Universal architecture and system for protecting privacy computing
By introducing a masking mechanism for the secret computation server and the participating server in privacy computation, the problem of insufficient privacy protection in existing privacy computation schemes is solved, and more efficient and secure privacy computation is achieved, which is suitable for accelerating SMPC and FL.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-10
- Publication Date
- 2026-03-10
AI Technical Summary
Existing privacy-preserving computation schemes are inadequate in terms of privacy protection, especially due to the high computation and communication costs of secure multi-party computation (SMPC), the information leakage risks of federated learning (FL), and the trust hardware risks of trusted execution environments (TEEs). Effective solutions are lacking.
A general architecture and system for protecting privacy computing is adopted. By using a secret computing server and participating server, the plaintext data is masked by generating a mask through the same random number generator and communicating in different secure channels to ensure data privacy.
It improves the security and efficiency of privacy-preserving computation, reduces the risk of data leakage, and lowers computation and communication costs. It is suitable for accelerating privacy-preserving computation in machine learning in SMPC and FL, especially in scenarios such as activation functions, horizontal federated learning, and vertical federated linear regression learning.
Smart Images
Figure CN121644061A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security and privacy technology, and in particular to a general architecture and system for protecting privacy computing. Background Technology
[0002] With the rapid development of AI, data is playing an increasingly prominent role as a new factor of production. At the same time, various laws and regulations concerning data security and privacy protection have been introduced both domestically and internationally. How to use data securely, privately, and compliantly is a problem that needs to be addressed. Privacy-preserving computing offers a technological solution.
[0003] Currently, commonly used privacy computing schemes include privacy computing based on secure multiparty computation (SMPC), privacy computing based on federated learning (FL), and privacy computing based on trusted execution environment (TEE).
[0004] While SMPC-based solutions are secure, their high computational and communication costs hinder their widespread adoption. FL-based privacy computing is relatively fast, but often carries the risk of information leakage. TEE-based privacy computing offers advantages such as high processing speed and comprehensive processing capabilities, but it requires trust in the hardware vendor and is vulnerable to side-channel attacks.
[0005] To protect the security and privacy of federated learning, there are methods based on homomorphic cryptography, secret-sharing, and Google's PAM method. Homomorphic encryption suffers from high computational cost. Secret-sharing methods suffer from high communication overhead. Google's PAM method involves each client negotiating a random number, which masks the actual gradient. Each client then follows certain rules: if the random number is smaller, its index is incremented; if it is greater than or equal to the random number, its index is decremented. This process eliminates the random numbers at the end. Its drawbacks include high network quality requirements (clients cannot disconnect) and the significant communication overhead from negotiating the random number.
[0006] There is currently no effective solution to the problem of inadequate privacy protection in existing related technologies. Summary of the Invention
[0007] This invention provides a general architecture and system for protecting privacy computing, thereby addressing the shortcomings of poor privacy protection in existing technologies.
[0008] In a first aspect, the present invention provides a general architecture for protecting privacy computing, comprising: a private computing server and several participating server servers; the participating server servers are pre-configured with random number generators, the random number generators are used to generate masks, and each of the random number generators has the same random number generator logic; The encrypted state calculation server is used to receive the masked encrypted state data sent by the participating party server, calculate the masked encrypted state data, and send the calculation result to the participating party server according to a preset rule; the masked encrypted state data is generated by adding the mask transformation to plaintext data.
[0009] According to a general architecture for privacy-preserving computation provided by the present invention, when the participating server sends masked encrypted data to the encrypted computation server, the amount of data in the masked encrypted data is less than the number of parameters contained in the masked encrypted data.
[0010] According to a general architecture for privacy-preserving computing provided by the present invention, any two participating server servers communicate using different secure channels.
[0011] According to a general architecture for privacy-preserving computation provided by the present invention, the number of participating servers is two or three; when the participating servers process the activation function: The two participating servers input their respective activation functions into the slices, add mask transformations to generate the masked encrypted data, and send the masked encrypted data to the encrypted calculation server; The secret state calculation server performs calculations on the two mask secret state data to obtain the calculation result, and generates two or three arithmetic fragments based on the calculation result, and sends the arithmetic fragments to the corresponding participating party server; The participating server performs demasking on the arithmetic fragments to obtain the activation function processing result.
[0012] According to a general architecture for privacy-preserving computation provided by the present invention, the encrypted computation server performs calculations on two masked encrypted data to obtain the calculation result, including: The secret state calculation server performs an arithmetic addition on the two mask secret state data, inputs the arithmetic addition result into the activation function for processing, and determines the calculation result based on the output of the activation function.
[0013] According to a general architecture for privacy-preserving computation provided by the present invention, when the participating server performs horizontal federated learning and vertical federated linear regression learning: The participating server trains its own sub-model, adds a mask to the model parameters of the sub-model to obtain the dense-state model parameters, and sends the dense-state model parameters and the sample size of the participating server to the dense-state calculation server. The dense state calculation server performs weighted aggregation processing on the dense state model parameters to obtain the aggregation result and sends the aggregation result to each of the participating party servers; The participating server performs demasking on the aggregation result to obtain the target model parameters.
[0014] According to a general architecture for privacy-preserving computation provided by the present invention, the participating servers train their respective sub-models, add masks to the model parameters of the sub-models, and obtain dense-state model parameters, including: Each participating server generates a corresponding random number and determines a mask for each participating server based on the random number; The mask is appended to the model parameters of the corresponding sub-model of the participating server to obtain the secret-state model parameters.
[0015] According to a general architecture for privacy-preserving computation provided by the present invention, when performing collaborative evaluation of multi-party collaborative polynomials: For the objective polynomial, the participating server adds a mask to the variables in the objective polynomial to obtain the dense variables, and sends the dense variables to the dense calculation server; The secret state calculation server processes the mask to obtain the target value, and sends the target value to the participating party server; The participating server determines the collaborative evaluation result of the objective polynomial based on the objective value and the mask.
[0016] According to a general architecture for privacy-preserving computation provided by the present invention, the target polynomial is an additive polynomial or a multiplicative monomial; For the additive polynomial, the dense state calculation server sums the mask to obtain the target value; For the multiplicative monomial, the dense-state computation server performs a product operation on the mask to obtain the target value.
[0017] Secondly, the present invention also provides a general system for protecting privacy computing, comprising: a privacy computing server and several participating server servers; the participating server servers are pre-configured with random number generators, the random number generators are used to generate masks, and each of the random number generators has the same random number generator logic; The encrypted state calculation server is used to receive the masked encrypted state data sent by the participating party server, calculate the masked encrypted state data, and send the calculation result to the participating party server according to a preset rule; the masked encrypted state data is generated by adding the mask transformation to plaintext data.
[0018] Compared with the prior art, the present invention has the following beneficial effects: The general architecture for privacy-preserving computation provided by this invention involves a cryptographic computation server receiving masked cryptographic data sent by participating servers, performing calculations on the masked cryptographic data, and sending the calculation results back to the participating servers according to preset rules. In this mechanism, when participating servers send masked cryptographic data to the cryptographic computation server, the number of masked cryptographic data items is less than the number of parameters contained in the masked cryptographic data. Therefore, the participating servers' data constitutes information-theoretic security for the cryptographic computation server. Furthermore, the participating servers have conflicting interests regarding data privacy protection; they do not want each other to know their data, and collusion would inevitably lead to the leakage of their own data. Therefore, they will not collude to leak data. To prevent eavesdropping, any two participating servers communicate using different secure channels. Therefore, this general framework itself provides excellent data privacy protection, solving the problem of poor privacy protection in existing related technologies. Attached Figure Description
[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0020] Figure 1 This is a structural block diagram of the general architecture for privacy-preserving computing provided by the present invention; Figure 2 This is a structural block diagram of the machine learning privacy computing architecture based on masking and SMPC in this invention. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0022] This invention provides a general architecture for privacy-preserving computing. Figure 1This is a structural block diagram of the general architecture for privacy-preserving computing provided by the present invention, such as... Figure 1 As shown, the general architecture includes: a secret-state computation server and several participant servers; the participant servers are pre-configured with random number generators, which are used to generate masks, and each random number generator has the same random number generator logic.
[0023] The secret state calculation server is used to receive masked secret state data sent by the participating server, calculate the masked secret state data, and send the calculation result back to the participating server according to preset rules; the masked secret state data is generated by adding a mask transformation to plaintext data.
[0024] For example, this general architecture is composed of n It consists of +1 server, among which Indicates the number of participating servers. n ≥2, each configured with the same random number generator. Using the random number generator, this n Each participating server can generate the exact same random number to be used as a mask to mask the plaintext data. It is a secret computation server that accepts data from the servers of all participating parties. The system receives the masked encrypted data and performs calculations based on it. The results are then sent to the servers of each participating party according to different rules and requirements for different scenarios. In this mechanism, the participating servers To dense state computing server When sending masked encrypted data, the number of masked encrypted data items is less than the number of parameters contained in the masked encrypted data. Therefore, the data from the participants is less than the number of parameters contained in the encrypted data on the encrypted calculation server. P 0 constitutes security in the information theory sense. And the servers of each participating party... There is a conflict of interest in data privacy protection; neither party wants the other to know their data, and colluding would inevitably result in the leakage of their own data, so they would not collude to leak data. To prevent wiretapping, the servers of any two participating parties... They communicate using different secure channels. Therefore, this general framework itself provides excellent privacy protection for data, solving the problem of poor privacy protection in existing related technologies.
[0025] Based on this general architecture for privacy-preserving computation, it is possible to accelerate SMPC-based privacy-preserving computation for machine learning, FL-based privacy-preserving computation for machine learning, and multi-party polynomial evaluation. In other words, this general framework also has the capability to accelerate privacy-preserving computation.
[0026] In accelerating SMPC-based privacy-preserving machine learning computation, Figure 2This is a structural block diagram of the machine learning privacy computing architecture based on masking and SMPC in this invention, as shown below. Figure 2 As shown, the number of participating servers is two or three, which is privacy computation based on two-party secure computation. However, any number of data providers can arithmetically secret-shard their data and send it to two participating servers. and .
[0027] Under the above settings, convolution operations or matrix multiplication operations in neural networks can be quickly implemented using Beaver triples. However, non-linear operations such as activation functions are relatively time-consuming. For example, SMPC requires a significant amount of computation and communication to implement simple comparison operations. The computations of time-consuming components in neural networks, such as activation functions and max-pooling, can be accelerated using the privacy-preserving computational general architecture provided by this invention.
[0028] For a simple activation function similar to the Linear Rectification Function (RELU), the specific computation process is as follows: Two participating servers add mask transformations to their respective activation function input slices to generate masked dense state data, and send the masked dense state data to the dense state calculation server; the dense state calculation server performs operations on the two masked dense state data to obtain the operation result, and generates two or three arithmetic slices based on the operation result, and sends the two arithmetic slices to the corresponding participating servers; the participating servers perform demasking on the arithmetic slices to obtain the activation function processing result.
[0029] Specifically, the secret state calculation server performs calculations on the two mask secret state data to obtain the calculation result, including: the secret state calculation server performs arithmetic addition on the two mask secret state data, inputs the arithmetic addition result into the activation function for processing, and determines the calculation result based on the output of the activation function.
[0030] For example, the participating server P 1 and P 2. Each component inputs its own activation function into the fragment. , Add a mask to transform into masked dense data , ,in a It generates random numbers greater than 0 and sends the masked encrypted data to the encrypted calculation server. P 0 is obtained by arithmetic addition of the two masked dense state data. , Then, using this as input, perform a regular ReLU operation to obtain the result ReLU(...). axThe result of the operation is divided into two arithmetic parts. r and The two arithmetic fragments are sent to the participating server respectively. P 1 and P 2. P 1 and P 2. Perform the calculations separately. and The activation function is calculated, and the activation function processing result is obtained. To prevent... a The potential for information leakage due to a value greater than 0 can be mitigated by the participating servers performing random data permutation masking operations, a known technique that will not be elaborated upon here. Furthermore, the max pooling operation process is similar to the one described above and will not be discussed further.
[0031] For complex functions containing exponential operations, such as the Sigmoid and hyperbolic tangent (Tanh), the Tair expansion can be used to approximate the function polynomially. The expression for the Tair expansion is as follows:
[0032] in, x 0 represents the fixed point of the Tailor expansion. x Representation function f The independent variable, n This indicates the number of times the expansion is performed; the higher the number, the more... f ( x The better the approximation effect, the better. R n Indicates using n Polynomial approximation f ( x The error after ) . Due to x 0. It is known that, in this embodiment, only monomials can be considered. Multi-party computation of formal activation functions, where k >1, c It is a constant. Use your own fragments The mask is , Use your own fragments The mask is Then both shards are sent to the dense state computing server. .
[0033] Dense-state computing server P 0 is obtained by arithmetic summation of the pieces. And substitute it into the activation function. In the process, the activation function value is obtained, and the formula for the activation function value is as follows: activation=
[0034] The activation result is divided into two arithmetic parts. r and activation- r Send to the servers of the two participating parties respectively. P 1 and P 2.
[0035] Participant Servers P 1. Calculation Participating server P 2 Calculation Each as the actual activation value The final fragment.
[0036] Each monomial can be processed as a vector at once to obtain arithmetic pieces of the approximate function. The arithmetic sum of these pieces is used as... The arithmetic slices, or arithmetic slices of the activation function, can be used for subsequent calculations. Compared with existing activation function calculation methods, the activation function calculation in this scheme is only a single communication process, thus improving computational efficiency.
[0037] For a three-party server neural network privacy computing scheme based on replicated secret sharing (RSS), the calculation of its activation function can be handled similarly: two servers mask their parameters and send them to the secret state computing server. The secret state computing server calculates the input of the masked activation function according to the RSS rules. The result after activation function operation is then divided into three fragments according to the RSS rules and sent to the three participating servers respectively. The three participating servers then remove the mask according to the masking rules.
[0038] In scenarios that accelerate privacy-preserving computation for machine learning based on horizontal federated computing (FL), the number of participating servers in federated machine learning is: n In federated learning, each participating server trains its own sub-model, adds a mask to the model parameters of the sub-models to obtain the dense-state model parameters, and sends the dense-state model parameters and the amount of data from the participating server to the dense-state computation server; the dense-state computation server performs weighted aggregation processing on the dense-state model parameters, obtains the aggregation result, and sends the aggregation result to each participating server; the participating server demasks the aggregation result to obtain the target model parameters.
[0039] Specifically, each participating server trains its own sub-model, adds a mask to the model parameters of the sub-model, and obtains the dense-state model parameters. This includes: each participating server generating a corresponding random number and determining the mask for each participating server based on the random number; and attaching the mask to the model parameters of the corresponding participating server's sub-model to obtain the dense-state model parameters.
[0040] For example, n Each participating server Each component trains its sub-model locally using its own data and uses a mask to adjust its model parameters. x i,j ,i=1,..., n , j =0,1,.., m -1} is masked to obtain { m-1},in, x i,j Indicates user i The j One parameter, m This indicates the number of parameters in the dense-state model. , Each participating server uses its own random number generator to randomly generate a mask for each model parameter, where... You can generate positive and negative random numbers, and then combine the masked dense-state model parameters with your own data volume. Send together to the dense state computing server .
[0041] Dense-state computing server The parameters of the dense-state model are weighted and aggregated using the following formula: { } in, y j Represents the first element of the aggregated total model. j One dense state parameter, n sum express n The total number of samples provided by each participating server, and then the aggregated samples... m Each dense state model parameter, and the data volume of each participating server is sent to all participating servers.
[0042] Each participating party's server m The parameters of the dense-state model are subjected to the following demasking process: { , } Therefore, it is evident that each participating server has obtained the aggregated model parameters. Due to the dense-state computation server... Because the mask is unknown, the secret-state computation server cannot obtain any information about the model parameters, nor can it obtain the model parameter information of each participant. If it is required that the participating servers cannot infer information about other participants from each other, the number of participating servers needs to be greater than 2.
[0043] Compared to federated learning schemes without any security measures, the encrypted computation server in this scheme does not perform any additional calculations or communications. This ensures that its speed is greater than or equal to any known secure federated learning scheme. Furthermore, this protocol can be executed as long as the number of participants is greater than two, without the concern that participant disconnection will prevent the protocol from executing.
[0044] In a vertical federated linear regression scenario, each passive party and the labeled active party generate random numbers. k , b Passive side calculation k +b Active calculation k +b and send to the server P 0, where It is the passive party model based on m The sum of the results calculated from each data sample, and It is the active party model based on m The sum of the results calculated from each data sample. It is a sample of active data. i The tag, and They are the passive party a and the active party b Model parameters, , Data samples from the passive and active sides, respectively. i The attribute vector. Server P 0 receives the encrypted data from each passive and active party, sums them, and then sends the summed result back to each passive and active party. Each passive and active party removes the mask. k , b The resulting gradients are then used to calculate the model parameters and update them according to the gradient calculation method for linear regression. From the above process, it can be seen that when the number of samples updated in a single operation is sufficiently large, and the total number of participants is greater than two, the arithmetic sum after two or three rounds of information compression does not lead to the leakage of training data, labels, or model parameters to other parties. The calculation of the loss function is similar and will not be elaborated here. This scheme requires only one round of communication and lightweight computation, offering a speed advantage.
[0045] In the process of collaborative evaluation of multi-party polynomials: for the target polynomial, the participating server adds a mask to the variables in the target polynomial to obtain the dense variables, and sends the dense variables to the dense computation server; the dense computation server processes the mask to obtain the target value, and sends the target value to the participating server; the participating server determines the collaborative evaluation result of the target polynomial based on the target value and the mask.
[0046] Specifically, the target polynomial is either an additive polynomial or a multiplicative monomial. For additive polynomials, the dense-state computation server sums the mask to obtain the target value; for multiplicative monomials, the dense-state computation server multiplies the mask to obtain the target value.
[0047] Without loss of generality, n The square cooperative additive polynomial can be defined as ,in . n The definition of a squared-coordinated multiplicative monomial is ,in Assuming participants in collaborative computing... m ( m >2) All participating servers know the expression of the polynomial.
[0048] For a given additive polynomial, each participating server Use your own variables The mask is Then sent to the dense state computing server Dense-state computing server The received mask values are summed to obtain a total sum (sum), and this sum is sent to each participating party. Each participating party's server uses its own shared mask... a , b Calculate sum / a -mb / a The value of the addition polynomial is obtained. .
[0049] For multiplicative monomials m Each participating server Use your own variables The mask is Then sent to the dense state calculation server Dense-state computing server The received mask values are multiplied to obtain the product, which is then sent to the servers of each participating party. Each participating party uses its own shared mask... a Calculate product / All servers obtain monomial products. Furthermore, the joint evaluation process of the aforementioned cooperative polynomials can be used in joint statistical applications.
[0050] The present invention also provides a general system for protecting privacy computing, characterized in that it includes: a privacy computing server and several participating server servers; the participating server is pre-configured with a random number generator, the random number generator is used to generate a mask, and each random number generator has the same random number generator logic.
[0051] The secret state calculation server is used to receive masked secret state data sent by the participating server, calculate the masked secret state data, and send the calculation result back to the participating server according to preset rules; the masked secret state data is generated by adding a mask transformation to plaintext data.
[0052] For example, this general system consists of n It consists of +1 server, among which Indicates the number of participating servers. n ≥2, each configured with the same random number generator. Using the random number generator, this n Each participating server can generate the exact same random number to be used as a mask to mask the plaintext data. It is a secret computation server that accepts data from the servers of all participating parties. The system receives the masked encrypted data and performs calculations based on it. The results are then sent to the servers of each participating party according to different rules and requirements for different scenarios. In this mechanism, the participating servers To dense state computing server When sending masked encrypted data, the number of masked encrypted data items is less than the number of parameters contained in the masked encrypted data. Therefore, the data from the participants is less than the number of parameters contained in the encrypted data on the encrypted calculation server. P 0 constitutes security in the information theory sense. And the servers of each participating party... There is a conflict of interest in data privacy protection; neither party wants the other to know their data, and colluding would inevitably result in the leakage of their own data, so they would not collude to leak data. To prevent wiretapping, the servers of any two participating parties... They communicate using different secure channels. Therefore, this general framework itself provides excellent privacy protection for data, solving the problem of poor privacy protection in existing related technologies.
[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A general architecture for privacy-preserving computation, characterized in that, The application relates to a secure multi-party computation system. The system comprises a secure multi-party computation server and a plurality of participant servers. The participant servers are pre-configured with random number generators for generating masks, and each random number generator has the same random number generator logic. The secure multi-party computation server is configured to receive mask secure data sent by the participant servers, perform computation on the mask secure data, and send the computation result to the participant servers according to a preset rule; the mask secure data is generated by adding a mask to plaintext data.
2. The general-purpose architecture for privacy-preserving computation of claim 1, wherein, When the participant servers send mask secure data to the secure multi-party computation server, the number of the mask secure data is less than the number of parameters contained in the mask secure data.
3. The general-purpose architecture for privacy-preserving computation of claim 1, wherein, Any two participant servers communicate with each other through different secure channels.
4. The general-purpose architecture for privacy-preserving computation of claim 1, wherein, The number of the participant servers is two or three; when the participant servers process an activation function, two of the participant servers add mask transformation to respective activation function input fragments to generate mask secure data, and send the mask secure data to the secure multi-party computation server. The secure multi-party computation server performs operation processing on the two pieces of mask secure data to obtain an operation result, and generates two or three arithmetic fragments based on the operation result, and sends the arithmetic fragments to the corresponding participant servers. The participant servers perform de-masking processing on the arithmetic fragments to obtain an activation function processing result. The secure multi-party computation server performs operation processing on the two pieces of mask secure data to obtain an operation result, including:
5. The general-purpose architecture for privacy-preserving computation of claim 4, wherein, The secure multi-party computation server performs arithmetic addition on the two pieces of mask secure data, inputs the arithmetic addition result into the activation function for processing, and determines the operation result according to the output result of the activation function. When the participant servers perform horizontal federated learning and vertical federated linear regression learning, the participant servers train respective sub-models, add masks to the model parameters of the sub-models to obtain secure model parameters, and send the secure model parameters and the data sample quantity of the participant servers to the secure multi-party computation server.
6. The general-purpose architecture for privacy-preserving computation of claim 1, wherein, The secure multi-party computation server performs weighted aggregation processing on the secure model parameters to obtain an aggregation result and sends the aggregation result to each participant server. The participant servers perform de-masking processing on the aggregation result to obtain target model parameters. The participant servers train respective sub-models, add masks to the model parameters of the sub-models to obtain secure model parameters, including: Each participant server generates a corresponding random number, and determines a mask for each participant server based on the random number.
7. The general-purpose architecture for privacy-preserving computation of claim 6, wherein, The mask is added to the model parameters of the sub-model of the corresponding participant server to obtain the secure model parameters. When performing collaborative evaluation processing of a multi-party collaborative polynomial, for a target polynomial, the participant servers add masks to variables in the target polynomial to obtain secure variables, and send the secure variables to the secure multi-party computation server. 8. The general-purpose architecture for privacy-preserving computation of claim 1, wherein, The secure computation server processes the mask to obtain a target value, and sends the target value to the participant server; The participant server determines the collaborative evaluation result of the target polynomial based on the target value and the mask.
9. The general-purpose architecture for privacy-preserving computation of claim 8, wherein, The target polynomial is an addition polynomial or a multiplication single polynomial; For the addition polynomial, the secure computation server performs summation processing on the mask to obtain the target value; For the multiplication single polynomial, the secure computation server performs multiplication processing on the mask to obtain the target value.
10. A general system for privacy-preserving computation, characterized in that, Comprise: A secure computation server and a plurality of participant servers; The participant server is pre-configured with a random number generator, which is used to generate a mask, and each random number generator has the same random number generator logic; The secure computation server is used for receiving the mask ciphertext data sent by the participant server, performing calculation on the mask ciphertext data, and sending the calculation result to the participant server according to a preset rule; the mask ciphertext data is generated by adding the mask to the plaintext data.