Safety calculation method based on homomorphic encryption, medium, equipment and program product

Abstract

The invention discloses a security calculation method based on homomorphic encryption, a medium, equipment and a program product. The security calculation method is used for cooperatively calculating a product of a first matrix and a first column vector by a first participant and a second participant, and the method applied to the first participant comprises the following steps: performing number-theory transformation on the second column vector on a ring A to obtain N polynomials, the second column vector being a transpose of the product of (1, x,..., xN-1) and the first matrix; in response to receiving a first ciphertext polynomial sent by a second participant, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial; and executing the first data processing task based on the second ciphertext polynomial. Therefore, the product of the first matrix and the first column vector can be safely calculated by utilizing the property of the operator ring, so that the scheme can be suitable for safely calculating the product of the matrix and the vector on the ring with any modulus. In addition, through the scheme, the data security can be protected in a model training scene, and the applicability is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of secure multi-party computing, and in particular, to a secure computing method, medium, device and program product based on homomorphic encryption. Background Art

[0002] Secure multi-party computing is also known as multi-party secure computing (MPC). It allows multiple parties to jointly calculate the result of a function without disclosing the input data of each party in the function, and the result of the calculation is open to one or more of the parties. Typical applications of secure multi-party computing include joint statistical analysis of multi-party data with privacy protection, machine learning, etc. Among them, multi-party secure computing technology can be used to protect privacy data during the training stage of machine learning models, mainly involving the protection of model parameters and the protection of data of each participant during the training process.

[0003] During the training of machine learning models, model loss is usually used to update model parameters, where the calculation of model loss usually involves the secure calculation of the product of a matrix and a column vector. At present, a homomorphic encryption mechanism based on Number Theoretic Transform (NTT) coding is usually used to securely calculate the product of a matrix and a column vector. Since NTT coding converts a polynomial on a modulo prime ring into the coefficient representation of another polynomial, NTT coding relies on the specific properties of modulo prime numbers. Therefore, the homomorphic encryption mechanism based on NTT coding is only applicable to the secure calculation of the product of a matrix and a vector on a modulo prime ring, and its scope of application is relatively limited. Summary of the invention

[0004] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, the present disclosure provides a secure computing method based on homomorphic encryption, wherein a first participant and a second participant collaboratively calculate the product of a first N*N matrix and a first N-dimensional column vector, wherein the first matrix is ​​held solely by the first participant, and the first column vector is held solely by the second participant, and the method is applied to the first participant, including:

[0006] Perform number-theoretic transformation on the second column vector on ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1 ) and the first matrix, the independent variable x is the 2Nth primitive root of unity in the ring A, R is any commutative ring containing 1, and N is a power of 2;

[0007] In response to receiving a first ciphertext polynomial sent by the second party, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the first ciphertext polynomial is obtained by the second party performing homomorphic encryption on the first plaintext polynomial, and the first plaintext polynomial uses the first column vector as a coefficient vector;

[0008] A first data processing task is performed based on the second ciphertext polynomial.

[0009] In a second aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the secure computing method based on homomorphic encryption provided in the first aspect of the present disclosure.

[0010] In a third aspect, the present disclosure provides an electronic device, including:

[0011] a storage device having a computer program stored thereon;

[0012] A processing device is used to execute the computer program in the storage device to implement the steps of the secure computing method based on homomorphic encryption provided in the first aspect of the present disclosure.

[0013] In a fourth aspect, the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the secure computing method based on homomorphic encryption provided in the first aspect of the present disclosure.

[0014] In the above technical solution, when calculating the product of the first matrix and the first column vector, the first participant first performs a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1) and the transpose of the product of the first matrix, and at the same time, the second participant homomorphically encrypts the first plaintext polynomial to obtain the first ciphertext polynomial, and sends the first ciphertext polynomial to the first participant, wherein the first plaintext polynomial uses the first column vector as the coefficient vector; after receiving the first ciphertext polynomial sent by the second participant, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, and performs the first data processing task based on the second ciphertext polynomial. In this way, the properties of the operator ring can be used to safely calculate the product of the first matrix and the first column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of number theory transformation encoding. Therefore, this scheme can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the number theory transformation of the second column vector on the ring A, that is, encoding the first matrix through number theory transformation, can reduce the computational complexity of the encoding, thereby improving the execution efficiency of the first data processing task. In addition, this solution can protect data security in model training scenarios, and enable the trained models to demonstrate good performance and stability under different data, tasks, environments, and scenarios, thereby improving the applicability of the model.

[0015] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0017] Figure 1 The present invention is a flowchart of a secure computing method based on homomorphic encryption applied to a first party according to an exemplary embodiment.

[0018] Figure 2 It is a flowchart of a method for performing number-theoretic transformation on a second column vector on a ring A according to an exemplary embodiment.

[0019] Figure 3 The present invention is a flowchart of a secure computing method based on homomorphic encryption applied to a second party according to an exemplary embodiment.

[0020] Figure 4 The invention is a block diagram of a homomorphic encryption-based secure computing device applied to a first party according to an exemplary embodiment.

[0021] Figure 5The invention is a block diagram of a homomorphic encryption-based secure computing device applied to a second party according to an exemplary embodiment.

[0022] Figure 6 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0023] Before introducing the specific embodiments of the present disclosure, the specific application scenarios of multi-party secure computing and the terms involved in the present disclosure are first introduced and explained.

[0024] Ring: refers to a set that defines two operations, addition and multiplication, and forms a commutative group (i.e., Abelian group) for addition, a semigroup for multiplication for elements other than 0, and multiplication satisfies the distributive law for addition.

[0025] In the field of secure computing, especially in MPC, an operator ring usually refers to a set of operators that support secure computing between multiple parties. These operators can include basic arithmetic operations (such as addition, multiplication), logical operations, comparison operations, etc., which are the basis for building more complex secure computing protocols.

[0026] The ring of addition and multiplication is defined above. is the ring of integers, where addition is defined as integer addition modulo (mod) N, and multiplication is defined as integer multiplication mod N, where N is an integer greater than 1.

[0027] It is a ring consisting of equivalence classes obtained by taking integers modulo 2N, namely {0, 1, 2, ..., 2N-1}.

[0028] is the multiplication group modulo 2N, which is The set of all elements in that are coprime to 2N, that is, these elements have multiplicative inverses modulo 2N, namely {1, 3, …, 2N-1}.

[0029] Secret Sharing is also called secret splitting or secret sharing. Its basic principle is to split secrets (such as keys, private data, etc.) into multiple shares (Shares) and give them to different data parties for safekeeping. Only when parties exceeding a threshold number merge their shards can the secret be restored; Shares obtained from parties less than the threshold number cannot restore any information of the secret. In multi-party secure computing, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called shards. Among them, private data is the data that you do not want other parties to know in multi-party secure computing.

[0030] Homomorphic encryption is a technology that allows calculations to be performed on encrypted data (i.e., ciphertext) and then decrypted to obtain the result. The result of the homomorphic encryption calculation is the same as the result of direct calculation on the original data (i.e., plaintext), but the entire calculation process is performed on the encrypted data.

[0031] NTT is a method used in the field of number theory to efficiently calculate convolution, which is similar to the discrete Fourier transform. NTT mainly operates on a finite field, avoiding the accuracy problems caused by floating-point operations in the discrete Fourier transform, and is widely used in fields such as digital signal processing and cryptography. Like the fast Fourier transform, NTT achieves fast calculations through a divide-and-conquer strategy, specifically dividing the sequence to be transformed into an "even part" and an "odd part", then recursively applying the transformation until the length of the sequence to be transformed is 1, and finally merging the results.

[0032] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0033] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0034] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0035] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0036] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0037] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0038] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0039] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0040] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0041] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0042] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0043] Figure 1 FIG. 1 is a flowchart of a secure computing method based on homomorphic encryption applied to a first participant according to an exemplary embodiment. Figure 1 As shown, the method may include S101 to S103.

[0044] In S101, the second column vector is transformed by number theory on the ring A to obtain N polynomials. The second column vector is (1, x, ..., x N-1 ) is the transpose of the product of the first matrix and the argument x is the 2Nth primitive root of unity in the ring A.

[0045] In the present disclosure, the secure calculation method is used for the first participant and the second participant to collaboratively calculate the product of the first matrix of N*N and the first column vector of N dimension. It can be understood that the first matrix and the first column vector in the present disclosure can be any data that the holder is not convenient to disclose.

[0046] The first matrix is ​​held by the first participant alone, and the first column vector is held by the second participant alone. N,N (R), that is, the first matrix M is an N-dimensional square matrix on the R ring, and the first column vector α∈R (N) , that is, the first column vector is an N-dimensional column vector on the ring R, where R is any commutative ring containing 1. The ring A is the quotient ring of the univariate polynomial ring on the ring R, and the ring N is a power of 2.

[0047] The first matrix is ​​a square matrix. If the matrix used for security calculation is not initially a square matrix, it can be reconstructed into a square matrix by padding with zeros or cutting.

[0048] The second column vector is (1,x,…,x N-1 ) and the transpose of the product of the first matrix M, that is, the second column vector U = (1, x, …, x N-1 )·M=(m0(x),m1(x),…,m N-1 (x) T ,in, n i,j is the element in the i-th row and j-th column of the first matrix M, m j (x) is the polynomial in the i-th row of the second column vector U, i = 0, 1, ..., N-1, j = 0, 1, ..., N-1.

[0049] The first participant performs a number-theoretic transformation on the second column vector on ring A to encode the first matrix and obtain N polynomials. The number-theoretic transformation NTT, like the fast Fourier transform, can be quickly calculated through a divide-and-conquer strategy, specifically in O(N 2 logN) complexity to efficiently encode the first matrix.

[0050] In S102, in response to receiving the first ciphertext polynomial sent by the second party, a second ciphertext polynomial is generated according to the N polynomials and the first ciphertext polynomial.

[0051] In the present disclosure, the first ciphertext polynomial is obtained by the second party performing homomorphic encryption on the first plaintext polynomial, and the first plaintext polynomial has the first column vector as the coefficient vector, that is, the first column vector is the coefficient vector of the first plaintext polynomial corresponding to the first ciphertext polynomial.

[0052] Specifically, when calculating the product of the first matrix and the first column vector, the first participant performs a number theoretic transformation on the second column vector on ring A to encode the first matrix and obtain N polynomials. At the same time, the second participant uses the first column vector it holds as the coefficient vector to generate a first plaintext polynomial. Afterwards, the second participant uses the homomorphic encryption public key to homomorphically encrypt the first plaintext polynomial, and sends the first ciphertext polynomial obtained by the homomorphic encryption to the first participant. After receiving the first ciphertext polynomial, the first participant generates a second ciphertext polynomial based on the N polynomials obtained by encoding the first matrix and the first ciphertext polynomial.

[0053] The second participant can use the first column vector held by the second participant as the coefficient vector to generate the first plaintext polynomial m1 through the following equation (1):

[0054] m1=(1,x,...,x N-1 )α (1)

[0055] In S103, the first data processing task is performed based on the second ciphertext polynomial.

[0056] In one implementation, the first data processing task may be performed based on the second ciphertext polynomial through the following steps (c1) and (c2).

[0057] Step (c1): Generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant so that the second participant can generate a first slice of the product of the first matrix and the first column vector based on the masking polynomial.

[0058] Step (c2): using the random column vector as a second slice of the first matrix and the first column vector, and performing the first data processing task based on the second slice.

[0059] Among them, the random column vector β0∈R (N) , that is, the random column vector is an N-dimensional column vector on the randomly generated R ring.

[0060] After the first participant generates the random column vector, it can use it as a slice of the product of the first matrix and the first column vector, that is, the second slice. At the same time, the second ciphertext polynomial is masked using the random column vector, and the masked polynomial obtained after the masking process is sent to the second participant. After receiving the masked polynomial, the second participant generates another slice of the product of the first matrix and the first column vector based on the masked polynomial, that is, the first slice. Afterwards, the first participant and the second participant can share the slices of the product results generated by each party, and aggregate and merge the slices generated by the two parties to obtain the final calculation result (that is, the product of the first matrix and the first column vector). Among them, the result of the product of the first matrix and the first column vector includes the first slice and the second slice, that is, the first matrix*first column vector=first slice+second slice.

[0061] In addition, the first data processing task mentioned above may be a machine learning model training task, wherein the machine learning model may be, for example, a neural network model, a logistic regression model, etc. The first participant may perform machine learning model training in an MPC manner based on the first matrix held by itself, and the second participant may perform machine learning model training based on the first column vector held by itself, so as to obtain a slice of the product of the first matrix and the first column vector respectively, and then calculate the model loss based on the slices of the product held by each of the two, and update the model parameters of the machine learning model according to the model loss. The first matrix may be a feature matrix, and the first column vector may be a vector consisting of model parameters.

[0062] In the above technical solution, when calculating the product of the first matrix and the first column vector, the first participant first performs a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, ..., x N-1) and the transpose of the product of the first matrix, and at the same time, the second participant homomorphically encrypts the first plaintext polynomial to obtain the first ciphertext polynomial, and sends the first ciphertext polynomial to the first participant, wherein the first plaintext polynomial uses the first column vector as the coefficient vector; after receiving the first ciphertext polynomial sent by the second participant, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, and performs the first data processing task based on the second ciphertext polynomial. In this way, the properties of the operator ring can be used to safely calculate the product of the first matrix and the first column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of number theory transformation encoding. Therefore, this scheme can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the number theory transformation of the second column vector on the ring A, that is, encoding the first matrix through number theory transformation, can reduce the computational complexity of the encoding, thereby improving the execution efficiency of the first data processing task. In addition, this solution can protect data security in model training scenarios, and enable the trained models to demonstrate good performance and stability under different data, tasks, environments, and scenarios, thereby improving the applicability of the model.

[0063] The following is a detailed description of the specific implementation method of performing number-theoretic transformation on the second column vector on the ring A to obtain N polynomials in the above S101. Specifically, it can be achieved through the following steps (a1) to (a4).

[0064] Step (a1): Calculate (1,x,…,x N-1 ) and the first matrix to obtain the first row vector.

[0065] Step (a2): Transpose the first row vector to obtain the second column vector.

[0066] Step (a3): Use multi-level recursive operations to implement the number-theoretic transformation of the second column vector on ring A to obtain the third column vector.

[0067] Step (a4): Determine each row of the third column vector as N polynomials.

[0068] Specifically, we can use multi-level recursive operations to Figure 2 S201-S207 shown in the figure implements the number-theoretic transformation of the second column vector on the ring A to obtain the third column vector.

[0069] In S201, the second column vector is used as input data for the lth level recursive operation.

[0070] In this disclosure, l is initially 1.

[0071] In S202, the operation factors of the l-th level recursive operation are calculated.

[0072] In the present disclosure, the operation factor of the first level recursive operation is For ring A The second primitive root of unity, and The operation factor of the l-th level recursive operation is dimensional diagonal matrix.

[0073] For example, the operation factors of the first level recursive operation are ξ 2N is the 2Nth primitive root of unity in the ring A, and ξ 2N =x -1 .

[0074] Among them, the third column vector V = NTT N (U)=NTT N U, NTT N (U) Characterization using NTT N Perform number-theoretic transformation on U, where NTT N is the number-theoretic transformation matrix of the first-level recursive operation, and is NTT N

[0075]

[0076] In S203, the input data is split into a fourth column vector and a fifth column vector according to the parity of the index, wherein the fourth column vector is composed of the even rows of the input data, and the fifth column vector is composed of the odd rows of the input data.

[0077] For example, l = 1, then the input data is the second column vector U = (m0(x), m1(x), ..., m N-1 (x) T At this time, the second column vector is split according to the parity of the index, and the fourth column vector U can be obtained. even =(m0(x),m2(x),m4(x),…,m N-2 (x) T , the fifth column vector U odd =(m1(x),m3(x),m5(x),…,m N-1 (x) T .

[0078] In S204, two output data of the l-th level recursive operation are obtained according to the operation factors of the l-th level recursive operation and the input data of the l-th level recursive operation. The two output data include the sum of the number-theoretic transformation result of the fourth column vector and the first product, and the difference between the number-theoretic transformation result of the fourth column vector and the first product. The first product is the product of the operation factors of the l-th level recursive operation and the number-theoretic transformation result of the fifth column vector.

[0079] In the present disclosure, the two output data of the first-level recursive operation include: the number-theoretic transformation result of the fourth column vector + the operation factor of the first-level recursive operation * the number-theoretic transformation result of the fifth column vector, and the number-theoretic transformation result of the fourth column vector - the operation factor of the first-level recursive operation * the number-theoretic transformation result of the fifth column vector. The calculation results of these two output data are respectively the first and second of the number-theoretic transformation result of the input data of the first-level recursive operation. The result of the number-theoretic transformation of the input data of the first level recursive operation is The result of the number-theoretic transformation of the fourth column vector is equal to the product of the number-theoretic transformation matrix of the l+1th level recursive operation and the fourth column vector, and the result of the number-theoretic transformation of the fifth column vector is equal to the product of the number-theoretic transformation matrix of the l+1th level recursive operation and the fifth column vector.

[0080] For example, l=1, the input data is the second column vector, and the two output data of the first-level recursive operation include: V up and V down , where V up is a column vector, specifically the first N / 2 rows of the third column vector, V down is a column vector, specifically the last N / 2 rows of the third column vector, and:

[0081]

[0082] Among them, NTT N / 2 is the number-theoretic transformation matrix for the second-level recursive operation.

[0083] In S205 , it is determined whether the dimension of the fourth column vector or the fifth column vector is 1.

[0084] In the present disclosure, the dimension of the fourth column vector is the same as the dimension of the fifth column vector, and it can be determined whether the dimension of the fourth column vector is 1, and it can also be determined whether the dimension of the fifth vector is 1. If the dimension of the fourth column vector or the fifth column vector is not 1, l is incremented by 1, and the fourth column vector and the fifth column vector are used as input data of the l-th level recursive operation, and then the following S206 is executed, and then the process returns to the above S202 to perform the l-th level recursive operation on the fourth column vector and the fifth column vector, respectively; if the dimension of the fourth column vector or the fifth column vector is 1, it indicates that the length of the sequence to be transformed is 1, and at this time, the recursive transformation can be terminated and the following S207 is executed.

[0085] In S206, l is incremented by 1, and the fourth column vector and the fifth column vector are used as input data for the lth level recursive operation respectively.

[0086] In S207, the output data of each level of recursive operation are merged to obtain a third column vector.

[0087] For example, N = 4, then firstly transform the second column vector U = (m0(x), m1(x), m2(x), m3(x)) T As the input data of the first-level recursive operation, the operation factor of the first-level recursive operation is Then, the second column vector U = (m0(x), m1(x), m2(x), m3(x)) T Split into the fourth column vector U according to the parity of the index even =(m0(x),m2(x)) T and the fifth column vector U odd =(m1(x),m3(x)) T ; Next, according to the operation factors of the first level recursive operation And the input data of the l-th level recursive operation, that is, the second column vector, the following two output data of the first level recursive operation are obtained:

[0088]

[0089] At this time, the dimensions of the fourth and fifth column vectors are both 2, so we can add 1 to l, that is, l is equal to 2, and the fourth column vector U even =(m0(x),m2(x)) T 、The fifth column vector U odd =(m1(x),m3(x)) T As the input data of the second-level recursive operation, the operation factor diag(ξ N ) for the fourth column vector U even =(m0(x),m2(x)) T 、The fifth column vector U odd =(m1(x),m3(x)) T Perform the second level of recursive operation respectively.

[0090] Specifically, when the input data is the fourth column vector U even =(m0(x),m2(x)) T , the fourth column vector can be split into a new fourth column vector U according to the parity of the index even-even =(m0(x)) T and the new fifth column vector U even-odd =(m1(x)) T Next, according to the operation factor diag(ξ N ) and the input data of the second-level recursive operation, that is, the fourth column vector U even =(m0(x),m2(x)) T , we get the following two output data V of the second-level recursive operation:up1 and V down1 :

[0091] V up1 =NTT N / 4 U even-even +diag(ξ N )NTT N / 4 U evben-odd (4)

[0092] V down1 =NTT N / 4 U even-even -diag(ξ N )NTT N / 4 U even-odd (5)

[0093] Among them, NTT N / 4 is the number-theoretic transformation matrix for the third-level recursive operation.

[0094] At this point, the dimensions of the new fourth column vector and the new fifth column vector are both 1, so the iteration can be stopped. Then, NTT is calculated. N / 4 U even-even 、NTT N / 4 U even-odd , and thus calculate diag(ξ N )NTT N / 4 U even-odd , and then substitute into the above equations (4) and (5), we get V up1 and V down1 ; Among them, V up1 For NTT N / 2 U even The first row of the vector represented (two-dimensional column vector), V down1 NTT N / 2 U even The second row of the represented vector, thus, we can get NTT N / 2 U even The vector represented.

[0095] The input data is the fifth column vector U odd =(m1(x),m3(x)) T When the fifth column vector is split into a new fourth column vector U according to the parity of the index odd-even =(m1(x)) T and the new fifth column vector U odd-odd =(m3(x)) T Next, according to the operation factor diag(ξ N ) and the input data of the second-level recursive operation, that is, the fifth column vector U odd=(m1(x),m3(x)) T , we get the following two output data V of the second-level recursive operation: up2 and V down2 :

[0096] V up2 =TTT N / 4 U odd-even +diag(ξ N )NTT N / 4 U odd-odd (6)

[0097] V down2 =TTT N / 4 U odd-even -diag(ξ N )TTT N / 4 U odd-odd (7)

[0098] At this point, the dimensions of the new fourth column vector and the new fifth column vector are both 1, so the iteration can be stopped. Then, NTT is calculated. N / 4 U odd-even 、NTT N / 4 U odd-odd , and thus calculate diag(ξ N )NTT N / 4 U odd-odd , which can then be substituted into the above equations (6) and (7) to obtain V up2 and V down2 ; Among them, V up2 For NTT N / 2 U odd The first row of the vector represented (two-dimensional column vector), V down2 NTT N / 2 U odd The second row of the represented vector, thus, we can get NTT N / 2 U odd The vector represented.

[0099] Next, you can use NTT N / 2 U even The vector represented by NTT N / 2 U odd Substituting the represented vector into equations (2) and (3) above, we get V up and V down , V up is the first two rows of the third column vector (four-dimensional column vector), V down are the last 2 rows of the third column vector, thus, we can get the third column vector.

[0100] In the above implementation, a total of logN recursive iterations are performed, and each iteration performs N / 2 calculations of the monomial multiplication by the polynomial on the ring A, wherein the monomial refers to the data in the operation factor, and the polynomial refers to the number-theoretic transformation result of the fourth column vector and the number-theoretic transformation result of the fifth column vector. In this way, the computational complexity of the encoding of the first matrix is ​​O(N 2 logN), where the computational complexity of multiplying a monomial by a polynomial is N.

[0101] The specific implementation of generating the second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in S102 is described in detail below. Specifically, it can be implemented by the following steps (b1) and (b2).

[0102] Step (b1): performing N rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials;

[0103] In one embodiment, step (b1) may include the following steps:

[0104] Step (b11): receiving the Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on the homomorphic encryption private key.

[0105] In the present disclosure, the second party can generate a Galois key based on the homomorphic encryption private key and send it to the first party, wherein the Galois key is usually an element in the Galois group and is used to rotate the ciphertext; after the first party receives the Galois key, it uses the Galois key to rotate the corresponding ciphertext polynomial.

[0106] It should be noted that the specific method of generating a Galois key using a homomorphic encryption private key is well known to those skilled in the art and will not be elaborated in this disclosure.

[0107] Step (b12): For each element of the modulo 2N multiplication group, use the element and the Galois key to perform a rotation operation on the first ciphertext polynomial to obtain a third ciphertext polynomial.

[0108] In the present disclosure, the modulo 2N multiplication group Elements in That is, k = 1, 3, ..., 2N-1. Among them, the Galois key does not directly act on the transformation formula. Its role is to ensure that the first participant can make a transformation on the ciphertext (that is, the first ciphertext polynomial) so that the plaintext polynomial obtained after subsequent decryption (that is, a0+a1x k +…+a N-1 x k(N-1) mod(x N+1)) is equal to the polynomial obtained by directly performing k transformations on the first plaintext polynomial m1, that is:

[0109] Dec(sk,σ k (ct))=σ k (m1)=a0+a1x k +…+a N-1 x k(N-1) mod(x N +1)

[0110] Among them, σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials; the first ciphertext polynomial ct = Enc(a0+a1x+…+a N-1 x N-1 ), Enc represents encryption, that is, ct is the first plaintext polynomial m1=a0+a1x+…+a N- 1x N-1 The ciphertext of Dec represents decryption, and sk is the homomorphic encryption private key.

[0111] Here, performing k transformation refers to applying k to the power of the first ciphertext polynomial.

[0112] Step (b2): Generate a second ciphertext polynomial based on the N polynomials and the N third ciphertext polynomials.

[0113] For example, the second ciphertext polynomial can be generated according to the N polynomials and the N third ciphertext polynomials by the following equation (8):

[0114]

[0115] Where, ct(β) is the second ciphertext polynomial; v k (x) is the (k+1) / 2th polynomial among the N polynomials.

[0116] The following is a detailed description of the specific implementation method of using the random column vector to mask the second ciphertext polynomial in the above step (c1) to obtain the masked polynomial. Specifically, it can be achieved by the following steps (c11) to (c13):

[0117] Step (c11): Generate a second plaintext polynomial using the random column vector as the coefficient vector.

[0118] For example, the second plaintext polynomial m2 can be generated by using the random column vector as the coefficient vector through the following equation (9):

[0119] m2=(1,x,…,x N-1)β0 (9)

[0120] Among them, β0 is a random column vector.

[0121] Step (c12): Perform homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial.

[0122] Step (c13): Determine the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as a masking polynomial, that is, masking polynomial ct(β1)=ct(β)-ct(β0), where ct(β0) is the fourth ciphertext polynomial.

[0123] The correctness of the above-mentioned first matrix*first column vector=first slice+second slice, ie, Mα=β=β0+β1, is explained below, where β1 is the second slice.

[0124] If β=Mα, where β∈R (N) ,but

[0125]

[0126] The above equation (10) can be deduced through the following process:

[0127] make

[0128]

[0129] in,

[0130] is a compound operation, where the transpose of B T That is the number theory transformation matrix NTT of the first level recursive operation N ;tr A / R is the mapping from ring A to ring R, tr A / R =1+σ3+…+σ 2N-1 ,σ3,…,σ 2N-1 is an element in the Galois group, and an element in the Galois group is a mapping of a ring A to itself, tr A / R and P are both operators.

[0131] because And (1,x,…,x N-1 )M=(m0(x),…,m N-1 (x)), then:

[0132]

[0133] Since the second column vector U=(m0(x),…,m N-1 (x) T, the third column vector V = NTT N (U)=NTT N U, then:

[0134]

[0135] Therefore, we can get:

[0136] (1,x,…,x N-1 )β=P(1,x,…,x N-1 )α

[0137]

[0138] Among them, U T is the transpose of the second column vector U, V T is the transpose of the third column vector, (NTT N ) T For NTT N The transpose of u j is the element of the jth row in the second column vector; u 2j is the element in the 2jth row of the second column vector; u 2j+1 is the element in the 2j+1th row of the second column vector; ξ N is the Nth primitive root of unity in the ring A, and ξ N =x -2 .

[0139] Among them, in the above equation (8)

[0140]

[0141] Figure 3 FIG. 1 is a flowchart of a secure computing method based on homomorphic encryption applied to a second participant according to an exemplary embodiment. Figure 3 As shown, the method may include S301 to S305.

[0142] In S301, a first plaintext polynomial is generated using the first column vector as a coefficient vector.

[0143] In the present disclosure, a secure computing method is used by a first participant and a second participant to collaboratively compute the product of a first N*N matrix and a first N-dimensional column vector.

[0144] In S302, homomorphic encryption is performed on the first plaintext polynomial to obtain a first ciphertext polynomial.

[0145] In S303, the first ciphertext polynomial is sent to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the first matrix, and sends the masking polynomial to the second participant.

[0146] In S304, a first fragment of the product is generated based on the masking polynomial sent by the first party.

[0147] In S305, a first data processing task is executed based on the first slice.

[0148] In the present disclosure, the above-mentioned first data processing task may be a machine learning model training task. The above-mentioned first data processing task may be a machine learning model training task, wherein the machine learning model may be, for example, a neural network model, a logistic regression model, etc. The first participant may perform machine learning model training in an MPC manner based on the first matrix held by itself, and the second participant may perform machine learning model training in an MPC manner based on the first column vector held by itself, so as to obtain a slice of the product of the first matrix and the first column vector respectively, and then calculate the model loss based on the slices of the product held by each of the two, and update the model parameters of the machine learning model according to the model loss. Among them, the first matrix may be a feature matrix, and the first column vector may be a vector consisting of model parameters.

[0149] The following is a detailed description of the specific implementation scheme of generating the first fragment of the product based on the masking polynomial sent by the first participant in the above S304. Specifically, it can be implemented by the following steps (d1) and (d2):

[0150] Step (d1): Perform homomorphic decryption on the masking polynomial to obtain the third plaintext polynomial.

[0151] Step (d2): Determine the coefficient vector of the third plaintext polynomial as the first fragment.

[0152] After receiving the masking polynomial sent by the first participant, the second participant uses the local homomorphic encryption private key to homomorphically decrypt the masking polynomial to obtain a third plaintext polynomial, and then determines the coefficient vector (column vector) of the third plaintext polynomial as the first slice of the product of the first matrix and the first column vector.

[0153] In a possible implementation, the above-mentioned secure computing method based on homomorphic encryption applied to the second party may also include:

[0154] Generate Galois key based on homomorphic encryption private key;

[0155] Send the Galois key to the first party.

[0156] The specific implementation methods of each step in the secure computing method based on homomorphic encryption applied to the second party according to the embodiment of the present disclosure have been described in detail in the secure computing method based on homomorphic encryption applied to the first party according to the embodiment of the present disclosure, and will not be repeated here.

[0157] Figure 4 The block diagram of a secure computing device based on homomorphic encryption applied to a first participant is shown according to an exemplary embodiment. The secure computing method is used by the first participant and the second participant to collaboratively calculate the product of a first N*N matrix and a first N-dimensional column vector, the first matrix is ​​held by the first participant alone, the first column vector is held by the second participant alone, and the method is applied to the first participant. Figure 4 As shown, a secure computing device 400 based on homomorphic encryption applied to a first participant includes:

[0158] The number theory transformation module 401 is used to perform number theory transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1 ) and the first matrix, the independent variable x is the 2Nth primitive root of unity in the ring A, R is any commutative ring containing 1, and N is a power of 2;

[0159] A first generating module 402 is configured to generate a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial in response to receiving a first ciphertext polynomial sent by the second party, wherein the first ciphertext polynomial is obtained by the second party performing homomorphic encryption on the first plaintext polynomial, and the first plaintext polynomial uses the first column vector as a coefficient vector;

[0160] The first task execution module 403 is used to execute a first data processing task based on the second ciphertext polynomial.

[0161] In the above technical solution, when calculating the product of the first matrix and the first column vector, the first participant first performs a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1) and the transpose of the product of the first matrix, and at the same time, the second participant homomorphically encrypts the first plaintext polynomial to obtain the first ciphertext polynomial, and sends the first ciphertext polynomial to the first participant, wherein the first plaintext polynomial uses the first column vector as the coefficient vector; after receiving the first ciphertext polynomial sent by the second participant, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, and performs the first data processing task based on the second ciphertext polynomial. In this way, the properties of the operator ring can be used to safely calculate the product of the first matrix and the first column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of number theory transformation encoding. Therefore, this scheme can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the number theory transformation of the second column vector on the ring A, that is, encoding the first matrix through number theory transformation, can reduce the computational complexity of the encoding, thereby improving the execution efficiency of the first data processing task. In addition, this solution can protect data security in model training scenarios, and enable the trained models to demonstrate good performance and stability under different data, tasks, environments, and scenarios, thereby improving the applicability of the model.

[0162] In the above technical solution, when calculating the product of the first matrix and the first column vector, the first participant first performs a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1 ) and the transpose of the product of the first matrix, and at the same time, the second participant homomorphically encrypts the first plaintext polynomial to obtain the first ciphertext polynomial, and sends the first ciphertext polynomial to the first participant, wherein the first plaintext polynomial uses the first column vector as the coefficient vector; after receiving the first ciphertext polynomial sent by the second participant, the first participant generates a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, and performs the first data processing task based on the second ciphertext polynomial. In this way, the properties of the operator ring can be used to safely calculate the product of the first matrix and the first column vector, thereby avoiding the problem that the secure calculation method of the product of the matrix and the vector is only applicable to the modulus prime number ring due to the use of number theory transformation encoding. Therefore, this scheme can be applied to the secure calculation of the product of the matrix and the vector on the ring of any modulus. In addition, the number theory transformation of the second column vector on the ring A, that is, encoding the first matrix through number theory transformation, can reduce the computational complexity of the encoding, thereby improving the execution efficiency of the first data processing task. In addition, this solution can protect data security in model training scenarios, and enable the trained models to demonstrate good performance and stability under different data, tasks, environments, and scenarios, thereby improving the applicability of the model.

[0163] Optionally, the number theory transformation module 401 includes:

[0164] The first calculation submodule is used to calculate (1, x, ..., x N-1 ) and the first matrix to obtain a first row vector;

[0165] A transposition submodule, used for performing a transposition operation on the first row vector to obtain a second column vector;

[0166] A number-theoretic transformation submodule, used for implementing a number-theoretic transformation of the second column vector on the ring A by using a multi-level recursive operation to obtain a third column vector;

[0167] The first determining submodule is used to determine each row of the third column vector as the N polynomials.

[0168] Optionally, the number theory transformation submodule includes:

[0169] A second determining submodule, used for taking the second column vector as input data of the l-th level recursive operation, wherein l is initially 1;

[0170] The second calculation submodule is used to calculate the operation factor of the first-level recursive operation, wherein the operation factor of the first-level recursive operation is For ring A The second primitive root of unity, and

[0171] a splitting submodule, used for splitting the input data into a fourth column vector and a fifth column vector according to the parity of the index, wherein the fourth column vector is composed of the even rows of the input data, and the fifth column vector is composed of the odd rows of the input data;

[0172] a recursive operation submodule, configured to obtain two output data of the first-level recursive operation according to an operation factor of the first-level recursive operation and input data of the first-level recursive operation, wherein the two output data include a sum of a number-theoretic transformation result of the fourth column vector and a first product, and a difference between the number-theoretic transformation result of the fourth column vector and the first product, wherein the first product is a product of the operation factor of the first-level recursive operation and a number-theoretic transformation result of the fifth column vector;

[0173] a third determining submodule, for determining whether the dimension of the fourth column vector or the fifth column vector is 1; a first triggering submodule, for, if the dimension of the fourth column vector or the fifth column vector is not 1, triggering the third triggering submodule to add 1 to l, and using the fourth column vector and the fifth column vector as input data of the l-th level recursive operation respectively, triggering the second calculating submodule to calculate the operation factor of the l-th level recursive operation, so as to perform the l-th level recursive operation on the fourth column vector and the fifth column vector respectively; and a second triggering submodule, for, if the dimension of the fourth column vector or the fifth column vector is 1, triggering the merging submodule to merge the output data of each level of recursive operation to obtain the third column vector.

[0174] a third trigger submodule, configured to add 1 to l, and use the fourth column vector and the fifth column vector as input data of the first-level recursive operation, respectively, to trigger the second calculation submodule to calculate the operation factor of the first-level recursive operation, so as to perform the first-level recursive operation on the fourth column vector and the fifth column vector, respectively;

[0175] The merging submodule merges the output data of each level of recursive operation to obtain the third column vector.

[0176] Optionally, the first task execution module 403 includes:

[0177] a first generating submodule, configured to generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial;

[0178] The fourth determination submodule is used to use the random column vector as a second slice of the product and perform a first data processing task based on the second slice.

[0179] Optionally, the first generating submodule includes:

[0180] A second generating submodule, used to generate a second plaintext polynomial using the random column vector as a coefficient vector;

[0181] A first homomorphic encryption submodule, used to perform homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial;

[0182] The fifth determining submodule is configured to determine the difference between the second ciphertext polynomial and the fourth ciphertext polynomial as the masking polynomial.

[0183] Optionally, the first generating module 402 includes:

[0184] A first rotation submodule, configured to perform N types of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials;

[0185] The third generating submodule is used to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials.

[0186] Optionally, the first rotation submodule includes:

[0187] A receiving submodule, configured to receive a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key;

[0188] The second rotation submodule is used to perform a rotation operation on the first ciphertext polynomial using each element of the modulo 2N multiplication group and the Galois key to obtain a third ciphertext polynomial.

[0189] Optionally, the third generating submodule is used to generate a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials by using the following formula:

[0190]

[0191] Wherein, ct(β) is the second ciphertext polynomial; v k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

[0192] Optionally, the first data processing task is a machine learning model training task.

[0193] Figure 5 The block diagram of a secure computing device based on homomorphic encryption applied to a second participant is shown according to an exemplary embodiment. The secure computing method is used by a first participant and a second participant to collaboratively calculate the product of a first N*N matrix and a first N-dimensional column vector, wherein the first matrix is ​​held by the first participant alone, and the first column vector is held by the second participant alone. Figure 5 As shown, the secure computing device 500 based on homomorphic encryption applied to the second participant includes:

[0194] A second generating module 501, configured to generate a first plaintext polynomial using the first column vector as a coefficient vector;

[0195] An encryption module 502 is used to perform homomorphic encryption on the first plaintext polynomial to obtain a first ciphertext polynomial;

[0196] A sending module 503 is used to send the first ciphertext polynomial to the first participant, so that the first participant generates a masking polynomial based on the first ciphertext polynomial and the first matrix, and sends the masking polynomial to the second participant;

[0197] A third generating module 504, configured to generate a first fragment of the product based on the masking polynomial sent by the first participant;

[0198] The second task execution module 505 is used to execute the first data processing task based on the first slice.

[0199] Optionally, the third generating module 504 includes:

[0200] A decryption submodule, used for performing homomorphic decryption on the masking polynomial to obtain a third plaintext polynomial;

[0201] The sixth determination submodule is used to determine the coefficient vector of the third plaintext polynomial as the first fragment.

[0202] Optionally, the homomorphic encryption-based secure computing device 500 applied to the second participant further includes:

[0203] A fourth generation module, used to generate a Galois key based on the homomorphic encryption private key;

[0204] The sending module 503 is further configured to send the Galois key to the first party.

[0205] Optionally, the first data processing task is a machine learning model training task.

[0206] Reference below Figure 6 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0207] like Figure 6As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0208] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0209] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0210] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0211] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0212] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0213] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device performs a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials, where the second column vector is (1, x, …, xN-1 ) is the transpose of the product of the first matrix, the argument x being the 2Nth primitive root of unity in the ring A, R is any commutative ring containing 1, N is a power of 2, and the secure calculation method is used by a first participant and a second participant to collaboratively calculate the product of a first matrix of N*N and a first column vector of N dimension, wherein the first matrix is ​​solely held by the first participant, and the first column vector is solely held by the second participant; in response to receiving a first ciphertext polynomial sent by the second participant, a second ciphertext polynomial is generated according to the N polynomials and the first ciphertext polynomial, wherein the first ciphertext polynomial is obtained by the second participant performing homomorphic encryption on a first plaintext polynomial, and the first plaintext polynomial uses the first column vector as a coefficient vector; and a first data processing task is performed based on the second ciphertext polynomial.

[0214] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0215] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0216] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the number theory transformation module may also be described as "a module that performs number theory transformation on the second column vector on the ring A to obtain N polynomials".

[0217] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0218] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0219] According to one or more embodiments of the present disclosure, Example 1 provides a secure computing method based on homomorphic encryption, wherein the secure computing method is used by a first participant and a second participant to collaboratively calculate the product of a first N*N matrix and a first N-dimensional column vector, wherein the first matrix is ​​held solely by the first participant, and the first column vector is held solely by the second participant, and the method is applied to the first participant, including:

[0220] Perform number-theoretic transformation on the second column vector on ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1 ) and the first matrix, the independent variable x is the 2Nth primitive root of unity in the ring A, R is any commutative ring containing 1, and N is a power of 2;

[0221] In response to receiving a first ciphertext polynomial sent by the second party, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the first ciphertext polynomial is obtained by the second party performing homomorphic encryption on the first plaintext polynomial, and the first plaintext polynomial uses the first column vector as a coefficient vector;

[0222] A first data processing task is performed based on the second ciphertext polynomial.

[0223] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein performing a number-theoretic transformation on the second column vector on the ring A to obtain N polynomials includes:

[0224] Calculate (1,x,…,x N-1 ) and the first matrix to obtain a first row vector;

[0225] Performing a transposition operation on the first row vector to obtain a second column vector;

[0226] A multi-level recursive operation is used to implement a number-theoretic transformation of the second column vector on the ring A to obtain a third column vector;

[0227] Each row of the third column vector is determined as the N polynomials.

[0228] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein the method of using a multi-level recursive operation to implement a number-theoretic transformation of the second column vector on the ring A to obtain a third column vector includes:

[0229] S201, using the second column vector as input data for the l-th level recursive operation, where l is initially 1;

[0230] S202, calculating the operation factor of the first-level recursive operation, wherein the operation factor of the first-level recursive operation is For ring A The second primitive root of unity, and

[0231] S203, splitting the input data into a fourth column vector and a fifth column vector according to the parity of the index, wherein the fourth column vector is composed of the even-numbered rows of the input data, and the fifth column vector is composed of the odd-numbered rows of the input data;

[0232] S204, obtaining two output data of the first-level recursive operation according to the operation factors of the first-level recursive operation and the input data of the first-level recursive operation, wherein the two output data include the sum of the number-theoretic transformation result of the fourth column vector and a first product, and the difference between the number-theoretic transformation result of the fourth column vector and the first product, and the first product is the product of the operation factors of the first-level recursive operation and the number-theoretic transformation result of the fifth column vector;

[0233] S205, determining whether the dimension of the fourth column vector or the fifth column vector is 1; if not, executing S206; if yes, executing S207;

[0234] S206, let l be increased by 1, and use the fourth column vector and the fifth column vector as input data of the l-th level recursive operation respectively, and return to S202 to perform the l-th level recursive operation on the fourth column vector and the fifth column vector respectively;

[0235] S207, merging the output data of each level of recursive operation to obtain the third column vector.

[0236] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 1, wherein the step of performing the first data processing task based on the second ciphertext polynomial includes:

[0237] Generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial;

[0238] The random column vector is used as a second slice of the product, and a first data processing task is performed based on the second slice.

[0239] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 4, wherein the step of masking the second ciphertext polynomial using the random column vector to obtain the masked polynomial includes:

[0240] Using the random column vector as a coefficient vector, generating a second plaintext polynomial;

[0241] Performing homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial;

[0242] A difference between the second ciphertext polynomial and the fourth ciphertext polynomial is determined as the masking polynomial.

[0243] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 1, wherein generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial includes:

[0244] Performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials;

[0245] A second ciphertext polynomial is generated according to the N polynomials and the N third ciphertext polynomials.

[0246] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 6, wherein performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials includes:

[0247] Receiving a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key;

[0248] For each element of the modulo 2N multiplication group, the first ciphertext polynomial is rotated using the element and the Galois key to obtain a third ciphertext polynomial.

[0249] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 6, wherein generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials includes:

[0250] According to the N polynomials and the N third ciphertext polynomials, a second ciphertext polynomial is generated by the following formula:

[0251]

[0252] Wherein, ct(β) is the second ciphertext polynomial; v k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

[0253] According to one or more embodiments of the present disclosure, Example 9 provides the method described in any one of Examples 1-8, wherein the first data processing task is a machine learning model training task.

[0254] According to one or more embodiments of the present disclosure, Example 10 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-9 when executed by a processing device.

[0255] According to one or more embodiments of the present disclosure, Example 11 provides an electronic device, including:

[0256] a storage device having a computer program stored thereon;

[0257] A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-9.

[0258] According to one or more embodiments of the present disclosure, Example 12 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-9 when executed by a processor.

[0259] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0260] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0261] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A secure computing method based on homomorphic encryption, characterized in that: The secure calculation method is used by a first participant and a second participant to collaboratively calculate the product of a first N*N matrix and a first N-dimensional column vector, wherein the first matrix is ​​held solely by the first participant, and the first column vector is held solely by the second participant. The method is applied to the first participant, and includes: Perform number-theoretic transformation on the second column vector on ring A to obtain N polynomials, where the second column vector is (1, x, …, x N-1 ) and the first matrix, the independent variable x is the 2Nth primitive root of unity in the ring A, R is any commutative ring containing 1, and N is a power of 2; In response to receiving a first ciphertext polynomial sent by the second party, generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial, wherein the first ciphertext polynomial is obtained by the second party performing homomorphic encryption on the first plaintext polynomial, and the first plaintext polynomial uses the first column vector as a coefficient vector; A first data processing task is performed based on the second ciphertext polynomial.

2. The method according to claim 1, characterized in that The second column vector is subjected to number-theoretic transformation on the ring A to obtain N polynomials, including: Calculate (1,x,…,x N-1 ) and the first matrix to obtain a first row vector; Performing a transposition operation on the first row vector to obtain a second column vector; A multi-level recursive operation is used to implement a number-theoretic transformation of the second column vector on the ring A to obtain a third column vector; Each row of the third column vector is determined as the N polynomials.

3. The method according to claim 2, characterized in that The method of using a multi-level recursive operation to implement the number-theoretic transformation of the second column vector on the ring A to obtain the third column vector includes: S201, using the second column vector as input data for the l-th level recursive operation, where l is initially 1; S202, calculating the operation factor of the first-level recursive operation, wherein the operation factor of the first-level recursive operation is For ring A The second primitive root of unity, and S203, splitting the input data into a fourth column vector and a fifth column vector according to the parity of the index, wherein the fourth column vector is composed of the even-numbered rows of the input data, and the fifth column vector is composed of the odd-numbered rows of the input data; S204, obtaining two output data of the first-level recursive operation according to the recursive factor of the first-level recursive operation and the input data of the first-level recursive operation, wherein the two output data include the sum of the number-theoretic transformation result of the fourth column vector and a first product, and the difference between the number-theoretic transformation result of the fourth column vector and the first product, and the first product is the product of the operation factor of the first-level recursive operation and the number-theoretic transformation result of the fifth column vector; S205, determining whether the dimension of the fourth column vector or the fifth column vector is 1; if not, executing S206; if yes, executing S207; S206, let l be increased by 1, and use the fourth column vector and the fifth column vector as input data of the l-th level recursive operation respectively, and return to S202 to perform the l-th level recursive operation on the fourth column vector and the fifth column vector respectively; S207, merging the output data of each level of recursive operation to obtain the third column vector.

4. The method according to claim 1, characterized in that: The performing the first data processing task based on the second ciphertext polynomial includes: Generate an N-dimensional random column vector, use the random column vector to mask the second ciphertext polynomial to obtain a masking polynomial, and send the masking polynomial to the second participant, so that the second participant generates a first fragment of the product based on the masking polynomial; The random column vector is used as a second slice of the product, and a first data processing task is performed based on the second slice.

5. The method according to claim 4, characterized in that The step of masking the second ciphertext polynomial using the random column vector to obtain a masked polynomial includes: Using the random column vector as a coefficient vector, generating a second plaintext polynomial; Performing homomorphic encryption on the second plaintext polynomial to obtain a fourth ciphertext polynomial; A difference between the second ciphertext polynomial and the fourth ciphertext polynomial is determined as the masking polynomial.

6. The method according to claim 1, characterized in that The step of generating a second ciphertext polynomial according to the N polynomials and the first ciphertext polynomial includes: Performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials; A second ciphertext polynomial is generated according to the N polynomials and the N third ciphertext polynomials.

7. The method according to claim 6, characterized in that The performing N kinds of rotation operations on the first ciphertext polynomial to obtain N third ciphertext polynomials includes: Receiving a Galois key sent by the second participant, wherein the Galois key is generated by the second participant based on a homomorphic encryption private key; For each element of the modulo 2N multiplication group, the first ciphertext polynomial is rotated using the element and the Galois key to obtain a third ciphertext polynomial.

8. The method according to claim 6, characterized in that Generating a second ciphertext polynomial according to the N polynomials and the N third ciphertext polynomials includes: According to the N polynomials and the N third ciphertext polynomials, a second ciphertext polynomial is generated by the following formula: Wherein, ct(β) is the second ciphertext polynomial; v k (x) is the (k+1) / 2th polynomial among the N polynomials, is the ring of integers; σ k (ct) is the (k+1) / 2th ciphertext polynomial among the N third ciphertext polynomials.

9. The method according to any one of claims 1 to 8, characterized in that The first data processing task is a machine learning model training task.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 9 are implemented.

11. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 9.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images