Iterative two-party privacy graph analysis method and apparatus

Abstract

The embodiment of the specification provides a kind of iterative two-party privacy graph analysis method and device, method includes: the first party is based on the current sequence fragment of the tuple sequence of the first order obtained in last round, by and the second party are executed jointly for target permutation safe permutation agreement, obtain the current sequence fragment of the tuple sequence of the second order;Based on the current sequence fragment of the tuple sequence of the second order, and the second party is executed jointly from node to edge casual message propagation, obtain the first update fragment of the tuple sequence of the second order;Based on the first update fragment of the tuple sequence of the second order, by and the second party are executed jointly for target permutation inverse permutation safe permutation agreement, obtain the first update fragment of the tuple sequence of the first order;Based on the first update fragment of the tuple sequence of the first order, and the second party is executed jointly from edge to node casual message aggregation, obtain the second update fragment of the tuple sequence of the first order.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of computer, and particularly relate to an iterative two-party privacy graph analysis method and device. BACKGROUND

[0002] There are many important applications of iterative full graph analysis based on graph data, such as fraud detection, community discovery, etc. When multiple participants with private graph data cooperate to perform analysis, the analysis results are often more accurate and reasonable because the full graph has more complete topology and attribute information. However, direct data sharing is often restricted due to concerns about data leakage or misuse.

[0003] In theory, secure multi-party computation (MPC) technology can allow multiple participants to securely complete the agreed analysis task without directly sharing data. However, general MPC protocols lack specific optimizations for iterative two-party privacy graph analysis tasks.

[0004] For the application scenario of iterative two-party privacy graph analysis, a special solution needs to be designed to efficiently and securely implement graph analysis. SUMMARY

[0005] One or more embodiments of the present specification describe an iterative two-party privacy graph analysis method and device, which can efficiently and securely implement graph analysis.

[0006] In a first aspect, an iterative two-party privacy graph analysis method is provided, the two parties including a first party and a second party, each having their own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the method is performed by the first party and includes multiple rounds of iteration, wherein any non-first round of iteration includes:

[0007] Based on the current sequence slice of the tuple sequence in the first order obtained in the last round, a current sequence slice of the tuple sequence in the second order is obtained by jointly executing a secure permutation protocol with the second party for a target permutation;

[0008] Based on the current sequence slice of the tuple sequence in the second order, a first update slice of the tuple sequence in the second order is obtained by jointly executing an unintentional message propagation from nodes to edges with the second party;

[0009] Based on the first update slice of the tuple sequence in the second order, a first update slice of the tuple sequence in the first order is obtained by jointly executing the secure permutation protocol with the second party for the inverse permutation of the target permutation;

[0010] performing, jointly with the second party, an oblivious message aggregation from edge to node based on a first updated slice of the tuple sequence of the first order, to obtain a second updated slice of the tuple sequence of the second order.

[0011] In a possible implementation, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is an order sorted according to the target node, and the second order is an order sorted according to the source node.

[0012] Further, the tuple further includes an object type identification bit, when the identification bit takes a first value, the source node and the target node are the same node, and the tuple represents an object of the same node; when the identification bit takes a second value, the source node and the target node are different, and the tuple represents an object of an edge from the source node to the target node.

[0013] In a possible implementation, the current sequence slice of the tuple sequence of the second order is obtained by performing, jointly with the second party, a secure permutation protocol with respect to a target permutation, including:

[0014] performing, jointly with the second party, a first invocation of the secure permutation protocol based on a first sequence slice input by a first party, a first permutation, a second sequence slice input by the second party, and a second permutation, to obtain the current sequence slice of the tuple sequence of the second order, wherein the first sequence slice is determined according to a current sequence slice of the tuple sequence of the first order, and a combination of the first permutation and the second permutation is equivalent to the target permutation.

[0015] In a possible implementation, the first updated slice of the tuple sequence of the first order is obtained by performing, jointly with the second party, the secure permutation protocol with respect to an inverse permutation of the target permutation, including:

[0016] performing, jointly with the second party, a second invocation of the secure permutation protocol based on a third sequence slice input by the first party, an inverse permutation of the first permutation, a fourth sequence slice input by the second party, and an inverse permutation of the second permutation, to obtain the first updated slice of the tuple sequence of the first order, wherein the third sequence slice is the first updated slice of the tuple sequence of the second order.

[0017] Further, the current sequence slice of the tuple sequence of the second order is obtained by further including:

[0018] applying an inverse permutation of the permutation to the current sequence slice of the tuple sequence of the first order, to obtain the first sequence slice.

[0019] The first updated slice of the tuple sequence of the first order is obtained by further including:

[0020] applying the target permutation to an execution result of the second invocation, as the first updated slice of the tuple sequence of the first order.

[0021] Further, the first call of the secure permutation protocol is executed, comprising:

[0022] Based on the first permutation input by the first party, the second sequence slice input by the second party, the secure permutation sharing protocol is called to perform the first permutation sharing operation, and the first intermediate slice after the first permutation of the second sequence slice is obtained;

[0023] According to the first permutation, the first sequence slice, and the first intermediate slice, local calculation is performed to obtain the first permutation result after the first permutation of the target data sequence; the first sequence slice and the second sequence slice are two slices constituting the target data sequence;

[0024] Based on the first permutation result input by the first party, the second permutation input by the second party, the secure permutation sharing protocol is called to perform the second permutation sharing operation, and the first party slice of the second permutation result after the second permutation of the first permutation result is obtained as the current sequence slice of the tuple sequence of the second order.

[0025] Further, the first permutation sharing operation is executed, comprising:

[0026] The sum of the elements of each row of the first incautious defective matrix and the sum of the elements of each column are calculated to obtain the row sum sequence and the column sum sequence, and the difference between the row sum sequence and the column sum sequence is calculated to obtain the first difference value sequence; wherein the first incautious defective matrix and the second incautious defective matrix held by the second party are different only in the permutation corresponding positions of the elements of each row, and the elements of the remaining positions are the same;

[0027] The encrypted data sequence and the random sequence are received from the second party; wherein the encrypted data sequence is obtained by the second party by calculating the column sum sequence of the second incautious defective matrix locally and encrypting the second sequence slice using the column sum sequence;

[0028] The encrypted data sequence is locally permuted using the first permutation, and the first difference value sequence and the random sequence are locally calculated to obtain the result slice after the first permutation of the second sequence slice as the first intermediate slice.

[0029] Further, when the first permutation sharing operation is performed for the first time, it further comprises:

[0030] According to the first permutation, the incautious defective matrix generation processing is jointly performed with the second party to obtain the first incautious defective matrix, and the second party obtains the second incautious defective matrix.

[0031] Further, when the first permutation sharing operation is performed for the first time, it further comprises:

[0032] updating each element of the first incautious defective matrix by a deterministic pseudo-random number generator agreed with the second party.

[0033] Further, the second call of the secure permutation protocol comprises:

[0034] based on the inverse permutation of the first permutation input by the first party and the fourth sequence segment input by the second party, calling the secure permutation sharing protocol to perform a third permutation sharing operation to obtain a second intermediate segment after inverse permutation of the first permutation on the fourth sequence segment;

[0035] performing local calculation according to the inverse permutation of the first permutation, the third sequence segment and the second intermediate segment to obtain a third permutation result after inverse permutation of the first permutation on the target data sequence; the third sequence segment and the fourth sequence segment are two segments constituting the target data sequence;

[0036] based on the third permutation result input by the first party and the inverse permutation of the second permutation input by the second party, calling the secure permutation sharing protocol to perform a fourth permutation sharing operation to obtain a first party segment of the fourth permutation result after inverse permutation of the second permutation on the third permutation result as the first update segment of the first ordered tuple sequence.

[0037] Further, the third permutation sharing operation comprises:

[0038] performing local calculation on the sum of elements of each row of the first incautious defective matrix to obtain a row sum sequence, and the sum of elements of each column to obtain a column sum sequence, calculating the difference between the row sum sequence and the column sum sequence to obtain a first difference sequence; wherein the first incautious defective matrix and the second incautious defective matrix held by the second party are different only in the elements at the permutation corresponding positions of each row, and the elements at other positions are the same;

[0039] performing inverse permutation processing on the sequence of the inverse of each element of the first difference sequence to obtain an updated first difference sequence;

[0040] receiving an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by the second party performing local calculation on the row sum sequence of the second incautious defective matrix and encrypting the fourth sequence segment by the row sum sequence;

[0041] performing local permutation processing on the encrypted data sequence by the inverse permutation of the first permutation, and performing local calculation on the first difference sequence and the random sequence to obtain a result segment after inverse permutation of the first permutation on the fourth sequence segment as the second intermediate segment.

[0042] Further, the first round of iteration comprises:

[0043] performing, based on the input sequence of tuples in the first order, an initial sequence slice of the sequence of tuples in the second order by jointly executing a secure ordering protocol with the second party for the first ordering key;

[0044] performing, based on the initial sequence slice of the sequence of tuples in the second order, an oblivious message dissemination from nodes to edges to obtain a third updated slice of the sequence of tuples in the second order;

[0045] performing, based on the third updated slice of the sequence of tuples in the second order, a third updated slice of the sequence of tuples in the first order by jointly executing the secure ordering protocol with the second party for the second ordering key, and generating the target permutation;

[0046] performing, based on the third updated slice of the sequence of tuples in the first order, an oblivious message aggregation from edges to nodes to obtain a fourth updated slice of the sequence of tuples in the first order.

[0047] Further, performing, based on the input sequence of tuples in the first order, an initial sequence slice of the sequence of tuples in the second order by jointly executing a secure ordering protocol with the second party for the first ordering key, comprises:

[0048] performing, based on the input sequence of tuples in the first order, an initial sequence slice of the sequence of tuples in the second order by jointly executing a secure ordering protocol with the second party for the first ordering key, comprises:

[0049] performing, based on the third updated slice of the sequence of tuples in the first order, a third updated slice of the sequence of tuples in the first order by jointly executing the secure ordering protocol with the second party for the second ordering key, and generating the target permutation, comprises:

[0050] performing, based on the third updated slice of the sequence of tuples in the first order, a third updated slice of the sequence of tuples in the first order by jointly executing the secure ordering protocol with the second party for the second ordering key, and generating the target permutation, comprises:

[0051] Further, the first ordering key comprises key values of respective first keys corresponding to respective tuples in the sequence of tuples; the key values of the first keys are determined at least according to numbers of source nodes of the respective tuples; the second ordering key comprises key values of respective second keys corresponding to respective tuples in the sequence of tuples; the key values of the second keys are determined at least according to numbers of target nodes of the respective tuples.

[0052] Further, performing, based on the input sequence of tuples in the first order, an initial sequence slice of the sequence of tuples in the second order by jointly executing a secure ordering protocol with the second party for the first ordering key, comprises:

[0053] According to the first key fragment of the first sorting key, for each bit of the key value included in the first sorting key, a bit iteration process is performed jointly with the second party from the least significant bit, a position change of the current bit is calculated, and the random secret permutation and the first sorting key are permuted according to the calculated position change, and the random secret permutation and the first sorting key are updated according to the processing result;

[0054] Based on the first input sequence fragment input by the first party, the inverse permutation of the first secret permutation, the second input sequence fragment input by the second party, and the inverse permutation of the second secret permutation, a third call of the secure permutation protocol is performed to obtain a result fragment of the first masking result, and the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation;

[0055] The random secret permutation obtained through the bit iteration process is obtained jointly with the second party, and is applied to the result fragment of the first masking result to obtain an initial sequence fragment of the tuple sequence in the second order.

[0056] Further, the permutation processing of the random secret permutation and the first sorting key according to the calculated position change includes:

[0057] According to the sampling permutation of random sampling, the position change, the random secret permutation and the first sorting key are permuted respectively to obtain a local fragment of the masked position change, a local fragment of the masked random secret permutation, and a local fragment of the masked first sorting key.

[0058] The masked position change is determined jointly with the second party.

[0059] Using the masked position change, the local fragment of the masked random secret permutation and the local fragment of the masked first sorting key are permuted respectively to obtain a local fragment of the processing result of the permutation processing of the random secret permutation and the first sorting key using the position change.

[0060] In a second aspect, an iterative two-party private graph analysis method is provided, the two parties including a first party and a second party, each having their own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the method is executed by the first party and includes:

[0061] Based on the target message propagation operator used by the target application and the tuple fragment of the private graph of the first party, a message dispersion programming interface is called jointly with the second party, and the message dispersion programming interface performs the target message propagation operator corresponding to the unintentional message propagation from the node to the edge after the first sorting of the tuple sequence composed of the two-party tuple fragments using the secure sorting protocol or the secure permutation protocol.

[0062] based on the target message aggregation operator employed by the target application and the tuple shards, jointly invoke, with the second party, a message collection programming interface that executes an oblivious message aggregation from edges to nodes corresponding to the target message aggregation operator after a second ordering of the tuple sequence using the secure ordering protocol or the secure permutation protocol.

[0063] In a third aspect, there is provided an iterative two-party private graph analysis apparatus, the two parties comprising a first party and a second party, each having a respective private graph data, nodes and edges in the private graph data being represented in the form of tuples; the apparatus being arranged at the first party for performing a plurality of iterations, including for performing any non-first iteration, the following units:

[0064] a first permutation unit configured to obtain, based on a current sequence shard of a tuple sequence in a first order obtained in a previous iteration, a current sequence shard of a tuple sequence in a second order by jointly executing a secure permutation protocol with the second party for a target permutation;

[0065] a propagation unit configured to obtain, based on the current sequence shard of the tuple sequence in the second order obtained by the first permutation unit, a first updated shard of the tuple sequence in the second order by jointly executing an oblivious message propagation from nodes to edges with the second party;

[0066] a second permutation unit configured to obtain, based on the first updated shard of the tuple sequence in the second order obtained by the propagation unit, a first updated shard of the tuple sequence in the first order by jointly executing the secure permutation protocol with the second party for an inverse permutation of the target permutation;

[0067] an aggregation unit configured to obtain, based on the first updated shard of the tuple sequence in the first order obtained by the second permutation unit, a second updated shard of the tuple sequence in the first order by jointly executing an oblivious message aggregation from edges to nodes with the second party.

[0068] In a fourth aspect, there is provided an iterative two-party private graph analysis apparatus, the two parties comprising a first party and a second party, each having a respective private graph data, nodes and edges in the private graph data being represented in the form of tuples; the apparatus being arranged at the first party and comprising:

[0069] a first invoking unit configured to obtain, based on a target message propagation operator employed by a target application and tuple shards of a private graph of the first party, a message dispersion programming interface that executes an oblivious message propagation from nodes to edges corresponding to the target message propagation operator after a first ordering of a tuple sequence formed by the tuple shards of the two parties using a secure ordering protocol or a secure permutation protocol;

[0070] The second calling unit is configured to jointly call, based on a target message aggregation operator used by the target application and the tuple shard, a message collection programming interface with a second party, and perform, after the message collection programming interface performs second ordering on the tuple sequence by using the secure ordering protocol or the secure permutation protocol, an oblivious message aggregation from an edge to a node corresponding to the target message aggregation operator.

[0071] In a fifth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program. When the computer program is executed in a computer, the computer program causes the computer to execute the method in the first aspect or the second aspect.

[0072] In a sixth aspect, a computing device is provided, and the computing device includes a memory and a processor. The memory stores executable code, and the processor executes the executable code to implement the method in the first aspect or the second aspect.

[0073] In the method and device provided by the embodiments of the present disclosure, in any non-first round iteration, the first party first obtains a current sequence shard of a tuple sequence in a second order by performing a secure permutation protocol with the second party based on a current sequence shard of a tuple sequence in a first order obtained in a previous round; then performs an oblivious message propagation from a node to an edge with the second party based on the current sequence shard of the tuple sequence in the second order to obtain a first updated shard of the tuple sequence in the second order; then obtains a first updated shard of the tuple sequence in the first order by performing the secure permutation protocol with the second party based on the first updated shard of the tuple sequence in the second order; and finally performs an oblivious message aggregation from an edge to a node with the second party based on the first updated shard of the tuple sequence in the first order to obtain a second updated shard of the tuple sequence in the first order. As can be seen from the above, in any non-first round iteration, the tuple sequence needs to be converted between the first order and the second order, and the secure permutation protocol is used to replace the secure ordering protocol to implement the conversion. The secure permutation protocol reuses key intermediate calculation results under the premise of ensuring security, and greatly reduces the calculation and communication overhead, thereby efficiently and securely implementing graph analysis.

[0074] By another method and device provided by the embodiments of the present specification, the first party first jointly calls a message dispersion programming interface with the second party based on a target message propagation operator adopted by a target application and a tuple slice of a private graph of the first party, the message dispersion programming interface performs an oblivious message propagation from a node to an edge corresponding to the target message propagation operator after a tuple sequence composed of tuple slices of the two parties is first ordered by a secure ordering protocol or a secure permutation protocol; and then jointly calls a message collection programming interface with the second party based on a target message aggregation operator adopted by the target application and the tuple slice, the message collection programming interface performs an oblivious message aggregation from an edge to a node corresponding to the target message aggregation operator after the tuple sequence is second ordered by the secure ordering protocol or the secure permutation protocol. As can be seen from the above, the embodiments of the present specification design a programming framework for the scenario of two-party iterative privacy graph analysis, the MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance, and the framework provides a similar programming interface to traditional parallel graph analysis to meet ease of use and facilitate development of graph analysis applications. BRIEF DESCRIPTION OF DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0076] Figure 1 The schematic diagram of the implementation scenario of an embodiment disclosed by the present specification;

[0077] Figure 2 The schematic diagram of the system architecture of an embodiment disclosed by the present specification;

[0078] Figure 3 The schematic diagram of the basic flow of iterative two-party privacy graph analysis of an embodiment disclosed by the present specification;

[0079] Figure 4 The flowchart of the iterative two-party privacy graph analysis method according to an embodiment is shown;

[0080] Figure 5 The schematic diagram of the basic flow of the secure ordering protocol according to an embodiment is shown;

[0081] Figure 6 The schematic diagram of the basic flow of the permutation instead of ordering according to an embodiment is shown;

[0082] Figure 7 The flowchart of the iterative two-party privacy graph analysis method according to another embodiment is shown;

[0083] Figure 8 a schematic block diagram of an iterative two-party private graph analysis apparatus according to an embodiment is shown;

[0084] Figure 9 a schematic block diagram of an iterative two-party private graph analysis apparatus according to another embodiment is shown. DETAILED DESCRIPTION

[0085] The scheme provided in the present specification is described below with reference to the accompanying drawings.

[0086] Figure 1 An implementation scenario of an embodiment disclosed in the present specification is shown. The implementation scenario involves iterative two-party private graph analysis. The two parties include a first party and a second party, each of which has private graph data. The private graph data of the first party and the private graph data of the second party together constitute the graph data of a complete graph. As shown in the figure, Figure 1 the private graph data of the first party includes nodes V0, V1, V2, V6, an edge between nodes V0 and V1, an edge between nodes V0 and V2, and an edge between nodes V0 and V6. The private graph data of the second party includes nodes V0, V3, V4, V5, an edge between nodes V0 and V3, an edge between nodes V0 and V4, and an edge between nodes V0 and V5. The private graph data of the first party and the private graph data of the second party have a common node V0. When the two pieces of private graph data are combined to obtain the graph data of a complete graph, the node V0 in the two pieces of private graph data is combined into one node V0.

[0087] The first party and the second party described above are two participants involved in the iterative two-party private graph analysis. Each participant can be implemented as any device, platform, server, or device cluster that has computing and processing capabilities. The parties jointly implement graph analysis while protecting data privacy.

[0088] Figure 2 A system architecture of an embodiment disclosed in the present specification is shown. The system architecture involves iterative two-party private graph analysis. It can be understood that the graph analysis includes multiple rounds of iteration. In the embodiments of the present specification, the nodes and edges in the private graph data are represented in the form of tuples. This representation supports inadvertent message passing, thereby protecting topology information. As shown in the figure, Figure 2As shown, the iterative two-party privacy graph analysis can correspond to a specific application, by providing a programming framework, so that when programming for a specific application, only the pre-built programming interface needs to be called, providing the convenience of application development. The programming framework provides a programming interface similar to the "collection-application-dispersion" parallel graph computing programming model, namely "inadvertent message dispersion" and "inadvertent message collection". Among them, "message dispersion" means that the nodes on the graph disperse the messages containing local data information to the adjacent edges, and "message collection" means that each node collects messages from the adjacent edges and updates the local data information. "Inadvertent" means that the memory access mode of the operation is independent of the specific input, so the topology structure information of the graph will not be leaked. Through the combination of dispersion and collection, node-to-node message passing can be realized, and then graph analysis applications based on message passing semantics can be built, such as multi-source shortest path (MSSP) algorithm, weakly connected component (WCC) algorithm, page rank (PR) algorithm, etc.

[0089] The two programming interfaces are composed of four basic MPC protocols: secure ordering, secure permutation, inadvertent message propagation and inadvertent message aggregation. Among them, the programming interface "inadvertent message dispersion" is composed of three MPC protocols of secure ordering, secure permutation and inadvertent message propagation, and the programming interface "inadvertent message collection" is composed of three MPC protocols of secure ordering, secure permutation and inadvertent message aggregation. When the programming interface "inadvertent message dispersion" or "inadvertent message collection" is first called, the secure ordering protocol is executed first, and then the inadvertent message propagation or inadvertent message aggregation protocol is executed. When the programming interface "inadvertent message dispersion" or "inadvertent message collection" is called subsequently, the secure permutation protocol is executed first, and then the inadvertent message propagation or inadvertent message aggregation protocol is executed.

[0090] The parallel execution engine based on the backend of the garbled circuit supports the execution of the above four MPC protocols to realize efficient parallel execution.

[0091] The basic workflow of the framework can be as follows:

[0092] Input private augmented graph: At the beginning of the analysis, the two parties participating will input their own private graph data into the framework. The nodes and edges of the graph are represented in the form of a uniform tuple to support inadvertent message passing and protect the topology information.

[0093] Share the graph list using oblivious transfer (OT) extension technology: The two parties use the OT extension primitive to share their graph data, obtain the tuple list of the entire graph, and represent it in the form of a garbled circuit.

[0094] Secure ordering: In the first message-passing step, the list of tuples needs to be securely ordered so that the nodes can perform oblivious propagation and aggregation of data based on the order.

[0095] Oblivious propagation and aggregation: After secure ordering, the oblivious message propagation and oblivious message aggregation operations are performed. Specifically, a linear scan is performed on the list of tuples to exchange data between adjacent tuples, achieving message propagation and aggregation.

[0096] Secure permutation: In subsequent message-passing steps, a secure permutation protocol is used instead of a secure ordering protocol. The secure permutation protocol takes full advantage of the characteristics of iterative graph analysis, and reuses key intermediate calculation results on the premise of ensuring security according to the correlation of permutation operations between multiple rounds of iterations, achieving a substantial reduction in calculation and communication overhead.

[0097] In the embodiments of the present specification, src is a kind of ordering key, and dst is another ordering key. The input data D is represented in random order, and the data sorted by k∈{src, dst} is represented by D k . dst D src =σ(D src ), D src =σ′(D)。

[0098] In the first round of iteration of multiple rounds of iteration: the change of the order of data can be represented as D dst →D src , which has undergone two orderings in turn, wherein the first ordering can be represented as σ′, and the second ordering can be represented as σ. The first round of iteration includes the following processing process: ordering, both parties use their shards of (D, src) to call the secure ordering protocol to obtain the shards of D src . Propagation, perform oblivious message propagation on D src . Ordering, both parties use their shards of (D dst , dst) to call the secure ordering protocol to obtain the shards of D i , a target permutation π and a private permutation π dst , the target permutation can also be referred to as a public permutation. Aggregation, perform oblivious message aggregation on D dst .

[0099] In the non-first round of iteration of multiple rounds of iteration: the change of the order of data can be represented as D src →D dst →D -1 , which has undergone two orderings in turn, wherein the first ordering can be represented as σ dstThe inverse permutation π of the target permutation applied to the piecewise application -1 Then, the secure permutation protocol is invoked, and the i-th party P... i enter( π i ,1), to obtain D src Fragmentation. Propagation, in D src The message propagation occurs unintentionally. A permutation is performed, and both parties invoke a secure permutation protocol, where P... i enter Then, the target permutation π is applied locally on its result slice to obtain D. dst Fragmentation. Aggregation, for D dst The execution of unintentional information gathering.

[0100] Figure 3 This diagram illustrates the basic workflow of iterative two-party privacy graph analysis according to one embodiment disclosed in this specification, demonstrating the basic process of the breadth-first search (BFS) algorithm operating within the aforementioned framework. (Refer to...) Figure 3 In the first iteration, i.e., the first step of message passing, the randomly ordered input list is first arranged in a safe sort order based on the source nodes, and then unintentional message propagation is performed, thus completing the unintentional message distribution. Subsequently, the entire graph's data list is again arranged in a safe sort order based on the target nodes, and then unintentional message aggregation is performed, thus completing the unintentional message collection. In subsequent iterations, i.e., subsequent message passing, the entire graph's data list needs to be transformed between the two orders, and this transformation is accomplished through safe permutation. It should be noted that the entire graph's data list includes all nodes and edges in the graph, where nodes and edges are represented in a unified tuple format. The tuple format includes a source node u and a target node v. For a node, its source node u and target node v are both that node. For an edge, its source node u and target node v are different, and the direction of the edge is from the source node u to the target node v.

[0101] In the embodiments of this specification, when sorting based on source nodes, the sorting can also be based on whether the tuple represents a node or an edge. When source nodes are the same, the node is placed before the edge. Similarly, when sorting based on target nodes, the sorting can also be based on whether the tuple represents a node or an edge. When target nodes are the same, the node is placed after the edge.

[0102] In the embodiments of this specification, some symbols are often used in the examples. The correspondence between the symbols and their meanings is given below, as shown in Table 1.

[0103] Table 1: Correspondence between Symbols and Their Meanings

[0104]

[0105] Figure 4An iterative two-party private graph analysis method according to one embodiment is shown in a flowchart, which can be based on Figure 1 the implementation scenario shown, Figure 2 the system architecture shown, and Figure 3 the basic flow shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the method is executed by the first party. As shown in Figure 4 the embodiment, the iterative two-party private graph analysis method includes multiple rounds of iteration, where any non-first round of iteration includes the following steps: step 41, based on the current sequence slice of the first-order tuple sequence obtained in the last round, obtain the current sequence slice of the second-order tuple sequence by jointly executing a secure permutation protocol with the second party for a target permutation; step 42, based on the current sequence slice of the second-order tuple sequence, jointly execute an unintentional message propagation from nodes to edges with the second party, to obtain a first update slice of the second-order tuple sequence; step 43, based on the first update slice of the second-order tuple sequence, obtain a first update slice of the first-order tuple sequence by jointly executing the secure permutation protocol with the second party for the inverse permutation of the target permutation; and step 44, based on the first update slice of the first-order tuple sequence, jointly execute an unintentional message aggregation from edges to nodes with the second party to obtain a second update slice of the first-order tuple sequence. The specific execution of each of the above steps is described below.

[0106] First, in step 41, based on the current sequence slice of the first-order tuple sequence obtained in the last round, obtain the current sequence slice of the second-order tuple sequence by jointly executing a secure permutation protocol with the second party for a target permutation. It can be understood that the above target permutation can be obtained in the first round of iteration.

[0107] The meaning of permutation is briefly described as follows:

[0108] Permutation: For two sequences, if the sets of elements they each contain are the same, and each element appears the same number of times in the two sequences, then the two sequences are called permutations of each other.

[0109] Permutation: A mapping from a sequence to a permutation of the sequence. That is, when a permutation is applied to a sequence, a permutation of the sequence is obtained. For example, x represents a sequence, x[i] represents the ith element of the sequence; π represents a permutation; π(x) represents a new sequence obtained by applying the permutation π to the sequence x, where the ith element is the π(i)th element in x: π(x)[i] = x[π(i)].

[0110] In one example, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is an order sorted according to the target node, and the second order is an order sorted according to the source node.

[0111] In this example, the nodes have their node numbers, for example, the three nodes have node numbers 0, 1, and 2 respectively, the first order can be an order sorted in ascending order of the node numbers of the target nodes, and the second order can be an order sorted in ascending order of the node numbers of the source nodes.

[0112] Further, the tuple further includes an object type identification bit, when the identification bit takes a first value, the source node and the target node are the same node, and the tuple represents the same node; when the identification bit takes a second value, the source node and the target node are different, and the tuple represents an edge from the source node to the target node.

[0113] In this example, the nodes and edges are both represented in the form of tuples, and an object type identification bit is used to distinguish whether a tuple represents a node or an edge.

[0114] For example, both the nodes and the edges are represented in the form of uniform tuples: (u, v, is_vertex, attr), where u is the source node, v is the target node, is_vertex is the object type identification bit, and attr is the attribute value of the object represented by the tuple. For a tuple (v0, v0, 1, attr), the identification bit is 1, indicating that the tuple represents the node v0; for a tuple (v0, v1, 0, attr), the identification bit is 0, indicating that the tuple represents the edge v0→v1, the source node of the edge is v0, and the target node of the edge is v1.

[0115] In one example, the current sequence slice of the tuple sequence in the second order is obtained by jointly performing a secure permutation protocol with respect to the target permutation with a second party, including:

[0116] Based on the first sequence slice input by the first party, the first permutation, the second sequence slice input by the second party corresponding to the second permutation, the secure permutation protocol is executed for the first call to obtain the current sequence slice of the tuple sequence in the second order; wherein the first sequence slice is determined according to the current sequence slice of the tuple sequence in the first order, and the combination of the first permutation and the second permutation is equivalent to the target permutation.

[0117] In this example, the function implemented by the secure permutation protocol is that each party inputs a permutation and a ciphertext of data, and outputs a ciphertext of data after two permutations. For example, for the secure permutation protocol, let π i represent the input from the i-th party P i , where, is a sequence slice, π i is a private permutation.

[0118] Further, obtaining the current sequence slice of the second order tuple sequence, further comprises:

[0119] applying an inverse permutation of the target permutation to the current sequence slice of the first order tuple sequence, to obtain the first sequence slice.

[0120] In this example, instead of directly taking the current sequence slice of the first order tuple sequence as the input of the secure permutation protocol, an inverse permutation of the target permutation is applied to the current sequence slice to obtain the first sequence slice, and the first sequence slice is taken as the input of the secure permutation protocol. For example, the target permutation is denoted as π, and the two parties locally apply π dst to the slice from the i-th party P -1 , and then call the secure permutation protocol, denoted as π i , which represents the input from the i-th party P i , where, is a sequence slice, π i is a private permutation.

[0121] Further, the first call execution of the secure permutation protocol comprises:

[0122] based on the first permutation of the input of the local party, the second sequence slice of the input of the second party, calling the secure permutation sharing protocol to perform a first permutation sharing operation to obtain a first intermediate slice after the first permutation is performed on the second sequence slice;

[0123] performing local calculation according to the first permutation, the first sequence slice, and the first intermediate slice to obtain a first permutation result after the first permutation is performed on the target data sequence; the first sequence slice and the second sequence slice are two slices constituting the target data sequence;

[0124] based on the first permutation result of the input of the local party, the second permutation of the input of the second party, calling the secure permutation sharing protocol to perform a second permutation sharing operation to obtain a local slice of the second permutation result after the second permutation is performed on the first permutation result as the current sequence slice of the second order tuple sequence.

[0125] In this example, the first call execution of the secure permutation protocol is achieved by calling the secure permutation sharing protocol twice, and the function implemented by the secure permutation sharing protocol is that one party inputs a permutation and the other party inputs data, and outputs the ciphertext of the data after the permutation.

[0126] The specific flow of the secure permutation protocol is shown below. The flow includes: first, each party inputs a permutation and data ciphertext; then the two parties jointly call the secure permutation-sharing protocol, one party as the permutation party inputs the permutation, and the other party as the data party inputs the data ciphertext, and outputs the ciphertext of the permuted data; then the permutation party in the previous step performs corresponding calculation according to the data ciphertext and the output of the secure permutation-sharing protocol to obtain an intermediate calculation result; then the two parties jointly call the secure permutation-sharing protocol, the permutation party in the previous step now inputs the aforementioned intermediate calculation result as the data party, and the data party in the previous step now inputs the permutation as the permutation party, and outputs the ciphertext of the permuted data; then the permutation party performs corresponding calculation according to the outputs of the two secure permutation-sharing protocols; finally, each party outputs the obtained result.

[0127] For example, the secure permutation protocol is represented as The secure permutation function Π can be implemented permute . Let represent the input from P i , where π i is a private permutation, and b is a control bit that determines the control flow and output. The processing flow includes:

[0128] Both parties call the secure permutation-sharing protocol with input to obtain the shards of , which is represented as held by P i .

[0129] P b calculates

[0130] Both parties call the secure permutation-sharing protocol with input to obtain the shards of , which is represented as held by P i .

[0131] P 1-b calculates

[0132] P b outputs P 1-b outputs

[0133] As can be seen from the above, the function of the secure permutation protocol can be implemented by calling the secure permutation-sharing protocol twice.

[0134] Further, the first permutation sharing operation includes:

[0135] The local computer calculates a row sum sequence composed of sums of elements in each row of the first inadvertent defective matrix and a column sum sequence composed of sums of elements in each column, calculates a first difference sequence by calculating the difference between the row sum sequence and the column sum sequence; wherein the first inadvertent defective matrix and a second inadvertent defective matrix held by the second party are different only in elements at corresponding positions of permutation of each row, and the elements at other positions are the same;

[0136] Receiving an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by the second party calculating a column sum sequence of the second inadvertent defective matrix locally and encrypting the second sequence fragment using the column sum sequence;

[0137] Performing local permutation processing on the encrypted data sequence using a first permutation, and performing local calculation on the first difference sequence and the random sequence to obtain a result fragment of the second sequence fragment after the first permutation, as the first intermediate fragment.

[0138] In this example, the first permutation sharing operation is performed by invoking a secure permutation sharing protocol. The inadvertent defective matrix is a kind of encoding of permutation, which can assist in subsequent permutation of data, while not leaking information about the permutation itself to the data party. Specifically, the inadvertent defective matrix involves a pair of matrices, which are held by the permutation party and the data party respectively.

[0139] Further, when the first permutation sharing operation is performed for the first time, it further includes:

[0140] According to the first permutation, the second party jointly performs an inadvertent defective matrix generation process to obtain the first inadvertent defective matrix, and the second party obtains a second inadvertent defective matrix.

[0141] In this example, when the first permutation sharing operation is performed for the first time, an inadvertent defective matrix generation protocol can be invoked to generate the inadvertent defective matrix, and the invocation does not depend on the data of the data party.

[0142] Further, when the first permutation sharing operation is performed for the first time, it further includes:

[0143] Updating each element of the first inadvertent defective matrix using a deterministic pseudo-random number generator agreed with the second party.

[0144] In this example, when the first permutation sharing operation is performed for the first time, the inadvertent defective matrix generation protocol is no longer invoked, but the way of updating each element of the inadvertent defective matrix is adopted to improve security, so that the invocation overhead is greatly reduced.

[0145] The specific flow of the secure permutation sharing protocol is shown below. The flow includes: first, the permutation party inputs a permutation, and the data party inputs a plurality of data lists to be permuted; then the two parties jointly call the oblivious partial matrix (OPM) generation protocol, input the permutation, and output the corresponding oblivious partial matrix; then for each data list to be permuted, the following is sequentially executed: the permutation party calculates the difference between the row sum and the column sum of the oblivious partial matrix according to a specific manner, and the data party calculates the row sum and the column sum of the oblivious partial matrix; if the inverse permutation input by the permutation party is needed, the calculation results are transformed accordingly; the data party encrypts the data using the calculation results and sends them to the permutation party; the permutation party further calculates according to the calculation results and the received message, and outputs the permutation result; finally, the two parties update each element of the oblivious partial matrix using a predetermined deterministic pseudo-random number generator.

[0146] For example, the secure permutation sharing protocol is represented as The secure permutation sharing function Π can be implemented perm_share . Let π be a permutation of size n input by P b , and x (1) ...x (K) be K vectors to be permuted and shared by P 1-b . Both parties agree on a deterministic pseudo-random generator G: G→G and a bit vector rev∈{0,1} K . The processing flow includes:

[0147] Both parties input <π,⊥> and call to obtain P b sets P 1-b sets M (1) =M.

[0148] For k∈[K]:

[0149] a) P b calculates Δ (k) as:

[0150]

[0151] P 1-b sets a (k) as the column sum of M (k) , and sets b (k) as the row sum of M (k) :

[0152]

[0153] b) If rev[k]=1, P b performs Δ (k) =π-1 (-Δ (k) ), P 1-b executes (a (k) , b (k) ) = (b (k) , a (k) ).

[0154] c) P 1-b sends x (k) +a (k) and randomly sampled to P b .

[0155] d) P b outputs

[0156] P 1-b outputs w (k) -b (k) .

[0157] e) If k < K, P b and P 1-b respectively compute and M (k+1) as:

[0158] As can be seen from the above, through the encoding of the oblivious defective matrix on the permutation, the subsequent auxiliary is completed on the data permutation, so that the secure permutation sharing function is realized.

[0159] The embodiments of the present specification, the secure permutation protocol can also include any of the following optimizations:

[0160] Complexity optimization. Using permutation decomposition technology, the permutation whose size is proportional to the data scale is decomposed into several smaller permutations, realizing more optimal calculation and communication complexity. When the permutation is decomposed into a constant size, the calculation and communication complexity are relatively balanced. If communication becomes a serious bottleneck in practice, a slightly larger permutation size can be selected to slightly improve the calculation amount while realizing linear communication amount.

[0161] Calculation overlap. Two calls of the secure permutation sharing protocol will cause the oblivious defective matrix generation protocol to also be called twice. The process of each time is that one party first calculates, the other party waits, the two parties communicate, the other party calculates again, and the other party waits. Since the identities of the two calculation participants are different in the two calls, the above identities are specifically the permutation party or the data party, and the calculations of the two calls are independent of each other, the calculation processes in the two calls can be overlapped, so that the two parties calculate at the same time, avoiding the idle waiting state.

[0162] Communication optimization. When the input data is in the garbled circuit representation, the data is first converted to the Boolean secret sharing representation using the type conversion protocol, and then converted back to the garbled circuit representation after the secure permutation protocol is executed, to reduce the amount of communication.

[0163] Then in step 42, based on the current sequence slice of the tuple sequence of the second order, the joint execution of the node-to-edge careless message propagation is performed with the second party to obtain the first update slice of the tuple sequence of the second order. It can be understood that the second order can be an order sorted in ascending order according to the node number of the source node.

[0164] In the embodiments of the present specification, when sorted according to the source node, the sorting can also be combined with whether the tuple represents a node or an edge, and when the source nodes are the same, the node is arranged before the edge. According to the aforementioned second order, the linear scanning of the tuple list is performed to exchange the data between adjacent tuples to realize the message propagation.

[0165] Then in step 43, based on the first update slice of the tuple sequence of the second order, the first update slice of the tuple sequence of the first order is obtained by executing the secure permutation protocol with the second party for the inverse permutation of the target permutation. It can be understood that the two permutations are inverse permutations of each other, and when the two permutations are applied to a sequence in sequence, the sequence remains unchanged. That is, the combination of the two permutations which are inverse permutations of each other is a unit permutation.

[0166] In one example, the first update slice of the tuple sequence of the first order is obtained by executing the secure permutation protocol with the second party for the inverse permutation of the target permutation, including:

[0167] Based on the third sequence slice input by the first party, the inverse permutation of the first permutation, the fourth sequence slice input by the second party corresponding to the input, and the inverse permutation of the second permutation, the second call execution of the secure permutation protocol is performed to obtain the first update slice of the tuple sequence of the first order, and the third sequence slice is the first update slice of the tuple sequence of the second order.

[0168] In this example, the function of the secure permutation protocol is the same as the previous introduction, but the input and output are different in the specific calling process.

[0169] Further, the first update slice of the tuple sequence of the first order is obtained, including:

[0170] The execution result of the second call execution is subjected to the target permutation as the first update slice of the tuple sequence of the first order.

[0171] In this example, instead of directly taking the execution result of the second call execution as the first update slice of the first-order tuple sequence, the target permutation is imposed on the execution result of the second call execution to obtain the first update slice.

[0172] Further, the second call execution of the secure permutation protocol comprises:

[0173] Based on the inverse permutation of the first permutation input by the first party, the fourth sequence slice input by the second party, the secure permutation sharing protocol is called to perform a third permutation sharing operation to obtain a second intermediate slice after the inverse permutation of the first permutation is performed on the fourth sequence slice;

[0174] According to the inverse permutation of the first permutation, the third sequence slice, and the second intermediate slice, a local calculation is performed to obtain a third permutation result after the inverse permutation of the first permutation is performed on the target data sequence; the third sequence slice and the fourth sequence slice are two slices constituting the target data sequence;

[0175] Based on the third permutation result input by the first party and the inverse permutation of the second permutation input by the second party, the secure permutation sharing protocol is called to perform a fourth permutation sharing operation to obtain the first party's slice of the fourth permutation result after the inverse permutation of the second permutation is performed on the third permutation result as the first update slice of the first-order tuple sequence.

[0176] In this example, the second call execution of the secure permutation protocol is implemented by calling the secure permutation sharing protocol twice. The secure permutation sharing protocol realizes the function of inputting a permutation by one party and inputting data by the other party, and outputting the ciphertext of the data after permutation.

[0177] Further, the third permutation sharing operation comprises:

[0178] The sum of the elements of each row of the first incautious defective matrix and the sum of the elements of each column are calculated to obtain a row sum sequence and a column sum sequence, and the difference between the row sum sequence and the column sum sequence is calculated to obtain a first difference sequence; wherein the first incautious defective matrix and the second incautious defective matrix held by the second party are different only in the elements at the corresponding positions of each row, and the elements at other positions are the same;

[0179] The inverse permutation processing is performed on the sequence of the inverse numbers of each element of the first difference sequence to obtain an updated first difference sequence;

[0180] The encrypted data sequence and the random sequence are received from the second party; wherein the encrypted data sequence is obtained by the second party by calculating the row sum sequence of the second incautious defective matrix locally and encrypting the fourth sequence slice using the row sum sequence;

[0181] The encrypted data sequence is locally permuted by inverse permutation of the first permutation, and locally calculated with the first difference sequence and the random sequence, to obtain a result fragment after inverse permutation of the first permutation on the fourth sequence fragment, as the second intermediate fragment.

[0182] In this example, the third permutation sharing operation is performed by invoking the secure permutation sharing protocol. The careless defective matrix is a kind of encoding of the permutation, which can assist in subsequent permutation of data, while not leaking information about the permutation itself to the data party. Specifically, the careless defective matrix involves a pair of matrices, respectively held by the permutation party and the data party.

[0183] Finally, in step 44, based on the first updated fragment of the tuple sequence of the first order, the careless message aggregation from edge to node is jointly performed with the second party to obtain the second updated fragment of the tuple sequence of the first order. It can be understood that the first order can be an order sorted in ascending order according to the node number of the target node.

[0184] In the embodiment of the present specification, when sorting according to the target node, the sorting can also be combined with whether the tuple represents a node or an edge, and when the target nodes are the same, the node is arranged after the edge. According to the first order described above, the tuple list is linearly scanned to exchange data between adjacent tuples to realize message aggregation.

[0185] In one example, the first round of iteration includes:

[0186] Based on the input sequence fragment of the tuple sequence of the random order, the initial sequence fragment of the tuple sequence of the second order is obtained by jointly executing the secure sorting protocol with the second party for the first sorting key;

[0187] Based on the initial sequence fragment of the tuple sequence of the second order, careless message propagation from node to edge is performed to obtain the third updated fragment of the tuple sequence of the second order;

[0188] Based on the third updated fragment of the tuple sequence of the second order, the third updated fragment of the tuple sequence of the first order is obtained by jointly executing the secure sorting protocol with the second party for the second sorting key, and the target permutation is generated;

[0189] Based on the third updated fragment of the tuple sequence of the first order, careless message aggregation from edge to node is performed to obtain the fourth updated fragment of the tuple sequence of the first order.

[0190] In this example, in the first round of iteration, the tuple sequence needs to be sorted into the first order, and sorted into the second order, the above-mentioned sorting is implemented using a secure sorting protocol, and when converted from the first order to the second order, a target permutation is generated, so that in subsequent non-first round of iteration, a secure permutation protocol is used instead of the secure sorting protocol to implement the above-mentioned conversion from the first order to the second order or vice versa.

[0191] Further, by jointly executing the secure sorting protocol with the second party for the first sorting key, an initial sequence slice of the tuple sequence in the second order is obtained, including:

[0192] Based on the first input sequence slice input by the first party, the first key slice of the first sorting key, the second input sequence slice input by the second party corresponding to the second party, and the second key slice of the first sorting key, the first call execution of the secure sorting protocol is performed to obtain the initial sequence slice of the tuple sequence in the second order;

[0193] By jointly executing the secure sorting protocol with the second party for the second sorting key, a third updated slice of the tuple sequence in the first order is obtained, and the target permutation is generated, including:

[0194] Based on the third updated slice input by the first party, the first key slice of the second sorting key, the third updated slice input by the second party corresponding to the second party, and the second key slice of the second sorting key, the second call execution of the secure sorting protocol is performed to obtain the third updated slice of the tuple sequence in the first order, and the target permutation is generated.

[0195] In this example, the function implemented by the secure sorting protocol is that each party inputs the ciphertext of data and sorting key, and outputs the ciphertext of data sorted according to the key. For example, for the secure sorting protocol, let denote the input from the i-th party Pi, i , where is a data slice, is a slice of the sorting key.

[0196] Further, the first sorting key includes key values of each first key corresponding to each tuple in the tuple sequence; the key values of the first key are determined at least according to the number of the source node of the corresponding tuple; the second sorting key includes key values of each second key corresponding to each tuple in the tuple sequence; the key values of the second key are determined at least according to the number of the target node of the corresponding tuple.

[0197] In this example, the sorting key is used as the basis for sorting the tuple sequence, and when sorting according to the target node, each key value of the sorting key is determined at least according to the number of the target node, for example, according to (υ, is_υertex) sThe sorting is performed, wherein v is a target node, and is_vertex is an object type identification bit.

[0198] Further, the first call of the secure sorting protocol is executed, including:

[0199] According to the first key fragment of the first sorting key, for each bit of the key value included in the first sorting key, starting from the least significant bit, a bit iteration process is performed jointly with the second party: calculating the position exchange of the current bit of the sorting, and performing permutation processing on the random secret permutation and the first sorting key according to the calculated position exchange, and updating the random secret permutation and the first sorting key according to the processing result;

[0200] Based on the first input sequence fragment input by the first party, the inverse permutation of the first secret permutation, the second input sequence fragment input by the second party corresponding to the second party, and the inverse permutation of the second secret permutation, the third call of the secure permutation protocol is executed to obtain the result fragment of the first masking result, and the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation;

[0201] The random secret permutation obtained through the bit iteration process is obtained jointly with the second party, and is applied to the result fragment of the first masking result to obtain the initial sequence fragment of the tuple sequence in the second order.

[0202] In this example, through the bit iteration process, the random secret permutation and the first sorting key are updated, and then the first call of the secure sorting protocol is implemented by calling the secure permutation protocol.

[0203] Further, the permutation processing on the random secret permutation and the first sorting key according to the calculated position exchange includes:

[0204] According to the sampling permutation of random sampling, the position exchange, the random secret permutation and the first sorting key are respectively permuted to obtain the local fragment of the masked position exchange, the local fragment of the masked random secret permutation, and the local fragment of the masked first sorting key.

[0205] The masked position exchange is determined jointly with the second party.

[0206] Using the masked position exchange, the local fragment of the masked random secret permutation and the local fragment of the masked first sorting key are respectively permuted to obtain the local fragment of the processing result of the permutation processing on the random secret permutation and the first sorting key using the position exchange.

[0207] In this example, the above-mentioned masked position exchange is obtained by masking the position exchange, so that the disclosure of the plaintext does not leak the position exchange, facilitating subsequent calculation.

[0208] The specific flow of the secure sorting protocol is shown below. The flow includes: first, each party inputs the data and the ciphertext of the sorting key in the form of a garbled circuit; then the two parties jointly call the random secret permutation preparation protocol to generate a random secret permutation; then the two parties jointly call the type conversion protocol to convert the sorting key into a Boolean secret sharing representation; then for each bit of the sorting key, starting from the least significant bit, the following processing is performed respectively: convert the bit to an arithmetic secret sharing representation, calculate the permutation of the sorting bit, and generate a random secret permutation based on the calculated permutation and the entire sorting key, wherein in order to not reveal the sorting process, the content to be sorted needs to be randomly shuffled in advance using the secure permutation protocol; then the two parties jointly call the type conversion protocol to convert the data ciphertext into a Boolean secret sharing representation; then the two parties jointly call the secure permutation protocol to apply the inverse permutation of the generated random secret permutation to the data ciphertext; the foregoing sorted random secret permutation is disclosed and applied to the data ciphertext; the two parties jointly call the type conversion protocol to convert the data ciphertext into a garbled circuit representation; finally, each party outputs the final calculation result.

[0209] For example, the secure sorting protocol is represented as The secure sorting function Π sort can be implemented i The input data and the sorting key in the form of a garbled circuit are represented as The superscript S∈{Y, B, A} represents the type of sharing. The processing flow includes:

[0210] Call P i Obtain

[0211] Call Based on the input Obtain

[0212] For s∈[|K|], where |K| is the bit length of each key:

[0213] a) Extract the s-th least significant bit of each key and call to obtain

[0214] b) Call Based on the input Obtain

[0215] c) Call Based on P i Input wherein is randomly sampled to obtain wherein

[0216] d) reveal its plaintext. Then apply permutation and to get and and

[0217] e) update and to and

[0218] call based on input get

[0219] call based on P i input get

[0220] reveal then apply permutation get

[0221] call based on input get

[0222] P i output

[0223] As can be seen from the above, the secure ordering function is realized by the call of the secure permutation protocol, etc. Among them, is a protocol for preparing a random secret permutation; is a type conversion protocol; is used to generate a permutation, input output σ(k) is arranged in order; is a secure permutation protocol; is a type conversion protocol.

[0224] Figure 5 shows a basic flowchart of a secure ordering protocol according to an embodiment. Referring to Figure 5 , the outer frame line includes the main loop body of the protocol, that is, the ordering permutation σ is generated according to the ordering key K, and finally acts on the initial generated random secret permutation, that is, For the calculation of the data ciphertext D, the secure permutation protocol ​and one public permutation, the sorting of the ciphertext data is completed. Among them, for the type conversion from a Boolean secret sharing to an arithmetic secret sharing, the actual word length of the input data is 1, which makes the general type conversion protocol be able to be appropriately pruned to improve the efficiency.

[0225] Figure 6 The basic flowchart of replacing the permutation with the sorting according to one embodiment is shown. Referring to Figure 6 , the way of replacing the secure sorting protocol with the secure permutation protocol in the multi-round iteration analysis is shown. First, a random secret permutation π r is generated and is involved in the first round of secure sorting, and another permutation is output and is made public, and the public permutation When the sorting process needs to be repeated subsequently, the inverse permutation of the random secret permutation is first applied through the secure permutation protocol and then the public permutation is applied Similarly, when the inverse process of the sorting process needs to be repeated subsequently, the inverse permutation of the public permutation is first applied, and then the random secret permutation is applied through the secure permutation protocol.

[0226] By the method provided in the embodiments of the present specification, in any non-first round iteration, the first party first obtains the current sequence slice of the tuple sequence of the second order based on the current sequence slice of the tuple sequence of the first order obtained in the last round, through joint execution of the secure permutation protocol with the second party with respect to the target permutation; then, based on the current sequence slice of the tuple sequence of the second order, joint execution of the node-to-edge casual message propagation is performed with the second party to obtain the first update slice of the tuple sequence of the second order; then, based on the first update slice of the tuple sequence of the second order, the first update slice of the tuple sequence of the first order is obtained by joint execution of the secure permutation protocol with the second party with respect to the inverse permutation of the target permutation; finally, based on the first update slice of the tuple sequence of the first order, joint execution of the edge-to-node casual message aggregation is performed with the second party to obtain the second update slice of the tuple sequence of the first order. As can be seen from the above, in any non-first round iteration, the tuple sequence needs to be converted between the first order and the second order, and the secure permutation protocol is used to replace the secure sorting protocol to realize the above conversion. The secure permutation protocol, under the premise of ensuring security, reuses the key intermediate calculation results, realizes a substantial reduction in the calculation and communication overhead, and thus can efficiently and securely realize the graph analysis.

[0227] Further, the embodiments of the present specification also provide a two-party secure permutation protocol for scenario optimization, which is used to replace the secure sorting after the first round of iteration, so as to eliminate redundant sorting and significantly improve performance. The design of the protocol fully utilizes the characteristics of iterative graph analysis, and according to the correlation of permutation operations between multiple rounds of iteration, the key intermediate calculation results are reused under the premise of ensuring security, so that the calculation and communication overhead is greatly reduced.

[0228] The embodiments of the present specification also provide a two-party secure sorting protocol for scenario optimization, which is used to efficiently sort data in the first round of iteration and is replaced by the subsequent secure permutation protocol. The design of the protocol fully utilizes the characteristics of short sorting key length in iterative graph analysis, and is designed based on radix sorting and secure permutation protocol. Compared with the commonly used sorting protocol, the sorting protocol has better calculation and communication complexity. In actual scenarios, although the complexity is slightly improved compared with the non-trivial radix sorting, the constant factor is smaller, and the actual performance is better.

[0229] Figure 7 An iterative two-party privacy graph analysis method flowchart according to another embodiment is shown, which can be based on Figure 1 the implementation scenario shown, Figure 2 the system architecture shown, the two parties include a first party and a second party, each of which has its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; the method is executed by the first party. As Figure 7 shown, the iterative two-party privacy graph analysis method in this embodiment includes the following steps: step 71, based on the target message propagation operator adopted by the target application and the tuple slice of the private graph of the party, jointly calling a message dispersion programming interface with the second party, the message dispersion programming interface performs the non-trivial message propagation from the node to the edge corresponding to the target message propagation operator after the first sorting of the tuple sequence composed of the tuple slices of the two parties by using the secure sorting protocol or the secure permutation protocol; step 72, based on the target message aggregation operator adopted by the target application and the tuple slice, jointly calling a message collection programming interface with the second party, the message collection programming interface performs the non-trivial message aggregation from the edge to the node corresponding to the target message aggregation operator after the second sorting of the tuple sequence by using the secure sorting protocol or the secure permutation protocol.

[0230] Among them, the above-mentioned target message propagation operator and target message aggregation operator can be user-defined operators, so that various target applications can be flexibly implemented.

[0231] In addition, the implementation of the message dispersion programming interface can include the foregoing steps 41 and 42, and the implementation of the message collection programming interface can include the foregoing steps 43 and 44, which are adapted to the processing flow shown in Figure 4 .

[0232] By the method provided by the embodiments of the present specification, the first party first jointly calls a message dispersion programming interface with the second party based on a target message propagation operator adopted by a target application and a tuple slice of a private graph of the first party, the message dispersion programming interface performs an oblivious message propagation from a node to an edge corresponding to the target message propagation operator after first ordering a tuple sequence composed of the tuple slices of the two parties by a secure ordering protocol or a secure permutation protocol; and then jointly calls a message collection programming interface with the second party based on a target message aggregation operator adopted by the target application and the tuple slice, the message collection programming interface performs an oblivious message aggregation from an edge to a node corresponding to the target message aggregation operator after second ordering the tuple sequence by the secure ordering protocol or the secure permutation protocol. As can be seen from the above, the embodiments of the present specification design a programming framework for the scenario of two-party iterative privacy graph analysis, the MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance, and the framework provides a programming interface similar to traditional parallel graph analysis to meet ease of use, facilitating the development of graph analysis applications.

[0233] According to another aspect, embodiments also provide an iterative two-party privacy graph analysis apparatus for performing the method provided by the embodiments of the present specification. Figure 4 As shown in the method, the two parties include a first party and a second party, each having respective private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; the apparatus is arranged at the first party and is used to perform multiple rounds of iteration. Figure 8 A schematic block diagram of an iterative two-party privacy graph analysis apparatus according to an embodiment is shown. As shown in the apparatus 800, the apparatus includes the following units for performing any non-first round of iteration: Figure 8

[0234] A first permutation unit 81 is configured to obtain a current sequence slice of a tuple sequence in a second order by jointly executing a secure permutation protocol with the second party for a target permutation based on a current sequence slice of a tuple sequence in a first order obtained in the last round;

[0235] A propagation unit 82 is configured to jointly execute an oblivious message propagation from a node to an edge with the second party based on the current sequence slice of the tuple sequence in the second order obtained by the first permutation unit 81 to obtain a first updated slice of the tuple sequence in the second order;

[0236] A second permutation unit 83 is configured to obtain a first updated slice of the tuple sequence in the first order by jointly executing the secure permutation protocol with the second party for an inverse permutation of the target permutation based on the first updated slice of the tuple sequence in the second order obtained by the propagation unit 82;

[0237] ​An aggregating unit 84 is configured to jointly perform, with the second party, edge-to-node oblivious message aggregation based on the first updated shard of the tuple sequence in the first order obtained by the second permutation unit 83, to obtain a second updated shard of the tuple sequence in the first order.

[0238] Optionally, as an embodiment, the tuple includes a source node, a target node, and an attribute value of an object represented by the tuple; the first order is an order sorted according to the target node, and the second order is an order sorted according to the source node.

[0239] Further, the tuple further includes an object type identification bit, when the identification bit takes a first value, the source node and the target node are the same node, and the tuple represents an object of the same node; when the identification bit takes a second value, the source node and the target node are different, and the tuple represents an object of an edge from the source node to the target node.

[0240] Optionally, as an embodiment, the first permutation unit 81 is specifically configured to perform, based on a first sequence shard input by a local party, a first permutation, a second sequence shard input by a second party, and a second permutation, a first call of the secure permutation protocol to obtain a current sequence shard of the tuple sequence in the second order; wherein the first sequence shard is determined according to a current sequence shard of the tuple sequence in the first order, and a combination of the first permutation and the second permutation is equivalent to the target permutation.

[0241] The second permutation unit 83 is specifically configured to perform, based on a third sequence shard input by the local party, an inverse permutation of the first permutation, a fourth sequence shard input by the second party, and an inverse permutation of the second permutation, a second call of the secure permutation protocol to obtain a first updated shard of the tuple sequence in the first order, the third sequence shard being the first updated shard of the tuple sequence in the second order.

[0242] Further, the first permutation unit 81 is further configured to apply an inverse permutation of the target permutation to the current sequence shard of the tuple sequence in the first order to obtain the first sequence shard.

[0243] The second permutation unit 83 is further configured to apply the target permutation to an execution result of the second call to obtain the first updated shard of the tuple sequence in the first order.

[0244] Further, the first permutation unit 81 includes:

[0245] A first permutation sharing subunit is configured to perform, based on the first permutation input by the local party and the second sequence shard input by the second party, a first permutation sharing operation by calling a secure permutation sharing protocol to obtain a first intermediate shard after the second sequence shard is first permuted.

[0246] a local computing subunit configured to perform local computation according to the first permutation, the first sequence fragment, and a first intermediate fragment obtained by the first permutation sharing subunit, to obtain a first permutation result of the target data sequence after the first permutation;

[0247] a second permutation sharing subunit configured to, based on the first permutation result obtained by the local computing subunit input by the local party, the second permutation input by the second party, invoke the secure permutation sharing protocol, perform a second permutation sharing operation, and obtain a local fragment of a second permutation result of the first permutation result after the second permutation as a current sequence fragment of the tuple sequence of the second order.

[0248] Further, the first permutation sharing subunit comprises:

[0249] a local computing module configured to locally compute a row sum sequence composed of sums of elements of each row of a first incautious defective matrix and a column sum sequence composed of sums of elements of each column, and compute a first difference sequence by computing a difference between the row sum sequence and the column sum sequence; wherein the first incautious defective matrix and a second incautious defective matrix held by the second party are different only in elements at corresponding positions of permutation of each row, and the same in elements at other positions.

[0250] a receiving module configured to receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by the second party locally computing a column sum sequence of the second incautious defective matrix and encrypting the second sequence fragment using the column sum sequence.

[0251] a local permutation module configured to perform local permutation processing on the encrypted data sequence received by the receiving module using the first permutation, and perform local computation on the first difference sequence obtained by the local computing module and the random sequence received by the receiving module, to obtain a result fragment of the second sequence fragment after the first permutation as the first intermediate fragment.

[0252] Further, the first permutation sharing subunit further comprises:

[0253] a generating module configured to, when performing the first permutation sharing operation for the first time, perform incautious defective matrix generation processing jointly with the second party according to the first permutation, to obtain the first incautious defective matrix, and obtain the second incautious defective matrix by the second party.

[0254] Further, the first permutation sharing subunit further comprises:

[0255] An updating module is configured to update each element of the first incautious defective matrix by using the deterministic pseudo-random number generator agreed with the second party when performing the first permutation sharing operation for the first time.

[0256] Further, the second permutation sharing subunit comprises:

[0257] A third permutation sharing subunit is configured to perform a third permutation sharing operation on the fourth sequence fragment input by the second party based on the inverse permutation of the first permutation input by the local party, to obtain a second intermediate fragment after inverse permutation of the first permutation on the fourth sequence fragment;

[0258] A local calculation subunit is configured to perform local calculation on the third sequence fragment, the second intermediate fragment and the inverse permutation of the first permutation, to obtain a third permutation result after inverse permutation of the first permutation on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments constituting the target data sequence.

[0259] A fourth permutation sharing subunit is configured to perform a fourth permutation sharing operation on the third permutation result input by the local party based on the inverse permutation of the second permutation input by the second party, to obtain a local fragment of the fourth permutation result after inverse permutation of the second permutation on the third permutation result as the first updated fragment of the first ordered tuple sequence.

[0260] Further, the third permutation sharing subunit comprises:

[0261] A local calculation module is configured to locally calculate a row sum sequence composed of sums of elements in each row of the first incautious defective matrix and a column sum sequence composed of sums of elements in each column, to calculate a first difference sequence by calculating a difference between the row sum sequence and the column sum sequence; wherein the first incautious defective matrix and a second incautious defective matrix held by the second party are different only in elements at corresponding positions of permutation of each row.

[0262] An inverse permutation processing module is configured to perform inverse permutation processing on a sequence composed of inverses of each element of the first difference sequence, to obtain an updated first difference sequence.

[0263] A receiving module is configured to receive an encrypted data sequence and a random sequence from the second party; wherein the encrypted data sequence is obtained by encrypting the fourth sequence fragment by the row sum sequence calculated locally by the second party.

[0264] The local permutation module is configured to perform local permutation processing on the encrypted data sequence by using inverse permutation of the first permutation, and perform local calculation on the first difference sequence and the random sequence to obtain a result slice after inverse permutation of the first permutation on the fourth sequence slice as the second intermediate slice.

[0265] Further, the apparatus further comprises the following units for performing the first iteration:

[0266] The first sorting unit is configured to perform secure sorting protocol with the second party for the first sorting key based on the input sequence slice of the tuple sequence of the random order to obtain an initial sequence slice of the tuple sequence of the second order.

[0267] The propagation unit 82 is further configured to perform the inadvertent message propagation from the node to the edge based on the initial sequence slice of the tuple sequence of the second order to obtain a third updated slice of the tuple sequence of the second order.

[0268] The second sorting unit is configured to perform the secure sorting protocol with the second party for the second sorting key based on the third updated slice of the tuple sequence of the second order to obtain a third updated slice of the tuple sequence of the first order and generate the target permutation.

[0269] The aggregation unit 84 is further configured to perform the inadvertent message aggregation from the edge to the node based on the third updated slice of the tuple sequence of the first order to obtain a fourth updated slice of the tuple sequence of the first order.

[0270] Further, the first sorting unit is specifically configured to perform the first call of the secure sorting protocol based on the first input sequence slice input by the local party, the first key slice of the first sorting key, the second input sequence slice input by the second party corresponding to the second party, and the second key slice of the first sorting key to obtain the initial sequence slice of the tuple sequence of the second order.

[0271] The second sorting unit is specifically configured to perform the second call of the secure sorting protocol based on the third updated slice input by the local party, the first key slice of the second sorting key, the third updated slice input by the second party corresponding to the second party, and the second key slice of the second sorting key to obtain the third updated slice of the tuple sequence of the first order and generate the target permutation.

[0272] Further, the first sorting key comprises key values of respective first keys corresponding to respective tuples in the tuple sequence; the key values of the first keys are determined at least according to the number of the source node of the corresponding tuple; the second sorting key comprises key values of respective second keys corresponding to respective tuples in the tuple sequence; the key values of the second keys are determined at least according to the number of the target node of the corresponding tuple.

[0273] Further, the first sorting unit comprises:

[0274] The iteration processing subunit is configured to, according to the first key fragment of the first sorting key, and for each bit of the key value included in the first sorting key, perform bit iteration processing jointly with the second party from the least significant bit: calculate a position exchange of a current bit of sorting, and perform permutation processing on the random secret permutation and the first sorting key according to the calculated position exchange, and update the random secret permutation and the first sorting key according to the processing result;

[0275] The secure permutation subunit is configured to, based on the first input sequence fragment input by the first party, the inverse permutation of the first secret permutation, the second input sequence fragment input by the second party corresponding to the second party, and the inverse permutation of the second secret permutation, perform a third call execution on the secure permutation protocol to obtain a result fragment of the first masking result, and the combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation;

[0276] The public permutation subunit is configured to obtain the random secret permutation obtained by the bit iteration processing jointly with the second party, and act on the result fragment of the first masking result to obtain an initial sequence fragment of the tuple sequence in the second order.

[0277] Further, the iteration processing subunit comprises:

[0278] The masking module is configured to perform permutation processing on the position exchange, the random secret permutation and the first sorting key respectively according to the sampling permutation of random sampling to obtain a first-party fragment of the masked position exchange, a first-party fragment of the masked random secret permutation and a first-party fragment of the masked first sorting key.

[0279] The revealing module is configured to determine the masked position exchange jointly with the second party.

[0280] The local permutation module is configured to perform permutation processing on the first-party fragment of the masked random secret permutation and the first-party fragment of the masked first sorting key respectively by using the masked position exchange to obtain a first-party fragment of the processing result of performing permutation processing on the random secret permutation and the first sorting key by using the position exchange.

[0281] The device provided by the embodiments of the present specification, in any non-first round iteration, the first party first obtains, by the first permutation unit 71, a current sequence slice of a tuple sequence in a second order based on a current sequence slice of a tuple sequence in a first order obtained in the last round, by jointly executing a secure permutation protocol with the second party for a target permutation; then the propagation unit 72 jointly executes, with the second party, a node-to-edge oblivious message propagation based on the current sequence slice of the tuple sequence in the second order, to obtain a first update slice of the tuple sequence in the second order; then the second permutation unit 73 jointly executes, with the second party, the secure permutation protocol based on the first update slice of the tuple sequence in the second order for an inverse permutation of the target permutation, to obtain a first update slice of the tuple sequence in the first order; finally, the aggregation unit 74 jointly executes, with the second party, an edge-to-node oblivious message aggregation based on the first update slice of the tuple sequence in the first order, to obtain a second update slice of the tuple sequence in the first order. As can be seen from the above, in any non-first round iteration, the tuple sequence needs to be converted between the first order and the second order, and the secure permutation protocol is used to replace the secure ordering protocol to realize the above conversion. The secure permutation protocol, under the premise of ensuring security, reuses the key intermediate calculation results, realizes a substantial reduction in calculation and communication overhead, and thus can efficiently and securely realize graph analysis.

[0282] According to another aspect, embodiments also provide an iterative two-party privacy graph analysis device, which is configured to perform the method shown in the above embodiments of the present specification. Figure 7 The two parties include a first party and a second party, and each has its own private graph data, and the nodes and edges in the private graph data are represented in the form of tuples; and the device is arranged at the first party. Figure 9 A schematic block diagram of an iterative two-party privacy graph analysis device according to another embodiment is shown. As shown in the figure, Figure 9 The device 900 includes:

[0283] A first calling unit 91 is configured to call, with the second party, a message dispersion programming interface based on a target message propagation operator adopted by a target application and a tuple slice of a private graph of the present party, and the message dispersion programming interface is configured to perform a node-to-edge oblivious message propagation corresponding to the target message propagation operator after a first ordering of a tuple sequence formed by the tuple slices of the two parties by using a secure ordering protocol or a secure permutation protocol;

[0284] A second calling unit 92 is configured to call, with the second party, a message collection programming interface based on a target message aggregation operator adopted by the target application and the tuple slice, and the message collection programming interface is configured to perform an edge-to-node oblivious message aggregation corresponding to the target message aggregation operator after a second ordering of the tuple sequence by using the secure ordering protocol or the secure permutation protocol.

[0285] By the device provided by the embodiments of the present specification, the first party first jointly calls a message dispersion programming interface with the second party by the first calling unit 91 based on a target message propagation operator adopted by a target application and a tuple slice of a private graph of the first party, executes an inadvertent message propagation from a node to an edge corresponding to the target message propagation operator after the message dispersion programming interface performs a first ordering on a tuple sequence composed of the tuple slices of the two parties by using a secure ordering protocol or a secure permutation protocol, and then the second calling unit 92 jointly calls a message collection programming interface with the second party based on a target message aggregation operator adopted by the target application and the tuple slice, executes an inadvertent message aggregation from an edge to a node corresponding to the target message aggregation operator after the message collection programming interface performs a second ordering on the tuple sequence by using the secure ordering protocol or the secure permutation protocol. As can be seen from the above, the embodiments of the present specification design a programming framework for the scenario of two-party iterative privacy graph analysis, the MPC protocol encapsulated by the framework combines specific optimizations for the scenario to achieve high performance, and the framework provides a similar programming interface to traditional parallel graph analysis to meet ease of use and facilitate development of graph analysis applications.

[0286] According to another aspect, embodiments further provide a computer readable storage medium having stored thereon a computer program that, when executed in a computer, cause the computer to carry out the method described Figure 4 or Figure 7 above.

[0287] According to yet another aspect, embodiments further provide a computing device comprising a memory and a processor, the memory having stored therein executable code that, when executed by the processor, implement the method described Figure 4 or Figure 7 above.

[0288] Those skilled in the art will realize that the functions described in one or more examples above can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions can be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

[0289] The above detailed description has further explained the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific implementation of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. An iterative two-party privacy graph analysis method, wherein the two parties include a first party and a second party, each having its own private graph data, and the nodes and edges in the private graph data are represented in tuple form; The method is executed by a first party and includes multiple iterations, wherein any non-first iteration includes: Based on the current sequence fragment of the first-order tuple sequence obtained in the previous round, the current sequence fragment of the second-order tuple sequence is obtained by jointly executing a secure permutation protocol with the second party for the target permutation. Based on the current sequence slice of the second-order tuple sequence, the second party jointly performs unintentional message propagation from the node to the edge to obtain the first updated slice of the second-order tuple sequence. Based on the first updated fragment of the tuple sequence of the second order, the first updated fragment of the tuple sequence of the first order is obtained by jointly executing the secure permutation protocol with the inverse permutation of the second party for the target permutation. Based on the first update shard of the tuple sequence in the first order, the second update shard is obtained by jointly performing an unintentional message aggregation from the edge to the node with the second party.

2. The method as described in claim 1, wherein, The tuple includes a source node, a target node, and the attribute values ​​of the object represented by the tuple; the first order is the order in which the target node is sorted, and the second order is the order in which the source node is sorted.

3. The method as described in claim 2, wherein, The tuple also includes an object type identifier. When the identifier takes a first value, the source node and the target node are the same node, and the tuple represents the same node. When the identifier takes a second value, the source node and the target node are different, and the tuple represents the edge from the source node to the target node.

4. The method of claim 1, wherein, By jointly executing a secure permutation protocol with a second party for the target permutation, the current sequence fragment of the second-order tuple sequence is obtained, including: Based on the first sequence fragment and first permutation input by this party, and the second sequence fragment and second permutation input by the second party, the secure permutation protocol is executed by a first call to obtain the current sequence fragment of the tuple sequence of the second order; wherein, the first sequence fragment is determined according to the current sequence fragment of the tuple sequence of the first order, and the combination of the first permutation and the second permutation is equivalent to the target permutation; By jointly executing the secure permutation protocol with the second party for the inverse permutation of the target permutation, a first updated fragment of the first-order tuple sequence is obtained, including: Based on the third sequence fragment input by this party, the inverse permutation of the first permutation, and the fourth sequence fragment input by the second party, and the inverse permutation of the second permutation, the secure permutation protocol is executed in a second call to obtain the first updated fragment of the tuple sequence of the first order, and the third sequence fragment is the first updated fragment of the tuple sequence of the second order.

5. The method of claim 4, wherein, The current sequence slice for obtaining the second-order tuple sequence also includes: Apply the inverse of the target permutation to the current sequence fragment of the first sequence of tuples to obtain the first sequence fragment; The first update slice for obtaining the first ordered tuple sequence includes: The target permutation is applied to the execution result of the second call, serving as the first updated slice of the tuple sequence in the first order.

6. The method of claim 4, wherein, The first invocation of the security permutation protocol includes: Based on the first permutation input by this party and the second sequence fragment input by the second party, the secure permutation sharing protocol is invoked to perform the first permutation sharing operation, thereby obtaining the first intermediate fragment after the second sequence fragment has undergone the first permutation. Based on the first permutation, the first sequence fragment, and the first intermediate fragment, local calculations are performed to obtain the first permutation result after the first permutation of the target data sequence; the first sequence fragment and the second sequence fragment are two fragments that constitute the target data sequence; Based on the first permutation result input by this party and the second permutation input by the second party, the secure permutation sharing protocol is invoked to perform the second permutation sharing operation, thereby obtaining the fragment of this party's second permutation result after the second permutation of the first permutation result, which is used as the current sequence fragment of the tuple sequence of the second order.

7. The method of claim 6, wherein, Perform the first swap-sharing operation, including: The first unintentional incomplete matrix is ​​locally calculated to form a row sum sequence and a column sum sequence, which are formed by the sum of the elements in each row and the sum of the elements in each column. The difference between the row sum sequence and the column sum sequence is calculated to obtain the first difference sequence. The first unintentional incomplete matrix and the second unintentional incomplete matrix held by the second party are different only in the elements at the corresponding positions of the permutations in each row, and the elements at the other positions are the same. The second party receives an encrypted data sequence and a random sequence; wherein the encrypted data sequence is obtained by the second party locally calculating the columns and sequence of a second unintentionally incomplete matrix and using the columns and sequence to encrypt fragments of the second sequence; The encrypted data sequence is subjected to local permutation using the first permutation, and local calculations are performed with the first difference sequence and the random sequence to obtain the result fragment after the first permutation of the second sequence fragment, which is used as the first intermediate fragment.

8. The method of claim 7, wherein, The first execution of the first swap-sharing operation also includes: Based on the first permutation, the unintentional incomplete matrix generation process is jointly performed with the second party to obtain the first unintentional incomplete matrix, and the second party obtains the second unintentional incomplete matrix.

9. The method of claim 7, wherein, When performing the first swap-sharing operation for the first time, it also includes: The elements of the first unintentionally incomplete matrix are updated using a deterministic pseudo-random number generator agreed upon with the second party.

10. The method of claim 4, wherein, The second invocation execution of the security permutation protocol includes: Based on the inverse permutation of the first permutation input by this party and the fourth sequence fragment input by the second party, the secure permutation sharing protocol is invoked to perform the third permutation sharing operation, thereby obtaining the second intermediate fragment after the inverse permutation of the first permutation on the fourth sequence fragment; Based on the inverse permutation of the first permutation, the third sequence fragment, and the second intermediate fragment, local calculations are performed to obtain the third permutation result after the inverse permutation of the first permutation on the target data sequence; the third sequence fragment and the fourth sequence fragment are two fragments that constitute the target data sequence; Based on the third permutation result input by this party, the inverse permutation of the second permutation input by the second party, the secure permutation sharing protocol is invoked to perform the fourth permutation sharing operation, and the party's fragment of the fourth permutation result after performing the inverse permutation of the second permutation on the third permutation result is obtained, which is used as the first updated fragment of the tuple sequence of the first order.

11. The method of claim 10, wherein, Perform the third permutation sharing operation, including: The first unintentional incomplete matrix is ​​locally calculated to form a row sum sequence and a column sum sequence, which are formed by the sum of the elements in each row and the sum of the elements in each column. The difference between the row sum sequence and the column sum sequence is calculated to obtain the first difference sequence. The first unintentional incomplete matrix and the second unintentional incomplete matrix held by the second party are different only in the elements at the corresponding positions of the permutations in each row, and the elements at the other positions are the same. The sequence formed by the opposites of each element of the first difference sequence is subjected to inverse permutation to obtain the updated first difference sequence. The second party receives an encrypted data sequence and a random sequence; wherein the encrypted data sequence is obtained by the second party locally calculating the row sum sequence of the second unintentional incomplete matrix and using the row sum sequence to encrypt the fourth sequence fragments; The encrypted data sequence is subjected to local permutation processing using the inverse of the first permutation, and local calculation is performed with the first difference sequence and the random sequence to obtain the result fragment after the inverse of the first permutation on the fourth sequence fragment, which is used as the second intermediate fragment.

12. The method of claim 2, wherein, The first iteration includes: The input sequence of the random-order tuple sequence is sliced, and the initial sequence slice of the second-order tuple sequence is obtained by jointly executing a secure sorting protocol with a second party on the first sorting key. Based on the initial sequence partitioning of the second-order tuple sequence, perform unintentional message propagation from the node to the edge to obtain the third updated partitioning of the second-order tuple sequence. Based on the third updated fragment of the tuple sequence in the second order, the third updated fragment of the tuple sequence in the first order is obtained by jointly executing the secure sorting protocol with the second party against the second sorting key, and the target permutation is generated. Based on the third update slice of the tuple sequence in the first order, perform unintentional message aggregation from edge to node to obtain the fourth update slice of the tuple sequence in the first order.

13. The method of claim 12, wherein, By jointly executing a secure sorting protocol with a second party against a first sorting key, an initial sequence fragment of the second-order tuple sequence is obtained, including: Based on the first input sequence fragment and the first key fragment of the first sorting key input by this party, and the second input sequence fragment and the second key fragment of the first sorting key corresponding to the second party input, the secure sorting protocol is executed by a first call to obtain the initial sequence fragment of the tuple sequence of the second order; By jointly executing the secure sorting protocol with a second party for the second sorting key, a third updated fragment of the first-order tuple sequence is obtained, and the target permutation is generated, including: Based on the third updated fragment input by this party, the first key fragment of the second sorting key, and the third updated fragment and the second key fragment of the second sorting key input by the second party, the secure sorting protocol is executed in a second call to obtain the third updated fragment of the tuple sequence of the first order, and the target permutation is generated.

14. The method of claim 12, wherein, The first sort key includes key values ​​corresponding to each first key of each tuple in the tuple sequence; the key values ​​of the first keys are determined at least according to the source node number of the corresponding tuple; the second sort key includes key values ​​corresponding to each second key of each tuple in the tuple sequence; the key values ​​of the second keys are determined at least according to the target node number of the corresponding tuple.

15. The method of claim 13, wherein, The first invocation of the secure ordering protocol includes: Based on the first key fragment of the first sorting key, for each bit of the key value included in the first sorting key, starting from the least significant bit, perform bit iteration processing in conjunction with the second party: calculate the position transpose of the current bit, and perform transpose processing on the random secret permutation and the first sorting key according to the calculated position transpose, and update the random secret permutation and the first sorting key according to the processing result; Based on the first input sequence fragment and the inverse of the first secret permutation of the input of this party, and the second input sequence fragment and the inverse of the second secret permutation of the input of the corresponding party, the security permutation protocol is executed by a third call to obtain the result fragment of the first masking result. The combination of the first secret permutation and the second secret permutation is equivalent to the initial random secret permutation. The random secret permutation obtained by the bit iteration process is obtained in conjunction with the second party and applied to the result fragment of the first masking result to obtain the initial sequence fragment of the tuple sequence of the second order.

16. The method of claim 15, wherein, The permutation process is performed based on the calculated position swap, random secret permutation, and first sorting key, including: Based on the sampling permutation of random sampling, the position permutation, random secret permutation and the first sorting key are permuted respectively to obtain the local fragment with the position permutation masked, the local fragment with the random secret permutation masked and the local fragment with the first sorting key masked. Jointly determine the cover location with a second party; By using the masking positional substitution, the self-partition that masks the random secret permutation and the self-partition that masks the first sorting key are respectively subjected to permutation processing, resulting in the self-partition that is the result of permutation processing of the random secret permutation and the first sorting key using positional substitution.

17. An iterative two-party privacy graph analysis method, wherein the two parties include a first party and a second party, each having its own private graph data, wherein the nodes and edges in the private graph data are represented in tuple form; The method is performed by a first party and includes: Based on the target message propagation operator adopted by the target application and the tuple partitioning of the private graph of this party, the message distribution programming interface is jointly invoked with the second party. The message distribution programming interface performs a first sorting on the tuple sequence composed of the tuple partitioning of the two parties using a secure sorting protocol or a secure permutation protocol, and then performs the unintentional message propagation from the node to the edge corresponding to the target message propagation operator. Based on the target message aggregation operator adopted by the target application and the tuple sharding, the message collection programming interface is jointly invoked with the second party. After the message collection programming interface performs a second sorting on the tuple sequence using the secure sorting protocol or the secure permutation protocol, it performs unintentional message aggregation from the edge to the node corresponding to the target message aggregation operator.

18. An iterative two-party privacy graph analysis apparatus, comprising a first party and a second party, each having its own private graph data, wherein nodes and edges in the private graph data are represented as tuples; the apparatus is disposed on the first party and is used to perform multiple rounds of iteration, including the following unit for performing arbitrary non-first rounds of iteration: The first permutation unit is used to obtain the current sequence fragment of the second-order tuple sequence based on the first-order tuple sequence obtained in the previous round by jointly executing a secure permutation protocol with the second party for the target permutation. The propagation unit is used to perform unintentional message propagation from the node to the edge in conjunction with the second party, based on the current sequence fragment of the second-order tuple sequence obtained by the first permutation unit, to obtain the first updated fragment of the second-order tuple sequence. The second permutation unit is used to obtain the first update fragment of the first-order tuple sequence based on the first update fragment of the second-order tuple sequence obtained by the propagation unit by jointly executing the secure permutation protocol with the second party for the inverse permutation of the target permutation. The aggregation unit is used to jointly perform unintentional message aggregation from the edge to the node with the second party based on the first update fragment of the tuple sequence of the first order obtained by the second permutation unit, so as to obtain the second update fragment of the tuple sequence of the first order.

19. An iterative two-party privacy graph analysis device, wherein the two parties include a first party and a second party, each having its own private graph data, wherein the nodes and edges in the private graph data are represented in tuple form; The device is disposed in the first party and includes: The first calling unit is used to jointly call the message distribution programming interface with the second party based on the target message propagation operator adopted by the target application and the tuple partitions of the private graph of this party. The message distribution programming interface performs a first sorting on the tuple sequence composed of the tuple partitions of the two parties using a secure sorting protocol or a secure permutation protocol, and then performs the unintentional message propagation from the node to the edge corresponding to the target message propagation operator. The second calling unit is used to jointly call the message collection programming interface with the second party based on the target message aggregation operator adopted by the target application and the tuple sharding. The message collection programming interface performs a second sorting on the tuple sequence using the secure sorting protocol or the secure permutation protocol, and then performs unintentional message aggregation from the edge to the node corresponding to the target message aggregation operator.

20. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-17.

21. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-17.

Images