Privacy protection neural network reasoning method, system and device based on double servers and medium

Abstract

The invention discloses a privacy protection neural network reasoning method, system and device based on double servers and a medium, for a linear layer, by means of a homomorphic encryption technology, a blinded ciphertext is divided into two shares, the two servers respectively hold the shares for independent calculation, and finally results are combined into a homomorphic encrypted ciphertext; and for the ReLU activation function of the nonlinear layer, completing precision-lossless ReLU function calculation under a secret state condition by using an efficient security comparison protocol, and sending a ciphertext result of the linear layer and a ciphertext result of the ReLU function of the nonlinear layer to a client for decryption, thereby obtaining a reasoning result of a neural network model. According to the method, the confidentiality of the data is ensured through homomorphic encryption, and the calculation accuracy is ensured by virtue of a security comparison function of two parties.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption and privacy computing, and relates to a privacy-preserving neural network reasoning method, system, device and medium based on dual servers. Background Art

[0002] Deep learning technology has achieved tremendous success in fields such as image processing, speech recognition, and natural language processing. With the widespread adoption of cloud computing, vast amounts of data are being uploaded to the cloud for inference based on deep learning models. However, users often worry about privacy leaks when using sensitive data during model inference, thus rejecting the intelligent experience offered by deep learning. Furthermore, a growing number of privacy protection laws and regulations prohibit any company or organization from illegally collecting, distributing, or using user data. For these reasons, personal privacy information must be properly protected when deep learning models are applied to users' private data.

[0003] Combining privacy protection with deep learning has become a hot topic in the field of privacy-preserving computing. Researchers are exploring how to protect the privacy of deep learning models through privacy-preserving computing techniques such as homomorphic encryption, secret sharing, oblivious transfer, and obfuscated circuits. However, these existing methods still face numerous challenges in practical application. For example, homomorphic encryption offers high security but high computational overhead, while secret sharing offers low computational overhead but high communication costs. Therefore, effectively combining multiple privacy-preserving methods and leveraging their respective strengths is an effective approach to developing efficient and practical privacy-preserving deep learning methods. Summary of the Invention

[0004] In response to the problems existing in the prior art, the present invention provides a privacy-preserving neural network inference method, system, device and medium based on dual servers, which ensures the confidentiality of data through homomorphic encryption and the accuracy of calculation with the help of a two-party secure comparison function.

[0005] The present invention is achieved through the following technical solutions:

[0006] A privacy-preserving neural network inference method based on dual servers, including:

[0007] Generate public and private key pairs for the cloud server and client based on the HPRE and BFV algorithms, respectively. The cloud server includes cloud server CS1 and cloud server CS2.

[0008] Based on the client's private key and the public key of cloud server CS2, the client generates a re-encryption key RK and sends it to cloud server CS1;

[0009] The client encrypts the input plaintext x of the neural network model using its own public key, obtains the ciphertext y, and sends it to the cloud server CS1;

[0010] Cloud server CS1 performs ciphertext splitting on ciphertext y and, with the assistance of cloud server CS2, obtains the secret shares of cloud server CS1 and cloud server CS2 respectively.

[0011] Perform linear layer calculation based on the secret share and obtain the ciphertext result of the linear layer through ciphertext synthesis technology;

[0012] By combining point encryption with interval encryption, the ciphertext result of the nonlinear layer ReLU function is obtained through a secure comparison protocol based on the BFV encryption algorithm.

[0013] By calculating the linear layer and nonlinear layer layer by layer, the final ciphertext result is sent to the client for decryption, thereby obtaining the inference result of the neural network model.

[0014] Preferably, based on the HPRE and BFV algorithms, the public and private key pairs of the cloud server and client are generated respectively, specifically:

[0015] Based on the HPRE system parameters in the homomorphic proxy re-encryption technology, the cloud server CS2 and the client call the HPRE.KeyGen algorithm to generate their respective public and private key pairs, which are (PK2, SK2) and (PK C ,SK C ); Based on the homomorphic encryption scheme BFV system parameters, cloud server CS1 calls the BFV.KeyGen algorithm to generate a public-private key pair (PK1, SK1).

[0016] Preferably, a re-encryption key RK is generated based on the client's private key and the public key of the cloud server CS2 and sent to the cloud server CS1, specifically:

[0017] Based on the client's private key and the public key of cloud server CS2, the client calls the HPRE.ReKeyGen algorithm to generate the re-encryption key PK from the client to the cloud server CS2, and sends it to the cloud server CS1.

[0018] Preferably, the client encrypts the input plaintext x of the neural network model with the public key to obtain the ciphertext y and sends it to the cloud server CS1, specifically:

[0019] The client uses the homomorphic proxy re-encryption HPRE scheme to encrypt the message plaintext of the neural network model That is HPRE.Enc(PK C ,x)→y, and obtain the ciphertext y. The client sends the ciphertext y to CS1, where p is an integer, [0,1,…,p-1] is the message space, and s represents the length of the input data feature.

[0020] Preferably, the cloud server CS1 performs ciphertext segmentation processing on the ciphertext y, and obtains the secret shares of the cloud server CS1 and the cloud server CS2 respectively with the assistance of the cloud server CS2, specifically:

[0021] Cloud Server CS1 Random Selection Vector Call the HPRE.EvalSub algorithm to blind the original ciphertext y and obtain the blinded ciphertext Finally, the HPRE.ReEnc algorithm is called to blind the ciphertext corresponding to the client's public key Convert to the ciphertext corresponding to the cloud server CS2 public key, that is, re-encrypt the blinded ciphertext send Decrypt the cloud server CS2, that is Cloud server CS2 obtains the second share b and uses vector a as the first share of cloud server CS1;

[0022] The first share a and the second share b satisfy a+b≡x mod p; p is an integer, and mod p represents the message space [0, 1, …, p-1].

[0023] Preferably, a linear layer calculation is performed based on the secret share, and a ciphertext result of the linear layer is obtained by a ciphertext synthesis technique, specifically:

[0024] The first share a and the second share b are used as the neural network model data input, and the corresponding linear layer is calculated using the trained neural network model parameters to output the linear ciphertext of cloud server CS1 and cloud server CS2 respectively. and linear ciphertext Where: W is the weight matrix, β is the bias vector;

[0025] Through ciphertext synthesis technology, cloud server CS2 uses the client's public key to encrypt the linear ciphertext Get encrypted linear ciphertext Right now It is sent to the cloud server CS1, which calculates the complete linear layer ciphertext g, i.e.

[0026] Preferably, an encoding method combining point encryption and interval encryption is adopted, and the ciphertext result of the nonlinear layer ReLU function is realized through a secure comparison protocol based on the BFV encryption algorithm, specifically:

[0027] By using the ciphertext splitting method, the linear layer ciphertext g is split into the third share c owned by the cloud server CS1 and the fourth share d owned by the cloud server CS2;

[0028] Based on the cloud server CS1's calculation of each component c of the third share ci Perform power decomposition with base 2 to obtain the binary matrix V, and then use the homomorphic encryption algorithm to encrypt each row of the matrix V, that is, BFV.Enc(PK1,V[i])→u i Finally, all the ciphertexts of the rows are combined into a ciphertext group U = (u1, u2, ..., u l ) and sent to the cloud server CS2; where l = log2p, p is an integer, [0, 1, ..., p-1] represents the message space mod p represents the message space [0, 1, ..., p-1];

[0029] Based on the calculation of each component d of the fourth share d by the cloud server CS2 i By randomly selecting the threshold η i ∈{0,1} for comparison and divide the interval R i And the interval R is encrypted by the interval encryption algorithm i Encrypt, and then get each component d i The corresponding encryption result is combined into a matrix Z = [z1 T ,z2 T ,…,z m T ];

[0030] Where: If η i =0, then the interval R i is set to [1,-d i mod p]; if η i =1, then the interval R i is set to [-d i mod p, 2 l ];

[0031] The point-encrypted ciphertext group U and the interval-encrypted ciphertext matrix Z are ciphertext synthesized to obtain the synthesized ciphertext t. The synthesized ciphertext t is sent to the cloud server CS1 through the cloud server CS2 for decryption. The symbol information s is then extracted through the decryption cloud server CS2 to generate the ciphertext h encrypted by the ReLU function on the client Client public key, that is, h = HPRE.EvalMul(g,s).

[0032] A privacy-preserving neural network inference system based on dual servers, including:

[0033] A public-private key pair acquisition module is used to generate public-private key pairs for the cloud server and client based on the HPRE and BFV algorithms, respectively. The cloud servers include cloud server CS1 and cloud server CS2.

[0034] The re-encryption key acquisition module is used to generate the re-encryption key RK based on the client's private key and the public key of the cloud server CS2 and send it to the cloud server CS1;

[0035] The ciphertext y acquisition module is used by the client to encrypt the input plaintext x of the neural network model using the public key, obtain the ciphertext y, and send it to the cloud server CS1;

[0036] The secret share acquisition module is used by cloud server CS1 to perform ciphertext segmentation processing on the ciphertext y, and obtain the secret shares of cloud server CS1 and cloud server CS2 respectively with the assistance of cloud server CS2;

[0037] The linear layer ciphertext calculation module is used to perform linear layer calculations based on the secret share and obtain the ciphertext results of the linear layer through ciphertext synthesis technology;

[0038] The ReLU function's ciphertext calculation module uses a combination of point encryption and interval encryption to obtain the ciphertext result of the nonlinear layer ReLU function through a secure comparison protocol.

[0039] The neural network model inference result is used to calculate layer by layer through linear and nonlinear layers, and send the final ciphertext result to the client for decryption, thereby obtaining the neural network model inference result.

[0040] A computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of a dual-server-based privacy-preserving neural network inference method are implemented.

[0041] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the dual-server-based privacy-preserving neural network inference method.

[0042] Compared with the prior art, the present invention has the following beneficial technical effects:

[0043] This invention proposes a privacy-preserving neural network inference method, system, device, and medium based on dual servers. Neural networks generally consist of two major categories: linear layers and nonlinear layers. This patent can process linear layers including fully connected layers and convolutional layers, and nonlinear layers including Reluctant Unified Unit (ReLU) activation functions. For the linear layer, using homomorphic encryption technology, the blinded ciphertext is split into two shares. Two servers each hold a share and independently perform calculations, ultimately merging the results into a homomorphically encrypted ciphertext. For the ReLU activation function in the nonlinear layer, an efficient secure comparison protocol is utilized to perform ReLU function calculations without loss of accuracy under encrypted conditions. Due to the use of homomorphic proxy re-encryption, data remains encrypted throughout the calculation process, protecting data privacy. The secure comparison protocol ultimately yields an accurate ReLU function without the use of any approximation algorithms, ensuring model accuracy. Data communicated between the two servers is protected by homomorphic encryption, eliminating the need to generate multiplication triples, enabling efficient communication. This invention ensures data confidentiality through homomorphic encryption and computational accuracy through a two-party secure comparison function. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flowchart of the steps of a privacy-preserving neural network reasoning method based on dual servers of the present invention.

[0045] Figure 2 It is a schematic diagram of the system model structure of the present invention. DETAILED DESCRIPTION

[0046] The present invention will be further described in detail below with reference to specific embodiments, which are intended to explain the present invention rather than to limit it.

[0047] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0048] See also Figure 1 The present invention provides a privacy-preserving neural network reasoning method based on dual servers, comprising the following steps:

[0049] Step 1: If Figure 2 As shown, a neural network system model is constructed that includes two types of entities: two cloud servers CS1 and CS2 and a client. The following are the detailed steps and logic of the algorithm:

[0050] Step 2: System initialization phase

[0051] The entire system includes two scoring algorithms:

[0052] 1. Homomorphic Proxy Re-encryption (HPRE) scheme, specifically including algorithms (HPRE.KeyGen, HPRE.ReKeyGen, HPRE.Enc, HPRE.ReEnc, HPRE.Eval, and HPRE.Dec). HPRE.Eval includes many sub-algorithms, such as HPRE.EvalMul, HPRE.EvalAdd, and HPRE.EvalSub, which respectively represent multiplication, addition, and subtraction operations on the ciphertext domain. During key generation, public parameters are selected based on actual security parameters. Each entity then calls HPRE.KeyGen to generate public and private keys. During re-encryption key generation and distribution, the client uses its private key and CS2's public key to call HPRE.ReKeyGen to generate the proxy key RK. CS1 holds the re-encryption key RK. The implementation details of the algorithm are not restricted; any scheme that meets the above requirements is acceptable.

[0053] 2. The homomorphic proxy re-encryption scheme uses the Brakerski-Fan-Vercauteren (BFV) scheme, which is based on the error learning problem over a ring. It encrypts plaintext information and converts it into ciphertext, ensuring that only authorized parties with the decryption key can restore the original information. The BFV scheme specifically includes four algorithms: BFV.KeyGen, BFV.Enc, BFV.Eval, and BFV.Dec.

[0054] This step includes the following key generation algorithm:

[0055] (1) Key generation: Based on the homomorphic proxy re-encryption of HPRE system parameters, the cloud server CS2 and the client Client call HPRE.KeyGen to generate their respective public and private key pairs, namely (PK2, SK2) and (PK C ,SK C Based on the BFV system parameters, cloud server CS1 calls BFV.KeyGen to generate a public-private key pair (PK1, SK1).

[0056] (2) Re-encryption key generation and distribution: Based on the above parameters, the client calls HPRE.ReKeyGen to generate the re-encryption key RK from the client to CS2 and sends it to CS1. The subsequent related neural network model will be completed through interactive calculations between CS1 and CS2.

[0057] Step 3: Encryption Phase

[0058] (1) Encryption: Assume that the model input held by the client is Where p is an integer, [0,1,…,p-1] is the message space, and s represents the length of the input data feature. The client uses the homomorphic proxy to re-encrypt the HPRE encrypted message That is HPRE.Enc(PK C ,x)→y, and obtain the ciphertext y. The client sends the ciphertext y to CS1.

[0059] Step 4: Ciphertext Segmentation

[0060] (1) Blinding of ciphertext: CS1 randomly selects a vector calculate The proxy re-encryption key RK will be used to blind the ciphertext Re-encryption, that is

[0061] (2) Ciphertext sending: CS1 will re-encrypt the blinded ciphertext Send to CS2;

[0062] (3) Decrypt the ciphertext to obtain the second share b: CS2 decryption yields

[0063] After the above-mentioned ciphertext segmentation process, CS1 and CS2 respectively have the first share a and the second share b, and satisfy a+b≡x mod p as the neural network model data input.

[0064] Step 5: Linear Operation

[0065] Here we mainly consider the fully connected layer. In the case of plain text, for an input feature vector x=(x1,x2,...x s ), after the fully connected layer transformation of the weight matrix W (dimension is m×s) and the bias vector β (dimension is m), the output is r = Wx + β, where r is a vector of dimension m. Under the encrypted state, by calling the ciphertext segmentation process, CS1 and CS2 have a and b respectively, and satisfy a + b ≡ x mod p. The fully connected layer calculation process is as follows:

[0066] (1) Share calculation: CS1 and CS2 use a and b as model data input respectively, and use the trained model parameters to calculate the corresponding linear layer. Taking the fully connected layer as an example, the outputs of CS1 and CS2 are and

[0067] (2) Ciphertext synthesis: CS2 uses the client's public key to encrypt Right now and will Send to CS1, CS1 calculates Get the ciphertext g after the linear layer calculation.

[0068] Finally, CS1 holds g, which is the ciphertext form of r=Wx+β.

[0069] Step 6: Non-linear layer

[0070] The ReLU function is the main consideration here. In the plaintext case, the ReLU function (Rectified Linear Unit) is one of the most commonly used activation functions, with the formula ReLU(r) = max(0,r). Its advantages are simple calculation and no vanishing gradient problem. Under the encrypted state, the linear layer ciphertext g is split into the third share c owned by cloud server CS1 and the fourth share d owned by cloud server CS2 through the ciphertext segmentation processing method, and the third share c and the fourth share d are represented in vector form.

[0071] The ReLU calculation process is as follows:

[0072] (1) Point encryption: The third share c can be expressed in the form of component quantity Cloud server CS1 calculates the integer components c one by one i (1≤i≤m) is processed, the specific method is: Cloud Server CS1 for Component C i Perform point encryption, that is, execute pointEnc(c i )→{(j,λ j )|j∈[1,l]}, where λ j (j∈[1,l]) is c i According to the integer decomposition with base 2, that is, satisfying λ1×2 0 +λ2×2 1 +...+λ l ×2 l-1 =c i , let v i =(λ1,λ2,...,λ l ). All c iThe decomposition result combination of (1≤i≤m) is V=[v1 T ,v2 T ,…,v m T ]. After that, use the homomorphic encryption algorithm to encrypt each row V[i](1≤i≤l) of V, that is, BFV.Enc(PK1,V[i])→u i All u i (1≤i≤l) into a ciphertext group U=(u1,u2,…,u l ).

[0073] (2) Ciphertext sending: Cloud server CS1 sends all U to cloud server CS2.

[0074] (3) Interval encryption: The cloud server CS2 expresses the fourth share d in the form of component d=(d1, d2, ..., d m ), for each component d i (1≤i≤m) is processed, where d i is the i-th component of vector d, i = 1, 2, ..., m, the specific method is: randomly select an integer η i ∈{0,1}, if η i =0, then R i is set to [1,-d i mod p]; if η i =1, then R i is set to [-d i mod p,2 l ]. Use interval encryption algorithm to encrypt R i Encryption, i.e. rangeEnc(R i )={(j,θ j )|j∈W R}, construct vector z i =(σ1,σ2,...,σ l ), where when j∈W R , then σ j =θ j , otherwise σ j = 0. Set all d i The decomposition results of (1≤i≤m) are combined into a matrix Z=[z1 T ,z2 T ,…,z m T ].

[0075] (4) Ciphertext synthesis: Cloud server CS2 initializes a ciphertext For 1≤k≤l, the loop executes: ① Where Z[k] is the kth row of matrix Z; ② Calculate

[0076] (5) Ciphertext sending: CS2 sends t to CS1.

[0077] (6) Ciphertext decryption and symbol transmission: CS1 performs decryption, i.e., BFV.Dec(t,SK1)→ψ, and sends the decrypted ciphertext ψ to CS2;

[0078] (7)Symbol s synthesis: CS2 calculation in Expressed as exclusive OR.

[0079] (8) Obtain the ReLU result: CS2 calculates h = HPRE.EvalMul(g,s). h is the ciphertext of ReLU(r) encrypted with the client's public key.

[0080] (9) Ciphertext sending: CS2 sends the ciphertext h to CS1.

[0081] Step 7: Return the calculation results.

[0082] Depending on the neural network, steps 5 and 6 can be performed multiple times between CS1 and CS2.

[0083] CS1 sends the calculated ciphertext h to the Client, which decrypts it using the private key to obtain the result of the neural network inference. The entire model inference calculation process is performed on the ciphertext rather than the plaintext.

[0084] Specifically, the following is a further explanation in conjunction with the implementation steps:

[0085] In step 1, there are two types of entities, whose functions are:

[0086] ① Client: The client has data and is eager to perform model inference through deep neural networks, but is worried about its privacy being leaked in the process.

[0087] ② Cloud server CS: The cloud server has rich computing power and consists of two independent entities CS1 and CS2, which are not allowed to collude.

[0088] In step 2, the currently mainstream homomorphic proxy re-encryption scheme HPRE (Homomorphic Proxy Re-encryption) is used. Specifically, it includes algorithms such as (KeyGen, ReKeyGen, Enc, ReEnc, Eval, Dec). Eval includes many sub-algorithms, such as EvalMul, EvalAdd, and EvalSub, which respectively represent multiplication, addition, and subtraction operations on the ciphertext domain. During key generation, public parameters are selected based on actual security parameters. Each entity then calls KeyGen to generate public and private keys. During the re-encryption key generation and distribution process, the client uses its private key and CS2's public key to call ReKeyGen to generate the proxy key RK. CS1 holds RK.

[0089] In step 3, Client calls Enc(PK C , x)→y, and finally sends y to CS1. The subsequent neural network inference will be calculated interactively between CS1 and CS2.

[0090] In step 4, the ciphertext splitting will be done through an interaction to convert the original homomorphically encrypted ciphertext into shares held by CS1 and CS2 respectively. Specifically, CS1 randomly selects a vector Call the estimation sub-algorithm HPRE.EvalSub to blind the original ciphertext y and get Finally, call HPRE.ReEnc to get the ciphertext corresponding to the original Client public key Convert to the ciphertext corresponding to the CS2 public key, that is After that, CS1 will Sent to CS2, because the ciphertext It is already the ciphertext corresponding to the CS2 public key, so CS2 calls HPRE.Dec( SK2) decrypts the plaintext b. Through the above interactive calculation, CS1 holds CS2 holds And it satisfies x≡(a+b)mod p.

[0091] In step 5, the linear layer is mainly calculated. Since x≡(a+b)mod p, then for the fully connected layer,

[0092]

[0093] Therefore, the final ciphertext is numerically correct and is encrypted using the client's public key.

[0094] In step 6, the ReLU activation function needs to be calculated. The key is to determine whether (c+d)≥0 is true through secure comparison. This problem can be converted to c≥-d mod q. Therefore, a two-party secure comparison protocol is required here, that is, a secure protocol in which two parties compare the size of two values without leaking their respective data. In this step, a tree-based two-party secure comparison protocol is used. The basic method is that CS1 and CS2 each hold an integer and At the end of the protocol, CS1 holds ψ∈{0,1}, while CS2 holds the value η∈{0,1}. If β≤α then otherwise, The following only considers the case of comparing two integers.

[0095] The specific process is as follows: First, CS1 defines a complete binary tree. The leaf node number range is [1, k], where k is a power of 2. for The set of all nodes in . For any node Its level is defined as the distance from the node to the nearest leaf node. In particular, the level of any leaf node is assigned to 0, and the level of the root node is log2k. Each node is labeled as a pair (i, j), where i represents its level and j represents its index in the level from left to right (starting from 1). For a node Use parent(w) to represent its parent node. If z is on the path from the root node to w (including w itself), then z is called the ancestor node of w; conversely, if y is on the path from w away from the root node (including w itself), then y is called the descendant node of w. The three ranges are defined as follows: For any range If the node If all descendant leaf nodes of are included in R, then w is called a covering node of R and is recorded as w∈cover(R).

[0096] Define two encoding functions

[0097] 1. Range Enc(R): for

[0098]

[0099] This function returns the set of all nodes w that meet the condition: w is a covered node of R and its parent node parent(w) is not a covered node of R.

[0100] The interval function is usually denoted as rangeEnc(R)={(i,a i )|i∈W R}.

[0101] 2. Point encoding pointEnc(x): for x∈[1,k],

[0102] This function returns the set of all x's ancestor nodes w, that is, All nodes on the path from the root node to x. The electrical encoding is usually denoted as poointEnc(x)={(i,b i )|i∈[1,log k]}.

[0103] In step 5, steps (1) and (3) are point coding and interval coding respectively. In step (4), the cumulative product operation is used to determine whether there are identical elements in the two coding results, and then the corresponding size is determined.

[0104] Right now

[0105] In step 6 (6) and (7), since the partial result ψ of the final comparison is held by CS1, CS1 sends ψ to CS2, and CS2 combines its own partial result η to finally calculate If s i =0, indicating ciphertext g i The corresponding plaintext r i Is a positive number; otherwise, it means the ciphertext g i The corresponding plaintext r i Finally, by calculating h = HPRE.EvalMul (g, s), we can get the encrypted result of ReLU (r).

[0106] In step 7, the neural network contains several linear layers and several nonlinear layers. After calculation layer by layer, the final result is sent to the client for decryption, and the model inference result calculated using the privacy protection method can be obtained.

[0107] Advantages of the present invention:

[0108] (1) Homomorphic encryption: Due to the use of homomorphic proxy re-encryption, the data remains encrypted throughout the entire calculation process, protecting data privacy.

[0109] (2) Accurate calculation: Through a secure comparison protocol, the accurate ReLU function is finally obtained without using any approximate algorithm, ensuring the accuracy of the model.

[0110] (3) Low communication overhead: The communication data between the two servers is protected by homomorphic encryption, and there is no need to generate multiplication triples, which enables efficient communication.

[0111] A privacy-preserving neural network inference system based on dual servers, including:

[0112] A public-private key pair acquisition module is used to generate public-private key pairs for the cloud server and client based on the homomorphic proxy re-encryption (HPRE) and homomorphic encryption (BFV) schemes, respectively. The cloud servers include cloud server CS1 and cloud server CS2.

[0113] The re-encryption key acquisition module is used to generate the re-encryption key RK based on the client's private key and the public key of the cloud server CS2 and send it to the cloud server CS1;

[0114] The ciphertext y acquisition module is used by the client to encrypt the input plaintext x of the neural network model using the public key, obtain the ciphertext y, and send it to the cloud server CS1;

[0115] The secret share acquisition module is used by cloud server CS1 to perform ciphertext segmentation processing on the ciphertext y, and obtain the secret shares of cloud server CS1 and cloud server CS2 respectively with the assistance of cloud server CS2;

[0116] The linear layer ciphertext calculation module is used to perform linear layer calculations based on the secret share and obtain the ciphertext results of the linear layer through ciphertext synthesis technology;

[0117] The ReLU function's ciphertext calculation module is used to obtain the ciphertext result of the nonlinear layer ReLU function through a secure comparison protocol using a combination of point encryption and interval encryption.

[0118] The neural network model inference result is used to send the ciphertext result of the linear layer and the ciphertext result of the nonlinear layer ReLU function to the client for decryption, thereby obtaining the neural network model inference result.

[0119] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding function; the processor described in the embodiment of the present invention can be a privacy-preserving neural network reasoning method based on dual servers.

[0120] In another embodiment of the present invention, the present invention further provides a storage medium, specifically a computer-readable storage medium (Memory). The computer-readable storage medium is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium herein may include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides storage space, which stores the terminal's operating system. In addition, the storage space also stores one or more instructions suitable for being loaded and executed by the processor. These instructions may be one or more computer programs (including program code). It should be noted that the computer-readable storage medium herein may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage device. The processor may load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of a dual-server-based privacy-preserving neural network inference method in the above embodiment.

[0121] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0122] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

[0126] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or are inherent to these processes, methods, products or apparatuses.

[0127] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0128] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0129] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any ordinary technician in this industry can smoothly implement the present invention as shown in the drawings and described above. However, any equivalent changes, modifications and evolutions made by technicians familiar with this profession without departing from the scope of the technical solution of the present invention using the technical content disclosed above are all equivalent embodiments of the present invention. At the same time, any equivalent changes, modifications and evolutions made to the above embodiments based on the essential technology of the present invention are still within the scope of protection of the technical solution of the present invention.

Claims

1. A privacy-preserving neural network inference method based on dual servers, characterized in that: include, Generate public and private key pairs for the cloud server and client based on the HPRE and BFV algorithms, respectively. The cloud server includes cloud server CS1 and cloud server CS2. Based on the client's private key and the cloud server CS2's public key, the client generates a re-encryption key PK and sends it to the cloud server CS1. The client encrypts the input plaintext x of the neural network model using its own public key, obtains the ciphertext y, and sends it to the cloud server CS1; Cloud server CS1 performs ciphertext splitting on ciphertext y and, with the assistance of cloud server CS2, obtains the secret shares of cloud server CS1 and cloud server CS2 respectively. Perform linear layer calculation based on the secret share and obtain the ciphertext result of the linear layer through ciphertext synthesis technology; By combining point encryption with interval encryption, the ciphertext result of the nonlinear layer ReLU function is obtained through a secure comparison protocol based on the BFV encryption algorithm. By calculating the linear layer and nonlinear layer layer by layer, the final ciphertext result is sent to the client for decryption, thereby obtaining the inference result of the neural network model.

2. A privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: Based on the HPRE and BFV algorithms, the public and private key pairs of the cloud server and client are generated respectively. Specifically: Based on the HPRE system parameters in the homomorphic proxy re-encryption technology, the cloud server CS2 and the client call the HPRE.KeyGen algorithm to generate their respective public and private key pairs, which are (PK2, SK2) and (PK C ,SK C ); Based on the homomorphic encryption scheme BFV system parameters, cloud server CS1 calls the BFV.KeyGen algorithm to generate a public-private key pair (PK1, SK1).

3. The privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: Based on the client's private key and the public key of the cloud server CS2, the re-encryption key RK is generated and sent to the cloud server CS1. Specifically: Based on the client's private key and the public key of cloud server CS2, the client calls the HPRE.ReKeyGen algorithm to generate the re-encryption key RK from the client to the cloud server CS2, and sends it to the cloud server CS1.

4. The privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: The client encrypts the input plaintext x of the neural network model using the public key, obtains the ciphertext y, and sends it to the cloud server CS1. Specifically: The client uses the homomorphic proxy re-encryption HPRE scheme to encrypt the message plaintext of the neural network model That is HPRE.Enc(PK c ,x)→y, and obtain the ciphertext y. The client sends the ciphertext y to CS1, where p is an integer, [0,1,…,p-1] is the message space, and s represents the length of the input data feature.

5. The privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: Cloud server CS1 performs ciphertext splitting on ciphertext y and, with the assistance of cloud server CS2, obtains the secret shares of cloud server CS1 and cloud server CS2, specifically: Cloud Server CS1 Random Selection Vector Call the HPRE.EvalSub algorithm to blind the original ciphertext y and obtain the blinded ciphertext Finally, the HPRE.ReEnc algorithm is called to blind the ciphertext corresponding to the client's public key Convert to the ciphertext corresponding to the cloud server CS2 public key, that is, re-encrypt the blinded ciphertext send Decrypt the cloud server CS2, that is Cloud server CS2 obtains the second share b and uses vector a as the first share a of cloud server CS1; The first share a and the second share b satisfy a+b≡x mod p; p is an integer, and mod p represents the message space [0, 1, …, p-1].

6. The privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: The linear layer calculation is performed based on the secret share, and the ciphertext result of the linear layer is obtained through the ciphertext synthesis technology, specifically: The first share a and the second share b are used as the neural network model data input, and the corresponding linear layer is calculated using the trained neural network model parameters to output the linear ciphertext of cloud server CS1 and cloud server CS2 respectively. and linear ciphertext Where: W is the weight matrix, β is the bias vector; Through ciphertext synthesis technology, cloud server CS2 uses the client's public key to encrypt the linear ciphertext Get encrypted linear ciphertext Right now It is sent to the cloud server CS1, which calculates the complete linear layer ciphertext g, i.e.

7. The privacy-preserving neural network inference method based on dual servers according to claim 1, characterized in that: The encoding method combining point encryption and interval encryption is adopted. Based on the BFV encryption algorithm, the ciphertext result of the nonlinear layer ReLU function is realized through a secure comparison protocol. Specifically: By using the ciphertext splitting method, the linear layer ciphertext g is split into the third share c owned by the cloud server CS1 and the fourth share d owned by the cloud server CS2; Based on the cloud server CS1's calculation of each component c of the third share c i Perform power decomposition with base 2 to obtain the binary matrix V, and then use the homomorphic encryption algorithm to encrypt each row of the matrix V, that is, BFV.Enc(PK1,V[i])→U i Finally, all the ciphertexts of the rows are combined into a ciphertext group U = (u1, u2, ..., u l ) and sent to the cloud server CS2; where l = log2p, p is an integer, and mod p represents the message space [0, 1, ..., p-1]; Based on the calculation of each component d of the fourth share d by the cloud server CS2 i By randomly selecting the threshold η i ∈{0,1} for comparison and divide the interval R i And the interval R is encrypted by the interval encryption algorithm i Encrypt, and then get each component d i The corresponding encryption result is combined into a matrix Z = [z1 T ,z2 T ,…,z m T ]; Where: If η i =0, then the interval R i is set to [1,-d i mod p]; if η i =1, then the interval R i is set to [-d i mod p, 2 l ]; The point-encrypted ciphertext group U and the interval-encrypted ciphertext matrix Z are ciphertext synthesized to obtain the synthesized ciphertext t. The synthesized ciphertext t is sent to the cloud server CS1 through the cloud server CS2 for decryption. The symbol information s is then extracted through the decryption cloud server CS2 to generate the ciphertext h encrypted by the ReLU function on the client Client public key, that is, h = HPRE.EvalMul(g,s).

8. A privacy-preserving neural network inference system based on dual servers, characterized in that: include, A public-private key pair acquisition module is used to generate public-private key pairs for the cloud server and client based on the HPRE and BFV algorithms, respectively. The cloud servers include cloud server CS1 and cloud server CS2. The re-encryption key acquisition module is used to generate the re-encryption key RK based on the client's private key and the public key of the cloud server CS2 and send it to the cloud server CS1; The ciphertext y acquisition module is used by the client to encrypt the input plaintext x of the neural network model using the public key, obtain the ciphertext y, and send it to the cloud server CS1; The secret share acquisition module is used by cloud server CS1 to perform ciphertext segmentation processing on the ciphertext y, and obtain the secret shares of cloud server CS1 and cloud server CS2 respectively with the assistance of cloud server CS2; The linear layer ciphertext calculation module is used to perform linear layer calculations based on the secret share and obtain the ciphertext results of the linear layer through ciphertext synthesis technology; The ReLU function's ciphertext calculation module uses a combination of point encryption and interval encryption to obtain the ciphertext result of the nonlinear layer ReLU function through a secure comparison protocol. The neural network model inference result is used to calculate layer by layer through linear and nonlinear layers, and send the final ciphertext result to the client for decryption, thereby obtaining the neural network model inference result.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the processor implements the steps of a privacy-preserving neural network reasoning method based on a dual server as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of a privacy-preserving neural network reasoning method based on a dual server are implemented.

Images