Iterative two-party privacy graph analysis method and device

Abstract

The embodiment of the invention provides an iterative two-party privacy graph analysis method and device, and the method comprises the steps: obtaining a current sequence fragment of a tuple sequence of a second sequence by a first party based on the current sequence fragment of the tuple sequence of the first sequence obtained in the last round, and jointly executing a safety replacement protocol with a second party for target replacement; based on the current sequence fragment of the tuple sequence of the second sequence, jointly executing oblivious message propagation from the node to the edge with the second party to obtain a first update fragment of the tuple sequence of the second sequence; based on the first update fragment of the tuple sequence of the second sequence, jointly executing a security permutation protocol with inverse permutation of the second party on the target permutation to obtain a first update fragment of the tuple sequence of the first sequence; and based on the first update fragment of the tuple sequence of the first sequence, jointly executing oblivious message aggregation from the edge to the node with the second party to obtain a second update fragment of the tuple sequence of the first sequence.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the computer field, and in particular, to an iterative two-party privacy graph analysis method and device. Background Art

[0002] Iterative full-graph analysis based on graph data has many important applications, such as fraud detection, community discovery, etc. When multiple participants with private graph data collaborate to conduct analysis, the analysis results are often more accurate and reasonable because the full graph has more complete topological and attribute information. However, direct data sharing is often limited due to concerns about data leakage or abuse.

[0003] In theory, secure multi-party computation (MPC) technology allows multiple parties to securely complete agreed analysis tasks without directly sharing data. However, general MPC protocols lack specific optimizations for iterative two-party privacy graph analysis tasks.

[0004] For the application scenario of iterative two-party private graph analysis, a dedicated solution needs to be designed to implement graph analysis efficiently and securely. Summary of the invention

[0005] One or more embodiments of this specification describe an iterative two-party privacy graph analysis method and device that can implement graph analysis efficiently and securely.

[0006] In a first aspect, an iterative two-party private graph analysis method is provided, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the method is executed by the first party, including multiple rounds of iterations, wherein any non-first round iteration includes:

[0007] Based on the current sequence fragment of the first-order tuple sequence obtained in the previous round, the current sequence fragment of the second-order tuple sequence is obtained by jointly executing the safe permutation protocol with the second party for target permutation;

[0008] Based on the current sequence fragment of the tuple sequence of the second order, jointly with the second party, perform oblivious message propagation from the node to the edge to obtain a first updated fragment of the tuple sequence of the second order;

[0009] Based on the first updated fragment of the tuple sequence of the second order, the first updated fragment of the tuple sequence of the first order is obtained by executing the secure permutation protocol in conjunction with the inverse permutation of the target permutation by the second party;

[0010] Based on the first updated fragment of the tuple sequence in the first order, oblivious message aggregation from the edge to the node is performed jointly with the second party to obtain a second updated fragment of the tuple sequence in the first order.

[0011] In a possible implementation, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is the order in which the target nodes are sorted, and the second order is the order in which the source nodes are sorted.

[0012] Furthermore, the tuple also includes an object type identifier. When the identifier takes a first value, the source node and the target node are the same node, and the tuple represents the same node; when the identifier takes a second value, the source node and the target node are different, and the tuple represents the edge from the source node to the target node.

[0013] In a possible implementation, the current sequence fragment of the tuple sequence of the second order is obtained by jointly executing the secure permutation protocol with the second party for target permutation, including:

[0014] Based on the first sequence fragment and the first permutation input by the party, and the second sequence fragment and the second permutation input by the second party, the first call is executed on the security permutation protocol to obtain the current sequence fragment of the tuple sequence of the second order; wherein the first sequence fragment is determined according to the current sequence fragment of the tuple sequence of the first order, and the combination of the first permutation and the second permutation is equivalent to the target permutation;

[0015] The first update fragment of the first sequence of tuples is obtained by executing the secure permutation protocol in conjunction with the inverse permutation of the target permutation by the second party, including:

[0016] Based on the third sequence fragment input by this party, the inverse permutation of the first permutation, and the fourth sequence fragment input by the second party and the inverse permutation of the second permutation, a second call is made to the safe permutation protocol to obtain the first updated fragment of the tuple sequence of the first order, and the third sequence fragment is the first updated fragment of the tuple sequence of the second order.

[0017] Further, obtaining the current sequence fragment of the tuple sequence of the second order also includes:

[0018] Applying the inverse permutation of the permutation to the current sequence fragment of the tuple sequence of the first order to obtain the first sequence fragment;

[0019] Obtaining a first updated fragment of the tuple sequence of the first order, comprising:

[0020] The target permutation is applied to the execution result of the second call execution as a first update slice of the first ordered sequence of tuples.

[0021] Further, a first call is performed on the security replacement protocol, including:

[0022] Based on the first permutation input by the party and the second sequence of shards input by the second party, calling the secure permutation sharing protocol, performing the first permutation sharing operation, and obtaining the first intermediate shard after the first permutation is performed on the second sequence of shards;

[0023] Performing local calculation according to the first permutation, the first sequence fragment, and the first intermediate fragment to obtain a first permutation result after the first permutation is performed on the target data sequence; the first sequence fragment and the second sequence fragment are two fragments constituting the target data sequence;

[0024] Based on the first permutation result input by this party and the second permutation input by the second party, the secure permutation sharing protocol is called to perform a second permutation sharing operation to obtain this party's slice of the second permutation result after the second permutation of the first permutation result as the current sequence slice of the tuple sequence in the second order.

[0025] Further, performing a first replacement sharing operation includes:

[0026] Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0027] Receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating the columns and sequences of the second inadvertently incomplete matrix by the second party, and encrypting the second sequence slices using the columns and sequences;

[0028] The encrypted data sequence is locally permuted using the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain result fragments after the first permutation of the second sequence fragments as the first intermediate fragments.

[0029] Furthermore, when the first replacement sharing operation is performed for the first time, it also includes:

[0030] According to the first permutation, the inadvertent incomplete matrix generation process is performed jointly with the second party to obtain the first inadvertent incomplete matrix, and the second party obtains the second inadvertent incomplete matrix.

[0031] Furthermore, when the first replacement sharing operation is not performed for the first time, the method further includes:

[0032] Each element of the first inadvertently incomplete matrix is ​​updated using a deterministic pseudo-random number generator agreed upon with the second party.

[0033] Further, a second call is performed on the security replacement protocol, including:

[0034] Based on the inverse permutation of the first permutation input by the party and the fourth sequence of fragments input by the second party, calling the secure permutation sharing protocol, performing the third permutation sharing operation, and obtaining the second intermediate fragment after performing the inverse permutation of the first permutation on the fourth sequence of fragments;

[0035] Performing local calculation according to the inverse permutation of the first permutation, the third sequence fragment, and the second intermediate fragment, to obtain a third permutation result after the inverse permutation of the first permutation is performed on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments constituting the target data sequence;

[0036] Based on the third permutation result input by this party and the inverse permutation of the second permutation input by the second party, the secure permutation sharing protocol is called to perform a fourth permutation sharing operation to obtain this party's fragment of the fourth permutation result after performing the inverse permutation of the second permutation on the third permutation result as the first updated fragment of the tuple sequence in the first order.

[0037] Further, performing a third replacement sharing operation includes:

[0038] Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0039] Performing inverse permutation processing on a sequence consisting of opposite numbers of each element of the first difference sequence to obtain an updated first difference sequence;

[0040] receiving an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating a row and sequence of a second inadvertently incomplete matrix by the second party, and encrypting a fourth sequence slice using the row and sequence;

[0041] The encrypted data sequence is locally permuted using the inverse permutation of the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain a result fragment after the inverse permutation of the first permutation is performed on the fourth sequence fragment as the second intermediate fragment.

[0042] Furthermore, the first round of iterations includes:

[0043] Based on the input sequence fragmentation of the tuple sequence in the random order, an initial sequence fragmentation of the tuple sequence in the second order is obtained by jointly executing a secure sorting protocol with the second party for the first sorting key;

[0044] Based on the initial sequence fragment of the second-order tuple sequence, performing oblivious message propagation from the node to the edge to obtain a third updated fragment of the second-order tuple sequence;

[0045] Based on the third updated fragment of the tuple sequence in the second order, by jointly executing the secure sorting protocol with the second party on the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated;

[0046] Based on the third update fragment of the tuple sequence in the first order, oblivious message aggregation from the edge to the node is performed to obtain a fourth update fragment of the tuple sequence in the first order.

[0047] Further, by jointly executing the security sorting protocol with the second party for the first sorting key, an initial sequence fragmentation of the tuple sequence of the second order is obtained, including:

[0048] Based on the first input sequence fragment and the first key fragment of the first sort key input by the party, and the second input sequence fragment and the second key fragment of the first sort key input by the second party, a first call is executed on the security sorting protocol to obtain an initial sequence fragment of the tuple sequence of the second order;

[0049] By jointly executing the secure sorting protocol with the second party for the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated, including:

[0050] Based on the third update fragment input by this party, the first key fragment of the second sort key, and the third update fragment and the second key fragment of the second sort key input by the second party, a second call is made to execute the security sorting protocol to obtain the third update fragment of the tuple sequence in the first order and generate the target permutation.

[0051] Furthermore, the first sorting key includes key values ​​corresponding to each first key of each tuple in the tuple sequence; the key value of the first key is determined at least according to the number of the source node of the corresponding tuple; the second sorting key includes key values ​​corresponding to each second key of each tuple in the tuple sequence; the key value of the second key is determined at least according to the number of the target node of the corresponding tuple.

[0052] Further, performing a first call to execute the security sorting protocol includes:

[0053] According to the first key sharding of the first sort key, for each bit of the key value included in the first sort key, starting from the least significant bit, jointly with the second party respectively performs bit iteration processing: calculate the position permutation of the current bit of the sort, and perform permutation processing on the random secret permutation and the first sort key according to the calculated position permutation, and update the random secret permutation and the first sort key according to the processing result;

[0054] Based on the first input sequence fragment input by the party, the inverse permutation of the first secret permutation, and the second input sequence fragment and the inverse permutation of the second secret permutation correspondingly input by the second party, the secure permutation protocol is executed for a third time to obtain a result fragment of the first masking result, wherein the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation;

[0055] The random secret permutation obtained by the bit iteration processing is obtained jointly with the second party, and applied to the result slice of the first masking result to obtain the initial sequence slice of the tuple sequence of the second order.

[0056] Further, the random secret permutation and the first sort key are permuted according to the calculated position permutation, including:

[0057] According to the random sampling sampling permutation, the position permutation, the random secret permutation and the first sorting key are permuted respectively to obtain the masked position permuted local shard, the masked random secret permuted local shard and the masked first sorting key local shard;

[0058] jointly determining masking position changes with a second party;

[0059] By using masked position permutation, the masked random secret permuted local shard and the masked first sort key local shard are permuted respectively, and the local shard is obtained as a result of the permutation of the random secret permutation and the first sort key by using position permutation.

[0060] In a second aspect, an iterative two-party privacy graph analysis method is provided, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the method is executed by the first party, and includes:

[0061] Based on the target message propagation operator adopted by the target application and the tuple fragments of the private graph of the party, jointly call the message dispersion programming interface with the second party, the message dispersion programming interface uses a secure sorting protocol or a secure permutation protocol to perform a first sort on the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator;

[0062] Based on the target message aggregation operator adopted by the target application and the tuple fragmentation, the message collection programming interface is jointly called with the second party. After the message collection programming interface uses the safe sorting protocol or the safe permutation protocol to perform a second sort on the tuple sequence, it executes the inadvertent message aggregation from the edge to the node corresponding to the target message aggregation operator.

[0063] In a third aspect, an iterative two-party privacy graph analysis device is provided, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the device is set on the first party, and is used to perform multiple rounds of iterations, including the following units for performing any non-first round iterations:

[0064] A first replacement unit is used to obtain a current sequence fragment of the tuple sequence of the second order by jointly executing a safe replacement protocol with the second party for target replacement based on the current sequence fragment of the tuple sequence of the first order obtained in the previous round;

[0065] a propagation unit, configured to jointly perform oblivious message propagation from the node to the edge with the second party based on the current sequence fragment of the tuple sequence of the second order obtained by the first replacement unit, to obtain a first updated fragment of the tuple sequence of the second order;

[0066] A second replacement unit is configured to obtain a first updated fragment of the tuple sequence of the first order by executing the secure replacement protocol in conjunction with an inverse replacement of the target replacement by the second party based on the first updated fragment of the tuple sequence of the second order obtained by the propagation unit, so as to obtain a first updated fragment of the tuple sequence of the first order;

[0067] An aggregation unit is used to jointly perform oblivious message aggregation from edges to nodes with the second party based on the first updated fragment of the first order tuple sequence obtained by the second replacement unit to obtain a second updated fragment of the first order tuple sequence.

[0068] In a fourth aspect, an iterative two-party privacy graph analysis device is provided, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the device is set on the first party, and includes:

[0069] A first calling unit is used to jointly call a message dispersion programming interface with a second party based on a target message propagation operator adopted by a target application and a tuple fragment of a private graph of the party, wherein the message dispersion programming interface performs a first sorting on a tuple sequence consisting of the tuple fragments of the two parties using a secure sorting protocol or a secure permutation protocol, and then executes oblivious message propagation from a node to an edge corresponding to the target message propagation operator;

[0070] The second calling unit is used to jointly call the message collection programming interface with the second party based on the target message aggregation operator adopted by the target application and the tuple fragmentation. The message collection programming interface uses the safe sorting protocol or the safe permutation protocol to perform a second sort on the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator.

[0071] In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

[0072] In a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0073] Through a method and apparatus provided by an embodiment of the present specification, in any non-first round iteration, the first party first obtains the current sequence fragment of the second-order tuple sequence based on the current sequence fragment of the first-order tuple sequence obtained in the previous round by jointly executing a safe permutation protocol with the second party for target permutation; then, based on the current sequence fragment of the second-order tuple sequence, jointly executing oblivious message propagation from the node to the edge with the second party to obtain the first updated fragment of the second-order tuple sequence; then, based on the first updated fragment of the second-order tuple sequence, jointly executing the safe permutation protocol with the second party for the inverse permutation of the target permutation to obtain the first updated fragment of the first-order tuple sequence; finally, based on the first updated fragment of the first-order tuple sequence, jointly executing oblivious message aggregation from the edge to the node with the second party to obtain the second updated fragment of the first-order tuple sequence. As can be seen from the above, in the embodiments of the present specification, in any non-first round of iteration, the tuple sequence needs to be converted between the first order and the second order, and a safe permutation protocol is used instead of a safe sorting protocol to achieve the above conversion. The safe permutation protocol reuses key intermediate calculation results while ensuring security, thereby significantly reducing computing and communication overheads, thereby enabling efficient and secure implementation of graph analysis.

[0074] According to another method and device provided by the embodiment of this specification, the first party first calls the message dispersion programming interface with the second party based on the target message propagation operator used by the target application and the tuple fragmentation of the private graph of the first party. The message dispersion programming interface uses the secure sorting protocol or the secure replacement protocol to perform a first sort on the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator; then based on the target message aggregation operator used by the target application and the tuple fragmentation, the message collection programming interface is jointly called with the second party. The message collection programming interface uses the secure sorting protocol or the secure replacement protocol to perform a second sort on the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator. As can be seen from the above, the embodiment of this specification designs a programming framework for the scenario of two-party iterative privacy graph analysis. The MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance. At the same time, the framework provides a programming interface similar to traditional parallel graph analysis to meet ease of use and facilitate the development of graph analysis applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0076] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0077] Figure 2 A schematic diagram of a system architecture of an embodiment disclosed in this specification;

[0078] Figure 3 A schematic diagram of a basic process of iterative two-party privacy graph analysis according to an embodiment disclosed in this specification;

[0079] Figure 4 A flow chart of an iterative two-party privacy graph analysis method according to one embodiment is shown;

[0080] Figure 5 A basic flow chart of a security sequencing protocol according to an embodiment is shown;

[0081] Figure 6 A basic flow chart of permutation sorting according to an embodiment is shown;

[0082] Figure 7 A flow chart of an iterative two-party privacy graph analysis method according to another embodiment is shown;

[0083] Figure 8 A schematic block diagram of an iterative two-party privacy graph analysis device according to one embodiment is shown;

[0084] Fig. 9 A schematic block diagram of an iterative two-party privacy graph analysis device according to another embodiment is shown. DETAILED DESCRIPTION

[0085] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0086] Figure 1 The following is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. The implementation scenario involves iterative two-party privacy graph analysis. The two parties include a first party and a second party, each of which has its own private graph data. The private graph data of the first party and the private graph data of the second party together constitute the graph data of the full graph. Figure 1 As shown, the private graph data of the first party includes nodes V0, V1, V2, and V6, the edges between V0 and V1, the edges between V0 and V2, and the edges between V0 and V6; the private graph data of the second party includes nodes V0, V3, V4, and V5, the edges between V0 and V3, the edges between V0 and V4, and the edges between V0 and V5. The private graph data of the first party and the private graph data of the second party have a common node V0. When the two are merged to obtain the graph data of the full graph, the nodes V0 in the two private graph data are merged into one node V0.

[0087] The first party and the second party are two participants involved in the iterative two-party privacy graph analysis, and each participant can be implemented as any device, platform, server or device cluster with computing and processing capabilities. All parties should jointly implement graph analysis while protecting data privacy.

[0088] Figure 2 This is a schematic diagram of the system architecture of an embodiment disclosed in this specification. The system architecture involves iterative two-party private graph analysis. It can be understood that the above graph analysis includes multiple rounds of iterations. In this embodiment of the specification, the nodes and edges in the private graph data are represented as tuples. This representation supports casual message passing, thereby protecting topological information. Figure 2As shown in the figure, in accordance with the specific graph analysis requirements, iterative two-party private graph analysis can correspond to a specific application. By providing a programming framework, when programming for a specific application, only the pre-built programming interface needs to be called, which provides the convenience of application development. The programming framework provides programming interfaces similar to the "collect-apply-distribute" parallel graph computing programming model, namely "oblivious message dispersal" and "oblivious message collection". Among them, "message dispersal" means dispersing messages, which means that the nodes on the graph disperse the messages containing local data information to the edges adjacent to them, while "message collection" means collecting messages, which means that each node collects messages from the edges adjacent to them and updates the local data information. "Oblivious" means that the memory access mode of the operation is independent of the specific input, so the topological structure information of the graph will not be leaked. The combination of dispersal and collection can realize node-to-node message transmission, and then build graph analysis applications based on message transmission semantics, such as the multi-source shortest path (MSSP) algorithm, the weakly connected component (WCC) algorithm, and the page ranking (PR) algorithm.

[0089] The above two programming interfaces are composed of four basic MPC protocols: safe sorting, safe replacement, oblivious message propagation and oblivious message aggregation. Among them, the programming interface "oblivious message dispersion" is composed of three MPC protocols: safe sorting, safe replacement and oblivious message propagation, and the programming interface "oblivious message collection" is composed of three MPC protocols: safe sorting, safe replacement and oblivious message aggregation. When the programming interface "oblivious message dispersion" or "oblivious message collection" is called for the first time, the safe sorting protocol is executed first, and then the oblivious message propagation or oblivious message aggregation protocol is executed. When the programming interface "oblivious message dispersion" or "oblivious message collection" is called subsequently, the safe replacement protocol is executed first, and then the oblivious message propagation or oblivious message aggregation protocol is executed.

[0090] The parallel execution engine implemented at the bottom layer of the framework based on the garbled circuit backend supports the execution of the above four MPC protocols to achieve efficient parallel execution.

[0091] The basic workflow of this framework can be as follows:

[0092] Input private enhanced graph: At the beginning of the analysis, both parties input their own private graph data into the framework. The nodes and edges of the graph are represented in a unified tuple form to support oblivious messaging and protect topology information.

[0093] Sharing graph lists using oblivious transfer (OT) extension techniques: Both parties share their graph data using the OT extension primitive to obtain a list of tuples of the entire graph, represented in the form of garbled circuits.

[0094] Safe Sorting: In the first message passing step, the list of tuples needs to be safely sorted so that nodes can do oblivious propagation and aggregation of data based on the sorted order.

[0095] Oblivious propagation and aggregation: After safe sorting, oblivious message propagation and oblivious message aggregation operations are performed. Specifically, a linear scan is performed on the tuple list to exchange data between adjacent tuples to achieve message propagation and aggregation.

[0096] Safe Replacement: In the subsequent message passing step, the safe replacement protocol is used instead of the safe sorting protocol. The safe replacement protocol makes full use of the characteristics of iterative graph analysis, and reuses key intermediate calculation results under the premise of ensuring security based on the correlation of replacement operations between multiple rounds of iterations, thereby significantly reducing the computation and communication overhead.

[0097] In the present embodiment, src is a sorting key and dst is another sorting key. The input data D is represented in random order, and the data sorted by k∈{src, dst} is represented by D k Indicates. dst =σ(D src ), D src =σ′(D).

[0098] In the first round of multiple iterations: the order change of data can be expressed as D→D src →D dst , which has undergone two sortings, the first sorting can be represented as σ′, and the second sorting can be represented as σ. The first round of iteration includes the following processing: sorting, both parties use their (D, src) fragments to call the secure sorting protocol to obtain D src Sharding. Spread, in D src Perform oblivious message propagation on the order, both parties use their (D src , dst)'s shard calls the secure sorting protocol to obtain D dst shards, a target permutation π and a private permutation π i , the above target permutation can also be called public permutation. Aggregation, for D dst Perform oblivious message aggregation.

[0099] In the non-first round of multiple iterations: the order change of data can be expressed as D dst →D src →D dst , has undergone two sortings, of which the first sorting can be expressed as σ -1 , the second sorting can be expressed as σ. In the embodiment of this specification, permutation is used instead of sorting. The non-first round iteration includes the following processing: permutation, both parties locally dstThe slices of which apply the inverse permutation π of the target permutation -1 , and then call the secure replacement protocol, the i-th party P i enter( π i , 1), to obtain D src Sharding. Spread, in D src Perform oblivious message propagation on the permutation. For permutation, both parties call the secure permutation protocol, where P i enter Then the target permutation π is applied locally on its resulting slice to obtain D dst Sharding. Aggregation, for D dst Perform oblivious message aggregation.

[0100] Figure 3 This is a basic flow chart of iterative two-party privacy graph analysis according to an embodiment disclosed in this specification, which shows the basic flow of the breadth-first search (BFS) algorithm running in the aforementioned framework. Figure 3 In the first round of iteration, i.e., the first step of message passing, the input list in random order is first arranged into the order according to the source node order through secure sorting, and then the oblivious message propagation is performed, thereby completing the oblivious message dispersion. Thereafter, the data list of the entire graph is arranged into the order according to the target node order through secure sorting, and then the oblivious message aggregation is performed, thereby completing the oblivious message collection. In subsequent rounds of iteration, i.e., subsequent message passing, the data list of the entire graph needs to be converted between the two orders, and this conversion is completed through secure permutation. It should be noted that the data list of the entire graph includes each node and each edge in the graph, where both the nodes and the edges are represented in a unified tuple form. The tuple form includes the source node u and the target node v. For a node, its source node u and target node v are both the node. For an edge, its source node u and target node v are different, and the direction of the edge is from the source node u to the target node v.

[0101] In the embodiments of this specification, when sorting by source nodes, the sorting can also be combined with whether the tuple represents a node or an edge, so that the node is ranked before the edge when the source nodes are the same. When sorting by target nodes, the sorting can also be combined with whether the tuple represents a node or an edge, so that the node is ranked after the edge when the target nodes are the same.

[0102] In the embodiments of this specification, some symbols are often used when giving examples. The corresponding relationship between the symbols and their meanings is given below, as shown in Table 1.

[0103] Table 1: Correspondence table between symbols and their meanings

[0104]

[0105] Figure 4A flowchart of an iterative two-party privacy graph analysis method according to an embodiment is shown. The method can be based on Figure 1 The implementation scenario shown, Figure 2 The system architecture shown and Figure 3 In the basic process shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the method is executed by the first party. Figure 4 As shown, the iterative two-party privacy graph analysis method in this embodiment includes multiple rounds of iterations, wherein any non-first round iteration includes the following steps: Step 41, based on the current sequence fragment of the first-order tuple sequence obtained in the previous round, by jointly executing the security replacement protocol with the second party for the target replacement, to obtain the current sequence fragment of the second-order tuple sequence; Step 42, based on the current sequence fragment of the second-order tuple sequence, jointly executing the oblivious message propagation from the node to the edge with the second party, to obtain the first updated fragment of the second-order tuple sequence; Step 43, based on the first updated fragment of the second-order tuple sequence, by jointly executing the security replacement protocol with the second party for the inverse replacement of the target replacement, to obtain the first updated fragment of the first-order tuple sequence; Step 44, based on the first updated fragment of the first-order tuple sequence, jointly executing the oblivious message aggregation from the edge to the node with the second party, to obtain the second updated fragment of the first-order tuple sequence. The specific execution method of each of the above steps is described below.

[0106] First, in step 41, based on the current sequence fragments of the first-order tuple sequence obtained in the previous round, the current sequence fragments of the second-order tuple sequence are obtained by executing the security permutation protocol in conjunction with the second party for the target permutation. It can be understood that the above target permutation can be obtained in the first round of iteration.

[0107] The following is a brief description of the meaning of substitution:

[0108] Permutation: For two sequences, if the sets of elements they each contain are the same, and each element appears the same number of times in the two sequences, then the two sequences are called a permutation of each other.

[0109] Permutation: A mapping from a sequence to a permutation of the sequence. That is, when a permutation is applied to a sequence, a permutation of the sequence is obtained. For example, x represents a sequence, x[i] represents the i-th element of the sequence; π represents a permutation; π(x) represents the new sequence obtained by applying the permutation π to the sequence x, where the i-th element is the π(i)-th element in x: π(x)[i] = x[π(i)].

[0110] In one example, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is the order in which the target nodes are sorted, and the second order is the order in which the source nodes are sorted.

[0111] In this example, the nodes have their node numbers, for example, the three nodes have node numbers 0, 1, and 2 respectively, the first order may be an order in which the node numbers of the target nodes are sorted in ascending order, and the second order may be an order in which the node numbers of the source nodes are sorted in ascending order.

[0112] Furthermore, the tuple also includes an object type identifier. When the identifier takes a first value, the source node and the target node are the same node, and the tuple represents the same node; when the identifier takes a second value, the source node and the target node are different, and the tuple represents the edge from the source node to the target node.

[0113] In this example, both nodes and edges are represented in tuple form, and the object type identifier is used to distinguish whether a tuple represents a node or an edge.

[0114] For example, nodes and edges are represented in the form of a unified tuple: (u, v, is_vertex, attr), where u is the source node, v is the target node, is_vertex is the object type identifier, and attr is the attribute value of the object represented by the tuple. 0 , v 0 ,1,attr), its flag bit is 1, indicating that the tuple represents the node v 0 ; For a tuple (v 0 , v 1 , 0, attr), its identification bit is 0, indicating that the tuple represents the edge v 0 →v 1 , the source node of this edge is v 0 , the target node of this edge is v 1 .

[0115] In one example, the current sequence fragment of the tuple sequence of the second order is obtained by jointly executing the safe permutation protocol with the second party for the target permutation, including:

[0116] Based on the first sequence fragment and the first permutation input by the own party, and the second sequence fragment and the second permutation input by the second party, the first call is executed on the security permutation protocol to obtain the current sequence fragment of the tuple sequence of the second order; wherein the first sequence fragment is determined according to the current sequence fragment of the tuple sequence of the first order, and the combination of the first permutation and the second permutation is equivalent to the target permutation.

[0117] In this example, the function implemented by the secure substitution protocol is that each party inputs a substitution and a ciphertext of data, and outputs the ciphertext of the data after the two substitutions. For example, for the secure substitution protocol, let ( π i ) represents the source from the i-th party P i The input is is the sequence sharding, π i It is a private replacement.

[0118] Further, obtaining the current sequence fragment of the tuple sequence of the second order also includes:

[0119] Applying an inverse permutation of a target permutation to a current sequence fragment of the first-order tuple sequence to obtain the first sequence fragment.

[0120] In this example, instead of directly using the current sequence fragment of the first-order tuple sequence as the input of the secure permutation protocol, the inverse permutation of the target permutation is applied to the current sequence fragment to obtain the first sequence fragment, which is used as the input of the secure permutation protocol. For example, the target permutation is represented by π, and both parties locally perform D dst Sharded application π -1 , and then call the safe replacement protocol, let ( π i ) represents the source from the i-th party P i The input is is the sequence sharding, π i It is a private replacement.

[0121] Further, a first call is performed on the security replacement protocol, including:

[0122] Based on the first permutation input by the party and the second sequence of shards input by the second party, calling the secure permutation sharing protocol, performing the first permutation sharing operation, and obtaining the first intermediate shard after the first permutation is performed on the second sequence of shards;

[0123] Performing local calculation according to the first permutation, the first sequence fragment, and the first intermediate fragment to obtain a first permutation result after the first permutation is performed on the target data sequence; the first sequence fragment and the second sequence fragment are two fragments constituting the target data sequence;

[0124] Based on the first permutation result input by this party and the second permutation input by the second party, the secure permutation sharing protocol is called to perform a second permutation sharing operation to obtain this party's slice of the second permutation result after the second permutation of the first permutation result as the current sequence slice of the tuple sequence in the second order.

[0125] In this example, the first call to the secure permutation sharing protocol is implemented by calling the secure permutation sharing protocol twice. The function implemented by the secure permutation sharing protocol is that one party inputs a permutation, the other party inputs data, and outputs the ciphertext of the permuted data.

[0126] The specific process of the secure substitution protocol is given below. The process includes: first, each party inputs a substitution and data ciphertext; then the two parties call the secure substitution-sharing protocol together, one party as the substitution party inputs the substitution, and the other party as the data party inputs the data ciphertext, and outputs the ciphertext of the substitution data; then the substitution party in the previous step performs corresponding calculations based on the data ciphertext and the output of the secure substitution-sharing protocol to obtain the intermediate calculation result; then the two parties call the secure substitution-sharing protocol together, the previous substitution party now inputs the aforementioned intermediate calculation result as the data party, and the previous data party now inputs the substitution as the substitution party, and outputs the ciphertext of the substitution data; then the substitution party performs corresponding calculations based on the outputs of the two secure substitution-sharing protocols; finally, the two parties each output the obtained results.

[0127] For example, the secure replacement protocol is expressed as Can realize safe replacement function permute .set up Indicates that it comes from P i The input of i is a private permutation, and b is a control bit that determines the control flow and output. The processing flow includes:

[0128] Both sides use input Calling the secure swap-sharing protocol To obtain The fragmentation is represented by By P i hold.

[0129] P b calculate

[0130] Both parties invoke the secure swap-sharing protocol enter To obtain The fragmentation is represented by By P i hold.

[0131] P 1-b calculate

[0132] P b Output P 1-b Output

[0133] As can be seen from the above, the function of the safe replacement protocol can be realized by calling the safe replacement-sharing protocol twice.

[0134] Further, performing a first replacement sharing operation includes:

[0135] Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0136] Receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating the columns and sequences of the second inadvertently incomplete matrix by the second party, and encrypting the second sequence slices using the columns and sequences;

[0137] The encrypted data sequence is locally permuted using the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain result fragments after the first permutation of the second sequence fragments as the first intermediate fragments.

[0138] In this example, the first permutation sharing operation is performed by calling the secure permutation sharing protocol. The inadvertently incomplete matrix is ​​a certain encoding of the permutation, which can assist in completing the permutation of the data in the future without leaking information about the permutation itself to the data party. Specifically, the inadvertently incomplete matrix involves a pair of matrices, which are held by the permutation party and the data party respectively.

[0139] Furthermore, when the first replacement sharing operation is performed for the first time, it also includes:

[0140] According to the first permutation, the inadvertent incomplete matrix generation process is performed jointly with the second party to obtain the first inadvertent incomplete matrix, and the second party obtains the second inadvertent incomplete matrix.

[0141] In this example, when the first permutation sharing operation is performed for the first time, the inadvertently incomplete matrix generation protocol can be called to generate an inadvertently incomplete matrix, and the call does not depend on the data of the data party.

[0142] Furthermore, when the first replacement sharing operation is not performed for the first time, the method further includes:

[0143] Each element of the first inadvertently incomplete matrix is ​​updated using a deterministic pseudo-random number generator agreed upon with the second party.

[0144] In this example, when the first permutation sharing operation is not performed for the first time, the inadvertently incomplete matrix generation protocol is no longer called. Instead, each element of the inadvertently incomplete matrix is ​​updated to improve security, thereby significantly reducing the calling overhead.

[0145] The specific process of the secure permutation sharing protocol is given below. The process includes: first, the permutation party inputs a permutation, and the data party inputs several data lists to be permuted; then the two parties call the oblivious incomplete matrix (OPM) generation protocol together, input the permutation, and output the corresponding oblivious incomplete matrix; then for each data list to be permuted, the following are executed in sequence: the permutation party calculates the difference between the row sum and the column sum of the oblivious incomplete matrix in a specific way, and the data party calculates the row sum and the column sum of the oblivious incomplete matrix; if the inverse permutation input by the permutation party is required, the calculation result is transformed accordingly; the data party encrypts the data with the calculation result and sends it to the permutation party; the permutation party further calculates according to the calculation result and the received message, and outputs the permutation result; finally, the two parties use an agreed deterministic pseudo-random number generator to update each element of the oblivious incomplete matrix.

[0146] For example, the secure swap sharing protocol is expressed as Can realize safe replacement sharing functionΠ perm_share . Let π be P b The input is a permutation of size n, and x (1) ...x (K) YesP 1-b Input vectors to be permuted and shared. Both parties agree on a deterministic pseudo-random generator G: G → G and a bit vector rev ∈ {0, 1} K The processing flow includes:

[0147] Both sides input <π, ⊥>, call To obtain P b set up P 1-b Setting M (1) =M.

[0148] For k∈[K]:

[0149] a)P b Calculate Δ (k) for:

[0150]

[0151] P 1-b A (k) Calculated as M (k) The column sum of b (k) Calculated as M (k) The row sum:

[0152]

[0153] b) If rev[k] = 1, then P b Execute Δ (k) =π -1 (-Δ (k) ), P 1-b Execute (k) , b (k) )=(b (k) , a (k) ).

[0154] c)P 1-b x (k) +a (k) and randomly sampled Send to P b .

[0155] d) P b Output

[0156] P 1-b Output (k) -b (k) .

[0157] e) If k <K,P b and P 1-b Calculate separately and M (k+1) for:

[0158] As can be seen from the above, by encoding the permutation with an inadvertently incomplete matrix, the permutation of data is subsequently assisted to achieve a secure permutation sharing function.

[0159] In the embodiments of this specification, the secure replacement protocol may also include any of the following optimizations:

[0160] Complexity optimization. Using permutation decomposition techniques, a permutation whose size is proportional to the data size is decomposed into several smaller permutations, achieving better computational and communication complexity. When the permutation is decomposed into a constant size, the computational and communication complexities are relatively balanced. If communication becomes a serious bottleneck in practice, a slightly larger permutation size can be chosen to achieve a linear communication volume while slightly increasing the computational workload.

[0161] Calculation overlap. Calling the secure permutation sharing protocol twice will cause the inadvertent incomplete matrix generation protocol to be called twice. The process of each call is: one party calculates first, the other party waits, the two parties communicate, and the other party calculates again, and the other party waits. Since the identities of the two computing participants in the two calls are different, the above identities are specifically the permutation party or the data party, and the calculations of the two calls are independent of each other, the calculation processes in the two calls can be overlapped, so that the two parties can calculate at the same time and avoid being in an idle waiting state.

[0162] Communication optimization. When the input data is in the form of a garbled circuit representation, the data is first converted to a Boolean secret sharing representation using a type conversion protocol, and then converted back to the garbled circuit representation after executing a secure permutation protocol to reduce the amount of communication.

[0163] Then, in step 42, based on the current sequence fragment of the tuple sequence of the second order, the oblivious message propagation from the node to the edge is performed jointly with the second party to obtain the first updated fragment of the tuple sequence of the second order. It can be understood that the second order can be an order sorted in ascending order according to the node number of the source node.

[0164] In the embodiment of this specification, when sorting according to the source node, the tuples can also be sorted in combination with whether they represent nodes or edges. When the source nodes are the same, the nodes are sorted before the edges. According to the aforementioned second order, the tuple list is linearly scanned to exchange data between adjacent tuples to achieve message propagation.

[0165] Next, in step 43, based on the first update fragment of the tuple sequence of the second order, the safe permutation protocol is executed in conjunction with the inverse permutation of the target permutation by the second party to obtain the first update fragment of the tuple sequence of the first order. It can be understood that two permutations are inverse permutations of each other. When the two permutations are applied to a sequence one after another, the sequence remains unchanged. That is, the combination of two permutations that are inverse permutations of each other is a unit permutation.

[0166] In one example, the secure permutation protocol is performed in conjunction with the inverse permutation of the target permutation by the second party to obtain a first updated fragment of a first order sequence of tuples, including:

[0167] Based on the third sequence fragment input by this party, the inverse permutation of the first permutation, and the fourth sequence fragment input by the second party and the inverse permutation of the second permutation, a second call is made to the safe permutation protocol to obtain the first updated fragment of the tuple sequence of the first order, and the third sequence fragment is the first updated fragment of the tuple sequence of the second order.

[0168] In this example, the function of the secure substitution protocol is the same as that described above, except that the input and output are different in the specific calling process.

[0169] Further, obtaining a first update fragment of the tuple sequence in the first order includes:

[0170] The target permutation is applied to the execution result of the second call execution as a first update slice of the first ordered sequence of tuples.

[0171] In this example, instead of directly using the execution result of the second call execution as the first update fragment of the first-order tuple sequence, the target permutation is applied to the execution result of the second call execution to obtain the first update fragment.

[0172] Further, a second call is performed on the security replacement protocol, including:

[0173] Based on the inverse permutation of the first permutation input by the party and the fourth sequence of fragments input by the second party, calling the secure permutation sharing protocol, performing the third permutation sharing operation, and obtaining the second intermediate fragment after performing the inverse permutation of the first permutation on the fourth sequence of fragments;

[0174] Performing local calculation according to the inverse permutation of the first permutation, the third sequence fragment, and the second intermediate fragment, to obtain a third permutation result after the inverse permutation of the first permutation is performed on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments constituting the target data sequence;

[0175] Based on the third permutation result input by this party and the inverse permutation of the second permutation input by the second party, the secure permutation sharing protocol is called to perform a fourth permutation sharing operation to obtain this party's fragment of the fourth permutation result after performing the inverse permutation of the second permutation on the third permutation result as the first updated fragment of the tuple sequence in the first order.

[0176] In this example, the secure permutation sharing protocol is called twice to implement the second call execution of the secure permutation sharing protocol. The function implemented by the secure permutation sharing protocol is that one party inputs a permutation, the other party inputs data, and outputs the ciphertext of the permuted data.

[0177] Further, performing a third replacement sharing operation includes:

[0178] Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0179] Performing inverse permutation processing on a sequence consisting of opposite numbers of each element of the first difference sequence to obtain an updated first difference sequence;

[0180] receiving an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating a row and sequence of a second inadvertently incomplete matrix by the second party, and encrypting a fourth sequence slice using the row and sequence;

[0181] The encrypted data sequence is locally permuted using the inverse permutation of the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain a result fragment after the inverse permutation of the first permutation is performed on the fourth sequence fragment as the second intermediate fragment.

[0182] In this example, the third permutation sharing operation is performed by calling the secure permutation sharing protocol. The inadvertently incomplete matrix is ​​a certain encoding of the permutation, which can assist in completing the permutation of the data in the future without leaking information about the permutation itself to the data party. Specifically, the inadvertently incomplete matrix involves a pair of matrices, which are held by the permutation party and the data party respectively.

[0183] Finally, in step 44, based on the first update fragment of the tuple sequence of the first order, the second party jointly performs the oblivious message aggregation from the edge to the node to obtain the second update fragment of the tuple sequence of the first order. It can be understood that the first order can be an order sorted in ascending order according to the node number of the target node.

[0184] In the embodiment of this specification, when sorting according to the target node, the tuples can also be sorted according to whether they represent nodes or edges. When the target nodes are the same, the nodes are sorted after the edges. According to the aforementioned first order, the tuple list is linearly scanned to exchange data between adjacent tuples to achieve message aggregation.

[0185] In one example, the first iteration includes:

[0186] Based on the input sequence fragmentation of the tuple sequence in the random order, an initial sequence fragmentation of the tuple sequence in the second order is obtained by jointly executing a secure sorting protocol with the second party for the first sorting key;

[0187] Based on the initial sequence fragment of the second-order tuple sequence, performing oblivious message propagation from the node to the edge to obtain a third updated fragment of the second-order tuple sequence;

[0188] Based on the third updated fragment of the tuple sequence in the second order, by jointly executing the secure sorting protocol with the second party on the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated;

[0189] Based on the third update fragment of the tuple sequence in the first order, oblivious message aggregation from the edge to the node is performed to obtain a fourth update fragment of the tuple sequence in the first order.

[0190] In this example, in the first round of iterations, the tuple sequence needs to be sorted into a first order and a second order, and a safe sorting protocol is used to implement the above sorting, and when converting from the first order to the second order, a target permutation is generated so that the safe permutation protocol can be used instead of the safe sorting protocol in subsequent non-first round iterations to achieve the above conversion from the first order to the second order or vice versa.

[0191] Further, by jointly executing the security sorting protocol with the second party for the first sorting key, an initial sequence fragmentation of the tuple sequence of the second order is obtained, including:

[0192] Based on the first input sequence fragment and the first key fragment of the first sort key input by the party, and the second input sequence fragment and the second key fragment of the first sort key input by the second party, a first call is executed on the security sorting protocol to obtain an initial sequence fragment of the tuple sequence of the second order;

[0193] By jointly executing the secure sorting protocol with the second party for the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated, including:

[0194] Based on the third update fragment input by this party, the first key fragment of the second sort key, and the third update fragment and the second key fragment of the second sort key input by the second party, a second call is made to execute the security sorting protocol to obtain the third update fragment of the tuple sequence in the first order and generate the target permutation.

[0195] In this example, the function implemented by the secure sorting protocol is that two parties input the ciphertext of data and sorting key, and output the ciphertext of data sorted according to the key. For example, for the secure sorting protocol, suppose Indicates that it comes from the i-th party P i The input, where It is data sharding. Is the shard of the sort key.

[0196] Furthermore, the first sorting key includes key values ​​corresponding to each first key of each tuple in the tuple sequence; the key value of the first key is determined at least according to the number of the source node of the corresponding tuple; the second sorting key includes key values ​​corresponding to each second key of each tuple in the tuple sequence; the key value of the second key is determined at least according to the number of the target node of the corresponding tuple.

[0197] In this example, the sort key is used as the basis for sorting the tuple sequence. When sorting according to the target node, each key value of the sort key is determined at least according to the number of the target node, for example, according to (υ, is_υertex) s Sort by, where v is the target node and is_vertex is the object type identifier.

[0198] Further, performing a first call to execute the security sorting protocol includes:

[0199] According to the first key sharding of the first sort key, for each bit of the key value included in the first sort key, starting from the least significant bit, jointly with the second party respectively performs bit iteration processing: calculate the position permutation of the current bit of the sort, and perform permutation processing on the random secret permutation and the first sort key according to the calculated position permutation, and update the random secret permutation and the first sort key according to the processing result;

[0200] Based on the first input sequence fragment input by the party, the inverse permutation of the first secret permutation, and the second input sequence fragment and the inverse permutation of the second secret permutation correspondingly input by the second party, the secure permutation protocol is executed for a third time to obtain a result fragment of the first masking result, wherein the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation;

[0201] The random secret permutation obtained by the bit iteration processing is obtained jointly with the second party, and applied to the result slice of the first masking result to obtain the initial sequence slice of the tuple sequence of the second order.

[0202] In this example, the random secret permutation and the first sort key are updated through bit iteration processing, and then the first call execution of the secure sorting protocol is implemented by calling the secure permutation protocol.

[0203] Further, the random secret permutation and the first sort key are permuted according to the calculated position permutation, including:

[0204] According to the random sampling sampling permutation, the position permutation, the random secret permutation and the first sorting key are permuted respectively to obtain the masked position permuted local shard, the masked random secret permuted local shard and the masked first sorting key local shard;

[0205] jointly determining masking position replacement with a second party;

[0206] By using masked position permutation, the masked random secret permuted local shard and the masked first sort key local shard are permuted respectively, and the local shard is obtained as a result of the permutation of the random secret permutation and the first sort key by using position permutation.

[0207] In this example, the masked position permutation is obtained after masking the position permutation, so revealing its plaintext will not reveal the position permutation, which is convenient for subsequent calculations.

[0208] The specific process of the secure sorting protocol is given below. The process includes: first, the two parties each input the data represented by the obfuscated circuit and the ciphertext of the sorting key; then the two parties call the random secret permutation preparation protocol together to generate a random secret permutation; then the two parties call the type conversion protocol together to convert the sorting key into a Boolean secret sharing representation; then for each bit of the sorting key, starting from the least significant bit, the following processing is performed respectively: convert the bit into an arithmetic secret sharing representation, calculate the permutation of the sorted bit, and sort the generated random secret permutation and all the sorting keys according to the calculated permutation, wherein, in order not to disclose the sorting process, it is necessary to first use the secure permutation protocol to randomly shuffle the content to be sorted; then the two parties call the type conversion protocol together to convert the data ciphertext into a Boolean secret sharing representation; then the two parties call the secure permutation protocol together to apply the inverse permutation of the generated random secret permutation to the data ciphertext; the aforementioned sorted random secret permutation is made public and applied to the data ciphertext; the two parties call the type conversion protocol together to convert the data ciphertext into an obfuscated circuit representation; finally, the two parties each output the final calculation result.

[0209] For example, the secure ordering protocol is represented as Can realize the safety sorting function sort .P i The sharding of the input data and sort key in the form of garbled circuits are represented as The superscript S∈{Y,B,A} indicates the type of sharing. The processing flow includes:

[0210] Call P i get

[0211] Call Based on input get

[0212] For s∈[|K|], where |K| is the length in bits of each key:

[0213] a) Extract the sth least significant bit of each key and call To obtain

[0214] b) Call Based on input get

[0215] c) Call Based on P ienter in, is obtained by random sampling, in,

[0216]

[0217] d) Reveal Then and Apply displacement get and

[0218] e) and Updated to and

[0219] Call Based on input get

[0220] Call Based on P i enter get

[0221] reveal Then Apply displacement get

[0222] Call Based on input get

[0223] P i Output

[0224] As can be seen from the above, the safe sorting function is realized by calling the safe replacement protocol, etc. Prepare protocols for random secret permutations; It is a type conversion protocol; To generate a permutation, enter Output σ(k) is arranged in order; For safe replacement protocol; The type conversion protocol.

[0225] Figure 5 A basic flow chart of a security sequencing protocol according to an embodiment is shown. Figure 5, the outer frame includes the main loop of the protocol, which generates the sorting permutation σ according to the sorting key K, and finally acts on the initially generated random secret permutation, that is, For the calculation of data ciphertext D, a pair of secure replacement protocols are used. The ciphertext data is sorted by calling and permuting once. For the type conversion from Boolean secret sharing to arithmetic secret sharing, the actual word length of the input data is 1, which allows the general type conversion protocol to be appropriately tailored to improve efficiency.

[0226] Figure 6 FIG. 1 is a basic flow chart showing a permutation and replacement sorting process according to an embodiment. Figure 6 , shows how to replace the secure sorting protocol with a secure permutation protocol in a multi-round iterative analysis. First, generate a random secret permutation π r , and let this random secret permutation participate in the first round of secure sorting, output another permutation and make it public, and get the public permutation When the sorting process needs to be repeated later, the inverse permutation of the random secret permutation is first applied through the secure permutation protocol. Open Substitution Similarly, when the reverse process of this sorting process needs to be repeated later, the inverse permutation of the public permutation is first applied, and then the random secret permutation is applied through the secure permutation protocol.

[0227] Through the method provided by the embodiments of the present specification, in any non-first round of iteration, the first party first obtains the current sequence fragment of the second-order tuple sequence based on the current sequence fragment of the first-order tuple sequence obtained in the previous round by jointly executing the safe substitution protocol with the second party for the target substitution; then, based on the current sequence fragment of the second-order tuple sequence, jointly execute the oblivious message propagation from the node to the edge with the second party to obtain the first updated fragment of the second-order tuple sequence; then, based on the first updated fragment of the second-order tuple sequence, jointly execute the safe substitution protocol with the second party for the inverse substitution of the target substitution to obtain the first updated fragment of the first-order tuple sequence; finally, based on the first updated fragment of the first-order tuple sequence, jointly execute the oblivious message aggregation from the edge to the node with the second party to obtain the second updated fragment of the first-order tuple sequence. As can be seen from the above, in the embodiments of the present specification, in any non-first round of iteration, the tuple sequence needs to be converted between the first order and the second order, and a safe permutation protocol is used instead of a safe sorting protocol to achieve the above conversion. The safe permutation protocol reuses key intermediate calculation results while ensuring security, thereby significantly reducing computing and communication overheads, thereby enabling efficient and secure implementation of graph analysis.

[0228] In addition, the embodiments of this specification also provide a two-party secure permutation protocol optimized for the scenario, which is used to replace the secure sorting after the first round of iterations, thereby eliminating redundant sorting and significantly improving performance. The design of this protocol makes full use of the characteristics of iterative graph analysis, and reuses key intermediate calculation results while ensuring security based on the correlation of permutation operations between multiple rounds of iterations, thereby significantly reducing computing and communication overhead.

[0229] The embodiments of this specification also provide a two-party secure sorting protocol optimized for scenarios, which is used to efficiently sort data in the first round of iterations and is subsequently replaced by a secure replacement protocol. The design of this protocol makes full use of the short length of secure sorting keys in iterative graph analysis and is designed based on radix sorting and secure replacement protocols. Compared with commonly used sorting protocols, this sorting protocol has better computational and communication complexity. In actual scenarios, although the complexity is slightly improved compared to casual radix sorting, the constant factor is smaller and the actual performance is better.

[0230] Figure 7 A flowchart of an iterative two-party privacy graph analysis method according to another embodiment is shown. The method can be based on Figure 1 The implementation scenario shown, Figure 2 In the system architecture shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the method is executed by the first party. Figure 7 As shown, the iterative two-party privacy graph analysis method in this embodiment includes the following steps: Step 71, based on the target message propagation operator adopted by the target application and the tuple fragments of the private graph of the party, jointly call the message dispersion programming interface with the second party, the message dispersion programming interface uses the secure sorting protocol or the secure permutation protocol to perform a first sort on the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator; Step 72, based on the target message aggregation operator adopted by the target application and the tuple fragments, jointly call the message collection programming interface with the second party, the message collection programming interface uses the secure sorting protocol or the secure permutation protocol to perform a second sort on the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator.

[0231] Among them, the above-mentioned target message propagation operator and target message aggregation operator can be user-defined operators, so that various target applications can be flexibly implemented.

[0232] In addition, Figure 4 In accordance with the processing flow shown, the implementation of the message dispersing programming interface may include the aforementioned steps 41 and 42, and the implementation of the message collecting programming interface may include the aforementioned steps 43 and 44.

[0233] Through the method provided in the embodiment of this specification, the first party first calls the message dispersion programming interface with the second party based on the target message propagation operator used by the target application and the tuple fragmentation of the private graph of the first party. The message dispersion programming interface uses the secure sorting protocol or the secure permutation protocol to perform a first sort on the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator; then based on the target message aggregation operator used by the target application and the tuple fragmentation, the message collection programming interface is jointly called with the second party. The message collection programming interface uses the secure sorting protocol or the secure permutation protocol to perform a second sort on the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator. As can be seen from the above, the embodiment of this specification designs a programming framework for the scenario of two-party iterative privacy graph analysis. The MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance. At the same time, the framework provides a programming interface similar to traditional parallel graph analysis to meet ease of use and facilitate the development of graph analysis applications.

[0234] According to another embodiment, an iterative two-party privacy graph analysis device is also provided, which is used to perform the method provided in the embodiment of this specification. Figure 4 In the method shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the device is set on the first party to perform multiple rounds of iterations. Figure 8 FIG. 1 is a schematic block diagram of an iterative two-party privacy graph analysis device according to an embodiment. Figure 8 As shown, the apparatus 800 includes the following units for executing any non-first round iteration:

[0235] A first replacement unit 81 is used to obtain a current sequence fragment of a tuple sequence of the second order by jointly executing a safe replacement protocol with the second party for target replacement based on the current sequence fragment of the tuple sequence of the first order obtained in the previous round;

[0236] a propagation unit 82, configured to perform oblivious message propagation from the node to the edge in conjunction with the second party based on the current sequence fragment of the tuple sequence of the second order obtained by the first replacement unit 81, to obtain a first updated fragment of the tuple sequence of the second order;

[0237] A second replacement unit 83 is used for obtaining a first updated fragment of the tuple sequence of the first order by executing the secure replacement protocol in conjunction with the inverse replacement of the target replacement by the second party based on the first updated fragment of the tuple sequence of the second order obtained by the propagation unit 82;

[0238] The aggregation unit 84 is used to jointly perform oblivious message aggregation from the edge to the node with the second party based on the first updated fragment of the first order tuple sequence obtained by the second replacement unit 83 to obtain a second updated fragment of the first order tuple sequence.

[0239] Optionally, as an embodiment, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is the order in which the target nodes are sorted, and the second order is the order in which the source nodes are sorted.

[0240] Furthermore, the tuple also includes an object type identifier. When the identifier takes a first value, the source node and the target node are the same node, and the tuple represents the same node; when the identifier takes a second value, the source node and the target node are different, and the tuple represents the edge from the source node to the target node.

[0241] Optionally, as an embodiment, the first replacement unit 81 is specifically used to perform a first call execution on the security replacement protocol based on the first sequence fragmentation and the first replacement input by the party, and the second sequence fragmentation and the second replacement corresponding to the second party input, to obtain the current sequence fragmentation of the tuple sequence of the second order; wherein the first sequence fragmentation is determined according to the current sequence fragmentation of the tuple sequence of the first order, and the combination of the first replacement and the second replacement is equivalent to the target replacement;

[0242] The second replacement unit 83 is specifically used to perform a second call to the security replacement protocol based on the third sequence fragment input by the own party, the inverse replacement of the first replacement, the fourth sequence fragment input by the second party and the inverse replacement of the second replacement, so as to obtain the first updated fragment of the tuple sequence of the first order, and the third sequence fragment is the first updated fragment of the tuple sequence of the second order.

[0243] Furthermore, the first replacement unit 81 is further configured to apply the inverse replacement of the target replacement to the current sequence fragment of the tuple sequence of the first order to obtain the first sequence fragment;

[0244] The second replacement unit 83 is further used to apply the target replacement to the execution result of the second call execution as the first update fragment of the tuple sequence in the first order.

[0245] Further, the first replacement unit 81 includes:

[0246] A first permutation sharing subunit is configured to call a secure permutation sharing protocol based on the first permutation input by the party and the second sequence of fragments input by the second party, perform a first permutation sharing operation, and obtain a first intermediate fragment after the second sequence of fragments is permuted by the first permutation;

[0247] a local computing subunit, configured to perform local computing according to the first permutation, the first sequence fragment, and the first intermediate fragment obtained by the first permutation sharing subunit, to obtain a first permutation result after the first permutation is performed on the target data sequence; the first sequence fragment and the second sequence fragment are two fragments constituting the target data sequence;

[0248] The second permutation sharing sub-unit is used to call the secure permutation sharing protocol based on the first permutation result obtained by the local computing sub-unit input by the local party and the second permutation input by the second party, and perform a second permutation sharing operation to obtain the local fragment of the second permutation result after the second permutation is performed on the first permutation result as the current sequence fragment of the tuple sequence of the second order.

[0249] Furthermore, the first replacement sharing subunit includes:

[0250] A local calculation module is used to locally calculate a row sum sequence formed by the sum of each row element of the first inadvertent incomplete matrix, and a column sum sequence formed by the sum of each column element, and calculate the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0251] A receiving module, configured to receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating the columns and sequences of the second inadvertently incomplete matrix by the second party, and encrypting the second sequence slices using the columns and sequences;

[0252] A local permutation module is used to perform local permutation processing on the encrypted data sequence received by the receiving module using a first permutation, and perform local calculation with the first difference sequence obtained by the local calculation module and the random sequence received by the receiving module to obtain the result fragment after the first permutation of the second sequence fragment as the first intermediate fragment.

[0253] Furthermore, the first replacement sharing subunit further includes:

[0254] The generation module is used to perform an unintentional incomplete matrix generation process with the second party according to the first permutation when the first permutation sharing operation is performed for the first time, so as to obtain the first unintentional incomplete matrix, and the second party obtains a second unintentional incomplete matrix.

[0255] Furthermore, the first replacement sharing subunit further includes:

[0256] The updating module is used to update each element of the first inadvertently incomplete matrix by using a deterministic pseudo-random number generator agreed with the second party when the first permutation sharing operation is not performed for the first time.

[0257] Further, the second replacement unit 83 includes:

[0258] A third permutation sharing subunit is configured to call a secure permutation sharing protocol based on the inverse permutation of the first permutation input by the own party and the fourth sequence of fragments input by the second party, and perform a third permutation sharing operation to obtain a second intermediate fragment after the inverse permutation of the first permutation is performed on the fourth sequence of fragments;

[0259] a local calculation subunit, configured to perform local calculation according to the inverse permutation of the first permutation, the third sequence fragment, and the second intermediate fragment, to obtain a third permutation result after the inverse permutation of the first permutation is performed on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments constituting the target data sequence;

[0260] The fourth permutation sharing subunit is used to call the secure permutation sharing protocol based on the third permutation result input by the own party and the inverse permutation of the second permutation input by the second party, and perform a fourth permutation sharing operation to obtain the own fragment of the fourth permutation result after performing the inverse permutation of the second permutation on the third permutation result as the first updated fragment of the tuple sequence in the first order.

[0261] Furthermore, the third replacement sharing subunit includes:

[0262] A local calculation module is used to locally calculate a row sum sequence formed by the sum of each row element of the first inadvertent incomplete matrix, and a column sum sequence formed by the sum of each column element, and calculate the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0263] An inverse permutation processing module, used to perform inverse permutation processing on a sequence consisting of opposite numbers of each element of the first difference sequence to obtain an updated first difference sequence;

[0264] A receiving module, configured to receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating a row and sequence of a second inadvertently incomplete matrix by the second party, and encrypting a fourth sequence fragment using the row and sequence;

[0265] A local permutation module is used to perform local permutation processing on the encrypted data sequence using the inverse permutation of the first permutation, and perform local calculations with the first difference sequence and the random sequence to obtain the result fragment after the inverse permutation of the first permutation is performed on the fourth sequence fragment as the second intermediate fragment.

[0266] Furthermore, the apparatus further comprises the following unit for performing a first round of iteration:

[0267] A first sorting unit, configured to obtain an initial sequence fragmentation of the tuple sequence in a second order based on an input sequence fragmentation of the tuple sequence in a random order by jointly executing a secure sorting protocol with the second party for the first sorting key;

[0268] The propagation unit 82 is further configured to perform oblivious message propagation from the node to the edge based on the initial sequence fragment of the tuple sequence of the second order, so as to obtain a third updated fragment of the tuple sequence of the second order;

[0269] A second sorting unit is configured to obtain a third updated fragment of the tuple sequence in the first order based on the third updated fragment of the tuple sequence in the second order by jointly executing the secure sorting protocol with the second party on the second sorting key, and generate the target permutation;

[0270] The aggregation unit 84 is further configured to perform oblivious message aggregation from edges to nodes based on the third updated fragment of the tuple sequence in the first order, so as to obtain a fourth updated fragment of the tuple sequence in the first order.

[0271] Further, the first sorting unit is specifically used to perform a first call execution on the security sorting protocol based on the first input sequence fragment input by the party, the first key fragment of the first sorting key, and the second input sequence fragment and the second key fragment of the first sorting key correspondingly input by the second party, so as to obtain the initial sequence fragment of the tuple sequence of the second order;

[0272] The second sorting unit is specifically used to perform a second call to the security sorting protocol based on the third update fragment input by the own party, the first key fragment of the second sorting key, and the third update fragment and the second key fragment of the second sorting key corresponding to the second party input, to obtain the third update fragment of the tuple sequence in the first order, and generate the target permutation.

[0273] Furthermore, the first sorting key includes key values ​​corresponding to each first key of each tuple in the tuple sequence; the key value of the first key is determined at least according to the number of the source node of the corresponding tuple; the second sorting key includes key values ​​corresponding to each second key of each tuple in the tuple sequence; the key value of the second key is determined at least according to the number of the target node of the corresponding tuple.

[0274] Furthermore, the first sorting unit includes:

[0275] an iterative processing subunit, configured to perform bit iterative processing in conjunction with the second party for each bit of the key value included in the first sort key, starting from the least significant bit, according to the first key shard of the first sort key: calculate the position permutation of the current bit of the sort, and perform permutation processing on the random secret permutation and the first sort key according to the calculated position permutation, and update the random secret permutation and the first sort key according to the processing result;

[0276] a security substitution subunit, configured to perform a third call execution on the security substitution protocol based on the first input sequence fragment input by the party, the inverse substitution of the first secret substitution, the second input sequence fragment correspondingly input by the second party, and the inverse substitution of the second secret substitution, to obtain a result fragment of the first masking result, wherein the combination of the first secret substitution and the second secret substitution is equivalent to the initial random secret substitution;

[0277] The public permutation subunit is used to jointly obtain the random secret permutation obtained by the bit iteration processing with the second party, and act on the result slice of the first masking result to obtain the initial sequence slice of the tuple sequence of the second order.

[0278] Furthermore, the iterative processing subunit includes:

[0279] A masking module, used for performing permutation processing on the position permutation, random secret permutation and first sorting key respectively according to the sampling permutation of random sampling, so as to obtain masked position permuted local shards, masked random secret permuted local shards and masked first sorting key local shards;

[0280] a revealing module for determining a masking position replacement jointly with a second party;

[0281] The local replacement module is used to use masked position replacement to replace the local shards of the masked random secret replacement and the local shards of the masked first sort key, respectively, to obtain the local shards of the processing results of replacing the random secret replacement and the first sort key by position replacement.

[0282] Through the device provided by the embodiments of the present specification, in any non-first round iteration, the first party first obtains the current sequence fragment of the second-order tuple sequence by the first replacement unit 71 based on the current sequence fragment of the first-order tuple sequence obtained in the previous round, by jointly executing the safe replacement protocol with the second party for the target replacement; then the propagation unit 72 performs the oblivious message propagation from the node to the edge with the second party based on the current sequence fragment of the second-order tuple sequence, to obtain the first updated fragment of the second-order tuple sequence; then the second replacement unit 73 performs the safe replacement protocol with the second party for the inverse replacement of the target replacement based on the first updated fragment of the second-order tuple sequence, to obtain the first updated fragment of the first-order tuple sequence; finally, the aggregation unit 74 performs the oblivious message aggregation from the edge to the node with the second party based on the first updated fragment of the first-order tuple sequence, to obtain the second updated fragment of the first-order tuple sequence. As can be seen from the above, in the embodiments of the present specification, in any non-first round of iteration, the tuple sequence needs to be converted between the first order and the second order, and a safe permutation protocol is used instead of a safe sorting protocol to achieve the above conversion. The safe permutation protocol reuses key intermediate calculation results while ensuring security, thereby significantly reducing computing and communication overheads, thereby enabling efficient and secure implementation of graph analysis.

[0283] According to another embodiment, an iterative two-party privacy graph analysis device is also provided, which is used to perform the method provided in the embodiment of this specification. Figure 7 In the method shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are expressed in tuple form; the device is set on the first party. Fig. 9 FIG. 8 is a schematic block diagram of an iterative two-party privacy graph analysis device according to another embodiment. Fig. 9 As shown, the device 900 includes:

[0284] The first calling unit 91 is used to call the message dispersion programming interface with the second party based on the target message propagation operator adopted by the target application and the tuple fragments of the private graph of the party, and the message dispersion programming interface performs a first sorting on the tuple sequence composed of the tuple fragments of the two parties by using a secure sorting protocol or a secure permutation protocol, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator;

[0285] The second calling unit 92 is used to jointly call the message collection programming interface with the second party based on the target message aggregation operator adopted by the target application and the tuple fragmentation. The message collection programming interface uses the safe sorting protocol or the safe permutation protocol to perform a second sort on the tuple sequence, and then executes the inadvertent message aggregation from the edge to the node corresponding to the target message aggregation operator.

[0286] Through the device provided by the embodiment of this specification, the first party first calls the message dispersion programming interface with the second party based on the target message propagation operator used by the target application and the tuple fragments of the private graph of the first party by the first calling unit 91. The message dispersion programming interface uses the secure sorting protocol or the secure replacement protocol to perform the first sorting of the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator; then the second calling unit 92 calls the message collection programming interface with the second party based on the target message aggregation operator used by the target application and the tuple fragments. The message collection programming interface uses the secure sorting protocol or the secure replacement protocol to perform the second sorting of the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator. As can be seen from the above, the embodiment of this specification designs a programming framework for the scenario of two-party iterative privacy graph analysis. The MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance. At the same time, the framework provides a programming interface similar to traditional parallel graph analysis to meet ease of use and facilitate the development of graph analysis applications.

[0287] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 4 or Figure 7 The method described.

[0288] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 4 or Figure 7 The method described.

[0289] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0290] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. An iterative two-party private graph analysis method, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; The method is performed by a first party and includes multiple rounds of iterations, wherein any non-first round of iterations includes: Based on the current sequence fragment of the first-order tuple sequence obtained in the previous round, the current sequence fragment of the second-order tuple sequence is obtained by jointly executing the safe permutation protocol with the second party for target permutation; Based on the current sequence fragment of the tuple sequence of the second order, jointly with the second party, perform oblivious message propagation from the node to the edge to obtain a first updated fragment of the tuple sequence of the second order; Based on the first updated fragment of the tuple sequence of the second order, the first updated fragment of the tuple sequence of the first order is obtained by executing the secure permutation protocol in conjunction with the inverse permutation of the target permutation by the second party; Based on the first updated fragment of the tuple sequence in the first order, oblivious message aggregation from the edge to the node is performed jointly with the second party to obtain a second updated fragment of the tuple sequence in the first order.

2. The method of claim 1, wherein: The tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is the order in which the target nodes are sorted, and the second order is the order in which the source nodes are sorted.

3. The method of claim 2, wherein: The tuple also includes an object type identification bit. When the identification bit takes a first value, the source node and the target node are the same node, and the tuple represents the same node; when the identification bit takes a second value, the source node and the target node are different, and the tuple represents the edge from the source node to the target node.

4. The method of claim 1, wherein: By jointly executing the secure permutation protocol with the second party for the target permutation, a current sequence fragment of the tuple sequence of the second order is obtained, including: Based on the first sequence fragment and the first permutation input by the party, and the second sequence fragment and the second permutation input by the second party, the first call is executed on the security permutation protocol to obtain the current sequence fragment of the tuple sequence of the second order; wherein the first sequence fragment is determined according to the current sequence fragment of the tuple sequence of the first order, and the combination of the first permutation and the second permutation is equivalent to the target permutation; The first update fragment of the first sequence of tuples is obtained by executing the secure permutation protocol in conjunction with the inverse permutation of the target permutation by the second party, including: Based on the third sequence fragment input by this party, the inverse permutation of the first permutation, and the fourth sequence fragment input by the second party and the inverse permutation of the second permutation, a second call is made to the safe permutation protocol to obtain the first updated fragment of the tuple sequence of the first order, and the third sequence fragment is the first updated fragment of the tuple sequence of the second order.

5. The method of claim 4, wherein: Get the current sequence slice of the second-order tuple sequence, and also include: Applying the inverse permutation of the target permutation to the current sequence fragment of the tuple sequence of the first order to obtain the first sequence fragment; Obtaining a first updated fragment of the tuple sequence of the first order, comprising: The target permutation is applied to the execution result of the second call execution as a first update slice of the first ordered sequence of tuples.

6. The method of claim 4, wherein: The first call execution of the security replacement protocol includes: Based on the first permutation input by the party and the second sequence of shards input by the second party, calling the secure permutation sharing protocol, performing the first permutation sharing operation, and obtaining the first intermediate shard after the first permutation is performed on the second sequence of shards; Performing local calculation according to the first permutation, the first sequence fragment, and the first intermediate fragment to obtain a first permutation result after the first permutation is performed on the target data sequence; the first sequence fragment and the second sequence fragment are two fragments constituting the target data sequence; Based on the first permutation result input by this party and the second permutation input by the second party, the secure permutation sharing protocol is called to perform a second permutation sharing operation to obtain this party's slice of the second permutation result after the second permutation of the first permutation result as the current sequence slice of the tuple sequence in the second order.

7. The method of claim 6, wherein: Perform a first replacement sharing operation, including: Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same; Receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating the columns and sequences of the second inadvertently incomplete matrix by the second party, and encrypting the second sequence slices using the columns and sequences; The encrypted data sequence is locally permuted using the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain result fragments after the first permutation of the second sequence fragments as the first intermediate fragments.

8. The method of claim 7, wherein: When the first replacement sharing operation is performed for the first time, it also includes: According to the first permutation, the inadvertent incomplete matrix generation process is performed jointly with the second party to obtain the first inadvertent incomplete matrix, and the second party obtains the second inadvertent incomplete matrix.

9. The method of claim 7, wherein: When the first replacement sharing operation is not performed for the first time, it also includes: Each element of the first inadvertently incomplete matrix is ​​updated using a deterministic pseudo-random number generator agreed upon with the second party.

10. The method of claim 4, wherein: Performing a second call to execute the security replacement protocol includes: Based on the inverse permutation of the first permutation input by the party and the fourth sequence of fragments input by the second party, calling the secure permutation sharing protocol, performing the third permutation sharing operation, and obtaining the second intermediate fragment after performing the inverse permutation of the first permutation on the fourth sequence of fragments; Performing local calculation according to the inverse permutation of the first permutation, the third sequence fragment, and the second intermediate fragment, to obtain a third permutation result after the inverse permutation of the first permutation is performed on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments constituting the target data sequence; Based on the third permutation result input by this party and the inverse permutation of the second permutation input by the second party, the secure permutation sharing protocol is called to perform a fourth permutation sharing operation to obtain this party's fragment of the fourth permutation result after performing the inverse permutation of the second permutation on the third permutation result as the first updated fragment of the tuple sequence in the first order.

11. The method of claim 10, wherein: Perform a third replacement sharing operation, including: Locally calculating a row sum sequence formed by the sum of the elements of each row of the first inadvertent incomplete matrix and a column sum sequence formed by the sum of the elements of each column, and calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first inadvertent inadvertent matrix and the second inadvertent inadvertent matrix held by the second party differ only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same; Performing an inverse permutation process on a sequence consisting of opposite numbers of each element of the first difference sequence to obtain an updated first difference sequence; receiving an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by locally calculating a row and sequence of a second inadvertently incomplete matrix by the second party, and encrypting a fourth sequence slice using the row and sequence; The encrypted data sequence is locally permuted using the inverse permutation of the first permutation, and locally calculated with the first difference sequence and the random sequence to obtain a result fragment after the inverse permutation of the first permutation is performed on the fourth sequence fragment as the second intermediate fragment.

12. The method of claim 2, wherein: The first iteration includes: Based on the input sequence fragmentation of the tuple sequence in the random order, an initial sequence fragmentation of the tuple sequence in the second order is obtained by jointly executing a secure sorting protocol with the second party for the first sorting key; Based on the initial sequence fragment of the second-order tuple sequence, performing oblivious message propagation from the node to the edge to obtain a third updated fragment of the second-order tuple sequence; Based on the third updated fragment of the tuple sequence in the second order, by jointly executing the secure sorting protocol with the second party on the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated; Based on the third update fragment of the tuple sequence in the first order, oblivious message aggregation from the edge to the node is performed to obtain a fourth update fragment of the tuple sequence in the first order.

13. The method of claim 12, wherein: By jointly executing the security sorting protocol with the second party for the first sorting key, an initial sequence fragmentation of the tuple sequence of the second order is obtained, including: Based on the first input sequence fragment and the first key fragment of the first sort key input by the party, and the second input sequence fragment and the second key fragment of the first sort key input by the second party, a first call is executed on the security sorting protocol to obtain an initial sequence fragment of the tuple sequence of the second order; By jointly executing the secure sorting protocol with the second party for the second sorting key, a third updated fragment of the tuple sequence in the first order is obtained, and the target permutation is generated, including: Based on the third update fragment input by this party, the first key fragment of the second sort key, and the third update fragment and the second key fragment of the second sort key input by the second party, a second call is made to execute the security sorting protocol to obtain the third update fragment of the tuple sequence in the first order and generate the target permutation.

14. The method of claim 12, wherein: The first sort key includes key values ​​corresponding to each first key of each tuple in the tuple sequence; the key value of the first key is determined at least according to the number of the source node of the corresponding tuple; the second sort key includes key values ​​corresponding to each second key of each tuple in the tuple sequence; the key value of the second key is determined at least according to the number of the target node of the corresponding tuple.

15. The method of claim 13, wherein: The first call execution of the security sorting protocol includes: According to the first key sharding of the first sort key, for each bit of the key value included in the first sort key, starting from the least significant bit, jointly with the second party respectively performs bit iteration processing: calculate the position permutation of the current bit of the sort, and perform permutation processing on the random secret permutation and the first sort key according to the calculated position permutation, and update the random secret permutation and the first sort key according to the processing result; Based on the first input sequence fragment input by the party, the inverse permutation of the first secret permutation, and the second input sequence fragment and the inverse permutation of the second secret permutation correspondingly input by the second party, the secure permutation protocol is executed for a third time to obtain a result fragment of the first masking result, wherein the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation; The random secret permutation obtained by the bit iteration processing is obtained jointly with the second party, and applied to the result slice of the first masking result to obtain the initial sequence slice of the tuple sequence of the second order.

16. The method of claim 15, wherein: The random secret permutation and the first sort key are permuted according to the calculated position permutation, including: According to the random sampling sampling permutation, the position permutation, the random secret permutation and the first sorting key are permuted respectively to obtain the masked position permuted local shard, the masked random secret permuted local shard and the masked first sorting key local shard; jointly determining masking position changes with a second party; By using masked position permutation, the masked random secret permuted local shard and the masked first sort key local shard are permuted respectively, and the local shard is obtained as a result of the permutation of the random secret permutation and the first sort key by using position permutation.

17. An iterative two-party privacy graph analysis method, wherein the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; The method is performed by a first party and includes: Based on the target message propagation operator adopted by the target application and the tuple fragments of the private graph of the party, jointly call the message dispersion programming interface with the second party, the message dispersion programming interface uses a secure sorting protocol or a secure permutation protocol to perform a first sort on the tuple sequence composed of the tuple fragments of the two parties, and then executes the oblivious message propagation from the node to the edge corresponding to the target message propagation operator; Based on the target message aggregation operator adopted by the target application and the tuple fragmentation, the message collection programming interface is jointly called with the second party. After the message collection programming interface uses the safe sorting protocol or the safe permutation protocol to perform a second sort on the tuple sequence, it executes the inadvertent message aggregation from the edge to the node corresponding to the target message aggregation operator.

18. An iterative two-party privacy graph analysis device, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the device is set on the first party, and is used to perform multiple rounds of iterations, including the following units for performing any non-first round iterations: A first replacement unit is used to obtain a current sequence fragment of the tuple sequence of the second order by jointly executing a safe replacement protocol with the second party for target replacement based on the current sequence fragment of the tuple sequence of the first order obtained in the previous round; a propagation unit, configured to jointly perform oblivious message propagation from the node to the edge with the second party based on the current sequence fragment of the tuple sequence of the second order obtained by the first replacement unit, to obtain a first updated fragment of the tuple sequence of the second order; A second replacement unit is configured to obtain a first updated fragment of the tuple sequence of the first order by executing the secure replacement protocol in conjunction with an inverse replacement of the target replacement by the second party based on the first updated fragment of the tuple sequence of the second order obtained by the propagation unit, so as to obtain a first updated fragment of the tuple sequence of the first order; An aggregation unit is used to jointly perform oblivious message aggregation from edges to nodes with the second party based on the first updated fragment of the first order tuple sequence obtained by the second replacement unit to obtain a second updated fragment of the first order tuple sequence.

19. An iterative two-party privacy graph analysis device, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; The device is arranged at the first party and includes: A first calling unit is used to jointly call a message dispersion programming interface with a second party based on a target message propagation operator adopted by a target application and a tuple fragment of a private graph of the party, wherein the message dispersion programming interface performs a first sorting on a tuple sequence consisting of the tuple fragments of the two parties using a secure sorting protocol or a secure permutation protocol, and then executes oblivious message propagation from a node to an edge corresponding to the target message propagation operator; The second calling unit is used to jointly call the message collection programming interface with the second party based on the target message aggregation operator adopted by the target application and the tuple fragmentation. The message collection programming interface uses the safe sorting protocol or the safe permutation protocol to perform a second sort on the tuple sequence, and then executes the oblivious message aggregation from the edge to the node corresponding to the target message aggregation operator.

20. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 17.

21. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 17 is implemented.

Images