Privacy preserving linear regression method

Abstract

The embodiment of the application provides a privacy protection-based linear regression method, which comprises the following steps: a current participant receives an inverse decomposition factor matrix of a regular symmetric matrix affected by column encryption data transformation encryption matrix corresponding to private original data of previous participants or a transformed form of the inverse decomposition factor matrix; the current participant cooperates with the previous participants to determine a respective product matrix or a transformed form of the product matrix; the current participant sends the inverse decomposition factor matrix or the transformed form of the inverse decomposition factor matrix to subsequent participants; or, the current participant obtains and utilizes the product matrix or the transformed form of the product matrix of the previous participants and the current participant, cooperates with the previous participants and a label data owner to determine a multiplication encryption linear regression coefficient vector; the multiplication encryption linear regression coefficient vector is equal to the product of the respective inverse decomposition factor matrix of the previous participants and the current participant and a first product vector; the method provided by the application can reduce the implementation complexity and meets the actual application requirement.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of machine learning technology, and in particular to a privacy-preserving linear regression method. Background Technology

[0002] Vertical Federated Learning (VFL) is a distributed machine learning approach that allows multiple participants to collaboratively train a shared machine learning model while protecting their individual data privacy. This method is particularly suitable for datasets with similar samples (such as users or transactions) but different features, such as banks and e-commerce companies in the same region, whose user bases may be similar but whose business characteristics differ. Challenges facing VFL include privacy protection, data alignment, communication efficiency, and security. To address these challenges, researchers have proposed various techniques, such as additive homomorphic encryption, secure multi-party computation, and differential privacy. VFL has wide applications in finance, healthcare, advertising, and recommender systems. For example, banks and insurance companies can jointly train a credit scoring model without directly sharing their respective customer data. In VFL, data is vertically partitioned, meaning each participant possesses a different set of features. For example, one participant might have users' transaction data, while another might have users' social network data. In this way, each participant can collaboratively train a more comprehensive model without directly accessing the other's data.

[0003] In existing longitudinal federated learning techniques for implementing linear regression, in order to ensure the data security of each data owner, it is often necessary to encrypt the service provider and the evaluator, or to introduce obfuscation circuits to ensure the security of the data computation and interaction process. However, the above methods are complex and not conducive to implementation in practical applications. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This application provides a privacy-preserving linear regression method that reduces implementation complexity and meets practical application needs.

[0006] To achieve the above objectives, a first aspect of this application proposes a privacy-preserving linear regression method, comprising: a current participant receiving an inverse factor matrix of a regularized symmetric matrix or a transformation form of the inverse factor matrix, which is influenced by the column-encrypted data transformation encryption matrix corresponding to the private original data of preceding participants; the current participant collaborating with the preceding participants to determine, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data, a product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, or a transformation form of the product matrix; the current participant sending, in whole or in part, the inverse factor matrix of the regularized symmetric matrix or the transformation form of the inverse factor matrix, which is influenced by the column-encrypted data transformation encryption matrix of the preceding participants and the current participant; or, the current participant... Participants obtain and utilize the product matrix or its transformation form of the column-encrypted data transformation encryption matrix of each of the preceding participants and the current participant, and collaborate with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participants are the participants who subsequently provide the private original data; the multiplicative encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrix of each of the preceding participants and the current participant, and the first product vector, which is determined by the transpose of the inverse decomposition factor matrix and the product of the column-encrypted data transformation encryption matrix of the preceding participants and the tag, and the product of the column-encrypted data transformation encryption matrix of the current participant and the tag; the transformation form of the matrix satisfies that the matrix can be calculated from this transformation form without other information.

[0007] In some embodiments, the product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participants is equal to the product of the transpose of the column-encrypted data transformation encryption matrix of the preceding participants and the column-encrypted data transformation encryption matrix of the current participants. The product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participants, or its transformation form, is determined or directly calculated by the preceding participants and the current participants in cooperation based on a preset secure multi-party computation protocol.

[0008] In some embodiments, the column-encrypted data transformation encryption matrix corresponding to the private original data of any participant is equal to the product of the column-encrypted data matrix of the arbitrary participant and the first mask matrix of the arbitrary participant; wherein, the column-encrypted data matrix of the arbitrary participant is a submatrix of the original data matrix formed by the private original data of the arbitrary participant, the column-encrypted data matrix includes each sub-column of the original data matrix and a mask column generated by the arbitrary participant itself or obtained from a trusted node, and the number of items contained in the mask column is equal to the number of items in the arbitrary participant's own... The original data matrix contains the same number of items in each column; and the first mask matrix of any participant is an invertible matrix, generated by the participant itself or obtained from a trusted node; wherein, multiplying the encrypted linear regression coefficient vector is equal to adding the influence of the mask columns of each participant to the target linear regression coefficient column vector, and then right-multiplying it by the block diagonal matrix composed of the first mask matrices of each participant, wherein the block diagonal matrix contains the inverse matrix of the first mask matrix of each participant as a submatrix located on the diagonal of the block diagonal matrix.

[0009] In some embodiments, including the influence of the column-encrypted data transformation encryption matrix of the preceding participants is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants as a submatrix; including the influence of the column-encrypted data transformation encryption matrix of each of the preceding participants and the current participant is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants and the column-encrypted data transformation encryption matrix of the current participant as submatrixes; wherein, the regularized symmetric matrix of a matrix is ​​the sum of the symmetric matrix of the matrix plus a regularization term, wherein the regularization term is a matrix that includes the product of the symmetric matrix of the first mask matrix of the relevant participant and a preset regularization coefficient as a submatrix; the symmetric matrix of a matrix is ​​equal to the product of the transpose of the matrix and the matrix itself; the inverse decomposition factor matrix of the regularized symmetric matrix is ​​the decomposition factor matrix of the inverse matrix of the regularized symmetric matrix, and the decomposition factor matrix is ​​a square root matrix or LDL matrix. T One of the L-factor matrices in the decomposition.

[0010] In some embodiments, the current participant collaborates with the preceding participants to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix corresponding to their respective private original data. The current participant then sends, in whole or in part, the inverse factor matrix or transformation form of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrices of the preceding and current participants. Alternatively, the current participant obtains and utilizes the product matrix or transformation form of the column-encrypted data transformation encryption matrix of the preceding and current participants, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector. The subsequent participants are those that subsequently provide the private original data, including: the current participant collaborating with the preceding participants to determine the product matrix or transformation form of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrix of the preceding and current participants. The encrypted data transformation encryption matrix of the preceding participants determines the product matrix or its transformation form, which is obtained by the current participant. The current participant uses the product matrix or its transformation form of the encrypted data transformation encryption matrix of the preceding participants and the current participant to obtain the inverse decomposition factor matrix or its transformation form of the regularized symmetric matrix containing the influence of the encrypted data transformation encryption matrices of the preceding participants and the current participant. The current participant then sends all or part of the inverse decomposition factor matrix or its transformation form to the subsequent participants. After all the participants have participated in calculating the inverse decomposition factor matrix or its transformation form of the regularized symmetric matrix containing the influence of their respective encrypted data transformation encryption matrices, the current participant then uses its own inverse decomposition factor matrix or its transformation form to collaborate with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector.

[0011] In some embodiments, the current participant obtains and utilizes the product matrix or its transformation form of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encryption linear regression coefficient vector. This includes: after all the participants have participated in calculating the inverse factor matrix or its transformation form of the regularized symmetric matrix containing the influence of their respective column-encrypted data transformation encryption matrices, determining the multiplicative encryption linear regression coefficient vector, and using the column-encrypted data transformation encryption matrix containing the influence of their respective column-encrypted data transformation encryption matrices. The inverse decomposition factor matrix of the regularized symmetric matrix of the affected matrix, the product of the column encrypted data transformation encryption matrix and the label of the preceding participants, and the product of the column encrypted data transformation encryption matrix and the label of the current participant; the product of the column encrypted data transformation encryption matrix and the label of any participant is equal to the product between the transpose of the column encrypted data transformation encryption matrix of the corresponding participant and the label column vector of the label owner; the product of the column encrypted data transformation encryption matrix and the label of any participant is determined or directly calculated by the collaboration between the any participant and the label owner based on a preset secure multi-party computation protocol.

[0012] In some embodiments, determining the multiplicative encrypted linear regression coefficient vector involves using the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, the product of the column encrypted data transformation encryption matrix and the label of the preceding participants, and the product of the column encrypted data transformation encryption matrix and the label of the current participant. The multiplicative encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, and a first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with a concatenated vector containing the product of the column encrypted data transformation encryption matrix and the label of the preceding participants and the product of the column encrypted data transformation encryption matrix and the label of the current participant as subvectors. When the decomposition factor matrix is ​​a square root matrix, the first product vector equals the second product vector; or, when the decomposition factor matrix is ​​an LDL matrix... T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

[0013] In some embodiments, there are m participants providing their respective private original data, where m is an integer greater than or equal to 2; the current participant is the i-th participant, where i is any integer greater than or equal to 2 and less than or equal to m; the preceding participant is the j-th participant, where j is any positive integer less than i; the subsequent participant is the k-th participant, where k is any integer greater than i and less than or equal to m. The current participant collaborates with the preceding participants to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data. This includes: the i-th participant and the j-th participant collaborate to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix of the j-th participant and the i-th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data, where j is any positive integer less than i.

[0014] In some embodiments, when the current participant is the i-th participant and i is less than or equal to m-1, the preceding participant is the (i-1)-th participant, and the subsequent participant is the (i+1)-th participant. The (i-1)-th participant sends all or part of the inverse factor matrix or the transformed form of the regularized symmetric matrix of the matrix affected by the transformation encryption matrix of the column encrypted data corresponding to the private original data of the i-1 participants from the 1st participant to the (i-1)-th participant to the i-th participant. The i-th participant receives the inverse factor matrix or its transformed form. Each party collaborates with each of the participants from the first participant to the (i-1)th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the i-th participant and each of the i-1 participants. Then, using the product matrix or its transformation form, it obtains and sends, in whole or in part, the column-encrypted data transformation encryption matrix containing the private original data corresponding to the private original data of the i participants from the first participant to the i-th participant. The matrix influenced by the matrix is ​​the inverse factor matrix of the regularized symmetric matrix or the transformation form of the inverse factor matrix; when the current participant is the i-th participant and i equals m, then the preceding participant is the (m-1)-th participant, and the (m-1)-th participant sends all or part of the inverse factor matrix of the regularized symmetric matrix of the matrix influenced by the matrix influence by the matrix influence to the m-1 participants, and the m-th participant receives the inverse factor matrix or the transformation form of the inverse factor matrix. Its transformation form; the m-th participant collaborates with each of the m-1 participants from the 1st participant to the (m-1)th participant, using the column encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column encrypted data transformation encryption matrix of the m-th participant and each of the m-1 participants, and then uses the product matrix or its transformation form to collaborate with the tag data owner and the m-1 participants from the 1st participant to the (m-1)th participant to determine the multiplicative encrypted linear regression coefficient vector;The encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the matrix influenced by the column encrypted data transformation encryption matrix of each of the m participants from the first participant to the mth participant, and the first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with the concatenated vector containing the column encrypted data transformation encryption matrix of each of the m participants from the first participant to the mth participant, and the product of the label as a subvector. When the decomposition factor matrix is ​​the square root matrix, the first product vector is equal to the second product vector, or when the decomposition factor matrix is ​​LDL. T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

[0015] To achieve the above objectives, a second aspect of this application proposes a privacy-preserving linear regression system, which is used to perform the privacy-preserving linear regression method described in the first aspect.

[0016] To achieve the above objectives, a third aspect of this application provides a computer-readable storage medium comprising a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the privacy-preserving linear regression method as described in the first aspect.

[0017] The embodiments of this application include at least the following beneficial effects: the participants who possess private original data encrypt their own original data matrix. Apart from the participants themselves, no other participants know the specific encryption method. After all participants have completed encryption, the participants are arranged. The first participant determines its own inverse factor matrix based on the column encryption transformation encryption matrix obtained by encrypting its original data matrix. The first participant sends its own inverse factor matrix or its transformation form to the second participant. The second participant, based on the first participant's inverse factor matrix and its own column encryption transformation encryption matrix, determines the inverse factor matrix or its transformation form that includes the influence of the column encryption transformation encryption matrices of the first and second participants, and sends it to the third participant. This process continues until the last participant calculates the inverse factor matrix that includes the influence of the column encryption transformation encryption matrices of all participants from the first participant to the last participant. The last participant then collaborates with the tag data owner to determine the encrypted linear regression coefficient vector using the inverse factor matrix of the last participant and the tag data of the tag data owner. Compared with the prior art, this invention does not require the introduction of trusted computing nodes and encryption service providers, nor does it require the implementation of highly complex obfuscation circuits, thereby reducing the implementation complexity and meeting the needs of practical applications.

[0018] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0019] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0020] Figure 1 This is a schematic diagram of an optional process for a privacy-preserving linear regression method provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0022] In the description of this application, "several" means one or more, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0023] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, or the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0024] It should be noted that in various specific embodiments of this application, when processing data related to the characteristics of the target object, such as target object attribute information or attribute information sets, is required, the permission or consent of the target object will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. The target object can be a user. In addition, when embodiments of this application need to obtain target object attribute information, separate permission or consent from the target object will be obtained through pop-ups or redirection to a confirmation page. Only after obtaining the target object's separate permission or consent will the necessary target object-related data for the normal operation of the embodiments of this application be obtained.

[0025] In existing longitudinal federated learning techniques for implementing linear regression, in order to ensure the data security of each data owner, it is often necessary to encrypt the service provider and the evaluator, or to introduce obfuscation circuits to ensure the security of the data computation and interaction process. However, the above methods are complex and not conducive to implementation in practical applications.

[0026] Based on this, this application provides a privacy-preserving linear regression method that can reduce implementation complexity and meet practical application needs.

[0027] The privacy-preserving linear regression method provided in this application is illustrated in the following embodiments. First, the privacy-preserving linear regression method in this application is described.

[0028] The privacy-preserving linear regression method provided in this application relates to the field of computer technology. This privacy-preserving linear regression method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the privacy-preserving linear regression method, but is not limited to the above forms.

[0029] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0030] The method employs a secure inner product, where two parties holding vectors x and y can obtain the inner product of x and y through a privacy-preserving secure inner product. The results of the inner product are then placed in the hands of both parties, and the sum of the results from both parties yields the inner product of vectors x and y.

[0031] A secure method for joint inner product computation supported by a trusted initializer relies on the trusted initializer not colluding with the data provider. The specific process is as follows:

[0032] Parties: The data provider 1 is called P1, the data provider 2 is called P2, and the trusted initializer is called TI.

[0033] Input: The column vector x owned by P1; the column vector y owned by P2.

[0034] Input: P1 gets s1, and P2 gets s2, where s1 + s2 = <x, y>, and <x, y> represents the inner product of vectors x and y.

[0035] Scheme:

[0036] 1. TI generates random vectors a and b, and a random number r, and lets z = <a, b> - r. TI sends (a, r) to P1 and (b, z) to P2.

[0037] 2. P1 sends x + a to P2.

[0038] 3. P2 sends y - b to P1.

[0039] 4. P1 calculates its shard output s1 = <x, y - b> - r.

[0040] 5. P2 calculates its shard output s2 = <x + a, b> - z.

[0041] It is easy to verify that s1 + s2 = <x, y - b> - r + <x + a, b> - z = <x, y> - <x, b> - r + <x, b> + <a, b> - z == <x, y> + <a, b> - r – z. Substituting z = <a, b> - r into it, we can get s1 + s2 = <x, y>.

[0042] The above secure inner product joint calculation method is used to calculate A and b. It is easy to see that A = X T X + λI is a matrix symmetric about the diagonal, so only half of the non - diagonal terms need to be calculated. Generally, is locally calculated by user i who owns the data X i ; while (i is not equal to j. Here, it is assumed that only the upper - triangular half is calculated, so i < j; actually, the lower - triangular part can also be calculated when i > j) needs to be jointly calculated by two parties. It can be jointly calculated by the first - party user i using its own data X i and the second - party user j using its own data X j , based on the privacy - preserving SMM algorithm, and can be obtained by transposing the calculation result. Among them, or The result is additive fragmentation, with the result stored separately by user i and user j. Participants can reconstruct the matrix by concatenating the locally computed portions according to their local computation results; portions without local computation results are filled with 0s. Specifically, for... Only user i has a result; for all other m-1 users, this position is filled with 0. Only users i and j store the results of the addition partitioning, while the other m-2 users fill this position with 0. After the above processing, each participant has a matrix Ai, where Ai represents the symmetric matrix A = X owned by user i. T The i-th additive piece (i = 1, 2, ..., m) in X + λI, the corresponding

[0043] Assuming the label vector y belongs to the m-th user, then Included components (i = 1, 2, ..., m-1) is obtained through secure computation between the i-th user and the m-th user, and the results are stored separately for the i-th user and the m-th user. The results held by the i-th user and the m-th user are then added together. and This is obtained by the m-th user using their own data. Each participant also fills in any parts without local computation results with 0. After the above processing, each participant possesses a vector. Indicates what user i owns The i-th addition piece (i = 1, 2, ..., m), the corresponding

[0044]

[0045] The aforementioned participants can be referred to as data providers P1, P2, ..., Pm, and each data provider Pi (i = 1, 2, ..., m) obtains A through the steps described above. i and A i The symmetric matrix A = X owned by user i T The i-th addition piece in X+λI, and It belongs to user i The i-th addition slice.

[0046] This invention presents a privacy-preserving linear regression method. It addresses a scenario where m (m≥2) data owners providing private data and one label data owner jointly participate in vertical federated learning. The method aims to protect the data privacy of the data owners, where the m (m≥2) data owners providing private raw data are referred to as the m participants. The label data owner is referred to as the label owner, and can be one of the m participants or other participants. This privacy-preserving linear regression method can be understood as follows: the m participants in the vertical federated learning collaboratively calculate the regularized symmetric matrix X of the concatenated matrix X of the m participants' raw data matrices, using methods that protect the privacy of their respective private raw data. T The inverse matrix of X+λI (X T X+λI) -1 The factor matrix is ​​decomposed, and then the target linear regression coefficient vector is calculated based on the theory of linear regression coefficients in longitudinal federated learning. The process involves factoring the matrix into square root matrices and LDL. T One of the L-factor matrices in the decomposition, the corresponding process of calculating the target linear regression coefficient vector can be understood as: the m participants in the longitudinal federated learning use their own private original data X... i Privacy-preserving methods, cooperative computation to satisfy FF T =(X T X+λI) -1 The matrix F, or satisfying LDL T =(X T X+λI) -1 Let L and D be matrices, where F is a regularized symmetric matrix X formed by concatenating the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 The square root matrix, matrix L, and matrix D represent the regularized symmetric matrix X of the concatenated matrix X of the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 LDL T Decompose the factor matrix into L-factor matrices and D-factor matrices; then... The target linear regression coefficient vector is calculated. Because of FF T =(X T X+λI) -1 Substitution It can be obtained On the other hand, it can also be derived from the L factor matrix L and the D factor matrix D, by... The target linear regression coefficient vector is calculated.

[0047] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0048] like Figure 1 As shown, Figure 1 This is an optional flowchart illustrating a privacy-preserving linear regression method provided in an embodiment of this application. This privacy-preserving linear regression method can be executed by a server, a terminal, or a server in conjunction with a terminal. The privacy-preserving linear regression method includes, but is not limited to, the following steps S11 to S12:

[0049] Step S11: The current participant receives the inverse factor matrix or transformation form of the regularized symmetric matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the preceding participants; the current participant collaborates with the preceding participants to determine the product matrix or transformation form of the product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, using the column-encrypted data transformation encryption matrices corresponding to their respective private original data; the current participant sends, in whole or in part, the inverse factor matrix or transformation form of the regularized symmetric matrix affected by the column-encrypted data transformation encryption matrices of the preceding participants and the current participant to subsequent participants;

[0050] Step S12, or, the current participant obtains and utilizes the product matrix of the encrypted data transformation and encryption matrix of the previous participants and the current participant, or its transformation form, and collaborates with the previous participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participants are the participants who subsequently provide private original data.

[0051] The product of the encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the effects of the column encrypted data transformation encryption matrix of the previous and current participants, and the first product vector; the transformation form of any matrix satisfies the condition that any matrix can be obtained from this transformation form without the need for calculation through other information.

[0052] Understandably, each participant possessing the original data matrix encrypts its own original data matrix. No other participant knows the specific encryption method. After all participants have completed encryption, they are ranked. The first participant determines its inverse factor matrix based on the column encryption transformation matrix obtained from its original data matrix. The first participant sends its column encryption transformation matrix and inverse factor matrix to the second participant (or equivalently to the second participant). The second participant, based on the first participant's column encryption transformation matrix and inverse factor matrix, as well as its own column encryption transformation matrix, determines an inverse factor matrix that includes the influence of the first and second participants' column encryption transformation matrices. This inverse factor matrix is ​​then sent to the third participant (or equivalently to the third participant), and so on, until the last participant, the m-th participant, calculates its own inverse factor matrix. The last participant's inverse factor matrix contains the influence of the column encryption transformation matrices corresponding to the original data matrices of all m participants. The m-th participant then collaborates with the tag data owner and m-1 other participants (from the 1st to the (m-1th)th participants) to determine a multiplicative encrypted linear regression coefficient vector. This multiplicative encrypted linear regression coefficient vector is equal to the product of the inverse factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix of each of the m participants (from the 1st to the m-th participants) and a vector. Compared to existing technologies, this invention does not require the introduction of trusted computing nodes and encryption service providers, nor does it require the implementation of highly complex obfuscation circuits, thereby reducing implementation complexity and meeting practical application requirements.

[0053] First, an embodiment of the present invention will be introduced, referred to as Embodiment 1 of the present invention. Embodiment 1 of the present invention includes steps S11 and S12, and step S11 further includes steps S111 and S112, which are described below.

[0054] In its specific implementation, step S11 includes steps S111 to S112. Step S111 includes sub-steps S111-a to S111-e, and step S112 includes sub-steps S112-a to S112-f. The sub-steps S111-a to S111-e included in step S111 will be described below:

[0055] Sub-step S111-a: This sub-step is optional, involving adding mask columns. In this sub-step, the first participant adds one or more mask columns after its original data matrix X1. This is an optional step; the first participant chooses this step if it wants to achieve better privacy protection. Typically, a single mask vector is sufficient for privacy protection, but the first participant can also use multiple mask columns to achieve better privacy protection. The first participant generates the data matrix with added mask columns based on the original data matrix X1 composed of its private original data and the added-column encryption mask matrix Δ1. This will also be referred to as column-encrypted data matrix for short.

[0056] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. The original data matrix X1 of the first participant has τ1 columns containing τ1 features, while the additional column encryption mask matrix Δ1 has... The column can be generated by the first participant, and the added column encryption mask matrix Δ1 is usually randomly generated. This indicates adding a column τ1 to the end of the original data matrix X1. The column-adding encryption mask matrix Δ1 is used to obtain the common... Column-wise encrypted data matrix Notice It can be equal to 0, which is equivalent to the first participant not adding an additional column to the encryption mask matrix Δ1 to encrypt the original data; in addition, it is usually allowed to A value of 1 provides excellent encryption; in this case, there is... The column-adding encryption mask matrix Δ1 is actually a column vector of the column-adding encryption mask with only one column. If the first participant does not choose this optional column-adding mask step, then the following steps will be used...

[0057] Sub-step S111-b: This sub-step is an optional sub-step that multiplies by the first mask matrix for encryption. In this sub-step, the first participant uses a matrix containing its own original data matrix X1 as the sub-matrix (i.e., the column-encrypted data matrix). Multiplying by the first mask matrix Ω1 on the left yields the product of the column encrypted data matrix and the first mask matrix. The This is simply referred to as the first participant's column encryption data transformation encryption matrix. The aforementioned first mask matrix Ω i It is used for encryption and is an invertible matrix. The first mask matrix Ω1 can be an identity matrix, in which case we have... This means that this step involves no actual operation, which is equivalent to not selecting this step.

[0058] Sub-step S111-c: The first participant uses its own column-encrypted data to transform the encryption matrix. Find the square root matrix P1 of the inverse of the regularized symmetric matrix of the encryption matrix transformed by the encryption matrix of the first participating column, wherein P1 satisfies Here, λ represents a scalar called the regularization coefficient, which is usually a real number greater than or equal to zero. This represents the effect of the first mask matrix Ω1 used in the transformation; when the first mask matrix Ω1 is an orthogonal matrix, then the above... It can be simplified to a common regularization matrix, i.e. Here, I represents the identity matrix. Note that the first participant can right-multiply P1 by any orthogonal matrix Θ1 to obtain the updated P1 = P1Θ1; on the other hand, this sub-step calculates the result satisfying... The matrix P1 can be obtained, and various methods can be used for the specific calculation. The square root matrix P1 of the inverse of the regularized symmetric matrix of the first participating column's encrypted data transformation encryption matrix is ​​one type of factorization factor matrix of the inverse of the regularized symmetric matrix of the first participating column's encrypted data transformation encryption matrix. In the following text, the square root matrix of the inverse matrix is ​​simply called the inverse square root, and the factorization factor matrix of the inverse matrix is ​​simply called the inverse factor matrix. The inverse factor matrix is ​​the short name for the inverse of the factorization factor matrix, and also the short name for the factorization factor matrix of the inverse matrix. Mathematically, the inverse matrix of the factorization factor matrix of a matrix is ​​equal to the factorization factor matrix of the inverse matrix of that matrix.

[0059] In this application document, (·) T This represents the transpose of a real matrix (including vectors), or the conjugate transpose of a complex matrix (including vectors), as described above. In and In Putting two matrices together, or a scalar and a matrix together, indicates multiplication. For example... middle express take λI represents the scalar λ multiplied by the identity matrix I.

[0060] In this application document, The symmetric matrix called the first participant's column encrypted data transformation encryption matrix is ​​the first participant's column encrypted data transformation encryption matrix. transpose Multiply the encrypted data by the first participant to transform the encryption matrix The resulting product; The regularized symmetric matrix called the encryption matrix of the first participant's encrypted data transformation is also simply called the first regularized symmetric matrix of the first participant. Obviously, it is also the first regularized symmetric matrix of a single participant. This is called the inverse of the regularized symmetric matrix of the encryption matrix transformed by the first participant's encrypted data. The aforementioned regularized symmetric matrix... In this context, λI is a matrix related to regularization. In some cases, λI can take the form of... A diagonal matrix, where the terms on the diagonal can take different values.

[0061] To enhance secrecy, it is typically required that P1 is not a triangular matrix. If the inverse Cholesky decomposition algorithm is used to obtain the first regularized symmetric matrix of the first participant... (It contains) As a special case, if the inverse of the Cholesky decomposition matrix is ​​taken as P1, then P1 is a triangular matrix. In this case, P1 is usually right-multiplied by an arbitrary orthogonal matrix Θ1 to obtain the updated P1 = P1Θ1, making P1 non-triangular. To achieve encryption in this step, after the first participant obtains a P1, even if P1 is no longer a triangular matrix, they usually right-multiply P1 by an orthogonal matrix Θ1 known only to the first participant to obtain the updated P1 = P1Θ1.

[0062] Sub-step S111-d: When the first implementation of the sending step in this embodiment is adopted, the first participant sends the inverse decomposition factor matrix P1 of its first regularized symmetric matrix or a transformed form of the inverse decomposition factor matrix P1 to the second participant in this sub-step; or, when the second implementation of the sending step in this embodiment is adopted, the first participant sends P1 or its transformed form to the m-1 participants, namely participants 2, 3...m, in this sub-step. The transformed form of the inverse decomposition factor matrix P1 satisfies the condition that the inverse decomposition factor matrix P1 can be calculated from this transformed form without the need for other information.

[0063] Sub-step S111-e: The control variable i corresponding to the first participant (i.e., the first data owner) is equal to 1. In this sub-step, the value of i is first incremented by 1; then, if the value of i is greater than m, proceed to step S12; if the value of i is less than or equal to m, proceed to step S112. As mentioned earlier, vertical federated learning has m participants who own their own private original data, also called m data owners, where m is an integer greater than or equal to 1; in addition, there are label owners. This step is explained as follows: when i is greater than m, then the next step mainly involves the addition of the label data owner, and proceeds to step S12 accordingly; when i is less than or equal to m, then the next step mainly involves the addition of the i-th participant, i.e., the i-th data owner, and proceeds to step S112 accordingly.

[0064] In this invention, the concatenation matrix of encrypted data from the i (i ≤ m) participant columns is used. This can be simply referred to as a column-encrypted data matrix with i participants, noting that the column-encrypted data matrix belongs to the j-th participant (j is greater than or equal to 1 and less than or equal to i). The original data matrix X is composed of the original data privately owned by the j-th participant. j An additional encryption mask matrix Δ is added at the rear. j The result is obtained, and it is also possible to obtain it without adding an additional encryption mask matrix Δ. j Therefore, On the other hand, the column encryption data matrix of the j-th participant (j is greater than or equal to 1 and less than or equal to i) Left-multiply by the first mask matrix Ω of the j-th participant j The product of the column-encrypted data matrix and the first mask matrix is ​​obtained, which is the column-encrypted data transformation encryption matrix. This invention uses a concatenated matrix of encryption transformation encryption matrices for the i (i less than or equal to m) participant columns 1, 2, ..., i. It is simply referred to as the column encryption data transformation encryption matrix with i participants.

[0065] It is easy to see that the previous step S111 used... It can also be expressed as That is, a column-encrypted data matrix with one participant. The previous step S111 used... It can also be expressed as That is, the column encryption data transformation encryption matrix of a single participant.

[0066] In this application document, It is called a symmetric matrix that transforms the encrypted data of i participating parties into an encrypted matrix. Let be the regularized symmetric matrix of the encryption matrix transformed by the encrypting data of the i participating parties, or simply the first regularized symmetric matrix of the i participating parties, where It is along Ω [1:i] Place the matrix Ω1, Ω2, ..., Ω diagonally aligned. i The resulting block diagonal matrix can also be represented as Ω using the blkdiag function in the well-known MATLAB software. [1:i] =blkdiag(Ω1,Ω2,…,Ω) i ); because Ω1, Ω2, ..., Ω i These are the first mask matrices for participants 1, 2, ..., i. In this application, Ω is... [1:i]This is called the block diagonal matrix composed of the first mask matrices of each of the i participants, or simply the first mask matrix of the i participants. Clearly, when i is greater than or equal to 2, the above... It is the first regularized symmetric matrix involving multiple parties. Correspondingly, It is the inverse of the regularized symmetric matrix of the encryption matrix transformed by the encrypted data of the i participating parties, and is simply referred to as the inverse of the first regularized symmetric matrix of the i participating parties.

[0067] It is easy to see that the column encryption data of i participants is transformed into an encryption matrix. Regularized symmetric matrix It is a column-encrypted data transformation encryption matrix containing any one of the i participants from the 1st participant to the ith participant. A matrix with (j = 1, 2, ..., i) as submatrices The regularized symmetric matrix. middle, This is called the regularization term, and correspondingly, the regularization symmetric matrix. yes Symmetric matrix Upper regularization term The sum of these terms can be derived from the regularization term. That is, regularization term The first mask matrix Ω contains any one of the i participants from the 1st participant to the ith participant. j Symmetric matrix The product with the preset regularization coefficient λ As a submatrix, where j = 1, 2, ..., i.

[0068] In this embodiment, the i-th participant is equivalent to calculating the inverse factor matrix P of the first regularized symmetric matrix of all i participants. i It is to satisfy The square root matrix. When Ω [1:i] If it is an orthogonal matrix, then the above... It can be simplified to When Ω [1:i] If it is an orthogonal matrix, then the above... It can be simplified to The above P i It is the square root matrix of the inverse of the regularized symmetric matrix of the orthogonal transformation result of the encrypted data of i participating parties. It is a type of factor matrix of the inverse of the regularized symmetric matrix of the orthogonal transformation result of the encrypted data of i participating parties, and can be simply referred to as the inverse factor matrix of the first regularized symmetric matrix of i participating parties.

[0069] The following sub-steps S112-a to S112-h describe how participant i (i = 2, 3, ..., m) receives P i-1 After its transformation, or the received P is used. i-1 Or its transformed form, and its own data matrix X i P was calculated. i The method; when i is less than or equal to m-1, then participant i calculates P. i After that, put P i Or send its transformed form to the next participant, i.e., participant i+1, or send P i Relative to P i-1 The added columns or their transformed forms are sent to the mi participants i+1, i+2, ..., m. To further protect the data privacy of participants 1, 2, ..., i-1, this embodiment includes an implementation using Secure Multi-Party Computation protocols, which can transform the encrypted data into an encryption matrix when participant i has not received the column encryption data from participants 1, 2, ..., i-1. In the case of P, the calculation is obtained. i .

[0070] In step S112, the i-th participant (i ≥ 2 ≤ m), i.e., the i-th data owner, receives the inverse factor matrix P of the first regularized symmetric matrix from a total of i-1 participants. i-1 The i-th participant uses its own column to encrypt the data matrix. (Note Δ) i It can be an empty matrix (as a special case), let P i-1 Updated to P i ; here P i It is the inverse factorization matrix of the first regularized symmetric matrix of the aforementioned i participants. When i is less than or equal to m-1, participant i calculates P. i After that, put P i Or send its transformed form to the next participant, i.e., participant i+1, or send P i Relative to P i-1 The matrix consisting of the added columns, or its transformed form, is sent to the mi participants i+1, i+2, ..., m. The transformed form of any of the above matrices satisfies the condition that the arbitrary matrix can be calculated from this transformed form without requiring other information.

[0071] The above step S112 includes the following sub-steps S112-a to S112-h, a total of 6 sub-steps:

[0072] Sub-step S112-a: The i-th participant, i.e., the i-th data owner, obtains the inverse factor matrix P of the first regularized symmetric matrix of the i-1 participants based on the received information. i-1 When the sending step in this embodiment adopts the first implementation method, the i-th participant receives the P sent by the (i-1)-th participant. i-1 Or its variant form; when the sending step of this embodiment adopts the second implementation method, the i-th participant receives P sent or equivalently sent by these participants from participants 1, 2...i-1 respectively. i-1 A portion of it or a transformed form thereof, which are then combined to obtain P i-1 .

[0073] Sub-step S112-b: This sub-step is optional and involves adding a mask column. In this sub-step, the data matrix X is... i The i-th participant in its own data matrix X i Adding one or more columns of masking is an optional step. The data matrix X constructed by the i-th participant based on its private original data... i and the addition of an encryption mask matrix Δ i The generated data matrix with added mask columns This will also be referred to as column-encrypted data matrix for short.

[0074] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. The original data matrix X of the i-th participant i There is τ i The column contains τ i The original data of each feature, and the added encryption mask matrix Δ i have The column can be generated by the i-th participant, usually by adding an encryption mask matrix Δ. i It is randomly generated. Indicates that there is τ i The original data matrix X of the column i Added later Column-adding encryption mask matrix Δ i To obtain shared ownership Column-wise encrypted data matrix in It can be equal to 0, which is equivalent to the i-th participant not adding an additional column to the encryption mask matrix Δ. i To encrypt the original data; in addition, it is usually made A value of 1 provides excellent encryption; in this case, there is... Column-adding encryption mask matrix Δ iIn reality, it's a single-column incrementing encryption mask column vector. If the i-th participant doesn't choose this optional incrementing mask column step, then the following steps will be used... It is easy to see that the added-column encryption mask matrix Δ i The number of items in each column compared to the original data matrix X i Each column contains the same number of items; the added column encryption mask matrix Δ i Each column can be generated by the i-th participant or obtained from a trusted node.

[0075] Sub-step S112-c: This sub-step is an optional sub-step that multiplies by the first mask matrix for encryption. In this sub-step, the i-th participant uses its own original data matrix X. i A matrix that serves as a submatrix (i.e., a column-encrypted data matrix). Left-multiply the first mask matrix Ω of the i-th participant i Obtain the product of the column encrypted data matrix of the i-th participant and the first mask matrix of the i-th participant. The This is simply referred to as the column encryption transformation encryption matrix for the i-th participant. The first mask matrix Ω i It is used for encryption, as mentioned before, Ω i This is called the first mask matrix for the i-th participant. It is an invertible matrix and is generated by the i-th participant itself or obtained from a trusted node. The i-th participant may also omit Ω. i Encryption, which is equivalent to Ω i The identity matrix I means that this step does not involve any actual operation; that is, this step was not selected.

[0076] Sub-step S112-d: Transform the encrypted data into an encryption matrix. The i-th participant, and the one who possesses the column-encrypted data transformation encryption matrix The j-th participating party collaborates to calculate and determine the product matrix based on a pre-defined secure multi-party computation protocol or by using direct computation. Or its transformed form, and the above R is obtained by the i-th participant. j,i Or its transformed form, where j is greater than or equal to 1 and less than or equal to i-1. For each j greater than or equal to 1 and less than or equal to i-1, perform this step, resulting in a total of i-1 product matrices R. j,i Or its transformed form, where j = 1, 2, ..., i-1. The above... It is the column encryption data transformation encryption matrix of the j-th participant. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of these matrices is simply referred to as the product matrix of the encrypted data transformation encryption matrices of the j-th participant and the i-th participant. The above i-1 matrices... (j=1,2…i-1) can be represented as a concatenated matrix It is easy to see that the above splicing matrix V i It is a column-encrypted data transformation encryption matrix with i-1 participants. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of In short, it is the product of the encryption matrix of the encrypted data transformation of the i-1 participating parties and the encryption matrix of the i-th participating party's encrypted data transformation. The i-1 participating parties are participants 1, 2, ..., i-1. When the i-th participating party obtains R... j,i If the transformation is such that the i-th participant is represented by R, then an easily known implementation method is that the i-th participant is represented by R. j,i The transformation form of R is obtained j,i Then it is used for subsequent calculations.

[0077] It is easy to see that the above R j,i The transformation form can be That is, the column encryption data of the i-th participant is transformed into an encryption matrix. transpose Transform the encrypted data of the j-th participant into an encryption matrix. If the product is , then the implementation method can be modified accordingly, which is an obvious variation of the implementation method.

[0078] This sub-step calculation The first implementation of this method, or a variation thereof, uses secure multi-party computation protocols, particularly secure inner product protocols. These secure inner product protocols refer to confidential computation when calculating the inner product of two vectors to ensure that the information of the input data is not leaked. This is a well-known prior art and has various different implementation methods. Typically, the j-th participant and the i-th participant each obtain R through computation. j,i Or a portion of its transformed form, the j-th participant sends its partial result to the i-th participant, who then sums these two parts to obtain R. j,i Or its transformed form; and in the above calculation process, the j-th participant's It does not need to be sent directly to the i-th participant, but the i-th participant's It also does not need to be sent directly to the j-th participant, although it usually includes information about... and The ciphertext obtained through further encryption is then sent. Alternatively, this sub-step can be implemented by direct computation, with the j-th participant... Send it to the i-th participant, and then the i-th participant uses what it owns. and received Direct calculation Or its transformed forms.

[0079] Sub-step S112-e: The i-th participant uses the splicing matrix V obtained in the previous sub-step. i That is, the product matrix of the encryption transformation encryption matrix of the i-1 participating columns and the encryption transformation encryption matrix of the i-th participating column, which satisfies the following conditions. square root matrix In this step, an orthogonal matrix Θ can be used. i Right multiplication To put Updated to When the first mask matrix Ω of the i-th participant i It is an orthogonal matrix, as mentioned above. Simplified to

[0080] If the triangle is obtained using inverse Cholesky decomposition... Then we use an orthogonal matrix Θ i Right multiplication get Make It's not triangular. In this step, to achieve encryption, user i typically obtains a... After that, even Even if it's not a triangle, use an orthogonal matrix Θ that only you know. i Right multiply by G i get

[0081] The square root matrix mentioned above It is the inverse factorization matrix P of the regularized symmetric matrix of the encrypted data transformation of the encryption matrix with i participants. i The submatrix in the matrix, namely the inverse factorization matrix P of the first regularized symmetric matrix of the i participating parties. i Submatrices in, such as As shown, × represents a submatrix not covered in the current discussion.

[0082] Sub-step S112-f: In this sub-step, the i-th participant uses the inverse factorization matrix P of the first regularized symmetric matrix of the i participants. i submatrix in And the product matrix V of the encryption transformation encryption matrix of the i-1 participating columns and the encryption transformation encryption matrix of the i-th participating column. i The inverse factorization matrix P of the first regularized symmetric matrix with i-1 participants. i-1 Updated to the inverse factorization matrix P of the first regularized symmetric matrix with i participants. i A specific implementation method could be that the i-th data owner calculates... In P i-1 Add multiple columns to the right of In P i-1 Add a submatrix consisting entirely of zeros directly below P. i-1 Add a submatrix to the lower right. Thus, P i-1 Updated to P i .

[0083] Sub-step S112-g: If the value of i is less than or equal to m-1, the i-th participant adopts the first implementation method of the sending step to send P. i Alternatively, it can be sent to the next participant, i.e., the (i+1)th participant, or the i-th participant can use the second implementation of the sending step to send P. i Relative to P i-1 The added non-zero column is Or its transformed form, is sent to the m-i+1 participants i+1, i+2, ..., m. The transformed form of the above arbitrary matrix satisfies the condition that the arbitrary matrix can be calculated from this transformed form without the need for other information.

[0084] Sub-step S112-h (iteration-controlled sub-step): If the value of i is less than or equal to m-1, increment the value of i by 1 and return to sub-step S112-a to start the next iteration; otherwise, when the value of i is equal to m, proceed to the next step S12.

[0085] In this application, (·) T `x` represents the transpose of a real matrix (including vectors), or the conjugate transpose of a complex matrix (including vectors); placing two matrices together, or a scalar and a matrix together, represents multiplication. `λI` is a matrix related to regularization; in some cases, `λI` can take the form of... λI is a diagonal matrix, where the terms on the diagonal can take different values; even λI can be any matrix.

[0086] It is easy to see that in the above sub-steps S112-d, S112-e, S112-f, and S112-g, the i-th participant and the j-th participant cooperate to determine the product matrix of the column encrypted data transformation encryption matrices of the i-th participant and the j-th participant respectively, using the column encrypted data transformation encryption matrix corresponding to their respective private original data. Or a transformed form thereof, where j is greater than or equal to 1 and less than or equal to i-1; the i-th participant obtains and utilizes the above R j,i Or its transformed form, the inverse factorization matrix P of the first regularized symmetric matrix with i-1 participants. i-1 Updated to the inverse factorization matrix P of the first regularized symmetric matrix with i participants. i When the value of i is less than or equal to m-1, the i-th participant puts P... i Or send it in its transformed form to the next participant, i.e., the (i+1)th participant, or send P i Partially send P to several participants, including the (i+1)th participant, that is, send P i Relative to P i-1 The added non-zero column is sent to the m-i+1 participants i+1, i+2, ..., m.

[0087] Typically, if node 1 sends a message to node 2, and then node 2 forwards it to node 3, this is also considered as node 1 sending the message to node 3. Furthermore, the scenario of forwarding by a single node can be extended to a scenario of forwarding by multiple nodes. That is, if node 1 sends a message to node 2a, and then it is forwarded by at least one of the nodes (nodes 2b, 2c, etc.), and then forwarded by the last of these nodes to node 3, this is also considered as node 1 sending the message to node 3. Accordingly, in step S11, which includes steps S111 and S112, considering the effect of step S112 being executed m-1 times, the i-th participant, j-th participant, and k-th participant are respectively considered as the current participant, the preceding participant, and the subsequent participant, where i is any integer greater than or equal to 2 and less than or equal to m, j is any positive integer less than i, and k is any integer greater than i and less than or equal to m. It can be seen that the i-th participant, j-th participant, and k-th participant satisfy the following relationship:

[0088] When sub-steps S111-d and S112-g both adopt the first implementation method of the sending step in this embodiment, the j-th participant sends the inverse factor matrix of the regularized symmetric matrix or its transformation form of the column encrypted data transformation encryption matrix corresponding to the private original data of the j participants from the first participant to the j-th participant to the i-th participant. When j is less than or equal to i-2, there are forwardings from participants j+1, j+2, ..., i-1. The i-th participant receives the aforementioned inverse factor matrix or its transformation form sent by the j-th participant. Clearly, it is the inverse factor matrix or its transformation form of the regularized symmetric matrix that includes the influence of the column encrypted data transformation encryption matrix corresponding to the private original data of the j-th participant. The i-th participant collaborates with the j-th participant, utilizing... Using the column-encrypted data transformation encryption matrix corresponding to their respective private original data, the product matrix or its transformation form of the column-encrypted data transformation encryption matrix of each j-th participant and the i-th participant is determined. Then, the i-th participant uses the above product matrix or its transformation form to obtain and send to the k-th participant the inverse factor matrix of the regularized symmetric matrix of the column-encrypted data transformation encryption matrix corresponding to the private original data of the i participants from the first participant to the i-th participant. It is the inverse factor matrix of the regularized symmetric matrix or its transformation form that includes the influence of the column-encrypted data transformation encryption matrix of each j-th participant and the i-th participant. When k is greater than or equal to i+2, there are forwardings by participants i+1, i+2, ..., k-1. If we do not consider the effect of m-1 iterations of step S112, and only consider one execution of step S112 when i is any positive integer greater than or equal to 2 and less than or equal to m, then j is equal to i-1 and k is equal to i+1.

[0089] When sub-steps S111-d and S112-g both adopt the second implementation method of the sending step in this embodiment, the j-th participant transforms the column encrypted data corresponding to the private original data of the j participants from the first participant to the j-th participant into the inverse factor matrix of the regularized symmetric matrix of the encryption matrix or a part of its transformation form (i.e., P). j Relative to P j-1The added non-zero column (or its transformation form) is sent to the i-th participant; the i-th participant receives a portion of the aforementioned inverse factor matrix or its transformation form sent by the j-th participant, which is obviously a portion of the inverse factor matrix or its transformation form of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix corresponding to the j-th participant's private original data; the i-th participant and the j-th participant cooperate to determine the product matrix or its transformation form of the column encrypted data transformation encryption matrix of the j-th participant and the i-th participant respectively, using the aforementioned product matrix or its transformation form, and then the i-th participant uses the aforementioned product matrix or its transformation form to obtain and send to the k-th participant a portion of the inverse factor matrix or its transformation form of the regularized symmetric matrix corresponding to the column encrypted data transformation encryption matrix of the i participants from the first participant to the i-th participant (i.e., P). i Relative to P i-1 The added non-zero column (or its transformed form) is part of the inverse factor matrix of the regularized symmetric matrix, which contains the column encryption data of the j-th participant and the i-th participant, and is influenced by the encryption matrix. If we disregard the effect of m-1 iterations of step S112, and only consider one execution of step S112 when i is any positive integer greater than or equal to 2 and less than or equal to m, then j equals i-1, and k equals i+1.

[0090] When the value of i equals m, the m-th participant calculates P in the above sub-step S112-f. m In the next step S12, we have a label column vector. The tag data owner, and the encrypted square root matrix P which has a total of m participants. m and the encryption matrix of each column of encrypted data transformation m participants (i = 1, 2, ..., m) collaborate to calculate the multiplied encrypted linear regression coefficient vector. The This involves adding a mask column Δ for each participant to the target linear regression coefficient vector. i The column vector obtained by multiplying the influence of (i = 1, 2, ..., m) on the right by a multiplier of an encryption matrix, where the encryption matrix is ​​a block diagonal matrix Ω composed of the first mask matrices of m participants. [1:m] inverse matrix

[0091] The steps for calculating the encrypted linear regression coefficient vector in Embodiment 2 of this invention mainly include: the tag data owner using a privately owned tag column vector. The tag data is transformed into an encryption matrix with each of its own encrypted data columns. m participants (i = 1, 2, ..., m) collaborate to calculate each... (i = 1, 2...m), then calculate To obtain the multiplicative encrypted linear regression coefficient vector

[0092] Step S12 includes steps S121 to S122.

[0093] Step S121: Possess a label column vector The owner of the tag data and the owner of the encrypted data transformation encryption matrix The i-th participating party collaborates, based on a pre-defined secure multi-party computation protocol or direct computation, to determine... Where i is greater than or equal to 1 and less than or equal to m. For each i that is greater than or equal to 1 and less than or equal to m, perform this step, resulting in a total of m. Where i = 1, 2…m. The above… It is the column encryption data transformation encryption matrix of the i-th participant. transpose The tag column vector of the tag data owner The product of the encrypted data transformation encryption matrix and the tag of the i-th participating column is simply referred to as the product of the encryption matrix and the tag of the i-th participating column. This sub-step calculates the product of the encryption matrix and the tag of the encrypted data transformation encryption matrix of the i-th participating column. There are multiple ways to implement this; some possible implementations are listed below:

[0094] Implementation Method 1) Obtain the calculation result from the i-th specific node. (i = 1, 2…m). Secure multi-party computation protocols, especially secure inner product protocols, can be used to compute... The specific implementation could be that the i-th participant and the label data owner each obtain a portion of the result, and then they send their respective partial results to the i-th specific node, which then merges these two portions of the result to obtain the final result. On the other hand, it can also be done by the i-th participant. Send it to the tag data owner, who then uses their own tag column vector. and received Calculated using direct calculation method. Then it is sent to the i-th specific node. It is easy to see that when the i-th specific node is the i-th participant or the owner of the tag data, part of the above sending is sent to itself, which actually does not require any operation.

[0095] Implementation Method 2) Calculation Results (i = 1, 2, ..., m) is divided into two parts, i.e. and The above are placed on two nodes, named node A and node B, respectively. and satisfy This implementation typically uses secure multi-party computation protocols, especially secure inner product protocols, to compute... And the calculation results Divided into and By placing the values ​​on two nodes separately and then adding the results of the calculations on the two nodes separately, we can obtain the result. The two nodes, namely node i and node i, can be the owner of the tag data and the i-th participant, or two other trusted nodes.

[0096] The above m column vectors (i = 1, 2, ..., m) can be represented as a concatenated column vector. It satisfies That is, the encrypted data of each of the above participants is transformed into the product of the encryption matrix and the label. They can be combined into the above concatenated column vectors. It is a column-encrypted data transformation encryption matrix involving m participants. transpose With label column vector The product of the m-participants' column-encrypted data transformation encryption matrix and the tag is simply referred to as the product of the m-participants' column-encrypted data transformation encryption matrix and the tag.

[0097] This step has a simple implementation method: when using implementation method one, and the i-th specific node is the owner of the label data, then all calculation results... (i = 1, 2, ..., m) are all owned by the label data owner.

[0098] Step S122: Possess P m m participating parties and owners Several nodes (i = 1, 2, ..., m) cooperate to compute... To obtain the multiplicative encrypted linear regression coefficient vector It is easy to see that, as mentioned above The above can be obtained The multiplication encryption linear regression coefficient vector Equal to the column-encrypted data transformation of m participants, the regularized symmetric matrix of the encryption matrix, and the inverse factorization matrix P. m With the second product vector The product of the two factors, the second product vector ξ is equal to the inverse factor matrix P. m transpose The encrypted data of m participants is transformed into an encryption matrix and the product of the labels. The results, among which It is a concatenated vector containing the product of the encryption matrix and the label of the encrypted data transformed from each of the m participants, from the 1st to the mth participant, as a subvector. There are several possible implementations for this step; some are listed below:

[0099] Implementation Method 1) If step S121 adopts Implementation Method 1, then in this step, P has m m participating parties and owners The collaboration of each specific node i in (i = 1, 2, ..., m) yields the following results: With possession The collaboration of the i-th specific node can be that which owns P m The mth participant, or all of them possess at least a portion of P m All m participants, or all of them possess at least a portion of P m At least two parties are involved. The calculated... It can be placed on one node, or on multiple nodes.

[0100] let Then we can get And it can be represented as

[0101] Right now Where Γ(:,i) (i = 1, 2, ..., m) represents the matrix Γ starting from the first...m... Listed to number All columns of the column. Correspondingly, the calculated... One implementation method that places them on multiple nodes is, The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node, which can be the i-th specific node, a participant, or other trusted nodes.

[0102] Implementation Method Two) If Implementation Method Two is adopted in step S121, then in this step, P has m The m participating parties and their respective shares Two nodes (i = 1, 2, ..., m), namely node i-th node A and node i-th node B, cooperate to calculate... Calculated It can be placed on one node, or on multiple nodes.

[0103] Bundle Substitution It can be obtained Correspondingly, One way to implement this is to place the elements on multiple nodes: The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node A, which can be the i-th node A, a participant, or other trusted nodes; The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node B, where the i-th coefficient storage node B can be the i-th node B, a participant, or another node.

[0104] From the above As you can see, It is obtained by calculating the product of three parts, which are: the inverse factor matrix P of the first regularized symmetric matrix of m participants (i.e., the regularized symmetric matrix containing the transformation effect of the column encryption data transformation of m participants). m The transpose of the above inverse factorization matrix And a total of m participating columns of encrypted data transformation encryption matrix and label product It can also be owned by P m The m participants first calculate Then calculate

[0105] The multiplication encryption linear regression coefficient vector With the target linear regression coefficient vector The relationship between them is That is, multiply the encrypted linear regression coefficient vector It is the target linear regression coefficient vector Right-multiply by the block diagonal matrix Ω composed of the first mask matrices of m participants. [1:m] inverse matrix The result is encrypted. If it is necessary for a node to obtain the entire P... m This can include the following scenarios: when a node is the m-th participant, then that node has already obtained P in the previous sub-step. m When a node is any one of the participants 1, 2, ..., m-1, then that node only has P. m Some items in the P list need to be handled by the relevant stakeholders. m If a node does not have an item, it should be sent to that node. The relevant participant can be the m-th participant, all other participants besides that node, or at least two of the other participants besides that node. If a node is a node other than participants 1, 2, ..., m, then the relevant participant needs to send P... mThe relevant participants are sent to this node. These participants can be the m-th participant, all m participants (participants 1, 2, ..., m), or at least two of the m participants. When the relevant participants include at least two participants, each of these participants sends P. m A portion of the data is given to a certain node, which then aggregates the data sent by several participants to obtain P. m .

[0106] When step S121 adopts the simple implementation method described above, that is, all calculation results (i = 1, 2, ..., m) are all owned by the label data owner, so this step can also be implemented in a simple way: that is, by the owner P m The mth participant and owner Collaborate with the tag data owner to calculate And put Placed in the m-th participant or the tag data owner. When If placed in the m-th participant, then the tag data owner will... Send to the m-th participant, who will then calculate the result. Or, when If the tag data is placed by the owner, then the m-th participant will place P. m Send it to the tag data owner, who will then calculate it.

[0107] The above-mentioned multiplicative encrypted linear regression coefficient vector is calculated. Subsequently, the effect achieved by the following steps in the above embodiments of the present invention is: if there are several participants from participant 1 to m that use an incremental encryption mask matrix with non-zero columns, then the several participants sequentially multiply the encryption square root matrix P. m Multiplication and encryption of linear regression coefficient vectors This at least partially eliminates the influence of its incrementing encryption mask matrix Δ. When each participant using a non-zero column incrementing encryption mask matrix multiplies the encryption linear regression coefficient vector... This at least partially eliminates the impact of the participant's added encryption mask matrix Δ, or, if there is no participant using a non-zero column added encryption mask matrix, then it possesses the most recently updated multiplied encryption linear regression coefficient vector. The participants or nodes, Several items corresponding to participant i (where i is greater than or equal to 1 and less than or equal to m) are sent to participant i, and participant i uses the inverse of its own private first mask matrix... The decryption process yields several terms corresponding to the target linear regression coefficient vector.

[0108] In this invention, for the sake of simplicity, it is assumed that the column encryption data matrix of the i-th participant is... The columns are arranged in the following order: The front τ i The column is the original data matrix X i ,then The column is an incremental encryption mask matrix Δ i In practice The columns can also be arranged in other ways, and the specific embodiments of the present invention can be slightly modified accordingly, which is well known to those skilled in the art.

[0109] Based on the implementation method of using square root decomposition for the inverse matrix of the regularized symmetric matrix in Embodiment 1 of the present invention, another commonly used LDL can be easily obtained. T The decomposed implementation method is, namely, Embodiment Two of this application. For example, the above-mentioned FF... T =(X T X+λI) -1 The matrix F is the inverse matrix (X) T X+λI) -1 The square root matrix can be viewed as a symmetric matrix (X). T X+λI) -1 One method of factorization matrix; the corresponding symmetric matrix can also be derived using another commonly used LDL method. T LDL in decomposition T Factor matrix replacement, and LDL T The factor matrix includes a triangular L-factor matrix and a diagonal D-factor matrix. The L-factor matrix can be extended to a general square matrix; that is, the L-factor matrix can be either triangular or not. The D-factor matrix remains a diagonal matrix. Based on this extended LDL... T The factor matrix can be slightly modified from Embodiment 1 of the present invention to obtain an LDL-based matrix. T The specific implementation of the factorization matrix is ​​referred to as Example 2. The main difference between Example 2 and Example 1 is that the matrix sent by the i-th participant to the (i+1)-th participant is different, where i = 1, 2, ..., m-1.

[0110] In Example 2, participant i equivalently calculates the LDL of the inverse matrix of the first regularized symmetric matrix (i.e., the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants) of all i participants. T Decompose the factor matrix, including those that satisfy L-factor matrix and D factor matrix D i The above. The inverse L-factor of the first regularized symmetric matrix with i participants is called the D-factor.i This is called the inverse D-factor of the first regularized symmetric matrix with i participants, or simply the D-factor of the i participants. When i equals 1, D1 and D1 are also referred to as the inverse L factor and inverse D factor of the first regularized symmetric matrix of the first participant, respectively.

[0111] Use satisfaction L factor matrix L i and D factor matrix D i , represents the LDL of the inverse of the second regularized symmetric matrix with i participants. T Decomposition of the factor matrix, i.e., L factor matrix L i and D factor matrix D i Therefore, it can be deduced that the above matrix... and L i satisfy That is, matrix It is matrix L i Right multiply by a first invertible matrix The result after multiplication and encryption. Correspondingly, the matrix... This is called the multiplication encryption L-factor matrix with i participants; it is a type of multiplication encryption factorization matrix with i participants. Correspondingly, the matrix... It is called the multiplication encryption L-factor matrix of the first participant, or the multiplication encryption L-factor matrix of one participant. It is a type of multiplication encryption factor matrix of one participant.

[0112] Since some steps in Embodiment 3 are repeated in Embodiment 2, the following will be based on steps S11 and S12 in Embodiment 2, and will describe in detail the entire implementation process by introducing the specific modifications required relative to Embodiment 2.

[0113] In the aforementioned Embodiment 2, step S11 includes steps S111 and S112, and step S12 includes steps S121 and S122. To modify Embodiment 2 into an embodiment based on the LDLT decomposition method for factor matrices, steps S111 and S112 in step S11 need to be modified to steps S111' and S112' as described below, and step S122 in step S12 needs to be modified to step S122' as described below, while step S121 in step S12 remains unchanged. The following describes steps S111' and S112' in step S11 and step S122' in step S12, respectively, obtained by the above modifications.

[0114] Step S111': To obtain step S111', the sub-steps S111-a, S111-b, and S111-e of step S111 in Embodiment 2 remain unchanged, while sub-steps S111-c and S111-d are modified into sub-steps S111'-c and S111'-d, respectively. Accordingly, step S111' sequentially includes the aforementioned sub-steps S111-a, S111-b, S111'-c, S111'-d, and S111-e, wherein sub-steps S111-c' and S111-d' are described as follows:

[0115] Sub-step S111'-c: In the first implementation of this sub-step, the first participant uses the well-known LDLT decomposition technique to obtain the result that satisfies... of and D1, of which Ω1 is the inverse L-factor of the first regularized symmetric matrix of the first participant, and D1 is the inverse D-factor of the first regularized symmetric matrix of the first participant; when the first invertible matrix Ω1 is an orthogonal matrix, then the above... It can be simplified to Correspondingly, The first regularized symmetric matrix of the first participant is called the inverse L factor, and D1 is called the inverse D factor of the first regularized symmetric matrix of the first participant. Alternatively, in the second implementation of this sub-step, the first participant uses sub-step S111-c of Embodiment 2 to obtain the condition that satisfies... The inverse factorization matrix P1 of the first regularized symmetric matrix of the first participant is obtained, and a diagonal matrix D1 with arbitrarily positive values ​​for each term on the diagonal is set. Then, using D1 and P1, the following is calculated:

[0116] The above can be verified satisfy Right now It is the encrypted L-factor matrix multiplied by the first participant. When the first participant has low requirements for protecting their own privacy data, they can also... It equals the identity matrix I, therefore we have

[0117] Sub-step S111'-d: When the first implementation method of the sending step in this embodiment is adopted, the first participant multiplies the encrypted L-factor matrix of the first participant in this sub-step. The first participant sends its D-factor matrix D1 or a transformed form thereof to the second participant; or, when using the second implementation of the sending step in this embodiment, the first participant sends the D-factor matrix D1 of the first participant to the second participant in this sub-step. And D1, or their transformed forms, are sent to participants 2, 3…m, the m-1 participants. The transformation form of D1 refers to Other forms of D1, where the receiver may not use other information, only... And other forms of D1 are obtained And D1, for example, send and One of these three forms.

[0118] Step S112': In order to obtain step S112', in the sub-steps S112-a, S112-b, S112-c, S112-d, S112-e, S112-f, S112-g and S112-h included in step S112 of embodiment two, sub-steps S112-b, S112-c, S112-d and S112-h remain unchanged, while sub-steps S112-a, S112-e, S112-f and S112-g are modified to sub-steps S112'-a, S112'-e, S112'-f and S112'-g respectively. Accordingly, step S112' sequentially includes the aforementioned sub-steps S112'-a, S112-b, S112-c, S112-d, S112'-e, S112'-f, S112'-g, and S112-h, wherein sub-steps S112'-a, S112'-e, S112'-f, and S112'-g are described as follows:

[0119] Sub-step S112-a: The i-th participant, i.e., the i-th data owner, obtains the encryption L-factor matrix multiplied by a total of i-1 participants based on the received information. The D-factor matrix D of i-1 participants i-1 When the sending step in this embodiment adopts the first implementation method, the i-th participant receives the message sent by the (i-1)-th participant. and D i-1 Or their transformed forms; when the sending step in this embodiment adopts the second implementation method, the i-th participant receives from participants 1, 2...i-1 respectively. and D i-1 Or a part of their transformed forms, thus merging to obtain and D i-1 .

[0120] Sub-step S112'-e: The i-th participant uses the splicing matrix V obtained in the previous sub-step. i That is, the product of the encryption matrix of the encrypted data transformation of the i-1 participating columns and the encryption matrix of the ith participating column, which satisfies the following conditions. LDL T Decomposition factors, including L factor and D factor The above It is the inverse L-factor of the first regularized symmetric matrix with i participants. The submatrix in, and the above D is the inverse D factor of the first regularized symmetric matrix with i participants. i The submatrix in the first invertible matrix Ω. i It is an orthogonal matrix, as mentioned above. Simplified to

[0121] Then the above It is the inverse L-factor of the first regularized symmetric matrix of the encryption matrix transformed from the encrypted data of i participating parties. The submatrix in, and the above D is the inverse D factor of the first regularized symmetric matrix of the encrypted data transformation matrix with i participating parties. i Submatrices in.

[0122] The first implementation method for this sub-step uses the well-known LDL. T Decomposition technique. The second implementation of this sub-step follows sub-step S112-e from Example 2, calculating the condition that satisfies... square root matrix Then set up a diagonal matrix where each term on the diagonal is an arbitrary positive number. And calculate

[0123] Sub-step S112'-f: In this sub-step, the i-th participant uses the inverse L factor of the first regularized symmetric matrix of the i participants. submatrix in The inverse D factor of the first regularized symmetric matrix with i participants. i submatrix in And the product V of the encryption matrix of the encrypted data transformation of the i-1 participating columns and the encryption matrix of the i-th participating column. i The inverse L factor of the first regularized symmetric matrix of i-1 participants. Updated to the inverse L-factor of the first regularized symmetric matrix with i participants. And factor D of the inverse D of the first regularized symmetric matrix of the i-1 participating parties. i-1 Updated to the inverse D factor D of the first regularized symmetric matrix with i participants. i A specific implementation method could be that the i-th data owner... D i-1 Updated to D i On the other hand, the i-th data owner calculates... relatively The added non-zero columns are Then through Bundle Updated to That is, in Add multiple columns to the right of exist Add a submatrix consisting entirely of zeros directly below it. Add a submatrix to the lower right. Thus Updated to

[0124] Sub-step S112'-g: If the value of i is less than or equal to m-1, the i-th participant adopts the first implementation method of the sending step to... and D i Alternatively, their transformed forms can be sent to the next participant, i.e., the (i+1)th participant, or the i-th participant can use the second implementation method of the sending step to send... relatively The added non-zero column is Or its transformed form, and D i Relative to D i-1 The added diagonal matrix Or a transformed form thereof, sent to the m-i+1 participants i+1, i+2, ..., m. The above... and D i The transformation form refers to and D i Other forms, whereby the recipient may not use other information, by and D i Other forms of recovery and D i For example, sending and One of these three forms.

[0125] In this embodiment, step S12 includes steps S121 and S122', wherein step S121 is the same as step S121 in embodiment two, and step S122' is described in detail below:

[0126] Step S122': Possess and D m m participating parties and owners Several nodes (i = 1, 2, ..., m) cooperate to compute... To obtain the multiplicative encrypted linear regression coefficient vector The above It is the inverse L-factor of the first regularized symmetric matrix with m participants, and the above D m It is the inverse D factor of the first regularized symmetric matrix with m participants. It is easy to see that the multiplied encrypted linear regression coefficient vector... The inverse factor matrix (i.e., the inverse L-factor) of the regularized symmetric matrix of the encryption matrix, which is equal to the column-encrypted data transformation of m participants. The inverse D factor of this regularized symmetric matrix. m and the second product vector The product of the second product vector Equal to the inverse decomposition factor matrix transpose Multiply the encrypted data of m participating columns by the product of the encryption matrix and the label. The results, among which It is a concatenated vector that contains the product of the encryption matrix and the label of each of the m participants from the 1st to the mth participant, with each participant's column of encrypted data transformed into a subvector.

[0127] There are several possible ways to implement this step. Some of them are listed below:

[0128] Implementation Method 1) If step S121 adopts Implementation Method 1, then in this step, possessing and D m m participating parties and owners The collaboration of each specific node i in (i = 1, 2, ..., m) yields the following results: With possession The collaboration of the i-th specific node can be possessed by and D m The mth participant, or all of them possess at least part of and D m All m participants, or all of them possess at least a portion of the resources. and D m At least two parties are involved. The calculated... It can be placed on one node, or on multiple nodes.

[0129] let Then we can get And it can be represented as

[0130] Right now Where Γ(:,i) (i = 1, 2, ..., m) represents the matrix Γ starting from the first...m... Listed to number All columns of the column. Correspondingly, the calculated... One implementation method that places them on multiple nodes is, The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node, which can be the i-th specific node, a participant, or other nodes.

[0131] Implementation Method Two) If Implementation Method Two is adopted in step S121, then in this step, possessing and D m The m participating parties and their respective shares Two nodes (i = 1, 2, ..., m), namely node i-th node A and node i-th node B, cooperate to calculate... Calculated It can be placed on one node, or on multiple nodes.

[0132] Bundle Substitution It can be obtained Correspondingly, One way to implement this is to place the elements on multiple nodes: The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node A, which can be the i-th node A, a participant, or other nodes; The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node B, where the i-th coefficient storage node B can be the i-th node B, a participant, or another node.

[0133] The multiplication encryption linear regression coefficient vector With the target linear regression coefficient vector The relationship between them is That is, multiply the encrypted linear regression coefficient vector It is the target linear regression coefficient vector Right multiplication The result is encrypted.

[0134] When it needs to be obtained from a specific node and D m Then, the following scenarios are possible: when a specific node is the m-th participant, then that specific node has already obtained [something] in the previous sub-step. and D m When a specific node is any one of the participants 1, 2, ..., m-1, then the specific node only has and D m Some items in the document need to be handled by the relevant parties. and D m Items not present at a specific node are sent to that specific node. The relevant participants can be the m-th participant, all other participants besides the specific node, or at least two of the other participants besides the specific node. If the specific node is a node other than participants 1, 2, ..., m, then the relevant participants need to... and D m Sending to a specific node, the aforementioned relevant participants can be the m-th participant, or all m participants (participants 1, 2, ..., m), or a number of participants of at least two among all m participants. When the relevant participants include a number of participants of at least two, each of the aforementioned participants sends... and D m A portion is given to a specific node, which then aggregates the data sent by several participants to obtain... and D m .

[0135] When step S121 adopts the simple implementation method described above, that is, all calculation results Since (i = 1, 2, ..., m) are all owned by the label data owner, this step can also be implemented in a simpler way: that is, by the owner... and D m The mth participant and owner Collaborate with the tag data owner to calculate And put Placed in the m-th participant or the tag data owner. When If placed in the m-th participant, then the tag data owner will... Send to the m-th participant, who will then calculate the result. Or, when If the data is placed by the tag data owner, then the m-th participant will... and D m Send it to the tag data owner, who will then calculate it.

[0136] The above-mentioned multiplicative encrypted linear regression coefficient vector is calculated. Subsequently, the effect achieved by the following steps in the above embodiments of the present invention is: if there are several participants from participant 1 to m that use an incrementing encryption mask matrix with non-zero columns, then the several participants sequentially... D m Multiplication and encryption of linear regression coefficient vectors This at least partially eliminates the influence of its incrementing encryption mask matrix Δ. When each participant using a non-zero column incrementing encryption mask matrix multiplies the encryption linear regression coefficient vector... This at least partially eliminates the impact of the participant's added encryption mask matrix Δ, or, if there is no participant using a non-zero column added encryption mask matrix, then it possesses the most recently updated multiplied encryption linear regression coefficient vector. The participants or nodes, Several items corresponding to participant i (where i is greater than or equal to 1 and less than or equal to m) are sent to participant i, and participant i uses the inverse of its own private first mask matrix... The decryption process yields several terms corresponding to the target linear regression coefficient vector.

[0137] It will be understood by those skilled in the art that Figure 1 The technical solutions shown do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0138] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0139] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0140] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0141] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A privacy-preserving linear regression method, characterized in that, include: The current participant receives the inverse factor matrix of the regularized symmetric matrix of the matrix affected by the column encrypted data transformation encryption matrix corresponding to the private original data of the preceding participants, or the transformation form of the inverse factor matrix; the column encrypted data transformation encryption matrix is ​​equal to the product of the column encrypted data matrix of any participant and the first mask matrix of any participant, the column encrypted data matrix is ​​formed by the original data matrix formed by the private original data of any participant as a submatrix, and the first mask matrix is ​​an invertible matrix; the regularized symmetric matrix of a matrix is ​​the sum of the symmetric matrix of the matrix plus the regularization term, wherein the regularization term is a matrix that contains the product of the symmetric matrix of the first mask matrix of the relevant participant and the preset regularization coefficient as a submatrix; the symmetric matrix of a matrix is ​​equal to the product of the transpose of the matrix and the matrix itself. The current participant collaborates with the preceding participants to determine the product matrix or transformation form of the column-encrypted data transformation matrices of the preceding and current participants using the column-encrypted data transformation matrices corresponding to their respective private original data. The product matrix of the column-encrypted data transformation matrices of the preceding and current participants is equal to the product of the transpose of the column-encrypted data transformation matrices of the preceding participants and the column-encrypted data transformation matrices of the current participant. The product matrix or transformation form of the column-encrypted data transformation matrices of the preceding and current participants is obtained by the preceding and current participants through direct calculation or by determination based on a preset secure multi-party computation protocol. The current participant sends, in whole or in part, the inverse factor matrix or a transformed form of the inverse factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant, respectively; or, the current participant obtains and utilizes the product matrix or a transformed form of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant respectively, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participant is the participant that subsequently provides the private original data; The encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix of the preceding participants and the current participant, and the first product vector. The first product vector is determined by concatenating the transpose of the inverse decomposition factor matrix with the product of the column encrypted data transformation encryption matrix and the label of the preceding participants and the product of the column encrypted data transformation encryption matrix and the label of the current participant as sub-vectors. The transformation form of the matrix satisfies the condition that the matrix can be calculated without other information from this transformation form.

2. The privacy-preserving linear regression method according to claim 1, characterized in that, The column-encrypted data transformation encryption matrix corresponding to the private original data of any participant is equal to the product of the column-encrypted data matrix of that participant and the first mask matrix of that participant; wherein, the column-encrypted data matrix of that participant is submatrixed from the original data matrix formed by the private original data of that participant, and the column-encrypted data matrix includes each sub-column of the original data matrix and a mask column generated by the participant itself or obtained from a trusted node, and the number of items contained in the mask column is equal to the number of items in the original data matrix of that participant. The data matrix contains the same number of items in each column; and the first mask matrix of any participant is an invertible matrix, generated by the participant itself or obtained from a trusted node; wherein, the multiplication of the encrypted linear regression coefficient vector is equal to the column vector obtained by right-multiplying the target linear regression coefficient column vector by the influence of the mask columns of each participant, and then multiplying it by the block diagonal matrix composed of the first mask matrices of each participant, wherein the block diagonal matrix contains the inverse matrix of the first mask matrix of each participant as a submatrix located on the diagonal of the block diagonal matrix.

3. The privacy-preserving linear regression method according to claim 2, characterized in that, The influence of the column-encrypted data transformation encryption matrix of the preceding participants is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants as a submatrix. The influence of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants and the column-encrypted data transformation encryption matrix of the current participant as a submatrix. Wherein, the inverse factor matrix of the regularized symmetric matrix is ​​the factor matrix of the inverse matrix of the regularized symmetric matrix, and the factor matrix is ​​a square root matrix or an LDL matrix. T One of the L-factor matrices in the decomposition.

4. The privacy-preserving linear regression method according to claim 1, characterized in that, The current participant collaborates with the preceding participants to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix corresponding to their respective private original data, thereby determining the product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant; the current participant sends, in whole or in part, the inverse decomposition factor matrix or transformation form of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant; or, the current participant obtains and utilizes the product matrix or transformation form of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, in collaboration with the preceding participants and the tag data owner, to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participants are the participants that subsequently provide the private original data, including: The current participant collaborates with the preceding participants to determine the product matrix or its transformation form using the column encrypted data transformation encryption matrix of the current participant and the column encrypted data transformation encryption matrix of the preceding participants. The product matrix or its transformation form is obtained by the current participant. The current participant uses the product matrix or its transformation form of the encryption matrix of the column-encrypted data transformation of the preceding participants and the current participant to obtain the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix containing the influence of the encryption matrix of the column-encrypted data transformation of the preceding participants and the current participant, and then sends all or part of the inverse factor matrix or the transformation form of the inverse factor matrix to the subsequent participants. After all the participating parties have calculated the inverse factor matrix or the transformed form of the regularized symmetric matrix containing the influence of their respective column encrypted data transformation encryption matrix, the current participating party then uses its own inverse factor matrix or the transformed form of the inverse factor matrix to collaborate with the preceding participating parties and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector.

5. The privacy-preserving linear regression method according to claim 3, characterized in that, The current participant obtains and utilizes the product matrix or its transformed form of the encrypted data transformation matrix of the preceding participants and the current participant, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, including: After all the participating parties have calculated the inverse factor matrix or the transformed form of the regularized symmetric matrix containing the influence of their respective column-encrypted data transformation encryption matrices, the multiplicative encrypted linear regression coefficient vector is determined. This is achieved using the inverse factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrices of the preceding and current participating parties, the product of the column-encrypted data transformation encryption matrices of the preceding participating parties and the label, and the product of the column-encrypted data transformation encryption matrix of the current participating party and the label. The product of the column-encrypted data transformation encryption matrix of any participating party and the label is equal to the product of the transpose of the corresponding participating party's column-encrypted data transformation encryption matrix and the label column vector of the label owner. The product of the column-encrypted data transformation encryption matrix of any participating party and the label owner is determined or directly calculated based on a preset secure multi-party computation protocol.

6. The privacy-preserving linear regression method according to claim 5, characterized in that, The determination of the multiplicative encrypted linear regression coefficient vector is achieved using the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, the product of the column encrypted data transformation encryption matrix and the label of the preceding participants, and the product of the column encrypted data transformation encryption matrix and the label of the current participant. The multiplicative encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, and a first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with a concatenated vector containing the products of the column encrypted data transformation encryption matrix and the label of the preceding participants and the current participant as subvectors, resulting in a second product vector. When the decomposition factor matrix is ​​a square root matrix, the first product vector equals the second product vector; or, when the decomposition factor matrix is ​​an LDL matrix... T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

7. The privacy-preserving linear regression method according to claim 6, characterized in that, There are m participants providing their respective private original data, where m is an integer greater than or equal to 2; the current participant is the i-th participant, where i is any integer greater than or equal to 2 and less than or equal to m; the preceding participants are the j-th participants, where j is any positive integer less than i; the subsequent participants are the k-th participants, where k is any integer greater than i and less than or equal to m. The current participant collaborates with the preceding participants, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, including: The i-th participant and the j-th participant collaborate to use the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the j-th participant and the i-th participant, where j takes any positive integer less than i.

8. The privacy-preserving linear regression method according to claim 7, characterized in that, When the current participant is the i-th participant and i is less than or equal to m-1, then the preceding participant is the (i-1)-th participant, and the subsequent participant is the (i+1)-th participant. The (i-1)-th participant sends all or part of the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix affected by the transformation encryption matrix of the column encrypted data corresponding to the private original data of the i-1 participants from the 1-th participant to the (i-1)-th participant to the i-th participant. The i-th participant receives the inverse factor matrix or its transformation form. The i-th participant collaborates with each of the participants from the 1st participant to the (i-1)th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the i-th participant and each of the i-1 participants. Then, using the product matrix or its transformation form, it obtains and sends to the (i+1)th participant the inverse decomposition factor matrix or the transformation form of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrix corresponding to the private original data of the i participants from the 1st participant to the i-th participant, in whole or in part. When the current participant is the i-th participant and i equals m, then the preceding participant is the (m-1)-th participant. The (m-1)-th participant sends all or part of the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the m-1 participants from the 1-th participant to the (m-1)-th participant. The m-th participant receives the inverse factor matrix or its transformation form. The m-th participant collaborates with each of the m-1 participants from the 1-th participant to the (m-1)-th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the m-th participant and each of the m-1 participants, and then uses... The product matrix or its transformation form, in collaboration with the tag data owner and the m-1 participants from the 1st to the (m-1th)th participants, determines the encrypted linear regression coefficient vector. The encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix of each of the m participants from the 1st to the mth participants, and the first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with the concatenated vector containing the column encrypted data transformation encryption matrix and the tag product as sub-vectors of the m participants from the 1st to the mth participants. When the decomposition factor matrix is ​​the square root matrix, the first product vector equals the second product vector; or when the decomposition factor matrix is ​​an LDL matrix... T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

9. A privacy-preserving linear regression system, characterized in that, The privacy-preserving linear regression system is used to perform the privacy-preserving linear regression method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the privacy-preserving linear regression method as described in any one of claims 1-8.

Images