 8: The client uses the private key sk to decrypt c and replace the factors of the corresponding plaintext matrix multiplication formula. Specifically: the client uses the private key sk to decrypt the first three columns of the ciphertext result matrix c of the plaintext matrix multiplication formula column by column. i Decrypt to get the corresponding plaintext column vector y i =Dec sk (c i ), where i=1, 2, 3.

[0093] It can be seen that the calculation result of the method of the present invention is consistent with the plain text calculation result.

[0094] Example 2: A user needs to use the Transformer model that has been trained on a plaintext dataset on the server to perform When making predictions, considering the privacy protection of data, users hope to encrypt the data on the local client and then send it to the server to complete the homomorphic ciphertext calculation, and then return the ciphertext to the client for decryption.

[0095] The method of the present invention provides a "transformer neural network for homomorphic ciphertext data". Figure 3As shown, the transformer neural network of the homomorphic ciphertext data is a multi-layer transformer neural network trained with a plaintext data set, with the input being ciphertext data and the output being ciphertext prediction data, and no decryption is required in the intermediate links. This embodiment is illustrated by taking DASHformer as an example, and the transformer neural network only has an encoder, and it should be noted that other types of transformer neural networks are similar. Each layer of the transformer neural network is sequentially composed of an embedding layer (Embedding), a positional encoding (Positional Encoding), a four-head attention mechanism, a linear layer, an Add&Norm layer, a feedforward neural network layer (Feed Forward), an Add&Norm layer, a pooling layer (Pooling) and a Softmax layer; here, the multi-head attention mechanism needs to be processed as a factor of three matrix multiplications.

[0096] The method of the present invention provides a "fast calculation method for ciphertext matrix multiplication based on homomorphic encryption".

[0097] The specific parameter settings are exactly the same as those in Example 1, and the details will not be repeated here. The specific process is:

[0098] Step 1: The user sets the security parameter λ of the CKKS homomorphic encryption scheme ε=(Enc,Dec) on the client, and generates the relevant encryption and decryption parameters of the homomorphic encryption scheme based on the security parameter λ.

[0099] Step 2: The client generates a key based on security parameters.

[0100] Step 3: The client factors the calculation formula of the transformer neural network for homomorphic ciphertext data and extracts the factors of the multiplication of three matrices and the factors of the multiplication of two matrices.

[0101] The specific analysis is as follows: The ciphertext matrix data after the plaintext matrix data is encrypted is recorded as It is input into the embedding layer, position encoding, four-layer multi-head attention mechanism, linear layer, the first Add&Norm layer, feedforward neural network layer, the second Add&Norm layer, pooling layer and Softmax layer in sequence.

[0102] Among them, the embedding layer and position encoding are calculated as: in, is the trained plaintext weight matrix, is the position encoding matrix of the plaintext.

[0103] The calculation of the four-head attention mechanism is: Where h = 1, 2, 3, 4, input is the trained plaintext weight matrix; is the trained plaintext bias vector.

[0104] The linear layer is calculated as: Among them, W c is the trained plaintext weight matrix; b c is the trained plaintext bias vector.

[0105] The calculation of the first Add&Norm layer is:

[0106] The calculation of the feedforward neural network layer is: Among them, W1 and W2 are the trained plaintext weight matrices; b1 and b2 are the trained plaintext bias vectors.

[0107] The calculation of the second Add&Norm layer is:

[0108] The calculation of the pooling layer is: Among them, W d is the trained plaintext weight matrix; b d is the trained plaintext bias vector.

[0109] The calculation of the Softmax layer is: y=softmax(x).

[0110] Among them, the multiplication formula of the plaintext matrix involved is mainly the factor of multiplying two matrices. In this embodiment, only the four-head attention mechanism is regarded as the factor of multiplying three matrices.

[0111] Step 4: For the factors of the multiplication of two matrices, the client encrypts them and packages them with the public key pk and the operation key ek and sends them to the server. The server uses the method in reference [6] to implement the ciphertext matrix multiplication calculation and obtain the ciphertext result matrix of the factors.

[0112] Step 5: For the factors of the three matrix multiplications, the client uses the public key pk to encrypt the plaintext matrix vector by vector to obtain the ciphertext vector; and sends the ciphertext matrix directly to the server.

[0113] It should be noted that after the plaintext data is encrypted on the client side, it is input into a transformer neural network with homomorphic ciphertext data for calculation. Due to the natural structure of the multi-head attention mechanism, the output ciphertext column vector can be directly used by the next-head attention mechanism, so there is no need to return to decrypt and re-encrypt in the middle.

[0114] Step 6: The server sends the ciphertext of the prediction result of the transformer neural network of the homomorphic ciphertext data to the client.

[0115] Step 7: The client uses the private key sk to decrypt the ciphertext of the prediction result.

[0116] In order to better demonstrate the beneficial effects of the method of the present invention, a comparative experiment is conducted here. 163 plaintext data are input into the transformer neural network for processing, and the computational efficiency is tested. The comparative experimental results are shown in Table 1.

[0117] Table 1 Comparative experimental results (unit: seconds)

[0118]

[0119] It can be seen that the method of the present invention can effectively improve the efficiency of multiplying multiple ciphertext matrices and is very suitable for application in transformer neural networks.

[0120] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.

Claims

1. A fast calculation method for ciphertext matrix multiplication based on homomorphic encryption, characterized in that: The method comprises the following steps: S1: The user sets the security parameter λ of the homomorphic encryption scheme ε=(Enc,Dec) on the client, and generates the relevant encryption and decryption parameters of the homomorphic encryption scheme according to the security parameter λ; S2: The client generates a private key sk, a public key pk and an operation key ek based on the encryption and decryption parameters; S3: The client factors the plaintext matrix multiplication formula and extracts the factors of the three matrix multiplications and the factors of the two matrix multiplications. S4: The client uses the public key pk to encrypt the plaintext matrix in the factor one by one according to the vector to obtain the ciphertext vector; and packages the ciphertext matrix, the public key pk and the operation key ek and sends them to the server; S5: The server uses parallel computing to perform ciphertext matrix multiplication on all factors to obtain the ciphertext result matrix of all factors, and uses it to replace the factors of the corresponding plaintext matrix multiplication formula; S6: Repeat steps S3 to S5 until the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix is ​​calculated; S7: The server sends the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix to the client; S8: The client uses the private key sk to decrypt the ciphertext result matrix of the continuous multiplication formula of the plaintext matrix; Among them, let the plaintext space be The ciphertext space is Enc is used to represent encryption algorithm operation, Dec is used to represent decryption algorithm operation; Encode is used to represent data encoding operation, Decode is used to represent data decoding operation; [] k Indicates that the calculation value needs to be a non-negative remainder modulo k, ⊙ represents the Hadamard Product of the vector; Indicates rounding up. Indicates rounding down; Among them, d ciphertexts The addition operation is The output ciphertext c satisfies Dec(c1)+Dec(c2)+…+Dec(c d )=Dec(c), where d is a positive integer; Among them, the multiplication operation of ciphertext c1 and c2 is The output ciphertext c satisfies Dec(c1)⊙Dec(c2)=Dec(c); Among them, the rotation operation of the ciphertext c is Input ciphertext c=(c0,c1,…,c n-1 ) and an integer Output ciphertext That is, the new plaintext is obtained by rotating each component of c to the left by l ciphertext slots at a time. If e is a negative number, it means rotating to the right. Each component of c is called a ciphertext slot, and there are n ciphertext slots in total. Further, step S1 is specifically as follows: S101: Determine the security parameter λ, which can at least defend against 2 λ Adversaries with sub-bit computing power; S102: The client selects a SIMD homomorphic encryption method according to requirements, and determines the size q of the number of ciphertext slots in the ciphertext homomorphic scheme; S103: The client selects an integer p based on the sample data, and the value will not exceed p / 2 during the ciphertext calculation process; S104: The user uses the security parameter λ and the Homomorphic Encryption Security Standard ( http: / / homomorphicencryption.org / ), select the parameters m and q, and determine the plaintext space of the homomorphic encryption scheme as That is, the ring of polynomials with integer coefficients Modulo the m-th degree cyclotomic polynomial φ m (X) and the integer p generate the ideal to obtain the residual class ring, the ciphertext space is Further, step S2 is specifically as follows: S201: The client generates a coefficient and randomly selects an undetermined element X from the set {-1, 0, 1} with a probability no greater than A random polynomial f, where represents the number of elements in the set {1,2,...,m} that are relatively prime to m, then the private key sk=(1,f); S202: Client from R q A polynomial a with an indeterminate variable X is randomly selected from a uniform distribution. A noise polynomial e about the indeterminate variable X is randomly selected from the error distribution χ, then the public key pk=(-[(a·f+e)] q ,a), where [·] q It represents the polynomial obtained by applying the coefficients of the polynomial in square brackets to q; S203: The client generates a computation key ek required for noise control during the ciphertext computation according to the selected homomorphic encryption scheme; Further, the factorization described in step S3 is specifically as follows: the continuous multiplication formula of the plaintext matrix is ​​sequentially extracted with three matrices as one factor, and a number of factors of three-matrix continuous multiplication are preferentially extracted, and a factor of two-matrix multiplication or a single matrix is ​​left; Further, for the factors Q·K·V of the three matrix multiplications, the step S4 is specifically as follows: S401: The client adds 0 column vectors to matrix K and 0 row vectors to matrix V, respectively, so that S402: The client uses the public key pk to sort the plaintext vectors q by column, K by row, and V by column. j , k j 、v j Encrypt to get the corresponding ciphertext c q,j =Enc pk (q j ),c k,j =Enc pk (k j ),c v,j =Enc pk (v j ), where Q = [q j ] 0≤j≤m-1 , V=[v j ] 0≤j≤m-1 , j = 0, ..., m-1; S403: The client sends the ciphertext vector {c q,j } 0≤j＜m 、{c k,j } 0≤j＜m 、{c v,j } 0≤j＜m , public key pk and operation key ek are packaged and sent to the server; Further, for any three matrix multiplication factors Q·K·V, step S5 is specifically as follows: S501: The server determines the outer loop number l and the inner loop number k according to the column number m of the matrix K, and requires that m≤l·k, where l and k are positive integers; S502: The server calculates the diagonal element ciphertext vector of Q·K Where 0≤i <l,0≤j<k; S503: Server calculates Q·K·v s The ciphertext result column vector Where 0≤s <d; S504: Repeat step S503, traverse all column vectors of V, and calculate the ciphertext result matrix [c s ] 0≤s＜m , and use [c s ] 0≤s＜m Replace Q·K·V in the multiplication formula of the plaintext matrix.

2. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: The homomorphic encryption scheme described in step S1 can be any scheme using SIMD technology, including: BGV scheme, B / FV scheme and CKKS scheme.

3. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: The security parameter λ in step S101 is λ=128 or 256.

4. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: The error distribution χ described in step S202 is taken as a discrete Gaussian distribution.

5. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: In order to reduce the computational complexity, the distance |lk| corresponding to the outer loop number l and the inner loop number k in step S501 is as small as possible.

6. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: In order to improve the computational efficiency, the calculations of the diagonal element ciphertext vectors of Q·K described in step S502 are independent of each other and can be implemented by parallel computing.

7. The method for calculating the multiplication of plaintext matrix and ciphertext tensor based on homomorphic encryption according to claim 1, characterized in that: In the process of replacing the plaintext matrix multiplication formula described in step S504, the intermediate matrix K of the factors Q·K·V of the three matrix multiplications appearing in the next round of calculation needs to be transposed.

8. A transformer neural network applied to homomorphic ciphertext data according to any one of claims 1 to 7, characterized in that: It is implemented by a multi-layer transformer neural network trained with a plaintext data set; the input of the multi-layer transformer neural network is ciphertext data, and the output is ciphertext prediction data, and no decryption is required in the intermediate links; each layer of the transformer neural network is composed of a multi-head attention mechanism, an Add&Norm layer, a feedforward neural network layer (FeedForward), a pooling layer (Pooling) and a Softmax layer; the multi-head attention mechanism is processed as a factor of three matrix multiplications, and is processed using a calculation method based on homomorphic encryption for plaintext matrix and ciphertext tensor multiplication.

Images