Multi-party data processing method based on homomorphic encryption and computing device

Abstract

A multi-party data processing method based on homomorphic encryption and a computing device, the method being executed by a first party, the method comprising: based on a conversion relationship between a first mode of a first ring space and a second mode of a second ring space, converting first fragmented data into third fragmented data in the second ring space; the second party performs secure multi-party data processing together with the second party based on the third fragmentation data, the fourth fragmentation data, the first error digit and a homomorphic encryption algorithm to obtain fifth fragmentation data in a second ring space, and the secure multi-party data processing comprises a truncation algorithm of the second ring space; based on the conversion relation, converting the fifth fragment data into seventh fragment data of the first ring space; and executing a truncation algorithm of the first ring space together with the second party based on the seventh fragmentation data and the eighth fragmentation data to obtain ninth fragmentation data.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of homomorphic encryption technology, and in particular, relate to a multi-party data processing method and computing device based on homomorphic encryption. Background Art

[0002] Homomorphic encryption can theoretically support arbitrary computations, such as matrix-vector multiplication, activation functions in neural networks, and private information retrieval and intersection. After more than a decade of development, the field of fully homomorphic encryption research has grown tremendously. Currently, the most popular are second-generation fully homomorphic encryption schemes, primarily BGV, BFV, and CKKS, which excel at handling arithmetic operations. Third-generation fully homomorphic encryption schemes, primarily FHEW and TFHE, excel at handling logical operations.

[0003] Privacy-preserving machine learning (PPML) encompasses a set of cryptographic protocols designed to provide solutions for secure multi-party computation (MPC), where two parties collaborate to perform inference on machine learning models while protecting private information. Previous PPML research focused on various neural network models, such as linear models, decision tree models, and convolutional neural networks (CNNs). Recently, research has shifted to more complex Transformer models, such as BERT and GPT.

[0004] Homomorphic encryption, based on the difficulty of the Ring Learning with Errors (RLWE) problem, is a key technology in privacy-preserving machine learning (PPML) and is commonly used to design various secure two-party computation protocols. Two-party computation protocols based on homomorphic encryption (HE) typically have low communication overhead, making them well-suited for low-cost communication. In these scenarios, ciphertext-to-ciphertext multiplication is avoided, allowing for smaller HE parameters. This type of HE that does not involve ciphertext-to-ciphertext multiplication is often called additive homomorphic encryption (AHE).

[0005] In PPML, the power ring modulo 2 is usually used ( The data in the power-of-two ring is called the power-of-two ring. In the power-of-two ring, the data range is 0 to 2. l -1, all operations on data (addition, multiplication, etc.) are performed modulo 2 l In the computer, by using Module 2 l The operation can be achieved by simply truncating the high bits, which makes This is well-suited for efficient implementation in hardware or software. Furthermore, since standard CPU architectures have excellent support for modular arithmetic with powers of two, computations on power-of-two rings are often more efficient than on prime fields. Furthermore, oblivious transfer (OT) protocols are often more efficient when implemented on power-of-two rings.

[0006] However, additively homomorphic encryption (AHE) usually supports homomorphic operations over prime fields, which incurs additional computational cost when processing inputs over the power-of-two ring. Summary of the Invention

[0007] The purpose of the present invention is to provide a multi-party data processing method based on homomorphic encryption to reduce the computational cost when using the homomorphic encryption algorithm in PPML.

[0008] In a first aspect, this specification provides a multi-party data processing method based on homomorphic encryption, wherein the multi-party includes a first party and a second party, wherein the first party possesses first shard data of input data in a first ring space, and the second party possesses second shard data of the input data in the first ring space, wherein the input data is generated based on first private data of the first party and / or second private data of the second party, and the first ring space is a power ring modulo 2. The method is performed by the first party and includes:

[0009] Based on a conversion relationship between a first modulus of the first ring space and a second modulus of the second ring space, converting the first sharded data into third sharded data in the second ring space, where the second ring space is a ring space used for a homomorphic encryption algorithm, the third sharded data having a first number of error bits compared to the first sharded data, the first number of error bits being determined based on the conversion relationship;

[0010] Together with the second party, secure multi-party data processing is performed based on the third shard data, the fourth shard data, the first number of error bits, and a homomorphic encryption algorithm to obtain fifth shard data in the second ring space, and the second party is enabled to obtain sixth shard data in the second ring space, wherein the fourth shard data is obtained by the second party converting the second shard data based on the conversion relationship, the secure multi-party data processing including a truncation algorithm in the second ring space, and the number of truncation bits is determined based on the first number of error bits;

[0011] Based on the conversion relationship, convert the fifth shard data into seventh shard data in the first annular space, wherein the seventh shard data has the first number of error bits compared to the shard of the data processing result in the first annular space;

[0012] Together with the second party, based on the seventh and eighth shard data, a truncation algorithm of the first ring space is executed to obtain ninth shard data as the shard of the data processing result in the first ring space. The number of truncation bits of the first ring space is determined based on the first error bit number. The eighth shard data is obtained by the second party by converting the sixth shard data based on the conversion relationship.

[0013] A second aspect of this specification provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0014] A third aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0015] A fourth aspect of this specification provides a computer program product, comprising a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0016] The embodiment of this specification provides a multi-party data processing method based on homomorphic encryption. Before the multi-party performs homomorphic operations, first, based on 2 l The conversion relationship between the prime modulus p and the prime modulus p is to convert the data to be processed from modulo 2 l The ring of is converted to a ring of modulo p (i.e. a large prime number ring suitable for homomorphic encryption algorithm), and then homomorphic operation is performed in the ring of modulo p. The truncation algorithm under the ring of modulo p can be used to eliminate the error caused by the conversion. After obtaining the operation result, the operation result can be converted to a ring of modulo 2 based on the same conversion relationship. l of the ring, and by modulo 2 l The truncation algorithm in the ring is used to truncate the data to eliminate the error caused by the conversion. This multi-party data processing method greatly reduces the computational overhead caused by the inconsistency between the ring space of the data and the ring space of the homomorphic encryption algorithm when multiple parties perform homomorphic encryption operations, thereby improving the efficiency of multi-party data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 This is a system architecture diagram in the embodiments of this specification;

[0019] Figure 2 This is a flowchart of a multi-party data processing method based on homomorphic encryption in an embodiment of this specification;

[0020] Figure 3 A schematic diagram of the multi-party data processing method according to an embodiment of this specification;

[0021] Figure 4 This is a flowchart of a multi-party data processing method based on homomorphic encryption in another embodiment of this specification. DETAILED DESCRIPTION

[0022] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0023] Homomorphic encryption (HE) allows computations to be performed on ciphertext without decrypting the data. The result of the homomorphic computation, after decryption, corresponds to the original plaintext. This means that even in an encrypted state, data can still be processed and manipulated without revealing the original data.

[0024] The CKKS homomorphic encryption algorithm is an encryption algorithm based on the RLWE difficulty assumption. The homomorphic encryption algorithm consists of the following parts:

[0025] (1) Key generation algorithm (KeyGen), which is used to generate private key sk and public key pk.

[0026] Let the plaintext space be a polynomial space Among them, the degree in the polynomial space is less than N, where N is a power of 2, for example, it can take values 4096, 8192, etc., and the coefficient is an integer in [0,q). The ciphertext space corresponding to the plaintext space is Among them, q is usually a large prime number to construct a secure encryption scheme.

[0027] R can be randomly generated by the key generation algorithm q A polynomial in , as the private key sk, each coefficient of the polynomial is subject to the standard deviation of χ σ Then, the public key pk = (-a*sk+e,a) can be generated, where a is R qA randomly generated polynomial in , e←χ σ .

[0028] (2) Encoding algorithm (Encode), used to convert plaintext vector Convert to polynomial v∈R q .

[0029] (3) Encryption algorithm, used to encrypt the plaintext polynomial v into ciphertext (the ciphertext is in the form of two polynomials) using the public key. Specifically, let pk = (p0, p1), then the ciphertext Here c1=u*p1+e1,c0=u*p0+e0+v,where v is the plaintext polynomial.

[0030] (4) Decryption algorithm: This decryption algorithm is used to decrypt ciphertext into plaintext polynomial. Let ciphertext ct = (c0, c1), then v≈(c0+c1*sk) mod q is the decrypted plaintext polynomial.

[0031] (5) Decoding algorithm (Decode), which is used to convert the plaintext polynomial into a plaintext vector.

[0032] Specifically, the CKKS scheme uses slot encoding to encode plaintext. In this encoding method, the plaintext vector is mapped to the coefficients of a polynomial through canonical embedding, and the polynomial is encrypted using the CKKS encryption algorithm to obtain the RLWE ciphertext. Canonical embedding is a mathematical tool used to map complex vectors to polynomials in a polynomial ring.

[0033] That is, in the CKKS scheme, plaintext vectors do not correspond directly to polynomial coefficients, but rather correspond to certain coefficients of the polynomial through a certain mapping relationship. This mapping method allows CKKS to support efficient SIMD (single instruction multiple data) arithmetic operations, thereby accelerating homomorphic computations. Among them, SIMD arithmetic operations include, for example, homomorphic addition, homomorphic multiplication, homomorphic substitution, and homomorphic rotation.

[0034] For example, in CKKS homomorphic addition, for plaintext polynomial m and plaintext polynomial t, E(m+t)=E(m)+E(t), where plaintext polynomial m and plaintext polynomial t are polynomials in the same polynomial space, and E() represents the ciphertext obtained by homomorphically encrypting the ciphertext polynomial; in homomorphic multiplication, E(t*m)=t*E(m).

[0035] In privacy-preserving machine learning (PPML) applications, all numerical values, including model parameters and data samples, are converted to fixed-point numbers to facilitate the processing of multi-party computation (MPC) protocols. Represented as a triple ((x,n,s)), relative to a ring and a precision parameter (s), satisfying in, In fixed-point arithmetic, overflow can be avoided by truncation. In particular, for two real numbers encoded with precision s, and The fixed-point numbers x and y, their product Encoded with precision 2s, this can be calculated To truncate xy by s bits, the precision is restored to s, that is, For Encoded fixed-point number.

[0036] In addition, in PPML applications, in order to protect privacy data, the input data can be divided into two shards based on the secret sharing algorithm and stored separately by the first and second parties. The first and second parties can perform model inference based on their respective shards, and can interact with data between the two parties through the homomorphic encryption algorithm, thereby obtaining intermediate results and inference results in shard form.

[0037] Figure 1 This is a system architecture diagram in the embodiment of this specification. Figure 1 As shown, the system may include a first party device and a second party device, which are shown as the first party and the second party.

[0038] In the MPC algorithm based on secret sharing, the first party and the second party usually have a shard x1 and x2 of the private data x. l In the ring, x1 and x2 satisfy the following formula (1)

[0039] x1+x2=x mod 2 l (1)

[0040] Among them, data x is, for example, target data fixed-point number, that is The first party has a fixed-point number slice x1, and the second party has a fixed-point number slice x2. The fixed-point number has a precision of s as described above. The first party and the second party want to perform a comparison based on slice x1 and slice x2. Function operation, for example, if you want to get The corresponding fixed-point value slices y1 and y2, that is, Among them, the above data x1, x2, y1 and y2 are all modulo 2 lThe data in the ring space of . Based on the secret sharing algorithm, In the case where only the addition operation of private data is included, there is no need for interaction between the first party and the second party, and they can directly perform the addition operation in module 2. l In the ring space, we just need to perform addition operations on each slice. In the case of a multiplication operation involving private data, the first party and the second party interact based on the homomorphic encryption algorithm to obtain shards y1 and y2. For example, Included In this case, Corresponding to fixed-point numbers

[0041]

[0042] From the above formula, we can see that in order to obtain The first and second parties need to calculate two shards of x1x2 based on the homomorphic encryption algorithm. However, for security reasons, the homomorphic encryption algorithm needs to be calculated in the ring space of modulo p (where p is a large prime number), and x1 and x2 are modulo 2 l In order to solve this problem, the related art has paid a high computational cost.

[0043] To address this issue, the embodiment of this specification first performs a homomorphic operation based on 2 l The conversion relationship between the prime modulus p and the prime modulus p is to convert the data to be processed from modulo 2 l The ring of is converted to a ring of modulo p (i.e. a large prime number ring suitable for homomorphic encryption algorithm), and then homomorphic operation is performed in the ring of modulo p. The truncation algorithm under the ring of modulo p can be used to eliminate the error caused by the conversion. After obtaining the operation result, the operation result can be converted to a ring of modulo 2 based on the same conversion relationship. l of the ring, and by modulo 2 l The truncation algorithm in the loop is used to truncate the data to eliminate the error caused by the conversion.

[0044] Figure 2 This is a flowchart of a multi-party data processing method based on homomorphic encryption in an embodiment of this specification.

[0045] In PPML applications, multiple common model layers are usually included, such as normalization layers, activation layers, matrix multiplication, etc. Taking the Transformer model as an example, matrix multiplication, Softmax, GELU and normalization (LayerNorm) are the four main computing modules. For example, matrix multiplication and Softmax may be included in the attention module, normalization calculation may be included in the normalization layer, and matrix multiplication may be included in the feedforward network. In the MPC scenario, the above four computing modules can be further decomposed into four basic operations including data multiplication: matrix multiplication (MatMul), exponential function (Exp), batch scalar and vector multiplication (BatchVOLE) and batch inner product (BatchInnProd). The four basic operations can be regarded as operation functions g(x) or g(x1,x2,…) on the data, where g(x) may include square operations on x, etc., and g(x1,x2,…) may include multiplication operations such as x1*x2. Thus, it can be achieved through Figure 2 The method process shown is used for processing. Wherein, x1, x2, ... are multiple private data to be processed by the first party and the second party, and the first party and the second party may include the shards of x1, the shards of x2, ... respectively.

[0046] The following description uses g(x) as an example. It can be understood that the operation on g(x1, x2, ...) can be performed similarly to the operation on g(x).

[0047] like Figure 2 As shown, in step S201, the first party Convert to Introduce f bit error. In step S203, the second party Convert to Introducing f-bit error.

[0048] Figure 3 This is a process diagram of the multi-party data processing method in the embodiment of this specification. Figure 3 , In modulo 2 l The first party in the ring has a slice of x, represents the slice of x owned by the first party in the ring modulo p, In modulo 2 l The second party in the ring has a slice of x, represents the slice of x owned by the second party in the ring modulo p.

[0049] In order to modulo 2 l The data in the ring can be converted into the data in the modulo p ring as follows.

[0050] First, the first party can Modulo p, and Convert to The second party may similarly Modulo p, and Convert to

[0051] To determine The relationship between and x can be converted from the above formula (1) to formula (2):

[0052]

[0053] Modifying formula (2) by p yields the following formula (3):

[0054]

[0055] Here, we can assume that p=2 L +c·2 f +1, where L ≥ l, c ∈ {-1, 1}, f ≥ 1 + log N, and N is the parameter N in the polynomial space.

[0056] When L is equal to 1, p=2 l +c·2 f +1, we can get formula (4):

[0057] 2 l =pc·2 f -1 (4)

[0058] Based on formula (4), formula (3) can be converted into the following formula (5):

[0059]

[0060] From formula (5), we can see that There is an error of f bits compared to x. That is, and Compared to the true slices of the modulo p space, each has an error of f bits.

[0061] In the case of L>1, the first party can first Will Convert to Then, the same process as above can be used to Convert to The second party can obtain and will Convert to

[0062] In step S205, the first party and the second party encrypt the and Perform secure multi-party computation g(x) and obtain and

[0063] refer to Figure 3 , obtained on the first party And the second party gets Afterwards, due to and Introducing f bit errors, the first and second parties can perform truncation algorithms to and After removing the f-bit error, g(x) is calculated. Alternatively, in another embodiment, the first party and the second party may first calculate the value of and The addition operation included in g(x) is performed, and then the f-bit error is removed from the result of the addition operation.

[0064] The following describes the truncation algorithm in the ring p space performed jointly by the first party and the second party.

[0065] The prior art does not disclose a truncation algorithm in the modulo p ring space, but only discloses a truncation algorithm in the modulo 2 ring space. l Truncation algorithm in ring space (hereinafter referred to as Algorithm 1), Algorithm 1 is first described below.

[0066] According to Algorithm 1, the first party and the second party are based on and Truncate x by t bits to obtain the fragment x′ of the truncated data and Algorithm 1 specifically includes the following steps:

[0067] Step 41: The first party and the second party obtain the fragments respectively through oblivious transfer (OT protocol) and

[0068] in, ∨ represents the OR operation, MSB represents the highest bit of x, represents the slice of w in the modulo 2 ring obtained by the first party, represents the slice of w in the modulo 2 ring obtained by the second party. That is, in and If the highest bit of any of is 1, the value of w is set to 1, otherwise w is set to 0. It can be understood that w is equivalent to ω in the above formula (2). and When the highest bit of any of the is 1, that is, w=1, it can be considered that and The sum is greater than 2 l , so you need and The number of fragments after truncation is reduced by 2. l A fragment of .

[0069] The first party and the second party can execute the OT protocol in the following steps to obtain a fragment of w respectively:

[0070] The first party first randomly determines in {0,1} The value of exist In the case of exist In the case of

[0071] Then, the first party and the second party call the OT protocol, where the first party inputs (s0, s1) and the second party inputs the selection Thus the second party obtains the output value of the OT protocol as Specifically, in In the case of (s0,s1)=(0,1), if The second party gets s0, that is If if The second party gets s1, that is exist In the case of (s0,s1)=(1,1), then no matter Whether it is 0 or 1, the value obtained by the second party is 1, that is, This process makes w satisfy the above formula That is, only When both are 0, In other cases,

[0072] In step 42, the first party and the second party and Convert to and Due to 2 l Greater than 2, after this conversion, and The values are equal to and

[0073] Step 43, the first party right Perform t-position truncation to obtain The second party is based on right Perform t-position truncation to obtain

[0074] Specifically, the first party can calculate The second party can calculate

[0075] The truncation algorithm in the ring p space (hereinafter referred to as Algorithm 2) can be obtained by modifying the above Algorithm 1. Through Algorithm 2, the first party and the second party are respectively based on and Truncate x by t bits to obtain the fragment x′ of the truncated data and Algorithm 2 specifically includes the following steps:

[0076] Step 51: The first party and the second party obtain the fragments respectively through the oblivious transfer (OT protocol) and

[0077] in, ∨ represents the OR operation, Indicates that in this 1 in the case of , 0 in other cases, represents the slice of w in the modulo 2 ring obtained by the first party, represents the slice of w in the modulo 2 ring obtained by the second party. That is, in and If any of is greater than or equal to p / 2, the value of w is set to 1, otherwise w is set to 0.

[0078] The first party and the second party can refer to the OT agreement mentioned above to obtain and I will not go into details here.

[0079] In step 52, the first party and the second party and Convert to and Since p is greater than 2, after this transformation, and The values are equal to and

[0080] Step 53, the first party right Perform t-position truncation to obtain The second party is based on right Perform t-position truncation to obtain

[0081] Specifically, the first party can calculate The second party can calculate

[0082] Back to Figure 2 In the method flow shown in FIG. 2, in step S205, the above algorithm 2 can be used based on and Perform truncation of at least f bits to remove f bits of noise. Figure 3 After noise removal, the first party and the second party can perform multiplication operations between the data included in g(x) based on the noise-removed shards in the modulo p ring space through a homomorphic encryption algorithm, thereby obtaining the shards of g(x) in the modulo p ring space. and

[0083] In step S207, the first party Convert to Introduce f bit error. In step S209, the second party Convert to Introducing f-bit error.

[0084] First-party calculation Similarly, the second party can calculate

[0085] Formula (6) can be determined similarly to formula (2):

[0086]

[0087] in and For two slices of z in the modulo p ring space, mod 2 l Formula (7) can be obtained:

[0088]

[0089] Based on the formula p=2 l +c·2 f +1 gives:

[0090]

[0091] That is to say, With an error of f bits.

[0092] In step S211, the first party and the second party and Execution 2 l The truncation algorithm of the ring space gives and

[0093] In the case where the precision of the output data (e.g. g(x)) is the same as the precision of the input data (e.g. x) (e.g. both are s), in order to eliminate The error in can be corrected using the above algorithm 1. Truncating at least f bits gives:

[0094]

[0095] and That is, g(x) modulo 2 l Sharding of the ring space.

[0096] In the case where the output data precision (e.g., s′) is different from the input data precision (e.g., s), the above algorithm 1 can be used to Truncates s+fs′ bits so that the precision of the output data is s′.

[0097] In the scenario of g(x1,x2), the first party has and The second party, for example, has and The first party can and Convert to and The second party may and Convert to and Similarly, and There is an error of f bits. Then, the first party and the second party can use the error f and the homomorphic encryption to and Perform secure multi-party computation g(x1,x2) to obtain and Later, you can Figure 2 Steps S207-S211 shown in the figure calculate g(x1,x2) in 2 l Sharding of the ring space.

[0098] Figure 4 This is a flowchart of a multi-party data processing method based on homomorphic encryption in another embodiment of this specification. In this method, the first party and the second party can use Figure 2 The method shown performs the operation of the exponential function.

[0099] In the MPC scenario, due to the exponential function e x is not a polynomial function and is therefore usually difficult to compute directly using the MPC protocol. To this end, the exponential function e x Approximately Where n can be set to a large natural number. If the accuracy requirement is not high, for example, n can be set to 5. Under this approximation, the exponential function is converted to calculate the nth square. is the value actually used to calculate the exponential function. As mentioned above, in order to facilitate the use of the MPC protocol for processing, Represented as a fixed-point number right The exponential function operation (i.e. ) can be equivalent to calculating That is, calculation

[0100]

[0101] like Figure 4 As shown, in step S401, the first party Convert to Introduce f bit error. In step S403, the second party Convert to Introducing f-bit error.

[0102] This step can refer to the description of step S201 above and will not be repeated here.

[0103] In step S405, the first party and the second party and Execute the truncation algorithm to Truncating s+nf′ bits to obtain fragments and Where f′=max{f,s′}, s′ is the calculated The precision of the corresponding fixed-point number can be set to s+nf′≥f.

[0104] In order to Perform exponential function operation, calculate the first and second sides separately and The first party and the second party may determine through negotiation and The first and second parties can then and Each of them is used as a slice to execute the truncation algorithm of the modulo p space (i.e., Algorithm 2 described above) to truncate After the low-order s+nf′ bit, the fragment is obtained and

[0105] You can verify the following steps to obtain the fragments after truncation. and yes The corresponding precision is the fixed-point number slice of f′:

[0106]

[0107] According to formula (9), Perform truncation of s+nf′, that is, Divide by 2 s+n- f′, that is:

[0108]

[0109] From formula (10), we can get that when s+nf′≥f is satisfied, ω·(c·2 f +1)) / 2 s+n-f′ The term can be ignored, so and They are A fragment of The precision of the fixed-point number is f′.

[0110] In step S407, through homomorphic encryption, based on and Perform the n-square algorithm and get and in, and The accuracy is 2f′.

[0111] The embodiments of this specification provide a method for and The calculation result with an accuracy of 2f′ obtained by performing the n-square algorithm is not particularly limited and can be performed using an algorithm known to those skilled in the art.

[0112] In one embodiment, when the first party and the second party perform each of the 1st to n-1th square algorithms, since the square algorithm makes the data precision become 2f', the truncation algorithm of the ring p space (i.e., the above-mentioned algorithm 2) can be performed once to truncate the f' bit error. After the first party and the second party perform the nth square algorithm, they can not perform the truncation algorithm, but can convert the data to modulo 2 in the subsequent steps. l The ring space is then adjusted for accuracy so that the final data accuracy is 2f′.

[0113] First, we describe the square algorithm based on homomorphic encryption. Taking the first square algorithm as an example, the first and second parties need to calculate The square of in

[0114]

[0115] According to the above formula (11), in order to obtain The first and second parties can calculate and The first and second parties also need to obtain and So the first party can As A fragment of As Another fragment of .

[0116] The first party and the second party respectively obtain and The first party can use the public key pair Perform homomorphic encryption and get and will Send to the second party, the second party can calculate And generate a random number r in the modulo p ring space, calculate The calculated ciphertext is sent to the first party. Afterwards, the ciphertext is decrypted using the private key of the homomorphic encryption algorithm, and the decrypted plaintext can be used as At the same time, the second party can use the random number r as

[0117] The first party and the second party obtain After a shard of Thus, the first party and the second party can use the above algorithm 2 to Truncating f′ bits to adjust the precision to f′, so that the first party and the second party respectively obtain A fragment of, for example and The first and second parties may and Similarly, based on and Execute the square algorithm and truncation algorithm to obtain A fragment of, and so on, until the fragment is obtained A fragment of, for example and

[0118] Afterwards, the first and second parties can only and Execute the square algorithm and get A fragment of, for example and Right now, and The accuracy is 2f′.

[0119] In step S409, the first party Convert to Introduce f bit error. In step S411, the second party Convert to Introducing f-bit error.

[0120] Referring to the above formula (6), formula (12) can be obtained similarly:

[0121]

[0122] Mod 2 for formula (12) l Formula (13) can be obtained:

[0123]

[0124] Based on the formula p=2 l +c·2 f +1 gives:

[0125]

[0126] That is to say, With an error of f bits.

[0127] In step S413, the first party and the second party and Execution 2 l The truncation algorithm of the ring space gives and

[0128] To eliminate The error in can be corrected using the above algorithm 1. Truncating the 2f′-s′ bit gives:

[0129]

[0130] Because w·2 l mod 2 l = 0, so formula (15) is actually the following formula (16):

[0131]

[0132] According to formula (16), in the case of 2f′-s′≥f, the latter term ω·(c·2 f +1) is negligible, making Approximately equal to The precision of s′ is a fixed-point number. Since f′=max{f,s′}, 2f′-s′≥f.

[0133] Therefore, the fragments obtained after truncation and That is (Right now ) in 2 l Two slices in the ring space with precision s′.

[0134] The embodiment of this specification also provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the following is achieved: Figure 2 or Figure 4 The method shown.

[0135] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0136] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0137] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0138] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0139] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0140] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0141] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0142] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0143] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0144] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0145] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0146] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0147] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0148] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0149] The foregoing description is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. Those skilled in the art will appreciate that various modifications and variations of one or more embodiments of this specification are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims.

Claims

1. A multi-party data processing method based on homomorphic encryption, wherein the multi-party comprises a first party and a second party, wherein the first party possesses first shard data of input data in a first ring space, and the second party possesses second shard data of the input data in the first ring space, wherein the input data is generated based on first private data of the first party and / or second private data of the second party, and the first ring space is a power ring modulo 2. The method is performed by the first party and comprises: Based on a conversion relationship between a first modulus of the first ring space and a second modulus of the second ring space, converting the first sharded data into third sharded data in the second ring space, where the second ring space is a ring space used for a homomorphic encryption algorithm, the third sharded data having a first number of error bits compared to the first sharded data, the first number of error bits being determined based on the conversion relationship; Together with the second party, secure multi-party data processing is performed based on the third shard data, the fourth shard data, the first number of error bits, and a homomorphic encryption algorithm to obtain fifth shard data in the second ring space, and the second party is enabled to obtain sixth shard data in the second ring space, wherein the fourth shard data is obtained by the second party converting the second shard data based on the conversion relationship, the secure multi-party data processing including a truncation algorithm in the second ring space, and the number of truncation bits is determined based on the first number of error bits; Based on the conversion relationship, convert the fifth shard data into seventh shard data in the first annular space, wherein the seventh shard data has the first number of error bits compared to the shard of the data processing result in the first annular space; Together with the second party, based on the seventh and eighth shard data, a truncation algorithm of the first ring space is executed to obtain ninth shard data as the shard of the data processing result in the first ring space. The number of truncation bits of the first ring space is determined based on the first error bit number. The eighth shard data is obtained by the second party by converting the sixth shard data based on the conversion relationship.

2. The method according to claim 1, wherein the first shard data and the second shard data include fixed-point numbers of first precision, the ninth shard data includes fixed-point numbers of second precision, and the number of truncated bits of the first ring space is determined based on the first error bit, the first precision, and the second precision.

3. The method according to claim 2, wherein the step of performing secure multi-party data processing with the second party based on the third shard data, the fourth shard data, the first number of error bits, and a homomorphic encryption algorithm comprises: converting the third slice data into a tenth slice data based on a first polynomial, wherein the tenth slice data has the first number of error bits compared to the slice data corresponding to the first polynomial, and the first polynomial is used to approximately calculate an exponential function value of the input data; Together with the second party, a truncation algorithm of the second ring space is executed based on the tenth slice of data and the eleventh slice of data to obtain a twelfth slice of data, wherein the number of truncation bits is determined based on the first precision, the first order number n, the first error number of bits, and the second precision, and the number of truncation bits is greater than or equal to the first error number of bits, and n is the degree of squaring the first polynomial when used to calculate the exponential function value; Together with the second party, through the homomorphic encryption algorithm, based on the twelfth shard data and the thirteenth shard data, an n-square algorithm is performed to obtain the fifth shard data, where the fifth shard data corresponds to the n-squared shard of the first polynomial, and the thirteenth shard data is the shard generated by the second party corresponding to the above-mentioned twelfth shard.

4. The method according to claim 3, wherein the step of executing a truncation algorithm of the second ring space based on the tenth and eleventh slices of data to obtain the twelfth slice of data together with the second party comprises: Obtaining a first fragmentation value by executing an oblivious transfer protocol with the second party, where the first fragmentation value is a fragmentation of the first value, and the first value is 1 when either the tenth fragmentation data or the eleventh fragmentation data is greater than half of the second modulus, and otherwise is 0; The twelfth slice data is calculated based on the tenth slice data, the first slice value, the second modulus and the truncated number of bits.

5. The method according to claim 4, wherein the twelfth slice data has a third precision, the third precision is the maximum value of the number of error bits and the second precision, and the truncated number of bits is a value obtained by subtracting the third precision from the sum of the first precision and n.

6. The method according to claim 5, wherein the method, together with the second party, performs an n-squared algorithm based on the twelfth and thirteenth shard data using a homomorphic encryption algorithm to obtain the fifth shard data, comprising: For the i-th squaring algorithm in the first n-1 squaring algorithms, together with the second square, a squaring algorithm is performed based on the two input slices of the squaring algorithm to obtain a fourteenth slice data of a fourth precision, where the fourth precision is twice the third precision; Together with the second party, a truncation algorithm of the second ring space is performed based on the fourteenth shard data and the fifteenth shard data, wherein the number of truncation bits is the third precision, to obtain the sixteenth shard data as the input shard of the next square algorithm, wherein the fifteenth shard data is the shard data generated by the second party and corresponding to the fourteenth shard data.

7. The method according to claim 6, wherein the step of performing the square algorithm based on the two input slices of the square algorithm together with the second party comprises: Calculating a first homomorphic ciphertext of the first input shard, and sending the first homomorphic ciphertext to the second party; receiving a second homomorphic ciphertext from the second party, where the second homomorphic ciphertext is a sharded ciphertext of a third homomorphic ciphertext, and the third homomorphic ciphertext is twice the product of a second input shard of the second party and the first homomorphic ciphertext; The second homomorphic ciphertext is decrypted to obtain a cross-term shard, and the fourteenth shard data is calculated based on the first input shard and the cross-term shard.

8. The method according to claim 6, wherein, together with the second party, a truncation algorithm of the first ring space is executed based on the seventh shard data and the eighth shard data to obtain the ninth shard data, comprising: Obtaining a second fragment value by executing an oblivious transfer protocol with the second party, where the second fragment value is a fragment of the second value, and the second value is 1 when the most significant bit of either the seventh fragment data or the eighth fragment data is 1, and otherwise 0; The ninth shard data is obtained by calculation based on the seventh shard data, the second shard value, the first modulus, and the number of truncated bits of the first ring space. 9 . The method according to claim 8 , wherein the number of digits of the truncation of the first ring space is the difference between the fourth precision and the second precision.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images