Privacy preserving linear regression method

Abstract

The embodiment of the application provides a linear regression method based on privacy protection, which comprises the following steps: an ith participant determines a regularized symmetric matrix of a column-encrypted data transformation encrypted matrix corresponding to an original data matrix of the participant or a transformed form of the regularized symmetric matrix, and sends the regularized symmetric matrix or the transformed form to a first computing node; a jth participant cooperates with the ith participant to determine a product matrix of column-encrypted data transformation encrypted matrices of the jth participant and the ith participant or a transformed form of the product matrix, and the first computing node saves the product matrix or the transformed form; i and j are integers greater than or equal to 1 and less than or equal to m, j is not equal to i and j is less than i, and m is the total number of all participants; the first computing node cooperates with each participant and a label data owner to determine a multiplication encrypted linear regression coefficient vector by using the regularized symmetric matrix and the product matrix; the method provided by the application is simple, and encryption does not need to use complex mixing circuit technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning, and particularly relates to a linear regression method based on privacy protection. BACKGROUND

[0002] Multiple regression analysis refers to a statistical analysis method that establishes a linear or nonlinear mathematical model quantity relationship between multiple variables, taking one variable as a dependent variable and other one or more variables as independent variables, and analyzes sample data. Linear regression is a statistical analysis method that determines the interdependent relationship between variables by using regression analysis in mathematical statistics, and is widely used in fields such as finance, economy and medical treatment. Linear regression can be used to fit a prediction model for the values of an observation data set.

[0003] Vertical federated learning (VFL for short) is a distributed machine learning technology that allows multiple participants to jointly train on their respective data to establish a shared machine learning model. This learning method is suitable for scenarios with many overlapping samples and few overlapping features. For example, supermarkets and banks in the same area have similar users (samples), but different businesses (features). The key to vertical federated learning is that the samples should overlap and the features should be complementary, so that the effect of jointly training the model will generally be better than using private features to train.

[0004] In related methods for implementing vertical federated learning, an encryption service provider and an evaluation party are often introduced to ensure the execution and effect of encryption, and some linear regression methods with encryption requirements need to introduce complex garbled circuits, which makes the implementation of linear regression difficult. SUMMARY

[0005] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0006] The embodiments of the present application provide a linear regression method based on privacy protection, which is simpler to implement and does not require complex garbled circuits for encryption.

[0007] To achieve the above object, an embodiment of the present application provides a privacy protection based linear regression method, which comprises the following steps: for any ith participant, the ith participant determines a regularized symmetric matrix of a column-encrypted data transformation encrypted matrix corresponding to an original data matrix of the participant or other transformation forms of the regularized symmetric matrix, and sends the regularized symmetric matrix or the transformation forms thereof to a first computing node, wherein the transformation forms of the regularized symmetric matrix satisfy that the regularized symmetric matrix can be calculated without other information from the transformation forms; the jth participant cooperates with the ith participant to determine a product matrix of the column-encrypted data transformation encrypted matrices of the jth participant and the ith participant or a transformation form of the product matrix, and the first computing node saves the product matrix or the transformation form of the product matrix; wherein the transformation form of the product matrix satisfies that the product matrix can be calculated without other information from the transformation form; the i and j are integers greater than or equal to 1 and less than or equal to m, j is not equal to i and j is less than i, and m is the total number of all participants; the first computing node cooperates with each participant and a label data owner to determine a multiplication encrypted linear regression coefficient vector by using the regularized symmetric matrix of the column-encrypted data transformation encrypted matrix of each participant or the transformation form thereof, and the product matrix or the transformation form thereof between the jth participant and the ith participant.

[0008] In some embodiments, the product matrix of the column-encrypted data transformation encrypted matrices of the jth participant and the ith participant is equal to the product of the transpose of the column-encrypted data transformation encrypted matrix of the jth participant and the column-encrypted data transformation encrypted matrix of the ith participant, and the transformation form of the product matrix comprises the transpose of the product matrix, i.e. the product of the transpose of the column-encrypted data transformation encrypted matrix of the ith participant and the column-encrypted data transformation encrypted matrix of the jth participant, and the product matrix of the column-encrypted data transformation encrypted matrices of the jth participant and the ith participant or the transformation form thereof is determined or directly calculated by the jth participant and the ith participant based on a preset secure multi-party computation protocol.

[0009] In some embodiments, the column-encrypted data matrix corresponding to the i-th participant's own original data matrix is equal to the product of the i-th participant's column-encrypted data matrix and the i-th participant's first mask matrix; wherein the column-encrypted data matrix contains the original data matrix as a sub-matrix, and further includes each column of the original data matrix and a mask column generated by the participant or obtained from a trusted node, the mask column containing the same number of entries as each column of the participant's own original data matrix; and the i-th participant's first mask matrix is an invertible matrix generated by the i-th participant or obtained from a trusted node.

[0010] In some embodiments, the multiplication of the encrypted linear regression coefficient vector is equal to the column vector obtained by right-multiplying the target linear regression coefficient column vector by a block diagonal matrix composed of the first mask matrices of each participant after adding the influence of each participant's mask column to the target linear regression coefficient column vector, wherein the block diagonal matrix takes the inverse matrix of each participant's first mask matrix as a sub-matrix located on the diagonal of the block diagonal matrix.

[0011] In some embodiments, the first computing node utilizes the regularized symmetric matrix of the transformed encryption matrix of each of the participants or a transformed version thereof, and the product matrix of the jth participant and the ith participant or a transformed version thereof, and collaborates with each of the participants and the label data owner to determine the multiply-encrypted linear regression coefficient vector, including: the label data owner collaborates with any one of the participants respectively to determine the product of the transformed encryption matrix of the column-encrypted data of each of the participants and the label or a transformed version thereof according to the label column vector of the label data owner and the transformed encryption matrix of the column-encrypted data of the participant, and store the product of the transformed encryption matrix of the column-encrypted data of each of the participants and the label or a transformed version thereof in any one or more of the participant, the label data owner, the first computing node, and a trusted storage node respectively, wherein the transformed version of the product of the transformed encryption matrix of the column-encrypted data and the label satisfies that the product of the transformed encryption matrix of the column-encrypted data and the label can be calculated from the transformed version; any ith participant performs regularization processing on the symmetric matrix of itself to obtain the regularized symmetric matrix of the transformed encryption matrix of the column-encrypted data of the ith participant or a transformed version thereof, and sends the regularized symmetric matrix or the transformed version thereof to the first computing node, wherein when the first mask matrix of the ith participant is not an orthogonal matrix, the above regularization processing also uses the first mask matrix of the ith participant; any ith participant collaborates with a jth participant to utilize the respective transformed encryption matrix of the column-encrypted data to determine the product matrix of the transformed encryption matrix of the column-encrypted data of the jth participant and the ith participant or a transformed version thereof, and the first computing node saves the product matrix or the transformed version of the product matrix; the first computing node utilizes the regularized symmetric matrix of the transformed encryption matrix of the column-encrypted data of the ith participant, and the product matrix of the transformed encryption matrix of the column-encrypted data of the jth participant and the ith participant or a transformed version thereof, and collaborates with one or more nodes storing the product of the transformed encryption matrix of the column-encrypted data of each of the participants and the label or a transformed version thereof to determine the multiply-encrypted linear regression coefficient vector.

[0012] In some embodiments, the arbitrary ith participant regularizes the symmetric matrix of itself to obtain a regularized symmetric matrix of the column encryption data transformation encryption matrix of the ith participant, including: the regularized symmetric matrix of the column encryption data transformation encryption matrix of the ith participant is a sum of a symmetric matrix of the column encryption data transformation encryption matrix of the ith participant and a regularization term, and the regularization term is a product of a symmetric matrix of the first mask matrix of the ith participant and a regularization coefficient; wherein the symmetric matrix of the column encryption data transformation encryption matrix is equal to a product of a transpose of the column encryption data transformation encryption matrix and the column encryption data transformation encryption matrix itself, and the symmetric matrix of the first mask matrix of the ith participant is equal to a product of a transpose of the first mask matrix of the ith participant and the first mask matrix of the ith participant itself.

[0013] In some embodiments, the arbitrary ith participant and the arbitrary jth participant cooperate to determine a product matrix or a transformed form thereof of the column encryption data transformation encryption matrix of the jth participant and the column encryption data transformation encryption matrix of the ith participant using the column encryption data transformation encryption matrix of the jth participant and the column encryption data transformation encryption matrix of the ith participant, respectively, including: the arbitrary ith participant and the arbitrary jth participant cooperate to determine the product matrix or the transformed form thereof by the column encryption data transformation encryption matrix of the ith participant and the column encryption data transformation encryption matrix of the jth participant, and the product matrix or the transformed form thereof is obtained by a first computing node; wherein the product matrix of the column encryption data transformation encryption matrix of the ith participant and the column encryption data transformation encryption matrix of the jth participant is equal to a product of a transpose of the column encryption data transformation encryption matrix of the jth participant and the column encryption data transformation encryption matrix of the ith participant, and the transformed form of the product matrix includes a transpose of the product matrix, i.e. a product of a transpose of the column encryption data transformation encryption matrix of the ith participant and the column encryption data transformation encryption matrix of the jth participant.

[0014] In some embodiments, the first computing node collaborates with one or more nodes storing the product of the column-encrypted data transformation encryption matrix of each of the participants and the label to determine the multiplied encrypted linear regression coefficient vector, including that the multiplied encrypted linear regression coefficient vector is equal to the product of the inverse of the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of all the participants and the product of the column-encrypted data transformation encryption matrix of all the participants and the label, wherein the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of all the participants comprises sub-matrices including the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of each of the participants and the product matrix of the column-encrypted data transformation encryption matrix of any two different participants, and the product of the column-encrypted data transformation encryption matrix of all the participants and the label is composed of the product of the column-encrypted data transformation encryption matrix of each of the participants and the label.

[0015] In some embodiments, the label data owner collaborates with any one of the participants respectively to determine the product of the column-encrypted data transformation encryption matrix of each of the participants and the label or a transformed form thereof based on the label column vector of the label data owner and the column-encrypted data transformation encryption matrix of the participant, and store the product of the column-encrypted data transformation encryption matrix of each of the participants and the label or the transformed form thereof in any one or more of the participant, the label data owner, the first computing node and the trusted storage node respectively, including that the label data owner collaborates with any one of the participants to determine the product of the column-encrypted data transformation encryption matrix of the participant and the label or a transformed form thereof based on a preset secure multi-party computation protocol or a direct computation manner, i.e. the product of the transpose of the column-encrypted data transformation encryption matrix of the participant and the label column vector or a transformed form thereof, and store the product of the column-encrypted data transformation encryption matrix of the participant and the label or the transformed form thereof in one or more of the participants, the label data owner, the first computing node and the trusted storage node.

[0016] To achieve the above object, the second aspect of the present application proposes a privacy protection based linear regression system, which is used to execute the privacy protection based linear regression method of the first aspect.

[0017] To achieve the above object, the third aspect of the present application provides a computer readable storage medium, which comprises a stored computer program; wherein the computer program controls the device where the computer readable storage medium is located to execute the privacy protection based linear regression method according to the first aspect when running.

[0018] The embodiments of the present application at least have the following beneficial effects: each participant respectively encrypts the original data matrix owned by the participant, and the participant determines the symmetric matrix of the participant based on the column encrypted data transformation encryption matrix obtained by the participant through encryption, any two different participants determine the product matrix through the column encrypted data transformation encryption matrix of each participant, the first computing node obtains the symmetric matrix of each participant and the product matrix of any two participants, and then the first computing node calculates the encrypted linear regression coefficient vector by using the label column vector of the label data owner; compared with the prior art, the present application does not need to introduce an encryption service provider, and the initial encryption method is determined by each participant, and a complex confusion circuit is also not needed, so that the complexity of the linear regression process can be reduced, and the actual application requirements can be met; and by setting the first computing node, the first computing node is used for storing the intermediate generated data and overall calculating all participants and the label data owner, so that the linear regression method provided by the present application can be completed only by the user who owns the data and the first computing node, so that the data transmission overhead can be saved, and the encryption effect can be improved.

[0019] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be realized and achieved by the structure particularly pointed out in the specification, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings are included to provide a further understanding of the technical scheme of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical scheme of the present application, and do not constitute a limitation on the technical scheme of the present application.

[0021] Figure 1 An optional flowchart of the privacy protection based linear regression method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0022] In order to make the objects, technical scheme and advantages of the present application more clear, the present application is further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and do not limit the present application.

[0023] In the description of the present application, the meaning of several is one or more, the meaning of multiple is more than two, greater than, less than, more than, etc. are understood as not including the number, above, below, within, etc. are understood to include the number.

[0024] It should be noted that although the functional modules are divided in the device schematic diagram, the logical order is shown in the flowchart, but in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims or above figures are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0025] It should be noted that in each specific embodiment of the present application, when it is necessary to perform relevant processing according to the data related to the characteristics of the target object, such as target object attribute information or attribute information set, the permission or consent of the target object will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. Among them, the target object can be a user. In addition, when the embodiments of the present application need to obtain target object attribute information, the separate permission or separate consent of the target object will be obtained through a pop-up window or jumping to a confirmation page, and after obtaining the separate permission or separate consent of the target object, the necessary target object related data for the normal operation of the embodiments of the present application will be obtained.

[0026] In the related implementation of the longitudinal federated learning method, an encryption service provider and an evaluation party are often introduced to ensure the execution and effect of encryption, and some linear regression methods with encryption requirements need to introduce complex garbled circuits, which makes the implementation of linear regression difficult.

[0027] Based on this, the embodiments of the present application provide a linear regression method based on privacy protection, which is more simple and does not need to use complex garbled circuits and other technologies for encryption.

[0028] The linear regression method based on privacy protection provided by the embodiments of the present application is described in detail through the following embodiments. First, the longitudinal federated learning method in the embodiments of the present application is described.

[0029] The vertical federated learning method provided by the embodiments of the present application relates to the technical field of computers. The vertical federated learning method provided by the embodiments of the present application can be applied to a terminal, can be applied to a server end, and can also be software running in the terminal or the server end. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc.; the server end can be configured as a stand-alone physical server, can be configured as a server cluster or a distributed system formed by multiple physical servers, can also be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms; and the software can be an application that implements the vertical federated learning method, but is not limited to the above forms.

[0030] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0031] In linear regression learning, suppose there are n training samples, where the i-th (i = 1, 2, …, n) training sample includes a column vector of d input variables and the corresponding output variable y i , where represents a column vector including d items, and y i is a scalar. Regression is a problem of learning a function f, such that is close to y i , i.e. For example, the input variables can be a person's age, weight, body mass index, etc., and the output can be their likelihood of contracting a disease. After completing such a model, for a new x value, without being given a y value that matches it, a y value can be predicted using the fitted model. Linear regression is to learn a such that where is a column vector including the d-th item, (·) T denotes the transpose of a matrix. As mentioned previously, there are n training samples, where the i-th (i = 1, 2, …, n) training sample includes a column vector and a corresponding output variable y i . Write y i (i = 1, 2, …, n) as a column vector Write (i = 1, 2, …, n) as a matrix Thus define and A = X T X + λI, where λ is a regularization coefficient, usually a real number greater than or equal to zero; then, can be obtained by solving the linear equation

[0032] Machine learning is a branch of artificial intelligence that enables computer systems to learn from data and make decisions or predictions. This process involves algorithms and statistical models that enable computers to improve the performance of models without explicit programming by optimizing the loss function designed by the model. The goal of machine learning is to enable computers to automatically detect patterns in data and use these patterns to predict future data or make decisions.

[0033] The process of vertical federated learning usually includes encrypted sample alignment and encrypted model training. In the encrypted sample alignment phase, the privacy intersection technique is used to align training sample data with overlapping IDs without exposing the original data. In the encrypted model training phase, participants calculate intermediate results based on the current model, exchange them after encryption, then calculate their own encrypted gradients and send them to the coordinator, who returns the decrypted gradients to the participants for their respective model updates.

[0034] Vertical federated learning has wide applications in finance, healthcare, security, and education, etc. It solves the problem of data silos, enabling different institutions to utilize their respective data resources to jointly build more powerful machine learning models.

[0035] Secure Inner Product (SIP) is used between two parties holding vectors x and y, i.e., Party A holding x and Party B holding y can obtain the inner product of x and y through privacy-protected SIP, and the results of the inner product are placed in Party A and Party B, respectively. The sum of the results in Party A and Party B gives the inner product of vectors x and y.

[0036] ​A secure two-party inner product supported by a trusted initializer, whose security relies on the trusted initializer not colluding with the data providers, is as follows:

[0037] Participants: data provider 1 is called P1, data provider 2 is called P2, and the trusted initializer is called TI.

[0038] Input: column vector x owned by P1; column vector y owned by P2.

[0039] Output: P1 gets s1, and P2 gets s2, which satisfy s1 + s2 = <x, y>, where <x, y> represents the inner product of vectors x and y.

[0040] The secure inner product protocol has multiple implementations, one of which is as follows:

[0041] 1. TI generates random vectors a and b, and a random number r, and sets z = <a, b> - r. TI sends (a, r) to P1 and (b, z) to P2.

[0042] 2. P1 sends x + a to P2.

[0043] 3. P2 sends y - b to P1.

[0044] 4. P1 calculates its partial output s1 = <x, y - b> - r.

[0045] 5. P2 calculates its partial output s2 = <x + a, b> - z.

[0046] It is easy to verify that s1 + s2 = <x, y - b> - r + <x + a, b> - z = <x, y> - <x, b> - r + <x, b> + <a, b> - z = <x, y> + <a, b> - r - z, where z = <a, b> - r is substituted, and s1 + s2 = <x, y> is obtained.

[0047] The above secure inner product protocol is used to calculate A and b. It is easy to see that A = X T X + λI is a matrix symmetric about the diagonal, so only half of the non-diagonal terms need to be calculated. Generally, is calculated locally by user i who owns data X i ; and (i ≠ j, here it is assumed that only half of the upper triangle is calculated, so i < j; in fact, only the lower triangle i > j can also be calculated) needs to be calculated jointly by two parties, which can be calculated by the first participant user i using his own data X i and the second participant user j using his own data Xj The first and second participants jointly calculate the result using a privacy-preserving, secure multi-party computation algorithm. and It can be obtained by transposing the calculation result. Among them, or The result is additive fragmentation, with the result stored separately by user i and user j. Participants can reconstruct the matrix by concatenating the locally computed portions according to their local computation results; portions without local computation results are filled with 0s. Specifically, for... Only user i has a result; for all other m-1 users, this position is filled with 0. Only users i and j store the results of the addition sharding, while the other m-2 users fill this position with 0. After the above processing, each participant has a matrix Ai, where Ai represents the regularized symmetric matrix A = X owned by user i. T The i-th additive piece (i = 1, 2, ..., m) in X + λI, the corresponding

[0048] Assuming the label vector y belongs to the m-th user, then Included components (i = 1, 2, ..., m-1) is obtained through secure computation between the i-th user and the m-th user, and the results are stored separately for the i-th user and the m-th user. The results held by the i-th user and the m-th user are then added together. and This is obtained by the m-th user using their own data. Each participant also fills in any parts without local computation results with 0. After the above processing, each participant possesses a vector. Indicates what user i owns The i-th addition piece (i = 1, 2, ..., m), the corresponding

[0049] The aforementioned participants can be referred to as data providers P1, P2, ..., Pm, and each data provider Pi (i = 1, 2, ..., m) obtains A through the steps described above. i and A i The symmetric matrix A = X owned by user i T The i-th addition piece in X+λI, and It belongs to user i The i-th addition slice.

[0050] Reference Figure 1 As shown, the privacy-preserving linear regression method provided in Embodiment 1 of the present invention includes steps S11 to S12:

[0051] Step S11, for any ith participant, the ith participant determines a regularized symmetric matrix of the column-encrypted data transformation encrypted matrix corresponding to the original data matrix of the ith participant or other transformation forms of the regularized symmetric matrix, and sends the regularized symmetric matrix or the transformation form thereof to the first computing node, wherein the transformation form of the regularized symmetric matrix satisfies that the regularized symmetric matrix can be calculated without other information from the transformation form; the jth participant cooperates with the ith participant to determine a product matrix of the column-encrypted data transformation encrypted matrices of the jth participant and the ith participant or a transformation form of the product matrix, and the product matrix or the transformation form of the product matrix is saved by the first computing node; wherein the transformation form of the product matrix satisfies that the product matrix can be calculated without other information from the transformation form; i and j are integers greater than or equal to 1 and less than or equal to m, j is not equal to i and j is less than i, and m is the total number of all participants;

[0052] Step S12, the first computing node cooperates with each participant and the label data owner to determine the multiply-encrypted linear regression coefficient vector by using the regularized symmetric matrix of the column-encrypted data transformation encrypted matrix of each participant or the transformation form thereof, and the product matrix or the transformation form thereof between the jth participant and the ith participant.

[0053] It can be understood that after each participant encrypts the original data matrix owned by the participant, the participant determines the symmetric matrix of the participant based on the column-encrypted data transformation encrypted matrix obtained by the participant through encryption, any two different participants determine the product matrix through the column-encrypted data transformation encrypted matrices of the participants, the first computing node obtains the symmetric matrix of each participant and the product matrix of any two participants, and then the multiply-encrypted linear regression coefficient vector is calculated by using the label column vector of the label data owner; compared with the prior art, the initial encryption method is determined by each participant without introducing an encryption service provider, and a complex confusion circuit is also not needed, so that the complexity of the linear regression process is reduced, and the actual application requirements are met; and by setting the first computing node, the first computing node is used to store the intermediate generated data and to overall calculate all participants and the label data owner, therefore, the linear regression method proposed in the application can be completed only by the user who owns the data and the first computing node, so that the data transmission overhead is saved, and the encryption effect is improved.

[0054] The application is based on a privacy protection linear regression method, which is based on an application scenario of vertical federated learning jointly participated by m (m≥2) data owners providing private data, a label data owner owning label data, and a first computing node, wherein the m (m≥2) data owners providing private original data are referred to as m participants. The label data owner can be referred to as a label owner, and the label owner can be one of the m participants or another participant other than the m participants, that is, one of the m participants can own both original data and label data. The first computing node can be one of the m participants, or the label owner, or another trusted computing node other than the m participants and the label owner.

[0055] The i-th participant (i=1, 2…m) in the m participants forms an original data matrix X i The original data matrix is constructed as a column encryption data matrix The column encryption data matrix is multiplied by an invertible matrix Ω i to represent a column encryption data transformation encryption matrix The invertible matrix Ω i is referred to as the first mask matrix of the i-th participant. For i=1, 2…m, the i-th participant calculates and sends or equivalently sends to the first computing node; on the other hand, for j=1, 2…i-1, the i-th participant with the column encryption data transformation encryption matrix collaborates with the j-th participant with the column encryption data transformation encryption matrix to calculate the matrix and the first computing node obtains the R j,i . The i-th participant and the j-th participant collaborate to calculate is based on secure multi-party computation protocols, or is directly calculated. The direct calculation is that the i-th participant sends or equivalently sends its column encryption data transformation encryption matrix to the j-th participant, and the j-th participant directly calculates; or the j-th participant sends or equivalently sends its column encryption data transformation encryption matrix to the i-th participant, and the i-th participant directly calculates. The equivalent sending refers to not sending the matrix itself, but sending other transformed forms of the matrix, and the receiver can obtain the matrix itself from the received transformed forms.

[0056] The above secure multi-party computation is a general cryptographic primitive, which allows distributed participants to collaboratively compute any function of their private data without revealing their respective private data. It is easy to see that the computation of the above is the computation of the product of two matrices, and it is well known that the product of matrices can be represented as the vector inner product between the vectors contained in the matrices; correspondingly, the computation of the above uses a secure multi-party computation protocol, which can generally be a secure inner product protocol, which is a subset of many secure multi-party computation protocols, including many different schemes; and the secure inner product protocol introduced in the above of the present application is only one of the many secure inner product protocols. Of course, the secure multi-party computation protocol used in the computation of the above may also be other secure multi-party computation protocols that are not secure inner product protocols.

[0057] The label data owner who has a label column vector collaborates with the ith participant who has a column-encrypted data transformation encrypted matrix to compute where i is greater than or equal to 1 and less than or equal to m. The label data owner and the ith participant collaboratively compute which is based on a secure multi-party computation protocol, or is directly computed. The direct computation is that the ith participant sends or equivalently sends its column-encrypted data transformation encrypted matrix to the label data owner, and the label data owner directly computes. It is easy to see that the secure multi-party computation protocol used in the computation of the above may generally be a secure inner product protocol, or other secure multi-party computation protocols that are not secure inner product protocols.

[0058] Finally, the first computing node that has the matrix R i,i composed of R j,i (i = 1, 2…m) and R [1:m],[1:m] (j = 1, 2…i-1) collaborates with several nodes that have (i = 1, 2…m) to compute that satisfies to obtain the encrypted linear regression coefficient vector where the concatenated column vector represents the inverse matrix of the matrix R [1:m],[1:m] , and R [1:m],[1:m] is a symmetric matrix that satisfies The above R [1:m],[1:m] and the concatenated column vector will be further described below.

[0059] In this patent application, the i (i is greater than or equal to 1 and less than or equal to m) participants participating in the splicing matrix of the column-encrypted data transformation encryption matrix are denoted as 1, 2, …, i The column-encrypted data transformation encryption matrix of the i participants is abbreviated as the column-encrypted data transformation encryption matrix of the i participants. The symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants is called the symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants; correspondingly, The regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants is called the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants, and is abbreviated as the first regularized symmetric matrix of the i participants, where And It reflects the influence of the first mask matrix Ω1, Ω2…Ω i of each of the i participants. The above Ω [1:i] is a block diagonal matrix formed by aligning the matrices Ω1, Ω2, …, Ω [1:i] along the diagonal of Ω i , which can also be represented as Ω [1:i] = blkdiag(Ω1, Ω2, …, Ω i ) using the blkdiag function in the MATLAB software well known in the industry; because Ω1, Ω2, …, Ω i are the first mask matrices of the participants 1, 2, …, i, this patent application refers to the block diagonal matrix composed of the first mask matrices Ω1, Ω2, …, Ω [1:i] of the i participants as the first mask matrix group of the i participants, and Ω [1:i] is abbreviated as the first mask matrix of the i participants. Note that when i is greater than or equal to 2, the above is the first regularized symmetric matrix of multiple participants. When Ω [1:i] is an orthogonal matrix, the above can be simplified as which is equivalent to the regularized matrix of the general form of the symmetric matrix .

[0060] The above where is the column-encrypted data transformation encryption matrix of the m participants, and Ω [1:m] is the first mask matrix of the m participants. Correspondingly, R [1:m],[1:m] is the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the m participants. It can be deduced that R [1:m],[1:m] can be represented as

[0061]

[0062] wherein each matrix block on the diagonal of R [1:m],[1:m] is (i = 1, 2, …, m), and R [1:m],[1:m]The matrix blocks that are not on the diagonal are (i = 1, 2, ..., m, j = 1, 2, ..., m and i ≠ j). Because R [1:m],[1:m] It is a symmetric matrix, and its properties are easily derived. Correspondingly, there are the aforementioned

[0063] In the implementation methods given below, for R [1:m],[1:m] For matrix blocks not on the diagonal, only the matrix block at the upper right of the diagonal is calculated. (i = 1, 2…m, j = 1, 2…m, and j is less than i), and if R is needed [1:m],[1:m] The matrix block at the lower left of the middle diagonal (i = 1, 2…m, j = 1, 2…m, and j is less than i), then use We obtain the result. It's easy to see that for any pair of i and j satisfying "i = 1, 2…m, j = 1, 2…m, and j < i", we calculate... or Any one of them will do; if you need to use the other one, use... This relationship leads to the following principle, which easily yields various modifications to the implementation methods given below. In this application, for any set of i and j satisfying "i = 1, 2…m, j = 1, 2…m, and j < i", we define... This is called the product matrix of the column-encrypted data transformation encryption matrix of the j-th participant and the column-encrypted data transformation encryption matrix of the i-th participant. It is equal to the product of the transpose of the column-encrypted data transformation encryption matrix of the j-th participant and the column-encrypted data transformation encryption matrix of the i-th participant, and is simply referred to as the product matrix of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant. On the other hand, with the above... corresponding The above R is called j,i The transformed form. It's easy to see that in actual implementation, calculating the above R... j,i Or the above R j,i Any one of the transformation forms is acceptable.

[0064] The technical solution of the present invention includes steps S11 and S12, which are described below. First, we will describe the sub-steps S112-a to S112-e included in step S11, where the initial value of i is set to 1:

[0065] Sub-step S112-a: This sub-step is optional and involves adding a mask column. In this sub-step, the original data matrix X is already in use. i The i-th participant in its original data matrix X iAdding one or more columns of masking is an optional step; if this sub-step is not selected, it is equivalent to adding 0 columns of masking, i.e., adding a mask with 0 columns. The original data matrix X constructed by the i-th participant based on its private original data. i and the addition of an encryption mask matrix Δ i The generated data matrix with added mask columns This will also be referred to as column-encrypted data matrix for short.

[0066] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. Where the data matrix X of the i-th participant i There is τ i The column contains τ i The original data of each feature, and the added encryption mask matrix Δ i have The column is generated by the i-th participant or obtained from a trusted node. Indicates that there is τ i Column data matrix X i Added later Column-adding encryption mask matrix Δ i To obtain shared ownership Column-wise encrypted data matrix in It can be equal to 0, which is equivalent to the i-th participant not adding an additional column to the encryption mask matrix Δ. i To encrypt the original data; in addition, it is usually made A value of 1 provides excellent encryption; in this case, there is... Column-adding encryption mask matrix Δ i In reality, it's a single-column incrementing encryption mask column vector. If the i-th participant doesn't choose this optional incrementing mask column step, then the following steps will be used...

[0067] Sub-step S112-b: This sub-step is an optional sub-step of multiplying an invertible matrix for encryption. In this sub-step, the i-th participant uses its original data matrix X containing its own data. i A matrix that serves as a submatrix (i.e., a column-encrypted data matrix). Multiply by an invertible matrix Ω on the left i Obtain the product of the column-encrypted data matrix and the invertible matrix. As mentioned above, the invertible matrix Ω i The first mask matrix, referred to as the mask matrix for the i-th participant, is generated by the i-th participant or obtained from a trusted node. Correspondingly, the... is the encrypted matrix obtained by multiplying the column-encrypted data matrix by the first mask matrix, and is referred to as the column-encrypted data transformation encrypted matrix of the ith participant, because it is well known that multiplying the column-encrypted data matrix by the first mask matrix can be regarded as transforming the column-encrypted data matrix, and the transformation refers to multiplying the first mask matrix. The ith participant can also not use Ω i encryption, which is equivalent to Ω i is the identity matrix I, i.e. there is no actual operation in this step, i.e. no selection is made to use this sub-step.

[0068] Note that the above sub-steps S112-a and S112-b provide a double encryption mechanism by using the above mask column and the first mask matrix, respectively. When implementing the technology of the present application, generally at least one of the above double encryption mechanisms is used to ensure encryption. Correspondingly, if the number of mask columns in the sub-step S112-a is set to 0 (i.e. the encryption mechanism of the sub-step S112-a is not used), then generally the first mask matrix in the sub-step S112-b cannot be the identity matrix to ensure the effect of encryption; or when the first mask matrix in the sub-step S112-b is the identity matrix (i.e. the encryption mechanism of the sub-step S112-b is not used), generally the number of mask columns in the sub-step S112-a cannot be set to 0 to ensure the effect of encryption.

[0069] To achieve the effect of encryption, the column-encrypted mask matrix Δ i generated by the ith participant or obtained from the trusted node in the sub-step S112-a, and the first mask matrix Ω i generated by the ith participant or obtained from the trusted node in the sub-step S112-b, must be known only to the ith participant or known only to the ith participant and the trusted node. The above column-encrypted mask matrix Δ i and the first mask matrix Ω i generally can be generated by the ith participant or generated by the trusted node and then sent to the ith participant, and the generation generally adopts a random manner to achieve the effect of privacy. The simplest and most common implementation is that the above column-encrypted mask matrix Δ i and the first mask matrix Ω i are generated by the ith participant in a random manner.

[0070] Sub-step S112-c: the ith participant calculates and sends or equivalently sends R i,i to the first computing node. In the above R , R is the transpose of the column-encrypted data transformation encrypted matrix of the ith participant . ​the product of the symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant and the symmetric matrix of the column-encrypted data transformation encryption matrix of the jth participant, which is called the symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant and the jth participant, and is abbreviated as the symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant and the jth participant. Correspondingly, the above-mentioned the regularization symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant, which is called the first regularization symmetric matrix of the ith participant, and is obviously the first regularization symmetric matrix of the single participant, i.e., the ith participant. Since the regularization coefficient λ is usually a real number greater than or equal to zero, it is easy to see that when the regularization coefficient λ is equal to zero, the regularization symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant is equal to the symmetric matrix of the column-encrypted data transformation encryption matrix of the ith participant, that is, the above-mentioned regularization symmetric matrix contains the symmetric matrix as a special case. The above-mentioned , in which embodies the influence of the first mask matrix Ω i of the ith participant; when Ω i is an orthogonal matrix, then is equal to the identity matrix I, and the above-mentioned is simplified to which is equivalent to the regularized matrix of the general form of the symmetric matrix . The equivalent sending refers to sending one or more matrices related to R i,i , and the receiver of the matrix can obtain R i,i therefrom, for example, directly sending or sending and respectively, and the receiver obtains λ. It is easy to see that when the first mask matrix Ω i of the ith participant is not an orthogonal matrix, the first mask matrix Ω i of the ith participant is used in the process of obtaining the regularization symmetric matrix through the above-mentioned regularization processing; and when the first mask matrix Ω i of the ith participant is an orthogonal matrix, the first mask matrix Ω i of the ith participant is not used in the process of obtaining the regularization symmetric matrix through the above-mentioned regularization processing.

[0071] Sub-step S112-d: the ith participant who possesses the column-encrypted data transformation encryption matrix R collaborates with the jth participant who possesses the column-encrypted data transformation encryption matrix R to calculate the matrix R , and the first computing node obtains the above-mentioned R j,i , where j is greater than or equal to 1 and less than or equal to i-1. For each j greater than or equal to 1 and less than or equal to i-1, the operation of this step is performed to obtain a total of i-1 matrices R j,i , where j = 1, 2, …, i-1. The above-mentioned It is the column encryption data transformation encryption matrix of the j-th participant. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of these components is simply referred to as the product matrix of the encrypted data transformation encryption matrices of the j-th participant and the i-th participant. The above i-1 product matrices... (j=1,2…i-1) can be represented as a concatenated matrix It is easy to see that the above splicing matrix V i It is a column-encrypted data transformation encryption matrix with i-1 participants. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of It is simply referred to as the product matrix of the encryption transformation matrix of the i-1 participating columns and the encryption transformation matrix of the i-th participating column, where the i-1 participating columns are participating 1, 2, ... i-1.

[0072] It is easy to see that the above product matrix R j,i Other forms can also be used, such as... That is, the column encryption data of the i-th participant is transformed into an encryption matrix. transpose Transform the encrypted data of the j-th participant into an encryption matrix. If the product is , then the corresponding modifications can be made to the embodiment, which is an obvious variation of the implementation method.

[0073] This sub-step calculation It is determined or directly calculated by the j-th participant and the i-th participant through collaboration, based on a preset secure multi-party computation protocol. The direct calculation involves the i-th participant transforming its own column-encrypted data into an encryption matrix. Send it to participant j, who can then use its own... and received Direct calculation Alternatively, the j-th participant can transform its own column-encrypted data into an encryption matrix. Send it to the i-th participant, who can then use its own... and received Direct calculation

[0074] As mentioned above, the above calculations The security multi-party computation protocol used can be a security inner product protocol or other security multi-party computation protocol not belonging to the security inner product protocol. The security inner product protocol is a well-known prior art and has various implementations. Generally, the jth participant and the ith participant each obtain a part of R j,i by calculation, and the jth participant sends the part of R j,i to the ith participant, and the ith participant adds the two parts to obtain R j,i . In the above calculation process, the of the jth participant does not need to be directly sent to the ith participant, and the of the ith participant does not need to be directly sent to the jth participant, and generally includes sending the ciphertext obtained by further encrypting the and . It is noted that there are some security inner product protocols in the prior art, in which the ith participant, the jth participant and the first computing node all participate in the calculation agreed in the security inner product protocol, and the is calculated by the cooperation of the three nodes, and the final result R j,i is stored in the first computing node. In the above security inner product protocol, not only the ith participant and the jth participant cooperate to calculate R j,i , but also the first computing node participates to calculate R j,i .

[0075] Sub-step S112-e (sub-step of iteration control): if the value of i is less than or equal to m-1, the value of i is increased by 1, and then the sub-step S112-a is returned to start the next iteration; otherwise, when the value of i is equal to m, the following step S12 is entered.

[0076] In order to further protect the data privacy of the participants 1, 2, …, i-1, as described above, the embodiment includes an implementation manner of using a security multi-party computation protocol (Secure Multi-Party Computation protocols), which can calculate (j = 1, 2, …, i-1) without the participant i receiving the column encryption data transformation encryption matrix of the participants 1, 2, …, i-1, and the participants 1, 2, …, i-1 also not receiving the column encryption data transformation encryption matrix of the participant i.

[0077] When the value of i is equal to m, the first computing node has obtained each (i = 1, 2, …, m) and (i = 1, 2…m, and the corresponding j = 1, 2…i-1). The first computation node can thus obtain a symmetric matrix. R [1:m],[1:m] This is called the regularized symmetric matrix of the column encryption data transformation encryption matrix with m participants, or simply the first regularized symmetric matrix with m participants, because it is easy to see. in It is a transformation encryption matrix for column-encrypted data involving m participants, and Ω [1:m] Let Ω be the first mask matrix of m participants. [1:m] If it is an orthogonal matrix, then the above Simplified to It is equivalent to a symmetric matrix. The regularized matrix in its usual form.

[0078] In the next step S12, the tag data owner transforms the encryption matrix based on the private tag column vector, the first computing node, and the encrypted data of each column. The m participants (i.e., m data owners) of (i = 1, 2, ..., m) collaborate to calculate the multiplied encrypted linear regression coefficient vector. That is, multiply the encryption mask by the linear regression coefficient vector.

[0079] The steps for calculating the encrypted linear regression coefficient vector in this embodiment of the invention are as follows: The tag data owner uses a privately owned tag column vector. The tag data is transformed into an encryption matrix with each of its own encrypted data columns. m participants (i = 1, 2, ..., m) collaborate to calculate... For i = 1, 2, ..., m; the above m column vectors (i = 1, 2, ..., m) can be represented as a concatenated column vector. Subsequently, all relevant nodes, including the first computing node, collaborated on computation. To obtain the multiplicative encrypted linear regression coefficient vector In this patent application document, This is called the inverse of the regularized symmetric matrix of the encryption matrix transformed by the i-th participating parties, or simply the inverse of the first regularized symmetric matrix of the i-th participating parties. Correspondingly, the above... It is called the inverse of the regularized symmetric matrix of the encryption matrix of the encrypted data transformation of m participating parties, or simply the inverse of the first regularized symmetric matrix of the m participating parties.

[0080] The above It is the column encryption data transformation encryption matrix of the i-th participant. transpose the product of the label column vector of the label data owner and the column-encrypted data transformation encryption matrix of the ith participant , which is abbreviated as the ith participant column-encrypted data transformation encryption matrix and label product. It can be easily seen that the product of the transpose of the column-encrypted data transformation encryption matrix of the m participants and the label column vector is , that is This shows that the spliced label column vector is the product of the transpose of the column-encrypted data transformation encryption matrix of the m participants and the label column vector, which is abbreviated as the column-encrypted data transformation encryption matrix of the m participants and label product.

[0081] The step S12 includes steps S121 to S122.

[0082] Step S121: The label data owner, which can be represented as a label column vector , cooperates with the ith participant, which has a column-encrypted data transformation encryption matrix , to calculate the ith participant column-encrypted data transformation encryption matrix and label product , and stores in a plurality of nodes, where i is greater than or equal to 1 and less than or equal to m. For each i greater than or equal to 1 and less than or equal to m, the operation of this step is performed to obtain the column-encrypted data transformation encryption matrix of the m participants , where i = 1, 2, …, m. This sub-step calculates the ith participant column-encrypted data transformation encryption matrix and label product There can be various implementation manners, and several possible implementation manners are listed as follows:

[0083] Implementation manner 1): Obtaining the calculation result by the ith specific node (i = 1, 2, …, m). This implementation manner 1) calculates which is determined or directly calculated by the label data owner and the ith participant based on a preset secure multi-party computation protocol. Based on the specific implementation manner of the secure multi-party computation protocol, the ith participant and the label data owner each obtain a partial result, and then they send the respective obtained partial results to the ith specific node, and the ith specific node combines the two partial results to obtain In addition, when the ith specific node is not the ith participant or the label data owner, for example, the ith specific node is the first calculation node, then there are some secure multi-party computation protocols in the prior art, which are used to calculate by the cooperation of the ith specific node, the ith participant and the label data owner. and the final result send to the tag data owner, then the tag data owner uses the tag column vector owned by himself to multiply and the received to obtain and then send to the ith specific node. It is easy to see that when the above-mentioned ith specific node is the ith participant or the tag data owner, part of the above-mentioned sending is sending to oneself, which actually does not require any operation.

[0084] Implementation mode two) calculation result (i = 1, 2…m) is divided into two parts, that is, and are respectively placed in two nodes called the ith node A and the ith node B, and the above-mentioned and satisfy This implementation mode usually uses a secure multi-party computation protocol to calculate and the calculation result is divided into and to be respectively placed in two nodes. The calculation results placed in two nodes are added to obtain The two nodes, namely the ith node A and the ith node B, can be the tag data owner and the ith participant, or other two nodes.

[0085] This step has a simple implementation mode: when the implementation mode one is adopted, and the above-mentioned ith specific node is the tag data owner, all the calculation results (i = 1, 2…m) are in the tag data owner.

[0086] Step S122: The first calculation node that owns the regular symmetric matrix R [1:m],[1:m] of the column encryption data transformation encryption matrix of the m participants cooperates with several nodes that own the product of the column encryption data transformation encryption matrix of the ith participant and the tag (i = 1, 2…m) to calculate to obtain the multiplication encryption linear regression coefficient vector It is easy to see that the above-mentioned is the result of multiplying the inverse matrix of the regular symmetric matrix of the column encryption data transformation encryption matrix of the m participants by the product of the column encryption data transformation encryption matrix of the m participants and the tag. This step has several possible implementation modes, some of which are listed as follows:

[0087] Implementation mode one) when the implementation mode one is adopted in step S121, in this step, the first calculation node that owns R [1:m],[1:m] cooperates with each ith specific node (wherein i = 1, 2…m) that owns to obtain Calculated It can be placed on one node, or on multiple nodes.

[0088] let Then we can get And it can be represented as

[0089] Right now

[0090] Where Γ(:,i) (i = 1, 2, ..., m) represents the matrix Γ starting from the first...m... Listed to number All columns of a column can be referred to as the product of the encryption matrix and the tag corresponding to the i-th participating column's encrypted data transformation. Several columns. Correspondingly, the calculation yields... And one implementation method that places them on multiple nodes is to have R [1:m],[1:m] The first computing node and owning The collaboration of the i-th specific node (i = 1, 2, ..., m) yields the following results: of

[0091] Quantity (i = 1, 2, ..., m) and placed in the i-th coefficient storage node, wherein the i-th coefficient storage node may be the i-th specific node, or the first calculation node, or other nodes.

[0092] Implementation Method Two) If Implementation Method Two is adopted in step S121, then in this step, R has [1:m],[1:m] The first computing node and its respective share Two nodes (i = 1, 2, ..., m), namely node i-th node A and node i-th node B, cooperate to calculate... Note that the value of i above is 1, 2, ..., m. The calculated... It can be placed on one node, or on multiple nodes.

[0093] Bundle Substitution It can be obtained Correspondingly, One way to implement this is to place it on multiple nodes: have R [1:m],[1:m] The first computing node and its ownership The i-th node A (i = 1, 2, ..., m) collaborates to calculate... The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node A, where the i-th coefficient storage node A can be the i-th node A, the first computation node, or other nodes; on the other hand, having R [1:m],[1:m]The first computing node and its ownership The i-th node B in (i = 1, 2, ..., m) collaborates, and the calculation yields... The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node B, which can be the i-th node B, the first computing node, or other nodes.

[0094] From the above As can be seen, calculation First, the encrypted data from m participating parties is transformed into a regularized symmetric matrix R of the encryption matrix. [1:m],[1:m] The inverse of the regularized symmetric matrix of the encryption matrix obtained from the column encryption data of m participants is then obtained. Finally, the inverse matrix is ​​obtained. and The product of, where It is the product of the encryption matrix and the label of the column-encrypted data transformation of m participants.

[0095] The multiplication encryption linear regression coefficient vector With an additional encrypted mask matrix Δ containing all participating parties i (where i = 1, 2, ..., m) affects the vector of target linear regression coefficients. The relationship between them is That is, multiply the encrypted linear regression coefficient vector It is the target linear regression coefficient vector that includes the influence of the added encryption mask matrix of each participant. Right multiplication of a matrix The result of encryption, where the matrix It is a block diagonal matrix Ω composed of m participants multiplied by an encryption mask. [1:m] The inverse matrix. When step S121 adopts the simple implementation of the above expression, that is, all the calculation results (i = 1, 2, ..., m) are all owned by the label data owner, so this step can also be implemented in a simpler way: that is, by the owner of R [1:m],[1:m] The first computing node and owning Collaborate with the tag data owner to calculate And put Placed on the first computing node or by the tag data owner. When If placed on the first computing node, it will be handled by the tag data owner. The data is sent to the first computing node, where it is calculated. Or, when If placed on the tag data owner, then the first computing node will transfer R. [1:m],[1:m] Send or equivalently send to the tag data owner, who will calculate the result. the equivalent sending R [1:m],[1:m] , the receiver can obtain R [1:m],[1:m] by the matrix, for example, sending or the decomposition factor matrix of R [1:m],[1:m] , or the decomposition factor matrix of R m .

[0096] The multiplication-addition encryption linear regression coefficient vector After that, the subsequent steps of the above-mentioned embodiments of the present application achieve the effect that if there are several participants in the participants 1 to m using the non-zero column augmented encryption mask matrix, then the several participants successively at least partially eliminate the influence of their augmented encryption mask matrix Δ in the multiplication-addition encryption square root matrix P m and the multiplication-addition encryption linear regression coefficient vector , wherein the multiplication-addition encryption square root matrix P m is the square root matrix of the matrix , and can be obtained by . When each participant using the non-zero column augmented encryption mask matrix has at least partially eliminated the influence of the augmented encryption mask matrix Δ of the participant in the multiplication-addition encryption linear regression coefficient vector , or when there is no participant using the non-zero column augmented encryption mask matrix, then the participant or node having the most recently updated multiplication-addition encryption linear regression coefficient vector sends the several items corresponding to the participant i (here i is greater than or equal to 1 and less than or equal to m) in to the participant i, which is decrypted by the participant i using the inverse matrix i of the first mask matrix Ω i of the participant i to obtain the corresponding several items in the target linear regression coefficient vector.

[0097] In the present application, for the sake of simplicity of description, it is assumed that the columns of the column-encryption data matrix of the i-th participant are arranged in the following order: The first τ i columns of i are the original data matrix X i , and the latter columns are the mask matrix Δ ; in practice, the columns of may also be arranged in other ways, and the corresponding specific embodiments of the present application can be slightly modified, which is well known to those skilled in the art.

[0098] The above merely describes preferred embodiments of the present application, and it should be noted that those skilled in the art can make several improvements and modifications without departing from the technical principles of the present application, and these improvements and modifications should also be considered as falling within the protection scope of the present application.

[0099] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0100] Those skilled in the art can understand that, Figure 1 The technical solutions shown in the above description do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than those shown, or combine certain steps, or different steps.

[0101] Those skilled in the art can understand that all or some steps in the above disclosed method, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware and appropriate combinations thereof.

[0102] The terms "first", "second", "third", "fourth" and the like used in the description of the present application and the above drawings, if any, are used to distinguish similar objects, and do not necessarily have to describe a particular order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0103] It should be understood that, in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally represents a "or" relationship between the associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0104] The preferred embodiments of the present application are described above with reference to the accompanying drawings, and are not limited to the scope of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the present application shall be within the scope of the present application.

Claims

1. A privacy-preserving linear regression method, characterized in that, include: For any i-th participant, the i-th participant determines the regularized symmetric matrix or other transformation form of the column-encrypted data transformation encryption matrix corresponding to its original data matrix, and sends the regularized symmetric matrix or its transformation form to the first computing node. The transformation form of the regularized symmetric matrix satisfies the condition that the regularized symmetric matrix can be calculated without other information. The j-th participant collaborates with the i-th participant to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix of each participant, and the first computing node saves the product matrix or its transformation form. The transformation form of the product matrix satisfies the condition that the product matrix can be calculated without other information. i and j are both integers greater than or equal to 1 and less than or equal to m, j is not equal to i and j is less than i, and m is the total number of all participants. The first computing node utilizes the regularized symmetric matrix or its transformation form of the column encrypted data transformation encryption matrix of each of the participating parties, as well as the product matrix or its transformation form between the j-th participating party and the ith participating party, to collaborate with each of the participating parties and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector. The column-encrypted data transformation encryption matrix corresponding to the original data matrix of the i-th participant is equal to the product of the column-encrypted data matrix of the i-th participant and the first mask matrix of the i-th participant; wherein, the column-encrypted data matrix includes the original data matrix as a sub-matrix, and includes each sub-column of the original data matrix and the mask column generated by the participant or obtained from the trusted node, the number of items contained in the mask column is the same as the number of items contained in each column of the original data matrix of the participant; and the first mask matrix of the i-th participant is an invertible matrix, generated by the i-th participant or obtained from the trusted node.

2. The privacy-preserving linear regression method according to claim 1, characterized in that, The product matrix of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant is equal to the product of the transpose of the column-encrypted data transformation encryption matrix of the j-th participant and the column-encrypted data transformation encryption matrix of the i-th participant. The transformation form of the product matrix includes the transpose of the product matrix, i.e., the product of the transpose of the column-encrypted data transformation encryption matrix of the i-th participant and the column-encrypted data transformation encryption matrix of the j-th participant. The product matrix of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant, or its transformation form, is determined or directly calculated by the j-th participant and the i-th participant in collaboration based on a preset secure multi-party computation protocol.

3. The privacy-preserving linear regression method according to claim 2, characterized in that, The multiplication of the encrypted linear regression coefficient vector is equal to the column vector obtained by right-multiplying the target linear regression coefficient column vector by the influence of the mask columns of each of the participants, and then multiplying it by the block diagonal matrix composed of the first mask matrices of each of the participants. The block diagonal matrix uses the inverse of the first mask matrix of each of the participants as a submatrix located on the diagonal of the block diagonal matrix.

4. The privacy-preserving linear regression method according to claim 1, characterized in that, The first computing node utilizes the regularized symmetric matrix or its transformation form of the encryption matrix transformed by the column encryption data of each of the participating parties, and the product matrix or its transformation form between the j-th and i-th participating parties, and collaborates with each of the participating parties and the tag data owner to determine the multiplicative encryption linear regression coefficient vector, including: The tag data owner collaborates with any one of the participating parties to determine the product of the column encryption data transformation encryption matrix and the tag, or its transformation form, for each participating party based on the tag column vector of the tag data owner and the column encryption data transformation encryption matrix of the participating party. The product of the column encryption data transformation encryption matrix and the tag, or its transformation form, for each participating party is stored in any one or more nodes among the participating party, the tag data owner, the first computing node, and the trusted storage node. The transformation form of the column encryption data transformation encryption matrix and the tag product satisfies the condition that the product of the column encryption data transformation encryption matrix and the tag can be calculated from this transformation form. Any i-th participant performs regularization processing on its own symmetric matrix to obtain a regularized symmetric matrix or its transformation form of the column encryption data transformation encryption matrix of the i-th participant, and sends the regularized symmetric matrix or its transformation form to the first computing node. Wherein, when the first mask matrix of the i-th participant is not an orthogonal matrix, the above regularization processing also uses the first mask matrix of the i-th participant. Any i-th participant and j-th participant collaborate to use their respective column-encrypted data transformation encryption matrices to determine the product matrix or its transformation form of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant, and the first computing node saves the product matrix or the transformation form of the product matrix. The first computing node uses the regularized symmetric matrix of the column encryption data transformation encryption matrix of the i-th participant, and the product matrix or its transformation form of the column encryption data transformation encryption matrix of the j-th participant and the i-th participant, to cooperate with one or more nodes that store the column encryption data transformation encryption matrix and the label product or its transformation form of each participant to determine the multiplicative encryption linear regression coefficient vector.

5. The privacy-preserving linear regression method according to claim 4, characterized in that, The i-th participant performs regularization processing on its own symmetric matrix to obtain a regularized symmetric matrix of the column encryption data transformation encryption matrix of the i-th participant, including: The regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i-th participant is the sum of the symmetric matrix of the column-encrypted data transformation encryption matrix of the i-th participant and the regularization term, wherein the regularization term is the product of the symmetric matrix of the first mask matrix of the i-th participant and the regularization coefficient; wherein the symmetric matrix of the column-encrypted data transformation encryption matrix is ​​equal to the product of the transpose of the column-encrypted data transformation encryption matrix and the column-encrypted data transformation encryption matrix itself, and the symmetric matrix of the first mask matrix of the i-th participant is equal to the product of the transpose of the first mask matrix of the i-th participant and the first mask matrix itself.

6. The privacy-preserving linear regression method according to claim 4, characterized in that, The collaboration between any i-th participant and j-th participant, utilizing their respective column-encrypted data transformation encryption matrices, determines the product matrix or its transformation form of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant, including: Any i-th participant and j-th participant collaborate to determine a product matrix or its transformation form by the column encryption data transformation encryption matrix of the i-th participant and the column encryption data transformation encryption matrix of the j-th participant, and the first computing node obtains the product matrix or its transformation form. Wherein, the product matrix of the column encryption data transformation encryption matrix of the i-th participant and the column encryption data transformation encryption matrix of the j-th participant is equal to the product of the transpose of the column encryption data transformation encryption matrix of the j-th participant and the column encryption data transformation encryption matrix of the i-th participant, and the transformation form of the product matrix includes the transpose of the product matrix, that is, the product of the transpose of the column encryption data transformation encryption matrix of the i-th participant and the column encryption data transformation encryption matrix of the j-th participant.

7. The privacy-preserving linear regression method according to claim 4, characterized in that, The first computing node utilizes the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i-th participant, and the product matrix or its transformation form of the column-encrypted data transformation encryption matrices of the j-th participant and the i-th participant, to collaborate with one or more nodes storing the product or its transformation form of the column-encrypted data transformation encryption matrices of each participant and their labels, to determine the multiplicative encryption linear regression coefficient vector, including: The multiplicative encrypted linear regression coefficient vector is equal to the inverse of the regularized symmetric matrix of the column encrypted data transformation encryption matrix of all the participants and the product of the column encrypted data transformation encryption matrix of all the participants and the label. The regularized symmetric matrix of the column-encrypted data transformation encryption matrix of all the participants includes the following sub-matrices: the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of each participant, and the product matrix of the column-encrypted data transformation encryption matrices of any two different participants; and the product of the column-encrypted data transformation encryption matrix and the label of all the participants is composed of the product of the column-encrypted data transformation encryption matrix and the label of each participant.

8. The privacy-preserving linear regression method according to claim 4, characterized in that, The tag data owner collaborates with any one of the participating parties to determine the product of the column encryption matrix of each participating party and the tag column vector, or its transformation form, based on the tag column vector of the tag data owner and the column encryption data transformation encryption matrix of the participating party. The product of the column encryption matrix of each participating party and the tag column vector, or its transformation form, is then stored on any one or more nodes among the participating party, the tag data owner, the first computing node, and the trusted storage node, including: The tag data owner collaborates with any i-th participant to determine the product of the column encryption data transformation encryption matrix and the tag, or its transformation form, of the i-th participant, based on a preset secure multi-party computation protocol or a direct computation method. That is, the product of the transpose of the column encryption data transformation encryption matrix of the i-th participant and the tag column vector, or its transformation form. The calculated product of the column encryption data transformation encryption matrix and the tag, or its transformation form, of the i-th participant is stored in one or more nodes among the multiple participants, the tag data owner, the first computation node, and the trusted storage node.

9. A privacy-preserving linear regression system, characterized in that, The privacy-preserving linear regression system is used to perform the privacy-preserving linear regression method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the privacy-preserving linear regression method as described in any one of claims 1 to 8.

Images