Linear regression methods for horizontal data partitioning and privacy protection

Abstract

This application provides a linear regression method for horizontally partitioning data and based on privacy protection, comprising: each of at least two data owners using their own private data samples to obtain ciphertext related to their original symmetric matrix and ciphertext of their original product vector, wherein the original symmetric matrix and the original product vector are respectively the symmetric matrix and product vector corresponding to several data samples; the data owners send the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector to a first server; the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of the at least two data owners, and cooperates with a second server to obtain the target linear regression coefficients; according to the method proposed in this application, apart from the data owners holding their own private data, neither the first server nor the second server can steal the private data based on their own conditions, thereby ensuring the security of the private data.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of machine learning technology, and in particular to a method and apparatus for horizontally partitioning data and performing privacy-preserving linear regression. Background Technology

[0002] As the public and policymakers become increasingly aware of the importance of privacy, the demand for privacy-preserving machine learning in data practices is rising. Access to data is subject to increasing scrutiny, and research into privacy-respecting tools such as horizontal federated learning is becoming increasingly active. Ideally, horizontal federated learning can enable collaboration among data stakeholders while protecting the privacy of individuals and institutions.

[0003] In lateral federated learning, even if lateral federated learning only shares model updates rather than the original data, attackers may still infer information about the training data by analyzing these updates. Such inference attacks threaten the privacy of user data. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This application provides a linear regression method for horizontally partitioning data and based on privacy protection, which ensures the security of private data during data transmission and computation.

[0006] To achieve the above objectives, a first aspect of this application proposes a privacy-preserving linear regression method for horizontally partitioning data, comprising: each of at least two data owners using several of their own private data samples to obtain ciphertext related to their original symmetric matrix and ciphertext of their original product vector, wherein the original symmetric matrix and the original product vector are respectively the symmetric matrix and product vector corresponding to the several data samples; each of the data owners sends their respective ciphertext related to the original symmetric matrix and the ciphertext of the original product vector to a first server; the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of the at least two data owners, and cooperates with a second server to obtain the target linear regression coefficients; the privacy-preserving linear regression method further comprises: the first server receiving the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of the at least two data owners, and obtaining pseudo-sample symmetric matrix processing results and pseudo-sample product vector processing results, wherein the pseudo-sample symmetric matrix processing results and the pseudo-sample product vector processing results are respectively the processed pseudo-sample symmetric matrix and pseudo-sample product vector processing results. The result obtained by the quantity is that the pseudo-sample symmetric matrix and the pseudo-sample product vector are respectively the symmetric matrix and product vector corresponding to several pseudo-data samples; the first server uses the ciphertext related to the original symmetric matrix and the processing result of the pseudo-sample symmetric matrix to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners that contain the influence of the pseudo-sample symmetric matrix, and uses the ciphertext of the original product vector and the processing result of the pseudo-sample product vector to obtain the sum of the ciphertexts of the original product vectors of multiple data owners that contain the influence of the pseudo-sample product vector; the first server will then process the multiple data samples that contain the influence of the pseudo-sample symmetric matrix... The sum of the original symmetric matrix ciphertexts of the data owners and the sum of the original product vector ciphertexts of the multiple data owners that include the influence of the pseudo-sample product vectors are sent to the second server; the second server receives and decrypts the sum of the original symmetric matrix ciphertexts of the multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the original product vector ciphertexts of the multiple data owners that include the influence of the pseudo-sample symmetric matrix, to obtain the sum of the original symmetric matrix plaintexts of all data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the original product vector plaintexts of all data owners that include the influence of the pseudo-sample product vectors;The second server calculates the pseudo-sample encrypted linear regression coefficients by using the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vectors of all data owners that include the influence of the pseudo-sample product vector. The second server then sends these pseudo-sample encrypted linear regression coefficients to the first server. Alternatively, the second server performs regularization processing on the sum of the plaintext of the original symmetric matrices of all data owners that includes the influence of the pseudo-sample symmetric matrix, and calculates the pseudo-sample encrypted linear regression coefficients based on the sum of the plaintext of the original symmetric matrices of all data owners that includes the influence of the pseudo-sample product vector. The pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, are obtained by summing the plaintext of the original product vector of the owner and summing the plaintext of the original symmetric matrix of all data owners after regularization. These pseudo-sample encrypted linear regression coefficients are then sent to the first server. The first server receives the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and at least partially eliminates the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector from the pseudo-sample encrypted linear regression coefficients to obtain the target linear regression coefficients.

[0007] In some embodiments, each of the plurality of privately owned data samples includes an original input feature column vector and a corresponding original label; each of the plurality of pseudo-data samples includes a pseudo-input feature column vector and a corresponding pseudo label; the original symmetric matrix of any data owner is equal to the sum of the products of each of the original input feature column vectors of the data owner and their own transposes, and the original product vector of any data owner is equal to the sum of the products of each of the original labels of the data owner and their corresponding original input feature column vectors; the pseudo-sample symmetric matrix is ​​the sum of the products of each of the pseudo-input feature column vectors contained in the plurality of pseudo-data samples and their own transposes, and the pseudo-sample product vector is the sum of the products of each of the pseudo-input feature column vectors contained in the plurality of pseudo-data samples and their corresponding pseudo labels; the ciphertext associated with the original symmetric matrix and the ciphertext of the original product vector are obtained by the data owner using encryption technology that supports addition calculations on the ciphertext to encrypt the plaintext associated with the original symmetric matrix and the original product vector respectively, while supporting addition calculations on the ciphertext The encryption technique for addition calculation satisfies the following: plaintext is processed by encryption techniques that support addition calculations on ciphertext to obtain ciphertext; the sum of the ciphertexts is obtained through arithmetic addition operations between the ciphertexts; the sum of the ciphertexts, after decryption, corresponds to the arithmetic sum of multiple plaintexts; the first server uses the ciphertext related to the original symmetric matrix and the processing result of the pseudo-sample symmetric matrix to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix. Specifically, it uses the encryption technique that supports addition calculations on ciphertext to accumulate the ciphertexts of the original symmetric matrices of multiple data owners and the processing result of the pseudo-sample symmetric matrix; the specific process by which the first server uses the ciphertext of the original product vector and the processing result of the pseudo-sample product vector to obtain the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector is to use the encryption technique that supports addition calculations on ciphertext to accumulate the ciphertexts of the original product vectors of multiple data owners and the processing result of the pseudo-sample product vector.

[0008] In some embodiments, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and at least partially eliminates the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector from the pseudo-sample encrypted linear regression coefficients to obtain target linear regression coefficients. This includes: the first server encrypting a pseudo-input matrix composed of several pseudo-input feature column vectors contained in the several pseudo-data samples to obtain pseudo-input matrix ciphertext; the first server sending the pseudo-input matrix ciphertext to the second server; the second server calculating the inverse matrix of the sum of the plaintext of the original symmetric matrices of all data owners containing the influence of the pseudo-sample symmetric matrix, i.e., the first inverse matrix; and the second server, based on the first server's encryption of the pseudo-data samples, encrypting the pseudo-input matrix composed of several pseudo-input feature column vectors contained in the pseudo-data samples to obtain pseudo-input matrix ciphertext; the second server sending the pseudo-input matrix ciphertext to the second server; and the second server calculating the inverse matrix of the sum of the plaintext of the original symmetric matrices of all data owners containing the influence of the pseudo-sample symmetric matrix. The encryption method of the pseudo-input matrix is ​​used to obtain the product of the ciphertext of the pseudo-input matrix and the first inverse matrix. The second server sends the product of the ciphertext of the pseudo-input matrix and the first inverse matrix to the first server. The first server decrypts the product of the ciphertext of the pseudo-input matrix and the first inverse matrix based on its own encryption method for the pseudo-input matrix, obtaining the product of the plaintext of the pseudo-input matrix and the first inverse matrix. The first server uses the product of the plaintext of the pseudo-input matrix and the first inverse matrix to at least partially eliminate the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector in the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, to obtain the target linear regression coefficients.

[0009] In some embodiments, each of at least two data owners uses the same encryption technique to encrypt intermediate variables related to several private data samples, respectively, to obtain ciphertexts related to their respective original symmetric matrices and ciphertexts of their original product vectors; the sum of the ciphertexts of the original symmetric matrices of the multiple data owners that include the influence of the pseudo-sample symmetric matrix obtained by the first server is the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of the multiple data owners that include the influence of the pseudo-sample product vector obtained by the first server is the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector.

[0010] In some embodiments, the at least two data owners each use at least two different encryption techniques to encrypt intermediate variables related to several private data samples, obtaining ciphertexts related to their respective original symmetric matrices and the original product vectors. The sum of the ciphertexts of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix, obtained by the first server, is the result of adding the influence of the pseudo-sample symmetric matrix to the sum of the ciphertexts of the original symmetric matrices of multiple data owners using the same encryption technique. The sum of the ciphertexts of the original product vectors of multiple data owners that includes the influence of the pseudo-sample product vector, obtained by the first server, is the result of adding the influence of the pseudo-sample product vector to the sum of the ciphertexts of the original product vectors of multiple data owners using the same encryption technique. The first server sends the sum of the ciphertexts of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of multiple data owners that includes the influence of the pseudo-sample product vector to the second server. The second server receives at least two ciphertexts related to different encryption methods. The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of pseudo-sample symmetric matrices, and the sum of the original product vector ciphertexts of multiple data owners, each associated with a different encryption method, are decrypted using different decryption techniques corresponding to various encryption techniques. This process yields at least two packets. The first server sums the plaintext of the original symmetric matrices of multiple data owners that are affected by pseudo-sample symmetric matrices, and the plaintext of the original product vectors of at least two data owners that are affected by pseudo-sample product vectors; the second server sums the plaintext of the original symmetric matrices of multiple data owners that are affected by pseudo-sample symmetric matrices to obtain the sum of the plaintext of the original symmetric matrices of all data owners that are affected by pseudo-sample symmetric matrices, and sums the plaintext of the original product vectors of multiple data owners that are affected by pseudo-sample product vectors to obtain the sum of the plaintext of the original product vectors of all data owners that are affected by pseudo-sample product vectors.

[0011] In some embodiments, the at least two data owners use at least two different encryption techniques, including a first encryption technique, to encrypt intermediate variables related to several private data samples, respectively, to obtain ciphertexts of their original symmetric matrices and original product vectors. The first server uses the first encryption technique to further encrypt the ciphertext of the original symmetric matrices obtained by other encryption techniques or the corresponding summation result, and further encrypts the ciphertext of the original product vectors obtained by the other encryption techniques or the corresponding summation result, wherein the other encryption techniques are encryption techniques other than the first encryption technique among the at least two different encryption techniques. The first server then uses the result of the further encryption to obtain the sum of the ciphertexts of all data owners' original symmetric matrices encrypted with the first encryption technique and containing the influence of the pseudo-sample symmetric matrix, and obtains the ciphertexts of all data owners' original symmetric matrices encrypted with the first encryption technique and containing the influence of the pseudo-sample product vector. The first server sends the sum of the ciphertexts of the product vectors, which includes the influence of the pseudo-sample symmetric matrix, encrypted using the first encryption technology, and the sum of the ciphertexts of the original product vectors of all data owners, which includes the influence of the pseudo-sample product vector, encrypted using the first encryption technology, to the second server. The second server receives and decrypts the sum of the ciphertexts of the original symmetric matrix of all data owners, which includes the influence of the pseudo-sample symmetric matrix, encrypted using the first encryption technology, and the sum of the ciphertexts of the original product vectors of all data owners, which includes the influence of the pseudo-sample product vector, encrypted using the first encryption technology, respectively. Then, it further decrypts using the decryption technology corresponding to the other encryption technology to obtain the sum of the plaintexts of the original symmetric matrix of all data owners, which includes the influence of the pseudo-sample symmetric matrix, and the sum of the plaintexts of the original product vectors of all data owners, which includes the influence of the pseudo-sample product vector.

[0012] In some embodiments, each of the at least two data owners encrypts using the same encryption technique, namely, using an additive homomorphic encryption technique that supports addition of ciphertext and using a first key, wherein the first key is the public key used in the additive homomorphic encryption technique; the ciphertext associated with the original symmetric matrix is ​​the ciphertext of the original symmetric matrix; the pseudo-sample symmetric matrix processing result is the ciphertext obtained by homomorphically encrypting the pseudo-sample symmetric matrix or its negative value using the first key, and the pseudo-sample product vector processing result is the ciphertext obtained by homomorphically encrypting the pseudo-sample product vector or its negative value using the first key; the sum of the ciphertexts of the original symmetric matrices of all data owners, including those affected by the pseudo-sample symmetric matrix, is obtained by using the addition technique included in the additive homomorphic encryption technique. The method involves summing the ciphertext of the pseudo-sample symmetric matrix processing result and the original symmetric matrix of all data owners, and performing optional regularization. The sum of the ciphertexts of the original product vectors of all data owners, including the influence of the pseudo-sample product vector, is obtained by adding the ciphertext using the addition homomorphic encryption technique. The second server decrypts the sum of the ciphertexts of the original symmetric matrices of all data owners, including the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of all data owners, including the influence of the pseudo-sample product vector, using the decryption technique corresponding to the addition homomorphic encryption technique and a second key, wherein the second key is the private key used in the addition homomorphic encryption technique.

[0013] In some embodiments, each of at least two data owners encrypts using the same encryption technique, which is to encrypt the plaintext using a masking technique; the ciphertext of the original product vector of any data owner is the sum of the original product vector of the data owner and the masked product vector of the data owner; the ciphertext related to the original symmetric matrix satisfies that the ciphertext of the original symmetric matrix can be calculated using the ciphertext related to the original symmetric matrix, and the ciphertext of the original symmetric matrix of any data owner is the sum of the original symmetric matrix of the data owner and the masked symmetric matrix of the data owner; the pseudo-sample symmetric matrix processing result is the pseudo-sample symmetric matrix or the negative value of the pseudo-sample symmetric matrix, and the pseudo-sample product vector processing result is the pseudo-sample product vector or the negative value of the pseudo-sample product vector; the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix is ​​the sum of the ciphertexts of the pseudo-sample symmetric matrix processing result and the ciphertexts of the original symmetric matrices of all data owners, and further... The result obtained by optional regularization processing; the sum of the ciphertext of the original product vectors of all data owners that includes the influence of the pseudo-sample product vector is the result obtained by accumulating the processing result of the pseudo-sample product vector and the ciphertext of the original product vectors of all data owners; the second server decrypts the sum of the ciphertext of the original symmetric matrix of all data owners that includes the influence of the pseudo-sample symmetric matrix and the sum of the ciphertext of the original product vector of all data owners that includes the influence of the pseudo-sample product vector respectively, by the second server subtracting the sum of the mask symmetric matrices of all data owners from the sum of the ciphertext of the original symmetric matrix of all data owners that includes the influence of the pseudo-sample symmetric matrix, and subtracting the sum of the mask product vectors of all data owners from the sum of the ciphertext of the original product vector of all data owners that includes the influence of the pseudo-sample product vector, to obtain the sum of the plaintext of the original symmetric matrix of all data owners that includes the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vector of all data owners that includes the influence of the pseudo-sample product vector.

[0014] In some embodiments, the mask symmetric matrix and the mask product vector of any data owner are respectively the symmetric matrix and product vector corresponding to a plurality of mask data samples of the data owner, wherein each of the plurality of mask data samples of any data owner includes a mask input feature column vector and a corresponding mask label; the mask symmetric matrix of any data owner is the sum of the products of each of the mask input feature column vectors and their transposes in the plurality of mask data samples of the data owner, and the mask product vector of any data owner is the sum of the products of each of the mask input feature column vectors and the corresponding mask label in the plurality of mask data samples of the data owner; the ciphertext associated with the original symmetric matrix of any data owner is the ciphertext of the original symmetric matrix or the product of a concatenated matrix and any orthogonal matrix, wherein the concatenated matrix is ​​composed of each of the original input feature column vectors and each of the mask input feature column vectors of the data owner.

[0015] To achieve the above objectives, a second aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the linear regression method described in the first aspect.

[0016] The embodiments of this application include at least the following beneficial effects: When a data owner encrypts their private data, sending the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector to a first server, the first server cannot know the method used by the data owner to encrypt the private data, and therefore cannot know the true nature of the private data. Furthermore, after receiving the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector, the first server also re-encrypts the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector using a pseudo-sample encryption method known only to itself. Therefore, after receiving the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector, the second server is also unable to decipher the true nature of the private data. In summary, apart from the data owner holding their own private data, neither the first nor the second server can steal the private data based on their own conditions, thus ensuring the security of the private data.

[0017] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0018] The accompanying drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0019] Figure 1 This is a schematic diagram of an optional process for a privacy-preserving linear regression method for horizontally partitioning data, as provided in an embodiment of this application.

[0020] Figure 2 This is a schematic diagram of an optional hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0022] In the description of this application, "several" means one or more, "multiple" means two or more, "greater than", "less than", "exceeding" etc. are understood to exclude the number itself, and "above", "below", "within" etc. are understood to include the number itself.

[0023] It should be noted that although functional modules are divided in the system diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than the module division in the system or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, or the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0024] It should be noted that in various specific embodiments of this application, when processing data related to the characteristics of the target object, such as target object attribute information or attribute information sets, is required, the permission or consent of the target object will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. The target object can be a user. In addition, when embodiments of this application need to obtain target object attribute information, separate permission or consent from the target object will be obtained through pop-ups or redirection to a confirmation page. Only after obtaining the target object's separate permission or consent will the necessary target object-related data for the normal operation of the embodiments of this application be obtained.

[0025] To facilitate understanding of the technical solutions provided in the embodiments of this application, some key terms used in the embodiments of this application will be explained below:

[0026] Machine learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learn-by-doing.

[0027] Linear regression is a type of regression analysis that models the relationship between one or more independent variables and a dependent variable using a least-squares function called the linear regression equation. This function is a linear combination of one or more model parameters called regression coefficients. A case with only one independent variable is called univariate linear regression, while a case with more than one independent variable is called multiple linear regression. The independent variables mentioned above are also called input features. The dependent variable mentioned above is also called the label, which refers to the target variable or the variable that is being predicted, representing the result or value that the regression model is expected to estimate based on the given input features. An example of linear regression is as follows: Suppose we want to build a regression model to predict house prices based on various features such as house size, number of bedrooms, and location; then the label would be the actual price of the house, while the input features include the size of the house, the number of bedrooms, location, and any other relevant factors. Horizontal federated learning is an emerging foundational technology in artificial intelligence. Its design goal is to enable highly efficient machine learning across multiple participants or computing nodes, while ensuring information security during big data exchange, protecting the privacy of terminal and personal data, and guaranteeing legal compliance. Horizontal federated learning allows for large-scale training on the devices that generate the data, with this sensitive data remaining with its owner—collected and trained locally. After local training, a central training coordinator obtains each node's training contribution by acquiring updates to the distributed model, but does not access the actual sensitive data.

[0028] Homomorphic encryption (HE) is a widely used cryptographic tool that satisfies the property of homomorphic computation on ciphertext. This means that after data is homomorphically encrypted, performing a specific computation on the ciphertext yields a ciphertext that, when homomorphically decrypted, results in plaintext that is equivalent to performing the same computation directly on the plaintext data, achieving "computable but invisible" data. Therefore, it is widely used in privacy-preserving scenarios such as cloud computing services, outsourced computing, and horizontal federated learning, representing an emerging direction in privacy technologies. Homomorphic encryption typically uses a pair of keys: a public key and a private key. The public key is used to encrypt plaintext data; that is, it is used to encrypt plaintext data to obtain the corresponding ciphertext data. The public key is usually held by multiple nodes that need to perform encryption operations. The private key is used to decrypt ciphertext data; that is, it is used to decrypt ciphertext data to obtain the corresponding plaintext data. The private key is usually held by one or a few trusted nodes that need to perform decryption operations. Homomorphic encryption techniques include additive homomorphic encryption, which supports addition of ciphertext; multiplicative homomorphic encryption, which supports multiplication of ciphertext; and fully homomorphic encryption, which supports both additive and multiplicative homomorphic operations. Generally, the more types of computations a homomorphic encryption technique needs to support, the higher its implementation complexity. For example, the implementation complexity of fully homomorphic encryption is typically higher than that of additive and multiplicative homomorphic encryption.

[0029] Based on this, embodiments of this application provide a linear regression method and apparatus for horizontally partitioning data and based on privacy protection, which can ensure the security of data transmission and computation in a horizontal federated learning platform.

[0030] The linear regression method and apparatus for horizontally partitioning data and based on privacy protection provided in this application are specifically described through the following embodiments. First, the linear regression method for horizontally partitioning data and based on privacy protection in this application embodiment is described.

[0031] The linear regression method for horizontally partitioning data and based on privacy protection provided in this application relates to the field of computer technology. This method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the linear regression method for horizontally partitioning data and based on privacy protection, but is not limited to the above forms.

[0032] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0033] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0034] The embodiments of this application will be further described below with reference to the accompanying drawings. Figure 1 As shown, Figure 1This is an optional flowchart illustrating a privacy-preserving linear regression method for horizontally partitioning data, provided in an embodiment of this application. This method is applied to a horizontal federated learning platform. The data owner communicates with the platform, which includes a first server and a second server. The first server and the second server communicate with each other. The first server executes machine learning tasks based on a federated model, and the second server coordinates encryption services. This privacy-preserving linear regression method can be executed by the server, by a terminal, or by a server in conjunction with a terminal. The method includes, but is not limited to, the following steps S110 to S140:

[0035] In step S110, the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners, and obtains the pseudo-sample symmetric matrix processing result and the pseudo-sample product vector processing result. The pseudo-sample symmetric matrix processing result and the pseudo-sample product vector processing result are respectively the results obtained by processing the pseudo-sample symmetric matrix and the pseudo-sample product vector, and the pseudo-sample symmetric matrix and the pseudo-sample product vector are respectively the symmetric matrix and product vector corresponding to several pseudo-data samples. The first server uses the ciphertext related to the original symmetric matrix and the pseudo-sample symmetric matrix processing result to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix, and uses the ciphertext of the original product vector and the pseudo-sample product vector processing result to obtain the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. The first server sends the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector to the second server.

[0036] Step S120: The second server receives and decrypts the sum of the ciphertexts of the original symmetric matrices of multiple data owners that contain the influence of the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of multiple data owners that contain the influence of the pseudo-sample product vector, so as to obtain the sum of the plaintexts of the original symmetric matrices of all data owners that contain the influence of the pseudo-sample symmetric matrix and the sum of the plaintexts of the original product vectors of all data owners that contain the influence of the pseudo-sample product vector.

[0037] Step S130: The second server uses the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vectors of all data owners that include the influence of the pseudo-sample product vector to obtain the pseudo-sample encrypted linear regression coefficients that include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and sends the pseudo-sample encrypted linear regression coefficients to the first server; or, the second server performs regularization processing on the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and obtains the pseudo-sample encrypted linear regression coefficients that include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector based on the sum of the plaintext of the original product vectors of all data owners that include the influence of the pseudo-sample product vector and the sum of the plaintext of the original symmetric matrices of all data owners after regularization processing, and sends the pseudo-sample encrypted linear regression coefficients to the first server.

[0038] In step S140, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors, and at least partially eliminates the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors from the pseudo-sample encrypted linear regression coefficients to obtain the target linear regression coefficients.

[0039] Understandably, horizontal federated learning refers to a situation where there is little overlap in users but significant overlap in user features among the data owners participating in joint modeling. It involves partitioning the private data of each data owner along the user dimension and using the portion of private data where user features are the same but user characteristics differ for training. It addresses the problem of joint learning between different subsets of samples within the same feature space, which is a key difference between it and vertical horizontal federated learning and federated transfer learning. Also known as sample-partitioned horizontal federated learning, it can be applied to scenarios where the private data of various data owners share the same feature space but have different sample spaces. IEEE has published the standard document IEEE Standard 3652.1-2020: IEEE Guide for Architectural Framework and Application of Federated Machine Learning, which provides standardized definitions and descriptions of horizontal federated learning, vertical horizontal federated learning, and federated transfer learning. According to this standard, horizontal federated learning follows the original framework of horizontal federated learning and is geared towards data scenarios where samples are jointly shared, meaning that the feature spaces of the private data of each data owner are consistent, and the private data sets of each data owner are "horizontally partitioned" with the entire sample set.

[0040] Horizontal federated learning is essentially the union of samples, suitable for scenarios where data owners have similar business models but reach different customers (i.e., high feature overlap but low user overlap). It is often applied to data with different samples but similar features. In traditional machine learning engine modeling, the data needed for model training is usually collected in a data center before training the model. In horizontal federated learning, it can be viewed as sample-based distributed model training, distributing all data to different machines. Each machine uses its local private data to collaboratively train the model while protecting the privacy of its local private data. Horizontal federated learning can be seen as sample-based distributed model training. The system scale of horizontal federated learning can range from a few to millions of data owners. Two typical scenarios are cross-device horizontal federated learning and cross-silo horizontal federated learning. The former is for relatively large-scale, heterogeneous client groups; the latter is for scenarios consisting of a small number of nodes with abundant resources (corresponding to large organizations such as e-commerce companies and banks), each node containing a relatively large amount of private data.

[0041] A typical example is that each mobile phone is used by an individual, generating a wealth of private data. While different phones may share similar basic features, their private data differs. Assuming data privacy is protected across individual phones, horizontal federated learning can aggregate these private data samples to train machine learning engine models. For instance, Google's Gboard system can federate multiple Gboard-equipped devices, merging multi-source data to construct horizontal federated learning, thereby improving the accuracy of the input method in predicting input words for users from different industries and with different input habits; and these multiple Gboard-equipped devices also include mobile phones.

[0042] Two companies with the same business but located in different regions have user groups from their respective regions with little overlap. However, their businesses are very similar, so the user characteristics they record are identical. In this case, lateral federated learning can be used to build a joint model.

[0043] In financial scenarios, horizontal federated learning is suitable for joint modeling among financial institutions, where data owners have similar business scenarios, share the same feature space for their private data, and have little overlap in their user groups. For example, two banks in different regions may have very little overlap in their user groups, but their businesses are very similar, so their private data feature spaces are the same. However, in certain specific business scenarios, such as SME lending, each data owner has limited modeling samples available, making it difficult to build models using traditional machine learning engines independently. In such cases, horizontal federated learning can be used to jointly utilize sample data from multiple different institutions, expanding the sample space for model training and thus building more accurate models with better generalization capabilities, including risk control models. Features frequently used in horizontal federated learning for SMEs include multi-source information such as business operation data, tax data, business registration data, and payment data.

[0044] In smart healthcare technology, patients' private data, such as symptoms, pathology reports, and test results, are scattered across multiple medical institutions. Each institution possesses different patient data samples, allowing multiple institutions to jointly train machine learning engine models using horizontal federated learning technology. Securities dealers can also utilize horizontal federated learning technology: Two branches of a brokerage firm in different regions, or two local brokerage firms in different areas, serve different client groups, but their clients' financial attributes are generally similar. In this scenario, horizontal federated learning often uses client characteristics that typically include information such as the type of securities purchased, the purchase amount, and the holding period, as well as client information such as occupation, gender, age, annual income, and family situation.

[0045] The embodiments of this application are based on a commonly used federated learning system model. The embodiments of this application include two servers that do not collude to steal user privacy data; one can be called a Machine-Learning Engine, and the other can be called a Crypto Service Provider (CSP). Hereinafter, the Machine-Learning Engine is referred to as the first server, and the Crypto Service Provider is referred to as the second server. Furthermore, in the subsequent detailed description of several embodiments of the present invention, the embodiments of the present invention also include M data owners, where M is greater than or equal to 2, and the form of the private data owned by each data owner is as follows.

[0046] The private data owned by the k-th data owner among M data owners is represented by the original data sample set. Here, k is any positive integer greater than or equal to 1 and less than or equal to M, i.e., 1 ≤ k ≤ M. The original data sample set D described above... k Contains n k -n k-1n original data samples k -n k-1 Greater than or equal to 1; the original data sample set D mentioned above k The i-th original data sample included is represented as Where i is greater than or equal to n k-1 +1 is less than or equal to n k That is, n k-1 +1≤i≤n k The i-th original data sample mentioned above is... middle, Let y represent the original input feature column vector contained in the i-th original data sample. i express The corresponding private original label can be referred to as the original label contained in the i-th original data sample; the aforementioned private original input feature column vector It includes a δ term, where δ is greater than or equal to 1; δ is also called the number of attributes in the original input feature column vector or the number of input attributes in linear regression. The embodiments of this application are for common scenarios where δ is greater than or equal to 2.

[0047] For the sake of brevity, the n above... k -n k-1 Original input feature column vectors Composition n k -n k-1 The original input feature matrix of row δ columns The above n k -n k-1 Original label y i (i=n) k-1 +1,n k-1 +2,…,n k The composition includes n k -n k-1 Original label column vector of items The original input feature matrix X mentioned above k Including n k -n k-1 The i-th row is the original input feature column vector. transpose In this application document, matrix X is referred to as... k This is called the original input feature matrix of the k-th data owner, and is simply referred to as the original input matrix; the column vectors mentioned above Including n k -n k-1 The i-th item is the original label y. i (i=n) k-1 +1,n k-1 +2,…,n k In this application document, column vectors are... This is simply referred to as the original label column vector of the kth data owner.

[0048] In the context of credit assessment for small and medium-sized enterprises (SMEs), the aforementioned private input feature column vector It can include multi-source information such as a company's operating data, tax data, business registration data, and payment data, and the corresponding y i This could be data related to a company's creditworthiness. Note the private input feature column vector. It can also be represented in other forms, such as in the form of private input feature row vectors. In this case, only the description of the embodiment needs to be changed accordingly, and such changes are well known.

[0049] In both Example 1 and Example 2, all data owners use the same encryption method. In Example 1, all data owners use homomorphic encryption, while in Example 2, all data owners use mask encryption.

[0050] First, we will describe Embodiment 1 of this application. The main difference between Embodiment 1 and Embodiment 2 described below is that in Embodiment 1, each data owner uses a homomorphic encryption method in the prior art to encrypt their own private original data sample, while the second server decrypts the intermediate ciphertext obtained in the calculation process based on the decryption method corresponding to the homomorphic encryption method used by the data owner.

[0051] Specifically, Figure 1 Before step S110, each data owner encrypts their own private data, including but not limited to the following steps S210 to S220:

[0052] Step S210: Each of at least two data owners determines its own original symmetric matrix and original product vector using its own private original feature column vectors and original labels. The original symmetric matrix of any data owner is equal to the sum of the products of each original feature column vector of that data owner and its own transpose. The original product vector of any data owner is equal to the sum of the products of each original label and its corresponding original feature column vector.

[0053] When expressed in matrix form, the aforementioned original symmetric matrix is ​​the symmetric matrix obtained by multiplying the transpose of the original input matrix by itself, while the aforementioned original product vector is the product of the transpose of the original input matrix and the original label column vector. Note that the aforementioned original symmetric matrix and original product vector are intermediate results calculated from the original data samples privately owned by the respective data owners. Before sending the intermediate results calculated from the private original data samples to other nodes, any data owner typically needs to encrypt the intermediate results to protect their privacy; therefore, the aforementioned original symmetric matrix is ​​also called the symmetric matrix to be encrypted, and the aforementioned original product vector is also called the product vector to be encrypted.

[0054] The implementation method of this step is described in detail below. The k-th data owner calculates the original symmetric matrix of the k-th data owner based on its own private data. The original product vector of the kth data owner The original symmetric matrix A mentioned above k It is the cumulative result of the products between the input feature column vectors and their transposes in each data sample owned by the k-th data owner. Specifically, it is the sum of the products of n... k -n k-1 Each of the data samples contains an input feature column vector. Seeking Rather than transpose product Then for n k -n k-1 indivual The accumulated result obtained by summing, where n k-1 +1≤i≤n k That is, the original symmetric matrix A mentioned above k It is the sum of the products of each input feature column vector of the k-th data owner and its transpose; when expressed in matrix form, the above original symmetric matrix... X is the original input matrix X of the kth data owner. k The symmetric matrix obtained by multiplying the transpose of itself can also be called the symmetric result of the original input matrix of the k-th data owner, where... X represents one of the feature column vectors of a data owner. k X represents the combined matrix obtained by transposing the column vectors of each feature of the k-th data owner. k Each row is the transpose of the respective feature column vector. On the other hand, the original product vector described above... It is the cumulative result of the products between the input feature column vectors and their corresponding private labels in each data sample owned by the k-th data owner, and is the result of applying the product of n. k -n k-1Each of the data samples contains an input feature column vector. Seeking With the corresponding private tag y i product Then for n k -n k-1 indivual The accumulated result obtained by summing, here n k-1 +1≤i≤n k That is, the column vectors mentioned above It is the sum of the products of each input feature column vector of the k-th data owner and its corresponding label; when represented in matrix form, the above original product vector... X is the original input matrix X of the kth data owner. k transpose Compared with the original label column vector The product of the original input matrix and the label of the k-th data owner can also be called the product of the original input matrix and the label of the k-th data owner.

[0055] In step S220, each of the at least two data owners uses an additive homomorphic encryption technique that supports addition calculations on ciphertext to encrypt their respective original symmetric matrix and original product vector, obtaining the ciphertext of their respective original symmetric matrix and original product vector; each data owner sends their respective ciphertext of the original symmetric matrix and original product vector to the first server.

[0056] Each of the M data owners must perform this step. The following implementation is given for the k-th data owner among the M data owners, where 1 ≤ k ≤ M. The k-th data owner obtains the first key, and then uses the first key to perform addition on its original symmetric matrix A using a homomorphic encryption technique that supports addition on the ciphertext. k and the original product vector Homomorphic encryption is performed separately to obtain the ciphertext A′ of the original symmetric matrix. k =Enc key1 (A k ) and the ciphertext of the original product vector Then convert the ciphertext A′ of the original symmetric matrix k The ciphertext of the original product vector Send to the first server. The key1 above represents the first key, Enc key1(Δ) indicates that the plaintext Δ is homomorphically encrypted based on a first key; this first key is typically sent by a second server to each of the M data owners, and is usually the public key used in homomorphic encryption. The aforementioned homomorphic encryption technique that supports addition of ciphertext uses not only the first key (usually called the public key) but also a second key (usually called the private key). The second server typically possesses the second key and uses it to decrypt the received ciphertext, as detailed below. This homomorphic encryption technique that supports addition of ciphertext can be a Palliier homomorphic encryption method.

[0057] The implementation method of this step is described in detail below. The ciphertext A′ of the original symmetric matrix described above... k The ciphertext of the original product vector respectively satisfy A′ k =Enc key1 (A k )and Where key1 represents the first key, Enc key1 (A k ) indicates based on the first key pair A k Homomorphic encryption is performed, A′ k Let A represent the original symmetric matrix with respect to the k-th data owner. k The ciphertext of the original symmetric matrix obtained by homomorphic encryption, correspondingly, A′ k It can be called the ciphertext of the original symmetric matrix of the k-th data owner; on the other hand, Indicates based on the first key pair Perform homomorphic encryption. Represents the original product vector for the k-th data owner. The ciphertext obtained by homomorphic encryption, correspondingly, It can be called the ciphertext of the original product vector of the kth data owner.

[0058] In step S110 of steps S210 to S220, each of at least two data owners obtains the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector using several private data samples, and sends the two ciphertexts to the first server; the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector are obtained by encrypting the original symmetric matrix and the original product vector respectively using encryption technology that supports addition calculation of ciphertext.

[0059] Understandably, before sending the intermediate result calculated from its own original data sample to the first server, the data owner performs homomorphic encryption on the intermediate result using its own first key. This ensures that the first server cannot know the true nature of the intermediate result. Furthermore, the data owner possesses the intermediate result calculated from its private data. The first server obtains the homomorphically encrypted ciphertext of the intermediate result and stores the second key used to decrypt it on its own server. Therefore, apart from the data owner holding the intermediate result calculated from its own private data, the first server cannot know the intermediate result, thus ensuring the security of the data owner's private data. Moreover, as will be explained below, the first server further encrypts the homomorphically encrypted ciphertext of the intermediate result before sending it to the second server. Correspondingly, the second server, after decrypting the received ciphertext using its second key, still cannot know the intermediate result because of the further encryption performed by the first server. Therefore, both the first and second servers cannot know the intermediate result calculated from the data owner's private data through the information they receive, thus protecting the data owner's privacy. In subsequent steps of this embodiment, the first server receives the ciphertext of the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners, and collaborates with the second server to obtain the linear regression coefficients. These subsequent steps include steps S110, S120, S130, and S140, which will be described below.

[0060] Figure 1In step S110 of the method, the first server receives the ciphertext of the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners. It processes the ciphertext of the original symmetric matrix sent by the at least two data owners to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners, and processes the ciphertext of the original product vector sent by the at least two data owners to obtain the sum of the ciphertexts of the original product vectors of multiple data owners. On the other hand, the first server obtains the symmetric matrix and product vector corresponding to the pseudo-data sample, which are respectively called the pseudo-sample symmetric matrix and the pseudo-sample product vector. Then, the first server uses the sum of the ciphertexts of the original symmetric matrices of multiple data owners... Adding the pseudo-sample symmetric matrix processing result, the first server obtains the sum of the original symmetric matrix ciphertexts of multiple data owners that include the influence of the pseudo-sample symmetric matrix. Furthermore, the first server adds the pseudo-sample product vector processing result to the sum of the ciphertexts of the original product vectors of multiple data owners, obtaining the sum of the original product vector ciphertexts of multiple data owners that include the influence of the pseudo-sample product vector. Finally, the first server sends the sum of the original symmetric matrix ciphertexts of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the original product vector ciphertexts of multiple data owners that include the influence of the pseudo-sample product vector to the second server. Step S110 includes, but is not limited to, the following steps S310 to S340:

[0061] In step S310, the first server receives the ciphertext of the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners; the first server performs accumulation processing and optional regularization processing on the ciphertext of the original symmetric matrix sent by at least two data owners to obtain the sum of the ciphertext of the original symmetric matrix of multiple data owners, which is simply referred to as the first ciphertext sum of the symmetric matrix; the first server also performs accumulation processing on the ciphertext of the original product vector sent by at least two data owners to obtain the sum of the ciphertext of the original product vector of multiple data owners, which is simply referred to as the first ciphertext sum of the product vector.

[0062] Specifically, the first server receives the ciphertext of the original symmetric matrix, i.e., ciphertext A′, from each of the M data owners. k And the ciphertext of the original product vector, i.e., the ciphertext Where k = 1, 2, ..., M; then, the first server uses the addition technique included in homomorphic encryption to perform addition calculations on the ciphertext, accumulating and optionally regularizing the ciphertexts of the original symmetric matrices of the M data owners to obtain the sum of the ciphertexts of the original symmetric matrices of the M data owners, which is the ciphertext. And the ciphertext of the original product vectors of the received M data owners The ciphertext is obtained by summing the original product vectors of the M data owners. The sum of the ciphertexts of the original symmetric matrices of multiple data owners (referred to as the sum of the first ciphertexts of the symmetric matrices), i.e., the sum of the ciphertexts A′ of the original symmetric matrices of the M data owners mentioned above, is the ciphertext Enc obtained by homomorphically encrypting the regularization term λI. key1 (λI) and the ciphertext A′ of the original symmetric matrix of the M data owners. k The ciphertext obtained by accumulating the input matrices (k = 1, 2, ..., M) is given by the regularization term λI, where λ is a real number greater than or equal to zero, and I is the identity matrix. The regularization process described above is optional, because when λ in the regularization term λI is equal to zero, it is equivalent to no regularization being performed. Instead, the ciphertext of the symmetric results of the original input matrices of the M data owners is accumulated to obtain the sum of the ciphertexts of the original symmetric matrices of the M data owners. Specifically, the regularization process described above can also be performed in other steps; please refer to the subsequent descriptions for details. On the other hand, the ciphertext sum of the original product vectors of multiple data owners (referred to as the first ciphertext sum of the product vectors) is the ciphertext sum of the original product vectors of the M data owners mentioned above. It is the ciphertext of the original product vector of M data owners. The cumulative result.

[0063] In step S320, the first server uses several pseudo-data samples to obtain the symmetric matrix and product vector corresponding to the pseudo-data samples, which are called the pseudo-sample symmetric matrix and pseudo-sample product vector, respectively.

[0064] Specifically, for further encryption, the first server obtains τ pseudo-data samples, where τ is greater than or equal to 1 and less than δ. The first server utilizes the pseudo-input matrix E and pseudo-label column vector contained in the pseudo-data samples. The symmetric matrix obtained by multiplying the transpose of the pseudo-input matrix E by itself is the pseudo-sample symmetric matrix φ = E. T E, and the transpose E of the pseudo-input matrix E T With pseudo-label column vector The product of the two samples, i.e., the pseudo-sample product vector. The values ​​of each item in the above τ pseudo-data samples are usually taken as random numbers.

[0065] The implementation method of this step is described in detail below. As mentioned earlier, δ is the input feature column vector in the data sample owned by the data owner. The number of items included is also called the number of attributes in the input feature column vector or the number of input attributes in linear regression. The aforementioned τ pseudo-data samples can be represented as a set of pseudo-data samples. The i-th pseudo-data sample contained in the set S can be represented as: Where i is greater than or equal to 1 and less than or equal to τ, i.e., 1 ≤ i ≤ τ. The i-th pseudo-data sample mentioned above is... middle, f represents the pseudo-input feature column vector contained in the i-th pseudo-data sample. i express The corresponding pseudo-label can be called the pseudo-label contained in the i-th pseudo-data sample; the above pseudo-input feature column vector It also includes a δ term, similar to the aforementioned private input feature column vector. In this application, for the sake of convenience, the aforementioned τ pseudo-input feature column vectors are referred to as... The pseudo-input feature matrix consisting of τ rows and δ columns The aforementioned τ pseudo-labels f i (i = 1, 2, ..., τ) form a pseudo-label column vector containing τ terms. The pseudo-input feature matrix E mentioned above consists of τ rows, where the i-th row is the pseudo-input feature column vector. transpose In this application, the pseudo-input feature matrix is ​​simply referred to as the pseudo-input matrix; the aforementioned pseudo-label column vector Including the τ terms, the i-th term is the pseudo-label f i (i = 1, 2, ..., τ).

[0066] The aforementioned pseudo-sample symmetric matrix φ is the cumulative result of the product of the pseudo-input feature column vectors and their transposes in the pseudo-data samples. It is the sum of the pseudo-input feature column vectors contained in each of the τ pseudo-data samples. Seeking Rather than transpose product Then for τ The accumulated result obtained by performing the summation is Here, 1 ≤ i ≤ τ; when expressed in matrix form, the above φ = E T E is the symmetric matrix obtained by multiplying the transpose of the pseudo-input matrix E by itself, simply referred to as the pseudo-input matrix symmetric result, or simply the pseudo-sample symmetric matrix. On the other hand, the aforementioned pseudo-sample product vector... It is the cumulative result of the product of the pseudo-input feature column vector and the pseudo-label in each of the τ pseudo-data samples, which is the pseudo-input feature column vector contained in each of the τ pseudo-data samples. Seeking With the corresponding pseudo-tag f i product Then for τ The accumulated result is... Here, 1 ≤ i ≤ τ; when expressed in matrix form, the above... It is the transpose of the pseudo-input matrix E and the pseudo-label column vector. The product of the pseudo-input matrix and the pseudo-label is also known as the pseudo-sample product vector.

[0067] In step S330, the first server adds the sum of the first ciphertext of the symmetric matrix to the processing result of the pseudo-sample symmetric matrix, obtaining the sum of the ciphertext of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix; the first server adds the sum of the first ciphertext of the product vector to the processing result of the pseudo-sample product vector, obtaining the sum of the ciphertext of the original product vector of multiple data owners that includes the influence of the pseudo-sample product vector. The first server sends the above sum of the ciphertext of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix and the sum of the ciphertext of the original product vector of multiple data owners that includes the influence of the pseudo-sample product vector to the second server.

[0068] The result of processing the pseudo-sample symmetric matrix is ​​the plaintext of the pseudo-sample symmetric matrix (i.e., the aforementioned pseudo-sample symmetric matrix φ = E). T E) The ciphertext obtained through homomorphic encryption, or the ciphertext obtained by negating the plaintext of the pseudo-sample symmetric matrix and then homomorphically encrypting it; the result of processing the pseudo-sample product vector is the plaintext of the pseudo-sample product vector (i.e., the aforementioned pseudo-sample product vector). The ciphertext obtained by homomorphic encryption, or the ciphertext obtained by negativeing ​​the plaintext of the pseudo-sample product vector and then homomorphically encryption, is as follows: To obtain the pseudo-sample symmetric matrix processing result and the pseudo-sample product vector processing result, the first server obtains the first key, which is usually sent by the second server, and uses homomorphic encryption technology that supports addition calculations on ciphertext to perform homomorphic encryption with the first key; as mentioned earlier, the first key is usually the public key used in homomorphic encryption technology. The pseudo-sample symmetric matrix processing result is obtained by homomorphically encrypting the pseudo-sample symmetric matrix φ, and the resulting ciphertext φ′=Enc key1 (φ), or the ciphertext φ′=Enc obtained by taking the negative sign of the pseudo-sample symmetric matrix φ and then performing homomorphic encryption. key1 (-φ); The above pseudo-sample product vector processing result is a pseudo-sample product vector. Ciphertext of the pseudo-sample product vector obtained by homomorphic encryption Or the product vector of pseudo-samples The ciphertext of the pseudo-sample product vector obtained by taking the negative sign and then homomorphically encrypting.

[0069] The first server utilizes the technique of adding multiple ciphertexts in homomorphic encryption to sum the sum of the first ciphertext of the symmetric matrix and the result of processing the pseudo-sample symmetric matrix, obtaining the sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix. Furthermore, it sums the sum of the first ciphertext of the product vector and the result of processing the pseudo-sample product vector, obtaining the sum of the original product vector ciphertexts of multiple data owners that includes the influence of the pseudo-sample product vector. Specifically, the first server adds the sum of the first ciphertext of the symmetric matrix A′ to the result of processing the pseudo-sample symmetric matrix φ′, obtaining the sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix C′=A′+φ′; and it sums the sum of the first ciphertext of the product vector... Processing result of product vector with pseudo-sample The sum of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vectors, is obtained by adding them together. Then, the first server combines the sum C′ of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix with the sum of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. Send to the second server.

[0070] This step involves using the ciphertext related to the pseudo-data sample to compare ciphertext A′ and... Further encryption is required. The result of processing the pseudo-sample symmetric matrix can be φ′=Enc key1 (φ) or φ′=Enc key1 (-φ), while the result of processing the pseudo-sample product vector can be or Accordingly, this step can include the following four implementation methods:

[0071] Implementation Method 1: The sum of the original symmetric matrix ciphertexts of multiple data owners, including those affected by the pseudo-sample symmetric matrix, is C′=A′+φ′=Enc key1 (A)+Enc key1 (φ), and the sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors.

[0072] Implementation Method 2: The sum of the original symmetric matrix ciphertexts of multiple data owners, including those affected by the pseudo-sample symmetric matrix, is C′=A′+φ′=Enc key1 (A)+Enc key1 (-φ), which is the sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors.

[0073] Implementation Method 3: The sum of the original symmetric matrix ciphertexts of multiple data owners, including those affected by the pseudo-sample symmetric matrix, is C′=A′+φ′=Enckey1 (A)+Enc key1 (φ), and the sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors.

[0074] Implementation Method 4: The sum of the original symmetric matrix ciphertexts of multiple data owners, including those affected by the pseudo-sample symmetric matrix, is C′=A′+φ′=Enc key1 (A)+Enc key1 (-φ), which is the sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors.

[0075] The following describes the implementation of this step in detail, taking Implementation Method 1 as an example. As described in step S220, key1 used in this step represents the first key, Enc key1 (Δ) indicates that the plaintext Δ is homomorphically encrypted based on the first key. The above φ′=Enc key1 (φ) represents the ciphertext obtained by homomorphically encrypting the pseudo-sample symmetric matrix φ based on the first key, and the above... Represents the product vector of pseudo-samples based on the first key pair The ciphertext obtained by homomorphic encryption.

[0076] The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, C′=A′+φ′ represents the ciphertext obtained by adding ciphertext A′ and ciphertext φ′ using the technique of adding multiple ciphertexts in additive homomorphic encryption. The sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, is... This indicates that the technique of adding multiple ciphertexts in homomorphic encryption is used to perform addition calculations on the ciphertexts. and ciphertext The ciphertext obtained by addition.

[0077] Steps S310 and S330 above both involve ciphertext addition. Specifically, the first server first adds the ciphertext of the original symmetric matrices sent by at least two data owners to the result of processing the pseudo-sample symmetric matrices; similarly, it first adds the ciphertext of the original product vectors sent by at least two data owners to the result of processing the pseudo-sample product vectors. In practice, the order of these ciphertext additions can be arbitrarily adjusted. For example, the first server can first add the ciphertext of the original symmetric matrices sent by one or more data owners, then add the result of processing the pseudo-sample symmetric matrices, and finally add the ciphertext of the remaining original symmetric matrices sent by several data owners. Alternatively, the first server can first add the ciphertext of the original product vectors sent by one or more data owners, then add the result of processing the pseudo-sample product vectors, and finally add the ciphertext of the remaining original product vectors sent by several data owners.

[0078] It should be noted that in Embodiment 1, since each data owner uses homomorphic encryption to encrypt their respective original symmetric matrices, in step S330, the first server adds the sum of the first ciphertext of the symmetric matrices to the processing result of the pseudo-sample symmetric matrix. The resulting sum of the ciphertexts of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix contains the ciphertexts related to the original symmetric matrices of all data owners, i.e., the sum of the first ciphertexts of the symmetric matrices in Embodiment 1. Therefore, in step S330, the sum of the ciphertexts of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix is ​​equivalent to the sum of the ciphertexts of the original symmetric matrices of all data owners that includes the influence of the pseudo-sample symmetric matrix. Similarly, since each data owner uses homomorphic encryption to encrypt their respective original product vectors, the sum of the ciphertexts of the original product vectors of multiple data owners that includes the influence of the pseudo-sample symmetric matrix in step S330 is equivalent to the sum of the ciphertexts of the original product vectors of all data owners that includes the influence of the pseudo-sample symmetric matrix.

[0079] In step S340, the first server encrypts the pseudo-input matrix E composed of several pseudo-input feature column vectors to obtain the pseudo-input matrix ciphertext. Then cipher the pseudo-input matrix The data is sent to the second server; the aforementioned pseudo-input feature column vectors are part of several corresponding pseudo-data samples, as described above. The encrypted pseudo-input matrix E can be implemented in different ways; two implementation methods are given below:

[0080] Implementation Method 1: The first server generates or obtains an invertible matrix Θ with τ rows and τ columns. This matrix Θ is called the multiplication encryption mask matrix, and as mentioned above, τ is greater than or equal to 2. The first server multiplies the invertible matrix Θ with the pseudo-input matrix E to obtain the multiplication encryption pseudo-input matrix. As ciphertext of the pseudo-input matrix.

[0081] Implementation Method 2: The first server uses a homomorphic encryption method that satisfies additive homomorphism and supports ciphertext-plaintext multiplication to encrypt the pseudo-input matrix E with a third key to obtain the pseudo-input matrix ciphertext. Right now The third key, key3, is typically the public key in a homomorphic encryption method that satisfies additive homomorphism and supports ciphertext-plaintext multiplication. This homomorphic encryption method uses not only the third key (usually the public key) but also a fourth key (usually the private key), which is used to decrypt the received ciphertext. Details will be provided below. This homomorphic encryption method can be a Palliier homomorphic encryption method.

[0082] Figure 1 In step S130, the second server receives the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector, sent by the first server. The second server then decrypts these two results to obtain the first plaintext sum of the symmetric matrices that include the influence of the pseudo-sample symmetric matrix and the first plaintext sum of the product vectors that include the influence of the pseudo-sample product vector. Subsequently, the second server uses the decrypted results to calculate the pseudo-sample encrypted linear regression coefficients that include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and sends these pseudo-sample encrypted linear regression coefficients to the first server. Step S130 includes, but is not limited to, the following steps S410 to S430:

[0083] In step S410, the second server receives the sum of ciphertexts of the original symmetric matrices of multiple data owners that are affected by the pseudo-sample symmetric matrix and the sum of ciphertexts of the original product vectors of multiple data owners that are affected by the pseudo-sample product vector sent by the first server. Then, the second server decrypts the sum of the two ciphertexts to obtain the sum of plaintexts of the original symmetric matrices of multiple data owners that are affected by the pseudo-sample symmetric matrix and the sum of plaintexts of the original product vectors of multiple data owners that are affected by the pseudo-sample product vector.

[0084] Specifically, the second server receives from the first server the sum of the ciphertexts C′ of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. The second server uses the second key to perform homomorphic decryption on the aforementioned C′ to obtain the sum C of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix, and then... Perform homomorphic decryption to obtain the sum of the plaintext of the original product vectors of multiple data owners, including the influence of pseudo-sample product vectors. The aforementioned second key is typically the private key used in homomorphic encryption techniques that support addition calculations on ciphertext. This private key is used to decrypt the received ciphertext. The sum C of the plaintext of the original symmetric matrices of multiple data owners, which includes the influence of pseudo-sample symmetric matrices, is encrypted only through the pseudo-sample symmetric matrices related to the pseudo-data samples, without further homomorphic encryption. On the other hand, the sum C of the plaintext of the original product vectors of multiple data owners, which includes the influence of pseudo-sample product vectors... Encryption is achieved solely through the product vector of pseudo-samples related to the pseudo-data samples, without any further homomorphic encryption.

[0085] To explain the effect of this step, it is necessary to introduce the technical principle related to the addition calculation of ciphertext in well-known homomorphic encryption technology. That is, the result of adding multiple ciphertexts is equivalent to adding the corresponding multiple plaintexts and then homomorphically encrypting them. Accordingly, the sum of the ciphertexts of the original symmetric matrices of the multiple data owners obtained in step S310 is equal to the ciphertext obtained after homomorphically encrypting the sum of the plaintexts of the original symmetric matrices of the multiple data owners, and the sum of the ciphertexts of the original product vectors of the multiple data owners obtained in step S310 is equal to the ciphertext obtained after homomorphically encrypting the sum of the plaintexts of the original product vectors of the multiple data owners. The above-mentioned sum of the ciphertexts of the original symmetric matrices of the multiple data owners is the sum of the ciphertexts of the original symmetric matrices of the M data owners after regularization, that is... The sum of the plaintext of the original symmetric matrices of the multiple data owners mentioned above is the sum of the plaintext of the original symmetric matrices of the M data owners after regularization, that is... The sum of the ciphertexts of the original symmetric matrices of the aforementioned data owners is equal to the ciphertext obtained by homomorphically encrypting the sum of the plaintexts of the original symmetric matrices of the aforementioned data owners, which can be represented as follows: On the other hand, the sum of the ciphertexts of the original product vectors of the aforementioned multiple data owners is the sum of the ciphertexts of the original product vectors of the M data owners, that is... The sum of the plaintext of the original product vectors of the multiple data owners mentioned above is the sum of the plaintext of the original product vectors of the M data owners, that is... The sum of the original product vectors of the aforementioned data owners, equal to the ciphertext obtained by homomorphically encrypting the sum of the plaintext of the original product vectors of the aforementioned data owners, can be represented as follows:

[0086] This step includes optional regularization steps. The optional regularization steps described in step S330 can be moved to this step. That is, if the optional regularization steps are not used in step S330, the sum C of the plaintext of the original symmetric matrices of the multiple data owners that include the influence of the pseudo-sample symmetric matrix does not include the regularization term λI. Accordingly, regularization can be performed in this step, i.e., the regularization term λI can be added. More generally, regularization can also be performed in step S330 and in this step. The final effect of regularization is the superposition of the effects of regularization in the two steps. The relevant implementation methods are easy to obtain and will not be described in detail here.

[0087] As mentioned earlier, the result of adding multiple ciphertexts in homomorphic encryption is equivalent to adding the corresponding multiple plaintexts and then homomorphically encrypting them. Accordingly, the sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, obtained in step S330 is equal to the ciphertext obtained after homomorphically encrypting the sum of the original symmetric matrix plaintexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix. Similarly, the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, obtained in step S330 is equal to the ciphertext obtained after homomorphically encrypting the sum of the original product vector plaintexts of multiple data owners, including the influence of the pseudo-sample product vector. The sum of the original symmetric matrix ciphertexts of multiple data owners, including those influenced by the pseudo-sample symmetric matrix, is ciphertext C′=A′+φ′, which is the ciphertext obtained by adding the sum of the first ciphertexts of the symmetric matrices A′ to the result of processing the pseudo-sample symmetric matrix φ′. The sum of the original symmetric matrix plaintexts of multiple data owners, including those influenced by the pseudo-sample symmetric matrix, is C=A+φ, which is the plaintext obtained by adding the sum of the first plaintexts of the symmetric matrices A to the result of processing the pseudo-sample symmetric matrix φ. The sum of the original symmetric matrix ciphertexts of multiple data owners, including those influenced by the pseudo-sample symmetric matrix, is equal to the ciphertext obtained after homomorphically encrypting the sum of the original symmetric matrix plaintexts of multiple data owners, including those influenced by the pseudo-sample symmetric matrix, which can be expressed as C′=Enc. key1 (C)=Enc key1 (A+φ). On the other hand, the sum of the ciphertexts of the original product vectors of multiple data owners, including those influenced by spurious sample product vectors, is the ciphertext. That is, the sum of the first ciphertext of the product vectors Results of adding pseudo-sample product vector processing The resulting ciphertext; the sum of the plaintext of the original product vectors of multiple data owners, including those influenced by the pseudo-sample product vectors, is the plaintext. That is, the sum of the first plaintext of the product vectors Add pseudo-sample product vector The resulting plaintext; the sum of the ciphertexts of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vectors, is equal to the sum of the plaintexts of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vectors, after being homomorphically encrypted, can be represented as follows:

[0088] The implementation of this step, namely step S410, is described in detail below. The sum of the plaintext of the original symmetric matrices of the multiple data owners, including the influence of the pseudo-sample symmetric matrix, is C = dec. key2 (C′), which is the sum of the plaintext of the original product vectors of multiple data owners that include the influence of pseudo-sample product vectors. The second key, key2, is the private key used in homomorphic encryption, which supports addition calculations on the ciphertext. key2 (Δ) indicates that the ciphertext Δ is decrypted based on the second key. As mentioned earlier, only the second server needs to use the second key for decryption. Therefore, in this embodiment, typically only the second server holds the second key to achieve better confidentiality. The above C = dec key2 (C′) can be derived from the previously introduced C′=Enc key1 (C)=Enc key1 (A+φ) is derived from dec key2 (C′)=dec key2 (Enc key1 (C))=dec key2 (Enc key1 (A+φ))=C=A+φ; and the above It can be derived from the previously introduced It is derived that, through

[0089] From the above description, we can see that the sum C of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix, satisfies C = A + φ, that is, it is the result of the sum A of the first plaintext of the symmetric matrices plus the pseudo-sample symmetric matrix φ; while the sum of the plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vector, is... satisfy That is, it is the sum of the first plaintext of the product vectors. Add pseudo-sample product vector The result.

[0090] It's easy to see that although the second server decrypted the homomorphically encrypted ciphertext, it was unaware of the result A calculated from the private data of the M data owners. Because the matrix C obtained by the second server through decryption is influenced by the pseudo-sample symmetric matrix φ, while the vector it decrypts... There are pseudo-sample product vectors. The impact.

[0091] In step S420, the second server calculates the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, using the sum of the plaintext of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. The second server then sends the pseudo-sample encrypted linear regression coefficients to the first server.

[0092] Specifically, the second server uses the sum of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix, obtained in the previous step, and the sum of the plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vector. First, calculate the inverse matrix G = C of the sum of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix. -1 Then, the inverse matrix G = C, which is simply referred to as the first inverse matrix, is used. -1 The sum of the plaintext of the original product vectors of multiple data owners, including those affected by spurious sample product vectors. Calculate the pseudo-sample encrypted linear regression coefficient vector that includes the effects of the pseudo-sample symmetric matrix and the pseudo-sample product vector. Then encrypt the linear regression coefficient vector of the above pseudo-samples. Send to the first server. The above pseudo-sample encrypted linear regression coefficient vector. This includes the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, which can also be referred to as including the influence of the aforementioned τ pseudo-data samples.

[0093] The implementation method of this step will be described in detail below. From the above... Easy to see, It contains the pseudo-sample symmetric matrix φ and the pseudo-sample product vector obtained from the pseudo-data samples. The influence of this, and the final target linear regression coefficient vector that needs to be obtained. Therefore, in subsequent steps, it is necessary to encrypt the linear regression coefficient vector of the pseudo-samples that contain the influence of pseudo-data samples. In practice, the influence of pseudo-data samples is at least partially eliminated; theoretically, it should completely eliminate the pseudo-sample symmetric matrix φ and the pseudo-sample product vector obtained from the pseudo-data samples. The impact.

[0094] Step S430: The second server receives the pseudo-input matrix ciphertext sent by the first server. Then use the first inverse matrix, i.e., matrix G = C -1 The ciphertext of the pseudo-input matrix is ​​obtained. Product with the first inverse matrix Then the product Ξ is sent to the first server. The product Ξ is simply referred to as the product of the pseudo-input matrix ciphertext and the first inverse matrix.

[0095] Regarding the two encryption methods given in step S340, this step has two corresponding implementation methods, as follows:

[0096] Implementation Method 1: When step S340 uses the first encryption method, i.e., multiplying the encryption mask matrix Θ for encryption, the product of the pseudo-input matrix ciphertext and the first inverse matrix is ​​the pseudo-input matrix ciphertext. The product with the first inverse matrix, i.e.

[0097] Implementation Method 2: When step S340 uses the second encryption method, i.e., a homomorphic encryption method that satisfies addition homomorphism and supports ciphertext-plaintext multiplication, the second server uses the ciphertext-plaintext multiplication and ciphertext addition techniques supported by this homomorphic encryption method to calculate the product of the pseudo-input matrix ciphertext and the first inverse matrix; specifically, the second server calculates the pseudo-input matrix ciphertext... The product of the plaintext G with the first inverse matrix is Here the calculation It includes multiplication operations of ciphertext and plaintext in homomorphic encryption and addition operations of ciphertext in homomorphic encryption. It uses the ciphertext addition technique and ciphertext multiplication technique contained in homomorphic encryption methods that satisfy addition homomorphism and support ciphertext and plaintext multiplication.

[0098] One embodiment of this application, Figure 1 In step S140 of the method, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors, and at least partially eliminates the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors to obtain the target linear regression coefficients. Step S140 includes, but is not limited to, the following steps S510 to S530:

[0099] In step S510, after the first server receives the product Ξ of the pseudo-input matrix ciphertext and the first inverse matrix sent by the second server, it performs the corresponding decryption operation to obtain the product of the pseudo-input matrix plaintext and the first inverse matrix, that is, the product of the pseudo-input matrix plaintext and the inverse matrix of the sum of the original product vector plaintexts of multiple data owners containing the influence of the pseudo-sample symmetric matrix.

[0100] Specifically, the first server satisfies Ψ=EC -1 The matrix Ψ is the product of the pseudo-input matrix plaintext and the first inverse matrix. Here, matrix Ψ is the inverse matrix of the sum of the pseudo-input matrix plaintext E and the original symmetric matrix plaintext of multiple data owners that includes the influence of the pseudo-sample symmetric matrix, i.e., G. -1The product of the two encryption methods given in step S340. This step also has two corresponding implementation methods, as follows:

[0101] Implementation Method 1: When the first server encrypts the pseudo-input matrix E using the encryption mask matrix Θ in step S340, the first server calculates the inverse matrix Θ of the encryption mask matrix Θ. -1 The product of the ciphertext of the pseudo-input matrix and the first inverse matrix Ξ is used to obtain the product Ψ of the plaintext of the pseudo-input matrix and the first inverse matrix, i.e., Ψ = Θ. -1 Ξ.

[0102] Implementation Method 2: In step S340, when the first server uses a homomorphic encryption method that satisfies additive homomorphism and supports ciphertext-plaintext multiplication, and uses the third key to homomorphically encrypt the pseudo-input matrix E, then the first server uses the corresponding homomorphic decryption method, using the fourth key 4, to homomorphically decrypt the product of the pseudo-input matrix ciphertext and the first inverse matrix, i.e., matrix Ξ, to obtain the product of the pseudo-input matrix plaintext and the first inverse matrix, i.e., matrix Ψ = dec key4 (Ξ), where the fourth key key4 is usually the private key used for decryption in a homomorphic encryption method that satisfies additive homomorphism and supports ciphertext-plaintext multiplication.

[0103] In step S520, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors, and at least partially eliminates the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors to obtain intermediate linear regression coefficients.

[0104] Specifically, the first server receives from the second server a vector of encrypted linear regression coefficients containing pseudo-sample symmetric matrices and pseudo-sample product vectors derived from pseudo-data samples. Then, using the product Ψ of the plaintext pseudo-input matrix and the first inverse matrix obtained in the previous step, and the pseudo-input matrix E and pseudo-label column vector obtained by the first server in step S320, The intermediate linear regression coefficients were calculated. The above calculations Theoretically, the vector of linear regression coefficients can be encrypted using pseudo-samples that contain the influence of pseudo-data samples. The influence of spurious data samples was eliminated, thus initially obtaining the target linear regression coefficient vector. In fact, considering the influence of various factors, including calculation errors, the above calculation results are... At least partially, the vector of encrypted linear regression coefficients in the pseudo-samples containing the influence of pseudo-data samples is encrypted. The influence of spurious data samples has been eliminated.

[0105] When step S330 employs implementation methods 1, 2, 3, or 4 described in that step, then this step also employs one of the four implementation methods described in this step. The four implementation methods of this step are implementation methods 1, 2, 3, and 4, as described below:

[0106] When the method in Implementation Method 1 is used in step S330, the formula for calculating the intermediate linear regression coefficient is as follows: or

[0107] When the method in Implementation Method 2 is used in step S330, the formula for calculating the intermediate linear regression coefficient is as follows: or

[0108] When the method matrix multiplication in Implementation Method 3 is used in step S330, the formula for calculating the intermediate linear regression coefficient is as follows: or

[0109] When the method matrix multiplication in Implementation 4 is used in step S330, the formula for calculating the intermediate linear regression coefficient is as follows: or

[0110] Step S530 typically involves the first server calculating the intermediate linear regression coefficients obtained in the previous step. After performing some processing related to the aforementioned homomorphic encryption and decryption, the desired target linear regression coefficient vector is finally obtained. The above satisfy The processing related to homomorphic encryption and decryption is a well-known existing technique. In some cases, the intermediate linear regression coefficients obtained in the previous step can also be used. It is equal to the target linear regression coefficient vector The confidentiality effect of this embodiment can be summarized as follows: From the above implementation process, it can be seen that neither the first server nor the second server knows the private data of the data owner, including the first plaintext sum A of the symmetric matrix and the first plaintext sum of the product vector calculated from the private data. This achieves the effect of protecting data privacy.

[0111] In Example 1, the data owner uses a homomorphic encryption technique that supports addition of ciphertext to encrypt their private data. The data owner can also use other encryption techniques to encrypt their private data, as long as those techniques also support addition of ciphertext. An encryption technique that supports addition of ciphertext can generally be described as follows: the sum of multiple ciphertexts encrypted with this technique is equal to the result of adding the corresponding plaintexts and then encrypting them again with this technique. Generally, an encryption technique that supports addition of ciphertext satisfies the following condition: based on the sum of multiple ciphertexts encrypted with this technique, the result of adding the corresponding plaintexts and then encrypting them again with this technique can be calculated.

[0112] The following provides a second embodiment for a scenario where a data owner uses a mask to encrypt their private data. One embodiment of this application is as follows: Figure 1 In step S110, each of at least two data owners uses several private data samples to obtain the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector, and sends the two ciphertexts to the first server.

[0113] Regarding the differences between Embodiment 2 and Embodiment 1 above, Embodiment 2 modifies the method steps in Embodiment 1. The differences between Embodiment 2 and Embodiment 1 include that in Embodiment 2, each data owner uses mask encryption to encrypt the private data of the cells. First, Embodiment 2 modifies steps S210 to S220 in Embodiment 1 to steps S610 to S620. That is, in Embodiment 2, before step S110, the following steps S610 to S620 are included, but are not limited to:

[0114] Step S610, each of at least two data owners, takes the mask input matrix U contained in the mask data sample. k and mask label column vector Send to a second server, or send the mask symmetric matrix. and mask product vector Send to the second server.

[0115] The masked data samples, masked input matrices, and masked label column vectors used by the aforementioned data owners are actually similar to the pseudo-data samples, pseudo-input matrices, and pseudo-label column vectors used by the first server in Embodiment 1. The different names used here are to better distinguish them from the pseudo-data samples, pseudo-input matrices, and pseudo-label column vectors used by the first server in Embodiment 1 and this embodiment. This step is described in detail below. Each of the M data owners must perform this step. The specific implementation method is given below for the k-th data owner among the M data owners, where M is an integer greater than or equal to 2, and 1 ≤ k ≤ M. The k-th data owner obtains ρ k A mask data sample is used as a mask for encryption, where ρ k Greater than or equal to 1. The ρ mentioned above. k Each mask data sample can be represented as a set of mask data samples. The set R k The i-th mask data sample can be represented as Where 1≤i≤ρ k The i-th mask data sample mentioned above is... middle, v represents the masked input feature column vector contained in the i-th masked data sample. i express The corresponding mask label can be referred to as the mask label contained in the i-th mask data sample; the above mask input feature column vector Includes the δ term. The ρ mentioned above... k A masked input feature column vector Represented as ρ k A matrix with δ rows and δ columns The above ρ k A pseudo-tag v i (i = 1, 2, ..., τ) represents a group containing ρ k A column vector of terms The above matrix U k Including ρ k The i-th row is the pseudo-input feature column vector. transpose This application document refers to matrix U k This is called the masked input feature matrix of the k-th data owner, and is simply referred to as the masked input matrix; the column vectors mentioned above Including ρ k The i-th term is the mask label v i (i = 1, 2, ..., ρ) k In this application document, column vectors are... This is called the mask label column vector of the k-th data owner.

[0116] The mask symmetric matrix Λ of the kth data owner mentioned above k It is the cumulative result of the product of each masked input feature column vector and its transpose in the masked data sample of the k-th data owner, and is the result of ρ k Each of the masked data samples contains a masked input feature column vector. Seeking Rather than transpose product Then for ρ k indivual The accumulated result obtained by performing the summation is Here 1≤i≤ρ k When represented in matrix form, the above... It is the mask input matrix U k The symmetric matrix obtained by multiplying the transpose of the matrix by itself is simply called the mask symmetric matrix. On the other hand, the mask product vector of the kth data owner mentioned above... It is the sum of the products of each mask input feature column vector and its corresponding mask label in the masked data sample of the k-th data owner, and is the sum of the products of ρ. k Each of the masked data samples contains a masked input feature column vector. Seeking With the corresponding mask label v i product Then for ρ k indivual The accumulated result is... Here 1≤i≤ρ k When represented in matrix form, the above... It is the mask input matrix U k Transpose and mask label column vector The product of these is called the mask product vector.

[0117] This step can also be implemented in other ways. One alternative implementation is that the second server inputs the mask data sample containing the mask matrix U... k and mask label column vector Send it to the k-th data owner, or send the mask symmetric matrix. and mask product vector The code is sent to the k-th data owner. A simpler implementation involves the second server and the k-th data owner maintaining the same codebook containing multiple matrices and vectors, with either party sending the index of a matrix and a vector from the codebook to the other to determine the masked input matrix U to be used. k and mask label column vector Or a symmetric mask matrix and mask product vector

[0118] Step S620: Each of at least two data owners encrypts their private data using a masking technique to obtain ciphertext related to their original symmetric matrix and ciphertext of their original product vector. Each data owner then sends the ciphertext related to their original symmetric matrix and ciphertext of their original product vector to the first server. This step is performed by each of the M data owners. The following implementation is given for the k-th data owner among the M data owners, where 1≤k≤M.

[0119] The ciphertext related to the original symmetric matrix obtained by the k-th data owner can take multiple forms, as long as it satisfies the requirement that the original symmetric matrix can be calculated using the ciphertext related to the original symmetric matrix. The ciphertext. The ciphertext forms associated with the original symmetric matrix include the two ciphertext forms described below:

[0120] In ciphertext form 1), first obtain the concatenation matrix of the original input matrix of the k-th data owner and the masked input matrix of the k-th data owner. Then obtain the above splicing matrix Γ k With any orthogonal matrix Θ k The product Π k =Γ k Θ l The product of the concatenated matrix and the orthogonal matrix serves as the ciphertext associated with the original symmetric matrix. It is easy to see that the concatenated matrix Γ... k The original input feature column vectors of the k-th data owner and each mask input feature column vector Composition; when represented in matrix form, the above concatenation matrix Γ k The original input matrix X of the kth data owner k and mask input matrix U k composition.

[0121] ciphertext form 2) Obtain the original symmetric matrix A k Symmetric matrix with mask The sum, i.e., matrix A′ k =A k +Λ k This serves as the ciphertext associated with the original symmetric matrix. It is easy to see...

[0122] The above ciphertext form 2 can be called the ciphertext of the original symmetric matrix, that is, the ciphertext of the original symmetric matrix is ​​the sum of the original symmetric matrix and the mask symmetric matrix.

[0123] On the other hand, the ciphertext of the original product vector obtained by the k-th data owner is the original product vector of the k-th data owner. Product vector with the k-th data owner mask The sum of, i.e., column vectors Easy to see

[0124] Understandably, before sending the intermediate results calculated from the original data samples to the first server, the data owner encrypts the intermediate results using a masking technique to encrypt their private data. This ensures that the first server cannot know the true nature of the intermediate results. Furthermore, the data owner possesses the intermediate results calculated from their private data. The first server obtains the ciphertext of the masked intermediate results and stores the mask-related information (i.e., the mask input matrix and mask label column vector, or the mask symmetric matrix and mask product vector) used to decrypt the masked ciphertext on the second server. Therefore, apart from the data owner holding the intermediate results calculated from their own private data, the first server cannot know the intermediate results, thus ensuring the security of the data owner's private data. Moreover, as will be explained below, the first server further encrypts the masked ciphertext of the intermediate results before sending it to the second server. Correspondingly, even after the second server decrypts the received ciphertext using the mask-related information, it still cannot know the intermediate results because of the further encryption performed by the first server. As can be seen from the above, neither the first server nor the second server can know the intermediate results calculated from the private data of the data owner through the information they receive, thus protecting the privacy of the data owner. In the subsequent steps of this embodiment, the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners, and cooperates with the second server to obtain the linear regression coefficients. The subsequent steps of this embodiment include steps S120, S130, and S140, which will be described below.

[0125] Figure 1In step S110 of the method, the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners. It processes the ciphertext related to the original symmetric matrix sent by the at least two data owners to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners, and processes the ciphertexts of the original product vectors sent by the at least two data owners to obtain the sum of the ciphertexts of the original product vectors of multiple data owners. On the other hand, the first server obtains the symmetric matrix and product vector corresponding to the pseudo-data sample, which are respectively called the pseudo-sample symmetric matrix and pseudo-sample product vector. Then, the first server adds the ciphertext of the original symmetric matrix of multiple data owners to the pseudo-sample symmetric matrix processing result to obtain the symmetric matrix containing the influence of the pseudo-sample symmetric matrix. The first ciphertext sum of the matrix is ​​obtained by adding the ciphertext sum of the original product vectors of multiple data owners to the result of processing the pseudo-sample product vector, thus obtaining the first ciphertext sum of the product vectors containing the influence of the pseudo-sample product vector. Finally, the first server sends the above-mentioned ciphertext sum of the original symmetric matrices of multiple data owners containing the influence of the pseudo-sample symmetric matrix and the ciphertext sum of the original product vectors of multiple data owners containing the influence of the pseudo-sample product vector to the second server. In view of the characteristics of Embodiment 2 compared to Embodiment 1, Embodiment 2 modifies steps S310 to S340 in Embodiment 1, resulting in steps S710 to S740 in Embodiment 2. That is, in Embodiment 2, step S110 includes, but is not limited to, the following steps S710 to S740:

[0126] In step S710, the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners; the first server performs accumulation processing and optional regularization processing on the ciphertext related to the original symmetric matrix sent by at least two data owners to obtain the sum of the ciphertexts of the original symmetric matrix of multiple data owners, which is simply referred to as the first ciphertext sum of the symmetric matrix; the first server also performs accumulation processing on the ciphertexts of the original product vector sent by at least two data owners to obtain the sum of the ciphertexts of the original product vector of multiple data owners, which is simply referred to as the first ciphertext sum of the product vector.

[0127] In step S620, the ciphertext related to the original symmetric matrix sent by the k-th data owner (1≤k≤M) has two different ciphertext forms. Accordingly, the method for processing the ciphertext related to the original symmetric matrix in this step also includes the following two preprocessing steps to obtain the preprocessing result:

[0128] The first preprocessing step of the original symmetric matrix related ciphertext) The k-th data owner uses ciphertext form 1 in step S620, i.e. The preprocessed result of the original symmetric matrix related ciphertext calculated by the first server is as follows: A′ is easy to see k satisfy The second preprocessing step for the original symmetric matrix related ciphertext) involves the k-th data owner using ciphertext form 2 in step S620. Therefore, the preprocessing step of the first server does not require any operation; it directly uses the above ciphertext form 2 as the preprocessing result of the original symmetric matrix related ciphertext.

[0129] As mentioned earlier, the above ciphertext form 2 can be called the ciphertext of the original symmetric matrix. It is easy to see that the two preprocessing results obtained by the above two preprocessing steps are equal to the ciphertext of the original symmetric matrix.

[0130] After the above preprocessing steps, the first server performs an accumulation and optional regularization on the preprocessing results of the ciphertexts related to the original symmetric matrices of the M data owners, i.e., the ciphertexts of the original symmetric matrices, to obtain the sum of the ciphertexts of the original symmetric matrices of the multiple data owners (referred to as the sum of the first ciphertexts of the symmetric matrices). The regularization process described above can also be performed in other steps; please refer to the subsequent descriptions for details. On the other hand, the ciphertext of the original product vector received by the first server... It is the ciphertext of the original product vector. Thus, the first server obtains the ciphertext of the original product vector of the M data owners, which is the ciphertext of the product of the original input matrix and the original label column vector. The summation is performed to obtain the ciphertext sum of the original product vectors of multiple data owners (referred to as the first ciphertext sum of the product vectors).

[0131] In step S720, the first server uses several pseudo-data samples to obtain the symmetric matrix and product vector corresponding to the pseudo-data samples, which are called the pseudo-sample symmetric matrix and pseudo-sample product vector, respectively.

[0132] This step remains unchanged from the corresponding step in Embodiment 1. For relevant details, please refer to the corresponding step in Embodiment 1.

[0133] In step S730, the first server adds the sum of the first ciphertext of the symmetric matrix to the processing result of the pseudo-sample symmetric matrix, obtaining the sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix; the first server adds the sum of the first ciphertext of the product vector to the processing result of the pseudo-sample product vector, obtaining the sum of the original product vector ciphertexts of multiple data owners that includes the influence of the pseudo-sample product vector. The first server sends the above sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix and the sum of the original product vector ciphertexts of multiple data owners that includes the influence of the pseudo-sample product vector to the second server.

[0134] The result φ′ of the pseudo-sample symmetric matrix processing is the pseudo-sample symmetric matrix (i.e., the pseudo-sample symmetric matrix φ=E mentioned above). T E) That is, φ′=φ, or the result of taking the negative sign of the pseudo-sample symmetric matrix, i.e., φ′=-φ; the result of processing the pseudo-sample product vector. It is the pseudo-sample product vector (i.e., the pseudo-sample product vector mentioned above) )Right now Or it could be the result of negating the product vector of pseudo-samples.

[0135] The first server adds the sum of the first ciphertext of the symmetric matrix to the result of processing the pseudo-sample symmetric matrix to obtain the sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix. Furthermore, it adds the sum of the first ciphertext of the product vector to the result of processing the pseudo-sample product vector to obtain the sum of the original product vector ciphertexts of multiple data owners that includes the influence of the pseudo-sample product vector. Specifically, the first server adds the sum of the first ciphertext of the symmetric matrix A′ to the result of processing the pseudo-sample symmetric matrix φ′ to obtain the sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix C′=A′+φ′; and adds the sum of the first ciphertext of the product vector... Processing result of product vector with pseudo-sample The sum of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vectors, is obtained by adding them together. Then, the first server combines the sum of the original symmetric matrices of the multiple data owners that contain the influence of the pseudo-sample symmetric matrices with the sum of the original product vectors of the multiple data owners that contain the influence of the pseudo-sample product vectors in C′. Send to the second server.

[0136] This step uses intermediate variables related to the pseudo-data samples, namely the pseudo-sample symmetric matrix processing result and the pseudo-sample product vector processing result, to process the ciphertext A′ and Further encryption is performed. The result of processing the pseudo-sample symmetric matrix can be φ′=φ or φ′=-φ, while the result of processing the pseudo-sample product vector can be... or Accordingly, this step can include the following four implementation methods:

[0137] Implementation Method 1: The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, is C′=A′+φ′=A′+φ, while the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, is...

[0138] Implementation Method 2: The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, is C′=A′+φ′=A′-φ, while the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, is...

[0139] Implementation Method 3: The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, is C′=A′+φ′=A′+φ, while the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, is...

[0140] Implementation Method 4: The sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, is C′=A′+φ′=A′-φ, while the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, is...

[0141] Steps S710 and S730 above both involve ciphertext addition. Specifically, the first server first adds the ciphertext of the original symmetric matrices sent by at least two data owners to the result of processing the pseudo-sample symmetric matrices; similarly, it first adds the ciphertext of the original product vectors sent by at least two data owners to the result of processing the pseudo-sample product vectors. In practice, the order of these ciphertext additions can be arbitrarily adjusted. For example, the first server can first add the ciphertext of the original symmetric matrices sent by one or more data owners, then add the result of processing the pseudo-sample symmetric matrices, and finally add the ciphertext of the remaining original symmetric matrices sent by several data owners. Alternatively, the first server can first add the ciphertext of the original product vectors sent by one or more data owners, then add the result of processing the pseudo-sample product vectors, and finally add the ciphertext of the remaining original product vectors sent by several data owners.

[0142] It is understandable that in Embodiment 2, since all data owners encrypt their private data using mask encryption, the sum of the first ciphertexts of all symmetric matrices received by the first server is obtained through mask encryption, and the sum of the first ciphertexts of all product vectors is also obtained through mask encryption. Therefore, when summing the ciphertexts of the original symmetric matrices based on different encryption methods, the summation result includes the influence of the private data of all data owners. Furthermore, when summing the original product vectors based on encryption methods, the summation result includes the influence of the private data of all data owners. Therefore, in Embodiment 2, the summation of the ciphertexts of the original symmetric matrices of multiple data owners that includes the influence of the pseudo-sample symmetric matrix obtained by the first server is equivalent to the sum of the ciphertexts of the original symmetric matrices of all data owners that includes the influence of the pseudo-sample symmetric matrix. The summation of the ciphertexts of the original product vectors of multiple data owners that includes the influence of the pseudo-sample symmetric matrix obtained by the first server is equivalent to the sum of the ciphertexts of the original product vectors of all data owners that includes the influence of the pseudo-sample symmetric matrix.

[0143] In step S740, the first server encrypts the pseudo-input matrix E composed of several pseudo-input feature column vectors to obtain the pseudo-input matrix ciphertext. Then cipher the pseudo-input matrix The data is sent to the second server; the aforementioned pseudo-input feature column vectors are part of the corresponding pseudo-data samples, as described above.

[0144] This step remains unchanged from the corresponding step in Embodiment 1. For relevant details, please refer to the corresponding step in Embodiment 1.

[0145] Figure 1 In step S130, the second server receives the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector, sent by the first server. The second server then decrypts these two results to obtain the sum of the plaintexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. Subsequently, the second server uses the decrypted results to calculate the pseudo-sample encrypted linear regression coefficients that include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and sends these pseudo-sample encrypted linear regression coefficients to the first server. Regarding the characteristics of Embodiment 2 compared to Embodiment 1, Embodiment 2 modifies steps S410 to S430 in Embodiment 1, resulting in steps S810 to S830 in Embodiment 2. That is, in Embodiment 2, step S130 includes, but is not limited to, the following steps S810 to S830:

[0146] In step S810, the second server receives the sum of ciphertexts of the original symmetric matrices of multiple data owners that are affected by the pseudo-sample symmetric matrix and the sum of ciphertexts of the original product vectors of multiple data owners that are affected by the pseudo-sample product vector sent by the first server. Then, the second server decrypts the sum of the two ciphertexts to obtain the sum of plaintexts of the original symmetric matrices of multiple data owners that are affected by the pseudo-sample symmetric matrix and the sum of plaintexts of the original product vectors of multiple data owners that are affected by the pseudo-sample product vector.

[0147] To decrypt the sum of the two ciphertexts mentioned above, the second server receives the mask input matrix U sent by at least two data owners. k and mask label column vector Or receive a mask symmetric matrix sent by at least two data owners. and mask product vector Then, these are used to decrypt the sum of the original symmetric matrix ciphertexts of multiple data owners that contain the influence of the pseudo-sample symmetric matrix, and the sum of the original product vector ciphertexts of multiple data owners that contain the influence of the pseudo-sample product vector. When step S610 is implemented in another way, instead of the kth data owner sending the masked input matrix U to the second server... k and mask label column vector Or a symmetric mask matrix and mask product vector Therefore, this step also needs to be implemented using the corresponding method, instead of the second server receiving the mask input matrix U. k and mask label column vector Or a symmetric mask matrix and mask product vector The corresponding implementation method used in this step is obvious to those skilled in the art and will not be described in detail here.

[0148] Specifically, the second server decrypts the sum C′ of the original symmetric matrix ciphertexts of multiple data owners, which contains the influence of pseudo-sample symmetric matrices, by calculating... That is, subtract the sum of the symmetric matrices masked by multiple data owners from the sum of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix.

[0149] The decryption involves the sum of the original product vector ciphertexts from multiple data owners, which contains the influence of spurious sample product vectors. Through calculation That is, subtract the sum of the product vectors of multiple data owners' masks from the sum of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vectors. It is easy to see that the calculated sum C of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix, satisfies The calculated sum of the plaintext original product vectors of multiple data owners, including those influenced by spurious sample product vectors, is... satisfy

[0150] This step includes an optional regularization step. The optional regularization step described in step S710 can be moved to this step. That is, if the optional regularization step is not used in step S710, the sum C of the plaintext of the original symmetric matrices of the multiple data owners that include the influence of the pseudo-sample symmetric matrix does not include the regularization term λI. Accordingly, regularization can be performed in this step, i.e., the regularization term λI can be added. More generally, regularization can also be performed in step S710 and in this step. The final effect of regularization is the superposition of the effects of regularization in the two steps. The relevant implementation methods are easy to obtain and will not be described in detail here.

[0151] In step S820, the second server calculates the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, using the sum of the plaintext of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. The second server then sends the pseudo-sample encrypted linear regression coefficients to the first server.

[0152] This step remains unchanged from the corresponding step in Embodiment 1. For relevant details, please refer to the corresponding step in Embodiment 1.

[0153] In step S830, the second server receives the pseudo-input matrix ciphertext sent by the first server. Then use the first inverse matrix, i.e., matrix G = C -1 The ciphertext of the pseudo-input matrix is ​​obtained. Product with the first inverse matrix Then the product Ξ is sent to the first server. The product Ξ is simply referred to as the product of the pseudo-input matrix ciphertext and the first inverse matrix.

[0154] This step remains unchanged from the corresponding step in Embodiment 1. For relevant details, please refer to the corresponding step in Embodiment 1.

[0155] Embodiment 2 of this application, Figure 1In step S140 of the method, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors, and at least partially eliminates the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors to obtain target linear regression coefficients. Based on the characteristics of Embodiment Two compared to Embodiment One, Embodiment Two modifies steps S510 to S530 in Embodiment One, resulting in steps S910 to S920 in Embodiment Two. That is, in Embodiment Two, step S140 includes, but is not limited to, the following steps S910 to S920:

[0156] In step S910, after the first server receives the product Ξ of the pseudo-input matrix ciphertext and the first inverse matrix sent by the second server, it performs the corresponding decryption operation to obtain the product of the pseudo-input matrix plaintext and the first inverse matrix, that is, the product of the pseudo-input matrix plaintext and the inverse matrix of the sum of the original symmetric matrix ciphertexts of multiple data owners that contain the influence of the pseudo-sample symmetric matrix.

[0157] This step remains unchanged from the corresponding step in Embodiment 1. For relevant details, please refer to the corresponding step in Embodiment 1.

[0158] In step S920, the first server receives the pseudo-sample encrypted linear regression coefficients, which contain the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector. The server then at least partially eliminates the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector to obtain the desired target linear regression coefficient vector. The above satisfy Note that since each data owner in Embodiment 2 only uses mask encryption and does not use homomorphic encryption, the first server usually no longer needs to perform the homomorphic encryption and homomorphic decryption related processing described in step S530 of Embodiment 1.

[0159] In Embodiments 1 and 2 above, each data owner uses the same encryption technique that supports addition calculations on ciphertext to obtain ciphertext related to their respective original symmetric matrices and ciphertext of the original product vectors. Correspondingly, the sum of the ciphertexts of the original symmetric matrices of multiple data owners containing the influence of pseudo-sample symmetric matrices obtained by the first server is the sum of the ciphertexts of the original symmetric matrices of all data owners containing the influence of pseudo-sample symmetric matrices, and the sum of the ciphertexts of the original product vectors of multiple data owners containing the influence of pseudo-sample product vectors obtained by the first server is the sum of the ciphertexts of the original product vectors of all data owners containing the influence of pseudo-sample product vectors. Embodiment 1 uses homomorphic encryption, and Embodiment 2 uses a technique of masking plaintext to obtain ciphertext. However, in practice, each data owner can also use other encryption techniques that support addition calculations on ciphertext besides the aforementioned homomorphic encryption and masking encryption.

[0160] Each data owner can also use different encryption techniques that support addition calculations on ciphertext to obtain their respective ciphertexts related to the original symmetric matrix and the original product vector. The following is a brief explanation of examples of different encryption techniques supporting addition calculations on ciphertext used by different data owners. It is assumed that some data owners use homomorphic encryption, while all other data owners use mask encryption. Accordingly, some data owners use the method of Example 1, while all other data owners use the method of Example 2. Only slight modifications can be made to step S410 in Example 1 or step S810 in Example 2, and minor modifications can be made to several other related steps.

[0161] First, let's briefly introduce Embodiment 3. In Embodiment 3, at least two data owners respectively use at least two different encryption techniques to encrypt intermediate variables related to several private data samples, obtaining ciphertexts of their original symmetric matrices and original product vectors. The at least two different encryption techniques include the homomorphic encryption technique used in Embodiments 1 and 2, and the encryption technique of masking plaintext to obtain ciphertext. The sum of the ciphertexts of the original symmetric matrices of multiple data owners containing the influence of pseudo-sample symmetric matrices obtained by the first server is the sum of at least two ciphertexts of the original symmetric matrices of multiple data owners containing the influence of pseudo-sample symmetric matrices corresponding to at least two different encryption techniques. The sum of the ciphertexts of the original product vectors of multiple data owners containing the influence of pseudo-sample product vectors obtained by the first server is the sum of at least two ciphertexts of the original product vectors of multiple data owners containing the influence of pseudo-sample product vectors corresponding to at least two different encryption techniques. The first server sends the sum of the ciphertexts of the original symmetric matrices of multiple data owners containing the influence of pseudo-sample symmetric matrices and the sum of the ciphertexts of the original product vectors of multiple data owners containing the influence of pseudo-sample product vectors to the second server.

[0162] The second server receives and decrypts, using different decryption techniques corresponding to different encryption techniques, the sum of ciphertexts of at least two original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices, and the sum of ciphertexts of at least two original product vectors of multiple data owners that contain the influence of pseudo-sample product vectors, respectively, to obtain the sum of plaintexts of at least two original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices and the sum of plaintexts of at least two original product vectors of multiple data owners that contain the influence of pseudo-sample product vectors. Then, the sum of the plaintexts of the at least two original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices is accumulated to obtain the sum of plaintexts of all original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices, and the sum of the plaintexts of the at least two original product vectors of multiple data owners that contain the influence of pseudo-sample product vectors is accumulated to obtain the sum of plaintexts of all original product vectors of multiple data owners that contain the influence of pseudo-sample product vectors.

[0163] The difference between Example 3 and Examples 1 and 2 is that each data owner can choose to use homomorphic encryption, mask encryption, or other third encryption techniques that support addition of ciphertext to encrypt their private data, respectively, to obtain ciphertext of the original symmetric matrix and ciphertext of the original product vector corresponding to each encryption method. After receiving the ciphertext of the original symmetric matrix and the original product vector corresponding to each encryption method, the first server sums the ciphertext of the original symmetric matrix corresponding to one of the encryption methods with the pseudo-sample symmetric matrix, to obtain the sum of the original symmetric matrix ciphertexts of multiple data owners that contain the influence of the pseudo-sample symmetric matrix, corresponding to at least two encryption methods, and the sum of the ciphertexts containing the influence of the pseudo-sample product vector. The first server sends at least two ciphertexts of the original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices, and at least two ciphertexts of the original product vectors of multiple data owners that contain the influence of pseudo-sample symmetric matrices, to the second server. The second server decrypts the ciphertexts of the original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices, respectively, using an encryption method, to obtain the plaintext sum of the original symmetric matrices of multiple data owners that contain the influence of pseudo-sample symmetric matrices. The second server then decrypts the ciphertexts of the original product vectors of multiple data owners that contain the influence of pseudo-sample product vectors, respectively, using an encryption method, to obtain the plaintext sum of the original product vectors of multiple data owners.

[0164] Embodiment 3 includes steps S1010, S1020, S1030, and S1040 listed below, the functions of which are respectively similar to Figure 1Steps S110 to S140 are briefly described below.

[0165] In step S1010, at least two data owners use at least two different encryption techniques to encrypt intermediate variables related to several private data samples, respectively, to obtain ciphertexts of their original symmetric matrices and original product vectors. Each of the at least two data owners uses one encryption technique to encrypt intermediate variables related to several private data samples, obtaining ciphertexts of their own original symmetric matrices and original product vectors. Each data owner sends their respective ciphertexts of the original symmetric matrices and original product vectors to the first server. The at least two different encryption techniques include the homomorphic encryption technique used in Embodiments 1 and 2, and the encryption technique of masking plaintext to obtain ciphertext. It may also include other encryption techniques that support addition calculations on ciphertext. The encryption technique of masking plaintext to obtain ciphertext will be referred to hereafter as mask encryption.

[0166] Step S1020 includes the following operations:

[0167] The first server receives the ciphertext of the original symmetric matrix and the ciphertext of the original product vector from each of at least two data owners. The first server then sums the ciphertext of the original symmetric matrix and the ciphertext of the original product vector obtained using the same encryption technique, to obtain the sum of the ciphertexts of the original symmetric matrices and the sum of the ciphertexts of the original product vectors of multiple data owners corresponding to that encryption technique. These are referred to as the first ciphertext sum of the symmetric matrix and the first ciphertext sum of the product vector corresponding to that encryption technique, respectively. In other words, the first server obtains: the first ciphertext sum of the symmetric matrix corresponding to homomorphic encryption, the first ciphertext sum of the product vector corresponding to homomorphic encryption, the first ciphertext sum of the symmetric matrix corresponding to mask encryption, the first ciphertext sum of the product vector corresponding to mask encryption, the first ciphertext sum of the symmetric matrix corresponding to other encryption techniques that support addition of ciphertext, and the first ciphertext sum of the product vector corresponding to other encryption techniques that support addition of ciphertext.

[0168] On the other hand, the first server obtains the symmetric matrix and product vector corresponding to the pseudo-data sample, which are respectively called the pseudo-sample symmetric matrix and pseudo-sample product vector. Then, the first server uses the methods described in the corresponding steps of Embodiment 1 and Embodiment 2 to obtain the pseudo-sample symmetric matrix processing result and pseudo-sample product vector processing result corresponding to homomorphic encryption technology, as well as the pseudo-sample symmetric matrix processing result and pseudo-sample product vector processing result corresponding to mask encryption technology; in addition, the first server also obtains the pseudo-sample symmetric matrix processing result and pseudo-sample product vector processing result corresponding to other encryption technologies that support addition calculation of ciphertext, which can be added to the ciphertext obtained by the other encryption technologies.

[0169] Finally, the first server uses the sum of the first ciphertext of the symmetric matrix corresponding to homomorphic encryption technology plus the processing result of the pseudo-sample symmetric matrix corresponding to homomorphic encryption technology to obtain the sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, corresponding to homomorphic encryption technology. It then uses the sum of the first ciphertext of the product vector corresponding to homomorphic encryption technology plus the processing result of the pseudo-sample product vector corresponding to homomorphic encryption technology to obtain the sum of the original product vector ciphertexts of multiple data owners, including the influence of the pseudo-sample product vector, corresponding to homomorphic encryption technology. Finally, it uses the sum of the first ciphertext of the symmetric matrix corresponding to mask encryption technology plus the processing result of the pseudo-sample symmetric matrix corresponding to mask encryption technology to obtain the sum of the original symmetric matrix ciphertexts of multiple data owners, including the influence of the pseudo-sample symmetric matrix, corresponding to mask encryption technology. The sum of the first ciphertext of the product vector corresponding to the encryption technique is added to the result of processing the pseudo-sample product vector corresponding to the mask encryption technique to obtain the sum of the original product vectors of multiple data owners corresponding to the mask encryption technique, which includes the influence of the pseudo-sample product vector. The sum of the first ciphertext of the symmetric matrix corresponding to other encryption techniques is added to the result of processing the pseudo-sample symmetric matrix corresponding to other encryption techniques to obtain the sum of the original symmetric matrix of multiple data owners corresponding to other encryption techniques, which includes the influence of the pseudo-sample symmetric matrix. The sum of the first ciphertext of the product vector corresponding to other encryption techniques is added to the result of processing the pseudo-sample product vector corresponding to other encryption techniques to obtain the sum of the original product vectors of multiple data owners corresponding to other encryption techniques, which includes the influence of the pseudo-sample product vector. The sum of the above multiple ciphertexts is then sent to the second server.

[0170] It is easy to see that the sum of the original symmetric matrix ciphertexts of multiple data owners that include the influence of pseudo-sample symmetric matrices obtained by the first server is the sum of at least two original symmetric matrix ciphertexts of multiple data owners that include the influence of pseudo-sample symmetric matrices, corresponding to at least two different encryption techniques. The sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors obtained by the first server is the sum of at least two original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors, corresponding to at least two different encryption techniques. The first server sends the sum of the original symmetric matrix ciphertexts of multiple data owners that include the influence of pseudo-sample symmetric matrices and the sum of the original product vector ciphertexts of multiple data owners that include the influence of pseudo-sample product vectors to the second server.

[0171] In step S1030, the second server receives from the first server the sum of ciphertexts of at least two original symmetric matrices of multiple data owners, each containing the influence of pseudo-sample symmetric matrices, corresponding to at least two different encryption techniques, and the sum of ciphertexts of at least two original product vectors of multiple data owners, each containing the influence of pseudo-sample product vectors, corresponding to at least two different encryption techniques. The second server uses the decryption techniques corresponding to the at least two different encryption techniques to decrypt the sum of the ciphertexts, respectively, to obtain the sum of plaintexts of at least two original symmetric matrices of multiple data owners, each containing the influence of pseudo-sample symmetric matrices, and the sum of plaintexts of at least two original product vectors of multiple data owners, each containing the influence of pseudo-sample product vectors. Subsequently, the second server accumulates the sum of the at least two original symmetric matrices of multiple data owners, each containing the influence of pseudo-sample symmetric matrices. The sum of the plaintext of the original product vectors of the data owners is obtained as the sum of the plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample symmetric matrix, corresponding to all data owners. This sum is then accumulated with the sum of at least two of the aforementioned plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vector, to obtain the sum of the plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vector, corresponding to all data owners. The second server uses the sum of the plaintext of the original symmetric matrices of multiple data owners, including the influence of the pseudo-sample symmetric matrix, and the sum of the plaintext of the original product vectors of multiple data owners, including the influence of the pseudo-sample product vector, to calculate the pseudo-sample encrypted linear regression coefficients, including the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, and sends these pseudo-sample encrypted linear regression coefficients to the first server. Further details of this step are described below.

[0172] The second server receives from the first server the sum of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, the sum of the original symmetric matrices of multiple data owners affected by the mask encryption technique, the sum of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, the sum of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, the sum of the original product vectors of multiple data owners affected by the homomorphic encryption technique, the sum of the original product vectors of multiple data owners affected by the mask encryption technique, and the sum of the original product vectors of multiple data owners affected by the pseudo-sample product vector, as well as the sum of the original product vectors of multiple data owners affected by the pseudo-sample product vector, as sent by the first server.

[0173] The second server uses homomorphic encryption and corresponding homomorphic decryption techniques to decrypt the sum of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, and the sum of the original product vectors of multiple data owners affected by the pseudo-sample product vector, resulting in the sum of the plaintext of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, and the sum of the plaintext of the original product vectors of multiple data owners affected by the pseudo-sample product vector, respectively. The second server then uses mask encryption and corresponding decryption techniques to decrypt the sum of the original symmetric matrices of multiple data owners affected by the mask encryption and the sum of the original symmetric matrices of multiple data owners affected by the pseudo-sample symmetric matrix, respectively. The sum of the original product vector ciphertexts yields the sum of the original symmetric matrices of multiple data owners, including the influence of pseudo-sample symmetric matrices, corresponding to the mask encryption technique, as well as the sum of the original product vectors of multiple data owners, including the influence of pseudo-sample product vectors, corresponding to the mask encryption technique. The second server uses decryption techniques corresponding to other encryption techniques to decrypt the sum of the original symmetric matrices of multiple data owners, including the influence of pseudo-sample symmetric matrices, corresponding to other encryption techniques, and the sum of the original product vectors of multiple data owners, including the influence of pseudo-sample product vectors, corresponding to other encryption techniques, yielding the sum of the original symmetric matrices of multiple data owners, including the influence of pseudo-sample symmetric matrices, corresponding to other encryption techniques, as well as the sum of the original product vectors of multiple data owners, including the influence of pseudo-sample product vectors, corresponding to other encryption techniques.

[0174] Subsequently, the second server sums the plaintext of the original symmetric matrices of multiple data owners, including those affected by pseudo-sample symmetric matrices, corresponding to the aforementioned homomorphic encryption technology; the plaintext of the original symmetric matrices of multiple data owners, including those affected by pseudo-sample symmetric matrices, corresponding to the mask encryption technology; and the plaintext of the original symmetric matrices of multiple data owners, including those affected by pseudo-sample symmetric matrices, corresponding to other encryption technologies, to obtain the sum of the plaintext of the original symmetric matrices of all data owners, including those affected by pseudo-sample symmetric matrices, for all data owners. On the other hand, the second server sums the plaintext of the original product vectors of multiple data owners, including those affected by pseudo-sample product vectors, corresponding to the aforementioned homomorphic encryption technology; the plaintext of the original product vectors of multiple data owners, including those affected by pseudo-sample product vectors, corresponding to the mask encryption technology; and the plaintext of the original product vectors of multiple data owners, including those affected by pseudo-sample product vectors, corresponding to other encryption technologies, to obtain the sum of the plaintext of the original product vectors of all data owners, including those affected by pseudo-sample product vectors, for all data owners.

[0175] Finally, the second server uses the sum of the plaintext of the original symmetric matrices of all data owners, which includes the influence of the pseudo-sample symmetric matrix, and the sum of the plaintext of the original product vectors of all data owners, which includes the influence of the pseudo-sample product vector, to calculate the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector. The second server then sends these pseudo-sample encrypted linear regression coefficients to the first server. The pseudo-sample encrypted linear regression coefficients are equal to the column vector obtained by multiplying the inverse of the sum of the plaintext of the original symmetric matrices of all data owners, which includes the influence of the pseudo-sample symmetric matrix, by the sum of the plaintext of the original product vectors of all data owners, which includes the influence of the pseudo-sample product vector.

[0176] In step S1040, the first server receives the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector. The server at least partially eliminates the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector to obtain the target linear regression coefficients. This step basically follows the corresponding steps in Embodiments 1 and 2, except that: the sum of the plaintext of the original symmetric matrix of all data owners, which includes the influence of the pseudo-sample symmetric matrix, contains the influence of three pseudo-sample symmetric matrices; and the sum of the plaintext of the original product vector of all data owners, which includes the influence of the pseudo-sample product vector, contains the influence of three pseudo-sample product vectors. Corresponding modifications are made to the relevant steps. Furthermore, it may be necessary to perform some corresponding operations based on the requirements of other encryption technologies that support addition calculations on ciphertext. This is well known to those skilled in the art and will not be elaborated here.

[0177] Finally, a brief introduction to Example 4. In Example 4, at least two data owners respectively use three different encryption techniques, including the first encryption technique, to encrypt intermediate variables related to several private data samples, obtaining ciphertexts related to their original symmetric matrices and original product vectors. The three different encryption techniques include the homomorphic encryption technique used in Example 1 (referred to as the first encryption technique), the mask encryption technique used in Example 2 (referred to as mask encryption), which masks plaintext to obtain ciphertext, and other third encryption techniques that support addition calculations on ciphertexts. Both the mask encryption technique and the third encryption technique satisfy the condition that the ciphertext obtained using the mask encryption technique and the third encryption technique can be further encrypted using the first encryption technique, i.e., the homomorphic encryption technique, to obtain the ciphertext further encrypted using the first encryption technique. The first server uses the first encryption technique... The first server further encrypts the ciphertext of the original symmetric matrix obtained by mask encryption and third encryption techniques, or the corresponding summation result, and further encrypts the ciphertext of the original product vector obtained by mask encryption and third encryption techniques, or the corresponding summation result; the first server then uses the above further encryption results to obtain the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, encrypted with the first encryption technique, and the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector, encrypted with the first encryption technique; the first server sends the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, encrypted with the first encryption technique, and the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector, encrypted with the first encryption technique, to the second server;

[0178] The second server receives and decrypts the sum of the original symmetric matrices of all data owners, which contain the influence of the pseudo-sample symmetric matrix, and the sum of the original product vectors of all data owners, which contain the influence of the pseudo-sample product vector, using the decryption techniques corresponding to the first encryption technology. Then, it further decrypts using the mask encryption technology and the two decryption techniques corresponding to the third encryption technology to obtain the sum of the plaintext of the original symmetric matrices of all data owners, which contain the influence of the pseudo-sample symmetric matrix, and the sum of the plaintext of the original product vectors of all data owners, which contain the influence of the pseudo-sample product vector.

[0179] Example 4 includes steps S1110, S1120, S1130 and S1140 listed below. The functions of these steps are similar to steps S110, S120, S130 and S140 in Example 1 and Example 2, respectively. These steps are briefly described below.

[0180] In step S1110, at least two data owners use at least three different encryption techniques, namely the homomorphic encryption technique used in Embodiment 1, the mask encryption technique used in Embodiment 2, and the third encryption technique that supports addition calculations on ciphertext, to encrypt the intermediate variables related to several private data samples of their own, thereby obtaining the ciphertext related to their original symmetric matrix and the ciphertext of their original product vector. Each of the at least two data owners uses one encryption technique to encrypt the intermediate variables related to several private data samples of their own, thereby obtaining the ciphertext related to their original symmetric matrix and the ciphertext of their original product vector. Each data owner sends the ciphertext of their original symmetric matrix and the ciphertext of their original product vector to the first server.

[0181] Step S1120 includes the following operations: The first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of at least two data owners; the first server respectively sums the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector obtained using the same encryption technology to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners corresponding to the encryption technology and the sum of the ciphertexts of the original product vectors of multiple data owners corresponding to the encryption technology, which are respectively referred to as the first ciphertext sum of the symmetric matrix corresponding to the encryption technology and the first ciphertext sum of the product vector corresponding to the encryption technology. That is, the first server obtains: the first ciphertext sum of the symmetric matrix corresponding to the homomorphic encryption technology, the first ciphertext sum of the product vector corresponding to the homomorphic encryption technology, the first ciphertext sum of the symmetric matrix corresponding to the mask encryption technology, the first ciphertext sum of the product vector corresponding to the mask encryption technology, the first ciphertext sum of the symmetric matrix corresponding to the third encryption technology, and the first ciphertext sum of the product vector corresponding to the third encryption technology. On the other hand, the first server obtains the symmetric matrix and product vector corresponding to the pseudo data sample, which are respectively called the pseudo sample symmetric matrix and the pseudo sample product vector. Then, the first server uses the methods described in the corresponding steps of Example 1 to obtain the pseudo-sample symmetric matrix processing result and the pseudo-sample product vector processing result corresponding to the homomorphic encryption technology.

[0182] Subsequently, the first server uses homomorphic encryption technology and the first key described in Example 1 to further encrypt the first ciphertext sum of the symmetric matrix corresponding to the mask encryption technology, the first ciphertext sum of the product vector corresponding to the mask encryption technology, the first ciphertext sum of the symmetric matrix corresponding to the third encryption technology, and the first ciphertext sum of the product vector corresponding to the third encryption technology, respectively, to obtain the result of the first ciphertext sum of the symmetric matrix corresponding to the mask encryption technology after further homomorphic encryption, the result of the first ciphertext sum of the product vector corresponding to the mask encryption technology after further homomorphic encryption, the result of the first ciphertext sum of the symmetric matrix corresponding to the third encryption technology after further homomorphic encryption, and the result of the first ciphertext sum of the product vector corresponding to the third encryption technology after further homomorphic encryption.

[0183] Finally, the first server sums the first ciphertext of the symmetric matrix corresponding to the homomorphic encryption technique, the processing result of the pseudo-sample symmetric matrix corresponding to the homomorphic encryption technique, the result of the first ciphertext of the symmetric matrix corresponding to the mask encryption technique after further homomorphic encryption, and the result of the first ciphertext of the symmetric matrix corresponding to the third encryption technique after further homomorphic encryption, to obtain the sum of the original symmetric matrix ciphertexts of all data owners that are further encrypted using homomorphic encryption, including the influence of the pseudo-sample symmetric matrix. On the other hand, the first server sums the first ciphertext of the product vector corresponding to the homomorphic encryption technique, the processing result of the pseudo-sample product vector corresponding to the homomorphic encryption technique, the result of the first ciphertext of the product vector corresponding to the mask encryption technique after further homomorphic encryption, and the result of the first ciphertext of the product vector corresponding to the third encryption technique after further homomorphic encryption, to obtain the sum of the original product vector ciphertexts of all data owners that are further encrypted using homomorphic encryption, including the influence of the pseudo-sample product vector. The first server sends the sum of the original symmetric matrix ciphertexts of all data owners, which are further encrypted using homomorphic encryption and contain the influence of the pseudo-sample symmetric matrix, and the sum of the original product vector ciphertexts of all data owners, which are further encrypted using homomorphic encryption and contain the influence of the pseudo-sample product vector, to the second server.

[0184] In the first embodiment of step S1120 above, for encryption techniques other than the first encryption technique, namely mask encryption technique and third encryption technique, the first server first accumulates the ciphertext related to the original symmetric matrix obtained by using the first encryption technique, mask encryption technique and third encryption technique and the ciphertext of the original product vector respectively, and then uses the first encryption technique to further encrypt the accumulated result; that is, the first server uses the first encryption technique to further encrypt the corresponding accumulated result of the ciphertext of the original symmetric matrix obtained by using mask encryption technique and third encryption technique, and further encrypts the corresponding accumulated result of the ciphertext of the original product vector obtained by using mask encryption technique and third encryption technique.

[0185] The above-described method of first accumulating encrypted text and then further encrypting it can be modified to first further encrypting and then accumulating encrypted text, thus obtaining another implementation of step S1120. In this other implementation, the first server first uses the first encryption technology to further encrypt the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector obtained by the mask encryption technology and the third encryption technology, and then accumulates the results of the above further encryption. In other words, the first server uses homomorphic encryption technology and the first key described in Embodiment 1 to further encrypt the ciphertext of the original symmetric matrix obtained by mask encryption technology and the third encryption technology, as well as the ciphertext of the original product vector obtained by mask encryption technology and the third encryption technology. Then, the results of the above further encryption are added together to obtain the results of the first ciphertext of the symmetric matrix corresponding to the mask encryption technology after further homomorphic encryption, the results of the first ciphertext of the product vector corresponding to the mask encryption technology after further homomorphic encryption, the results of the first ciphertext of the symmetric matrix corresponding to the third encryption technology after further homomorphic encryption, and the results of the first ciphertext of the product vector corresponding to the third encryption technology after further homomorphic encryption. Afterward, the first server uses the results of the above further homomorphic encryption in the first embodiment of step S120 for subsequent pseudo-sample encryption operations.

[0186] In step S1130, the second server receives from the first server the sum of the original symmetric matrix ciphertexts of all data owners, which are further encrypted using homomorphic encryption and contain the influence of pseudo-sample symmetric matrices, and the sum of the original product vector ciphertexts of all data owners, which are further encrypted using homomorphic encryption and contain the influence of pseudo-sample product vectors. The second server first uses the homomorphic decryption technique corresponding to the above homomorphic encryption technique and the second key described in Embodiment 1 to decrypt the sum of the two ciphertexts respectively. Then, it further decrypts using the mask encryption technique and the two decryption techniques corresponding to the third encryption technique to obtain the plaintext of the original symmetric matrix of all data owners containing the influence of pseudo-sample symmetric matrices. The sum of the original product vectors of all data owners, including the sum of the product vectors of the pseudo-samples, and the sum of the plaintext of the original product vectors of all data owners, can also be referred to as the sum of the first plaintext of the symmetric matrix of all data owners, including the sum of the product vectors of the pseudo-samples, and the sum of the first plaintext of the product vectors of all data owners, including the sum of the product vectors of the pseudo-samples, respectively. The second server uses the sum of the first plaintext of the symmetric matrix of all data owners, including the sum of the product vectors of the pseudo-samples, and the sum of the first plaintext of the product vectors of the pseudo-samples, to calculate the pseudo-sample encrypted linear regression coefficients, including the sum of the symmetric matrix of the pseudo-samples and the product vectors of the pseudo-samples, and sends the pseudo-sample encrypted linear regression coefficients to the first server. Some details of this step are supplemented as follows.

[0187] The second server first uses the homomorphic decryption technology corresponding to the above-mentioned homomorphic encryption technology, and uses the second key described in Example 1, to decrypt the sum of the original symmetric matrix ciphertexts of all data owners that contain the influence of pseudo-sample symmetric matrices, which are further encrypted using homomorphic encryption technology, and the sum of the original product vector ciphertexts of all data owners that contain the influence of pseudo-sample product vectors, which are further encrypted using homomorphic encryption technology. This yields the sum of the original symmetric matrix ciphertexts of all data owners that contain the influence of pseudo-sample symmetric matrices after homomorphic decryption, and the sum of the original product vector ciphertexts of all data owners that contain the influence of pseudo-sample product vectors after homomorphic decryption. The second server then uses the decryption techniques corresponding to the mask encryption technology and the third encryption technology to decrypt the sum of the original symmetric matrices of all data owners after homomorphic decryption, which includes the influence of the pseudo-sample symmetric matrix, and the sum of the original product vectors of all data owners after homomorphic decryption, which includes the influence of the pseudo-sample product vector. This yields the sum of the plaintext of the original symmetric matrices of all data owners (i.e., the sum of the first plaintext of the symmetric matrices of all data owners including the influence of the pseudo-sample symmetric matrix) and the sum of the plaintext of the original product vectors of all data owners (i.e., the sum of the first plaintext of the product vectors of all data owners including the influence of the pseudo-sample product vector). The decryption technique corresponding to the mask encryption technology is the same as the decryption technique described in step S810 of Example 2. Furthermore, the pseudo-sample encrypted linear regression coefficient is equal to the column vector obtained by multiplying the inverse matrix of the sum of the first plaintext of the symmetric matrices of all data owners including the influence of the pseudo-sample symmetric matrix by the sum of the first plaintext of the product vectors of all data owners including the influence of the pseudo-sample product vector.

[0188] In step S1140, the first server receives pseudo-sample encrypted linear regression coefficients containing the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors, and at least partially eliminates the influence of pseudo-sample symmetric matrices and pseudo-sample product vectors to obtain the target linear regression coefficients. This step follows the corresponding steps in Embodiments 1 and 2, but it should be noted that some corresponding operations may be required according to the needs of the third encryption technology, which is well known to those skilled in the art and will not be elaborated here.

[0189] The linear regression method provided in this application can be applied to various horizontal federated learning scenarios. The following is a detailed explanation using a financial scenario as an example.

[0190] The data owners include a second bank in the first region and a fourth bank in the third region. The second bank's private data includes user information and deposit / loan data from the first region, and the fourth bank's private data includes user information and deposit / loan data from the third region. User information consists of private input features, and deposit / loan information consists of private labels. It is understood that the private data of the second and fourth banks also includes private input features for user information and private labels for deposit / loan data. The horizontal federated learning performed by the second and fourth banks is horizontal federated learning. In this embodiment of the invention, a cooperative and checks-and-balances relationship is formed between the first server and the second server, thereby ensuring the security of authentic user information and deposit / loan information.

[0191] Additionally, refer to Figure 2 , Figure 2 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0192] The processor 201 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0193] The memory 202 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 202 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 202 and called by the processor 201 to execute the linear regression method for horizontal data partitioning and privacy protection based on the embodiments of this application, for example, executing the method described above. Figure 1 Method steps S110 to S140;

[0194] Input / output interface 203 is used to implement information input and output;

[0195] The communication interface 204 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0196] Bus 205 transmits information between various components of the device (e.g., processor 201, memory 202, input / output interface 203, and communication interface 204);

[0197] The processor 201, memory 202, input / output interface 203 and communication interface 204 are connected to each other within the device via bus 205.

[0198] This application embodiment also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs, which can be executed by one or more processors to implement the above-described linear regression method for horizontally partitioning data and based on privacy protection. For example, it executes the above-described method. Figure 1 The method steps S110 to S140.

[0199] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0200] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0201] It will be understood by those skilled in the art that Figure 1 The technical solutions shown do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0202] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0203] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0204] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0205] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0206] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0207] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0208] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0209] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0210] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A linear regression method for horizontally partitioning data and based on privacy protection, characterized in that, include: At least two data owners each use several of their own private data samples to obtain ciphertext related to their original symmetric matrix and ciphertext of their original product vector, wherein the original symmetric matrix and the original product vector are respectively the symmetric matrix and product vector corresponding to the several data samples; each data owner sends their respective ciphertext related to the original symmetric matrix and the ciphertext of the original product vector to a first server; the first server receives the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector sent by each of the at least two data owners, and cooperates with a second server to obtain the target linear regression coefficients. The privacy-preserving linear regression method includes: The first server receives ciphertext related to the original symmetric matrix and ciphertext of the original product vector from each of at least two data owners, and obtains pseudo-sample symmetric matrix processing results and pseudo-sample product vector processing results. The pseudo-sample symmetric matrix processing results and pseudo-sample product vector processing results are respectively the results obtained by processing pseudo-sample symmetric matrices and pseudo-sample product vectors, where each pseudo-sample symmetric matrix and pseudo-sample product vector corresponds to a plurality of pseudo-data samples. The first server uses the ciphertext related to the original symmetric matrix and the pseudo-sample symmetric matrix processing results to obtain the sum of ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix, and uses the ciphertext of the original product vector and the pseudo-sample product vector processing results to obtain the sum of ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector. The first server sends the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of multiple data owners that include the influence of the pseudo-sample product vector to the second server. The second server receives and decrypts the sum of the ciphertexts of the original symmetric matrices of the multiple data owners that are affected by the pseudo-sample symmetric matrix and the sum of the ciphertexts of the original product vectors of the multiple data owners that are affected by the pseudo-sample product vector, respectively, to obtain the sum of the plaintexts of the original symmetric matrices of all data owners that are affected by the pseudo-sample symmetric matrix and the sum of the plaintexts of the original product vectors of all data owners that are affected by the pseudo-sample product vector; The second server calculates the pseudo-sample encrypted linear regression coefficients by using the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix and the sum of the plaintext of the original product vectors of all data owners that include the influence of the pseudo-sample product vector, and sends the pseudo-sample encrypted linear regression coefficients to the first server. Alternatively, the second server performs regularization processing on the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and calculates the pseudo-sample encrypted linear regression coefficients by using the sum of the plaintext of the original product vectors of all data owners that include the influence of the pseudo-sample product vector and the sum of the plaintext of the original symmetric matrices of all data owners after regularization processing, and sends the pseudo-sample encrypted linear regression coefficients to the first server. The first server receives the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector. The server then removes at least part of the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector from the pseudo-sample encrypted linear regression coefficients to obtain the target linear regression coefficients.

2. The linear regression method according to claim 1, characterized in that, Each of the plurality of privately owned data samples contains an original input feature column vector and a corresponding original label; each of the plurality of pseudo-data samples contains a pseudo-input feature column vector and a corresponding pseudo label; the original symmetric matrix of any data owner is equal to the sum of the products of each of the original input feature column vectors of the data owner and its own transpose, and the original product vector of any data owner is equal to the sum of the products of each of the original labels of the data owner and the corresponding original input feature column vectors; the pseudo-sample symmetric matrix is ​​the sum of the pseudo-input feature column vectors contained in the plurality of pseudo-data samples and their own transposes. The product vector of the pseudo-samples is the sum of the products of the pseudo-input feature column vectors contained in the pseudo-data samples and their corresponding pseudo-labels; the ciphertext related to the original symmetric matrix and the ciphertext of the original product vector are obtained by the data owner using an encryption technology that supports addition of ciphertext to encrypt the plaintext related to the original symmetric matrix and the original product vector respectively. The encryption technology that supports addition of ciphertext satisfies the following: the plaintext is respectively encrypted by the encryption technology that supports addition of ciphertext to obtain ciphertext, and the sum of the ciphertext is obtained by arithmetic addition between the ciphertexts. The sum of the ciphertexts, after decryption, corresponds to the arithmetic sum of multiple plaintexts. The first server uses the ciphertext related to the original symmetric matrix and the processing result of the pseudo-sample symmetric matrix to obtain the sum of the ciphertexts of the original symmetric matrices of multiple data owners that include the influence of the pseudo-sample symmetric matrix. Specifically, it uses the encryption technology that supports addition calculation of ciphertext to perform addition calculation of ciphertext, and accumulates the ciphertexts of the original symmetric matrices of multiple data owners and the processing result of the pseudo-sample symmetric matrix. The specific process by which the first server obtains the sum of the original product vector ciphertexts of the multiple data owners, including the influence of the pseudo-sample product vectors, using the ciphertext of the original product vectors and the processing result of the pseudo-sample product vectors, is to utilize the encryption technology that supports addition calculations on ciphertexts to perform addition calculations on ciphertexts, and to accumulate the ciphertexts of the original product vectors of the multiple data owners and the processing result of the pseudo-sample product vectors.

3. The linear regression method according to claim 2, characterized in that, The first server receives pseudo-sample encrypted linear regression coefficients that include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector. It then removes at least part of the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector from these pseudo-sample encrypted linear regression coefficients to obtain the target linear regression coefficients, including: The first server encrypts the pseudo-input matrix composed of several pseudo-input feature column vectors contained in the several pseudo-data samples to obtain pseudo-input matrix ciphertext, and the first server sends the pseudo-input matrix ciphertext to the second server; The second server calculates the inverse matrix of the sum of the plaintext of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, i.e., the first inverse matrix. Based on the encryption method of the pseudo-input matrix by the first server, the second server obtains the product of the pseudo-input matrix ciphertext and the first inverse matrix, and sends the product of the pseudo-input matrix ciphertext and the first inverse matrix to the first server. The first server decrypts the product of the pseudo-input matrix ciphertext and the first inverse matrix based on its own encryption method for the pseudo-input matrix, obtaining the product of the pseudo-input matrix plaintext and the first inverse matrix. The first server then uses the product of the pseudo-input matrix plaintext and the first inverse matrix to at least partially eliminate the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector in the pseudo-sample encrypted linear regression coefficients, which include the influence of the pseudo-sample symmetric matrix and the pseudo-sample product vector, to obtain the target linear regression coefficients.

4. The linear regression method according to claim 2, characterized in that, Each of at least two data owners uses the same encryption technique to encrypt several private data samples related to their own intermediate variables, obtaining ciphertexts related to their respective original symmetric matrices and the original product vectors; the sum of the ciphertexts of the original symmetric matrices of the multiple data owners that include the influence of the pseudo-sample symmetric matrix obtained by the first server is the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of the multiple data owners that include the influence of the pseudo-sample product vector obtained by the first server is the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector.

5. The linear regression method according to claim 1, characterized in that, The at least two data owners each use at least two different encryption techniques to encrypt intermediate variables related to several private data samples, thereby obtaining ciphertext related to their original symmetric matrix and ciphertext of the original product vector. The sum of the original symmetric matrix ciphertexts of multiple data owners that includes the influence of the pseudo-sample symmetric matrix obtained by the first server is the result of adding the influence of the pseudo-sample symmetric matrix to the sum of the ciphertexts of the original symmetric matrices of the multiple data owners that used the same encryption technology. The sum of the original product vector ciphertexts of multiple data owners that includes the influence of the pseudo-sample product vector obtained by the first server is the result of adding the influence of the pseudo-sample product vector to the sum of the ciphertexts of the original product vectors of the multiple data owners that use the same encryption technology. The first server sends the sum of the original symmetric matrix ciphertexts of at least two data owners that contain the influence of pseudo-sample symmetric matrices and the sum of the original product vector ciphertexts of the at least two data owners that contain the influence of pseudo-sample product vectors to the second server. The second server receives at least two ciphertexts of multiple original symmetric matrices of data owners, each associated with a different encryption method and containing the influence of pseudo-sample symmetric matrices, and at least two ciphertexts of multiple original product vectors of data owners, each associated with a different encryption method and containing the influence of pseudo-sample product vectors. It then uses different decryption techniques corresponding to various encryption techniques to decrypt the sum of the ciphertexts of at least two original symmetric matrices of data owners, each associated with a different encryption method, and the sum of the ciphertexts of multiple original product vectors of data owners, each associated with a different encryption method, to obtain the sum of the plaintexts of at least two original symmetric matrices of data owners, each associated with a different encryption method, and the sum of the plaintexts of at least two original product vectors of data owners, each associated with a different encryption method. The second server sums the plaintext of the original symmetric matrices of multiple data owners that are affected by the pseudo-sample symmetric matrices to obtain the sum of the plaintext of the original symmetric matrices of all data owners that are affected by the pseudo-sample symmetric matrices, and sums the plaintext of the original product vectors of multiple data owners that are affected by the pseudo-sample product vectors to obtain the sum of the plaintext of the original product vectors of all data owners that are affected by the pseudo-sample product vectors.

6. The linear regression method according to claim 1, characterized in that, The at least two data owners each use at least two different encryption techniques, including the first encryption technique, to encrypt intermediate variables related to several private data samples, obtaining ciphertexts of their original symmetric matrices and original product vectors. The first server further encrypts the ciphertext of the original symmetric matrices or the corresponding summation result obtained by other encryption techniques using the first encryption technique, and further encrypts the ciphertext of the original product vectors or the corresponding summation result obtained by the other encryption techniques, wherein the other encryption techniques are encryption techniques other than the first encryption technique among the at least two different encryption techniques. The first server then uses the result of the further encryption to obtain the sum of ciphertexts of all data owners' original symmetric matrices containing the influence of the pseudo-sample symmetric matrix, encrypted using the first encryption technique, and the sum of ciphertexts of all data owners' original product vectors containing the influence of the pseudo-sample product vector, encrypted using the first encryption technique. The first server sends the sum of ciphertexts of all data owners' original symmetric matrices containing the influence of the pseudo-sample symmetric matrix, encrypted using the first encryption technique, and the sum of ciphertexts of all data owners' original product vectors containing the influence of the pseudo-sample product vector, encrypted using the first encryption technique, to the second server. The second server receives and decrypts the sum of the original symmetric matrices of all data owners, which are affected by the pseudo-sample symmetric matrix, and the sum of the original product vectors of all data owners, which are affected by the pseudo-sample product vector, using the decryption technology corresponding to the first encryption technology. Then, it further decrypts using the decryption technology corresponding to the other encryption technology to obtain the sum of the plaintext of the original symmetric matrices of all data owners, which are affected by the pseudo-sample symmetric matrix, and the sum of the plaintext of the original product vectors of all data owners, which are affected by the pseudo-sample product vector.

7. The linear regression method according to claim 4, characterized in that, Each of at least two of the data owners encrypts the data using the same encryption technique: an additive homomorphic encryption technique that supports addition of ciphertext and a first key, wherein the first key is the public key used in the additive homomorphic encryption technique; the ciphertext associated with the original symmetric matrix is ​​the ciphertext of the original symmetric matrix; the pseudo-sample symmetric matrix processing result is the ciphertext obtained by homomorphically encrypting the pseudo-sample symmetric matrix or its negative value using the first key; and the pseudo-sample product vector processing result is the pseudo-sample product vector or its negative value homomorphically encrypted using the first key. The obtained ciphertext; the sum of the ciphertexts of the original symmetric matrices of all data owners affected by the pseudo-sample symmetric matrix, is obtained by adding the pseudo-sample symmetric matrix processing result and the ciphertexts of the original symmetric matrices of all data owners using the addition homomorphic encryption technique, and then performing optional regularization processing; the sum of the ciphertexts of the original product vectors of all data owners affected by the pseudo-sample product vector, is obtained by adding the pseudo-sample product vector processing result and the ciphertexts of the original product vectors of all data owners using the addition homomorphic encryption technique. The second server decrypts the sum of the original symmetric matrix ciphertexts of all data owners that are affected by the pseudo-sample symmetric matrix and the sum of the original product vector ciphertexts of all data owners that are affected by the pseudo-sample product vector. This is done using the decryption technique corresponding to the homomorphic encryption technique and a second key, wherein the second key is the private key used in the homomorphic encryption technique.

8. The linear regression method according to claim 4, characterized in that, Each of at least two data owners encrypts the data using the same encryption technique, which involves masking the plaintext. The ciphertext of the original product vector of any data owner is the sum of the original product vector and the masked product vector of that data owner. The ciphertext associated with the original symmetric matrix satisfies the condition that the ciphertext of the original symmetric matrix is ​​calculated using the ciphertext associated with the original symmetric matrix, and the ciphertext of the original symmetric matrix of any data owner is the sum of the original symmetric matrix and the masked symmetric matrix of that data owner. The result of processing the pseudo-sample symmetric matrix is ​​either the pseudo-sample symmetric matrix itself or its negative value. The result of processing the pseudo-sample product vector is either the pseudo-sample product vector itself or its negative value. The sum of the ciphertexts of all original symmetric matrices of the data owners affected by the pseudo-sample symmetric matrix is ​​the result of summing the processing result of the pseudo-sample symmetric matrix and the ciphertexts of all original symmetric matrices of the data owners, followed by optional regularization. The sum of the ciphertexts of all original product vectors of the data owners affected by the pseudo-sample product vector is the result of summing the processing result of the pseudo-sample product vector and the ciphertexts of all original product vectors of the data owners. The second server decrypts the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector. This is achieved by subtracting the sum of the mask symmetric matrices of all data owners from the sum of the ciphertexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and by subtracting the sum of the mask product vectors of all data owners from the sum of the ciphertexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector, to obtain the sum of the plaintexts of the original symmetric matrices of all data owners that include the influence of the pseudo-sample symmetric matrix, and the sum of the plaintexts of the original product vectors of all data owners that include the influence of the pseudo-sample product vector.

9. The linear regression method according to claim 8, characterized in that, The mask symmetric matrix and the mask product vector of any data owner are respectively the symmetric matrix and product vector corresponding to a plurality of mask data samples of the data owner. Each of the plurality of mask data samples of any data owner includes a mask input feature column vector and a corresponding mask label. The mask symmetric matrix of any data owner is the sum of the products of each of the mask input feature column vectors and their transposes in the plurality of mask data samples of the data owner. The mask product vector of any data owner is the sum of the products of each of the mask input feature column vectors and the corresponding mask label in the plurality of mask data samples of the data owner. The ciphertext associated with the original symmetric matrix of any data owner is either the ciphertext of the original symmetric matrix or the product of a concatenated matrix and any orthogonal matrix, wherein the concatenated matrix is ​​composed of each of the original input feature column vectors and each of the masked input feature column vectors of the data owner.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the linear regression method according to any one of claims 1 to 9.

Images