A privacy preserving optimization method, system, device, and medium

Abstract

The present application relates to the field of information physical system and privacy computing technology, and particularly relates to a privacy protection optimization method, system, device and medium, which comprises interaction between a computing party and a decryption party for iterative processing, wherein in each round of iteration, a candidate dual variable is updated by using a secure addition protocol, a non-negative projection is performed by using a secure comparison protocol, an updated dual variable ciphertext is obtained, and iteration is repeated until a convergence condition is met to output a target dual variable ciphertext; the computing party calculates a target ciphertext according to the target dual variable ciphertext and sends the target ciphertext to the decryption party; and the decryption party performs fixed-point coding inverse mapping on the decrypted result after decryption to recover the target solution in real number form. The present application has the beneficial effects of hiding the sign and zero value information in the iteration process and significantly reducing the calculation and communication overhead.

Description

Technical Field

[0001] This invention relates to the fields of cyber-physical systems and privacy computing technology, and in particular to a privacy protection optimization method, system, device and medium. Background Technology

[0002] In cyber-physical systems and cloud outsourced computing scenarios, resource-constrained devices often outsource the solution of quadratic optimization problems to computing providers. However, existing privacy protection methods based on additive homomorphic encryption cannot directly support iterative computation in the real number domain. Furthermore, the sign information of dual variables and the zero-value information of intermediate results are easily leaked during the solution process, allowing attackers to reverse-engineer sensitive data. Therefore, there is an urgent need for a privacy protection optimization method that can both support iterative computation of real number ciphertexts and hide sign and zero-value information. Summary of the Invention

[0003] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a privacy protection optimization method, comprising: a data owner performing fixed-point encoding on private real number data to obtain integer data; performing binary block truncation processing on the integer data to divide it into multiple blocks of data; encrypting each block of data using an additive homomorphic encryption algorithm; and sending the encrypted block of data to a computing party. Based on the received block data, the computing party interacts with the decryption party to execute a secure addition protocol and a secure comparison protocol. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data. The computer and decryptor interact and iterate. In each iteration, the candidate dual variable is updated using a secure addition protocol and non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output. The computer calculates the target ciphertext based on the target dual variable ciphertext and sends it to the decryptor; After decryption, the decryptor performs a fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

[0004] As a preferred embodiment of the privacy protection optimization method of the present invention, the execution of a secure addition protocol includes: The computing party adds a random mask to each block of data and then sends it to the decryption party; After decryption, the decryptor performs modulo operations and integer division to obtain the blinded block value and carry auxiliary value, then re-encrypts and returns the result. The computer determines whether the current block addition produces a carry based on the returned result and recovers the ciphertext of the addition result block by block. During the carry determination process, random bits are used to confuse the comparison order to hide the true carry relationship.

[0005] As a preferred embodiment of the privacy protection optimization method of the present invention, the following is included: executing a security comparison protocol, comprising: The calculator extracts the highest-order bit block of the difference between the data to be compared, adds a random mask, and sends it to the decryptor. The decryptor performs modulo operations and integer division, then returns the encrypted remainder and quotient. The computing party uses random bits to randomly swap the comparison order, and then uses random numbers to blind the comparison difference before sending it to the decryption party; After decryption, the decryptor checks if the decryption result is greater than zero, and returns the encrypted comparison result based on the result. The computer recovers the true ciphertext of the comparison result based on the random bits.

[0006] As a preferred embodiment of the privacy protection optimization method of the present invention, the iterative processing adopts the projection gradient ascent method to update the dual variables; Iterative processing, including: The computer homomorphically calculates the gradient based on the current dual variable ciphertext and the public system parameters; The computer uses a secure addition protocol to weight the gradient and step size and then adds it to the current dual variable to obtain the ciphertext of the candidate dual variable; Nonnegative projection is based on the computation party calling a secure comparison protocol to compare the ciphertext of the candidate dual variable with zero, and selects to retain the candidate value or set it to zero according to the comparison result.

[0007] As a preferred embodiment of the privacy protection optimization method of the present invention, the binary block truncation processing includes: Based on the data owner, the binary string of integer data is divided into multiple consecutive data blocks according to the preset number of blocks and the number of bits per block; The highest-order block contains sign bit information, and all data uses the same block parameters.

[0008] As a preferred embodiment of the privacy protection optimization method of the present invention, the fixed-point encoding inverse mapping is based on the decryption party restoring the integer result obtained from decryption to the corresponding real number according to the fixed-point representation parameters used during encoding.

[0009] As a preferred embodiment of the privacy protection optimization method of the present invention, the convergence condition is that the infinite norm of the difference between the dual variables in two adjacent iterations is less than a preset threshold.

[0010] Secondly, the present invention provides a privacy protection optimization system, comprising: an encrypted transmission module, used by the data owner to perform fixed-point encoding on private real number data to obtain integer data; to perform binary block truncation processing on the integer data to divide it into multiple blocks of data; to encrypt each block of data using an additive homomorphic encryption algorithm, and to send the encrypted block of data to the computing party; The interactive execution module is used by the computing party to interact with the decryption party to execute a secure addition protocol and a secure comparison protocol based on the received block data. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data. The iterative output module is used for the interaction between the computer and the decryptor to perform iterative processing. In each round of iteration, the candidate dual variable is updated using a secure addition protocol, and a non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output. The calculation and sending module is used by the computing party to calculate the target ciphertext based on the target dual variable ciphertext and send it to the decrypting party; The decryption and recovery module is used by the decryptor to perform fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

[0011] Thirdly, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0012] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described above.

[0013] Compared with existing technologies, the beneficial effects of this invention are as follows: By using a fixed-point encoding and mapping mechanism, real-number data is converted into integer field representation and an inverse mapping is constructed, thus solving the problem that homomorphic encryption cannot directly support real-number optimization calculations while ensuring computational accuracy; furthermore, by adopting a block-based truncation mapping method to divide the encoded data into blocks, a single data block cannot reflect the symbol and numerical information of the original data, thereby effectively suppressing the privacy leakage risk caused by intermediate variables; even further, by designing a secure addition protocol to implement ciphertext carry processing and a privacy-preserving comparison protocol to implement secure comparison of ciphertext fields, the correctness and security of the calculation process can be guaranteed without leaking intermediate calculation results; in addition, this method completes the iterative solution of the quadratic optimization problem in the ciphertext field, which not only ensures data privacy but also obtains the optimal solution, while effectively reducing ciphertext expansion and computational overhead, thus improving overall computational efficiency and system practicality. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 A flowchart illustrating a privacy protection optimization method. Figure 1 .

[0016] Figure 2 This is a schematic diagram of the three-party computing architecture and data interaction.

[0017] Figure 3 A flowchart illustrating a privacy protection optimization method. Figure 2 .

[0018] Figure 4 This is a diagram showing the convergence process of the dual variable function values ​​in the later stage of the iteration. Detailed Implementation

[0019] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0020] Example 1, referring to Figures 1-3 This is the first embodiment of the present invention, which provides a privacy protection optimization method, including: This application addresses the issue of how to achieve encrypted iterative solution of quadratic optimization problems in the real number domain within cloud outsourced computing in cyber-physical systems, while avoiding the leakage of dual variable symbols and intermediate result zero values. A method that effectively solves the aforementioned problems will be provided below, with several embodiments illustrating in detail how to implement this privacy-preserving optimization method. It should be noted that this embodiment will take the cloud outsourced computing scenario in a cyber-physical system as an example to explain the privacy protection optimization method in detail, specifically: In this embodiment, a quadratic optimization problem model with linear inequality constraints is first constructed, and the original problem can be expressed as: ; ; In the formula: Represents the optimization variable to be solved; Represents a positive definite matrix; This represents the vector of linear coefficients in the objective function; Represents the inequality constraint matrix; This represents the constraint constant vector.

[0021] Understandably, due to Since the matrix is ​​positive definite, this quadratic optimization problem is a convex optimization problem, and its optimal solution is denoted as... .

[0022] Furthermore, to facilitate solving the above problem under privacy-preserving conditions, this method further transforms the primal problem into a dual problem by introducing Lagrange multipliers. And satisfy The corresponding dual problem is expressed as: ; ; When the primal problem satisfies the strong duality condition, the optimal solution of the dual problem can be obtained. The optimal solution to the original problem is obtained: ; Furthermore, the optimal solution must satisfy the Kalman-Kun-Took conditions: ; ; ; In the formula: For matrix The OK; for The One element; for The One element; and It is a zero vector.

[0023] In the specific solution process, this method uses the projected gradient ascent method to iteratively update the dual variables, and the update process is expressed as follows: ; ; In the formula: Indicates the number of iterations. Indicates step size, Indicates the first The gradient direction at the next iteration. To improve convergence efficiency, the step size can be set as follows: ; In the formula: This represents the largest eigenvalue of the matrix.

[0024] It should be further noted that, based on the aforementioned secondary optimization model, this method establishes a three-party computational architecture consisting of the data owner, the computation party, and the result decryptor (hereinafter referred to as the decryptor). The data owner is denoted as... Each data owner Holding its private data ,in , And satisfy , ,and , .

[0025] like Figure 2 As shown, the private data of the data owner together form the linear coefficient vector in the objective function. and constraint constant vector Calculation method Holding public parameters and And is responsible for performing the main computation process in the ciphertext domain; the result is decrypted by... Holding public key and private key ,in Make it public to data owners and computing providers. The result is kept secret by the decryptor.

[0026] Based on the above framework and as follows Figure 1 and Figure 3 As shown, the privacy protection optimization methods specifically include: S100: The data owner performs fixed-point encoding on the private real data to obtain integer data; performs binary block truncation processing on the integer data to divide it into multiple blocks; encrypts each block of data using an additive homomorphic encryption algorithm, and sends the encrypted block of data to the computing party.

[0027] Understandably, since Paillier and other additive homomorphic encryption algorithms only support integer plaintext spaces, and optimization problems in cyber-physical systems involve real-valued data, homomorphic operations cannot be performed if real numbers are directly encrypted. However, simple scaling and rounding would lead to error accumulation and ciphertext size expansion due to multiple iterations. Therefore, this method uses the following mapping method to encode fixed-point numbers into integers. Let... Then we have: ; Where: parameters To meet the accuracy requirements of data recovery, Let be the real number to be encoded.

[0028] Ideally, the encoded integer y falls into a finite set of integers. It can be encrypted by Paillier and supports ciphertext addition and multiplication. Furthermore, through inverse mapping, the integer result can be restored to a fixed-point real number, thus enabling iterative computation of the ciphertext field while ensuring accuracy.

[0029] Understandably, in order to hide symbolic information during subsequent ciphertext computation and reduce the risk of privacy leaks caused by inference from intermediate results, this method also performs block processing on the encoded integer data.

[0030] In one specific implementation, binary block truncation processing refers to dividing the binary string of integer data into multiple consecutive data blocks based on the data owner, according to a preset number of blocks and the number of bits per block; wherein, the highest bit block contains sign bit information, and all data uses the same block parameters.

[0031] Specifically, integer data is truncated as follows: ; In the formula: For the sign bit; The first one obtained by truncating the binary string The first block Bit; and satisfy ;symbol This indicates the number of blocks of data that have been truncated from the binary string.

[0032] Furthermore, the truncation mapping scheme can be expressed as: ; In the formula: For data blocks The number of digits.

[0033] Among them, the block partitioning parameters It is preferable to determine these parameters in advance during the system initialization phase and configure them as common protocol parameters.

[0034] It should be noted that all data to be processed is truncated using the same block partitioning parameters, meaning that the block length is not dynamically adjusted based on the specific data content.

[0035] Ideally, since the block partitioning rules are independent of the original data values, they will not reveal the statistical distribution characteristics or numerical range information of different data due to different partitioning methods.

[0036] It is important to emphasize that the block partitioning parameters can be configured according to the computational accuracy requirements, data dynamic range, homomorphic computation depth, and encrypted plaintext space size in the application scenario.

[0037] For example, when using 64-bit fixed-point encoding, the encoded result can be divided into two 32-bit data blocks, namely: At this point, the encoded data is represented as: Among them, the high-order block Includes the sign bit and high-order bits, low-order block It contains low-order information.

[0038] In an alternative implementation, to accommodate a larger numerical range or higher computational accuracy requirements, a three- or multi-block partitioning method may be used. For example: This allows for a flexible balance between computational complexity and privacy protection in different computing scenarios.

[0039] For example: the binary representation of the integer 23 is: ; When using If we truncate it, we get The corresponding data block is: ; ; ; Right now: .

[0040] Preferably, based on the above method, the original integer is mapped into multiple independent blocks of data. Therefore, in the subsequent ciphertext computation process, each data block can participate in the operation separately without directly exposing the complete numerical structure. This effectively reduces the risk of reverse inference based on the sign bit, zero value information and intermediate results, and improves privacy protection capabilities.

[0041] That is, the data owner sequentially performs fixed-point range mapping, integer encoding, and truncated block mapping to obtain data suitable for Paillier encryption and block operations. and The processing can be summarized as follows: ; ; The participants use the public key published by the decryptor to pk, and then pk the mapped keys respectively. and Encryption, obtaining ciphertext and The two types of encrypted data are then sent to the computing party. It should be noted that the computing party can only obtain the encrypted data and cannot directly obtain the original private data of the data owner.

[0042] S200: Based on the received block data, the computing party interacts with the decryption party to execute a secure addition protocol and a secure comparison protocol. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data.

[0043] In one specific implementation, performing the secure addition protocol includes the following: A1: The computing party adds a random mask to each block of data and then sends it to the decryption party.

[0044] Specifically, the computer randomly generates a mask vector based on each received block of data: ; as well as: ; in: ; In the formula: This is the first set of mask vectors; This is the second set of mask vectors.

[0045] At the same time, the computing party randomly generates one random bit: ; It should be noted that this random bit is used to randomly swap the order of the comparison objects, thereby hiding the true comparison direction and preventing the target node from deducing the true size relationship based on the comparison result.

[0046] In addition, the computer sets the initial carry flag of the least significant bit block to: It should be noted that this setting indicates that there is no carry from the lower bit when the least significant bit block begins to perform addition. and Its function is to perturb the data that is subsequently used in the calculation, so that even if the target node performs a decryption operation, it can only obtain the intermediate result after randomization, and cannot infer the true value of the original block data.

[0047] Furthermore, the calculation method proceeds sequentially from the least significant block to the most significant block, processing the first... The addition operation is performed on the first data block. Specifically, for the first data block... The computation method first uses the Paillier additive homomorphic property to calculate the sum of the two ciphertext data blocks: It should be noted that this operation corresponds to the plaintext field. However, the computing party cannot obtain the plaintext during the calculation process.

[0048] Furthermore, due to the first The final result of each data block may also be affected by the carry from the previous lower-order block. Due to the influence of this, the calculator incorporates the carry information from the previous block into the calculation of the current block and uses random numbers. The intermediate result is masked to construct the perturbed ciphertext intermediate result: Preferably, the computer sends the aforementioned ciphertext intermediate result to the decryptor. This is because the intermediate result already contains a random number. Therefore, even if the decryptor uses the private key to decrypt, they cannot directly obtain the actual block addition result.

[0049] A2: After decryption, the decryptor performs modulo operation and integer division to obtain the blinded block value and carry auxiliary value, and then re-encrypts and returns it.

[0050] Specifically, after receiving the perturbed ciphertext data, the decryptor uses the private key to decrypt it, obtaining the randomized intermediate value: =Dec([ ]); The decryptor determines the number of bits in the current data block. Perform a modulo operation on this intermediate value to obtain the remainder within the current block range: ; Meanwhile, the decryptor performs integer division on the intermediate value to obtain the corresponding high-order bits: ; In the formula: This represents the lower-order portion of the randomization result within the current block length range; This represents the high-order bits of the randomization result that exceed the current block length.

[0051] Preferably, by and These two values ​​allow the calculator to help determine whether a carry has occurred in the current block operation without directly exposing the original data.

[0052] After the decryptor completes the above calculations, it will not... and Instead of sending the plaintext directly to the computing party, it is re-encrypted using the public key to obtain... and The encrypted result is then sent back to the computing party.

[0053] It should be noted that the decryption party only undertakes decryption assistance and modular arithmetic assistance functions, and cannot obtain the real block data; although the calculation party obtains the returned result, it is still in ciphertext form, and cannot directly obtain the plaintext value calculated by the decryption party.

[0054] A3: The computer determines whether the current block addition produces a carry based on the returned result, and recovers the ciphertext of the addition result block by block. During the carry determination process, random bits are used to confuse the comparison order to hide the true carry relationship.

[0055] It should be noted that, in order to determine whether the current block has generated a carry, it is necessary to compare the remainder returned by the decryptor. With random numbers Remainder within the current block range The size relationship between them, where: ; Understandably, if we compare directly... and If this happens, the decryptor may infer whether the current block addition result is out of bounds based on the comparison direction or result, thus obtaining carry information related to the original data. Therefore, to avoid this problem, this method introduces random bits (RandomCoin) to randomly swap the comparison objects.

[0056] When RandomCoin=1, the calculator settings are as follows: When RandomCoin=0, the computing party swaps the order of the two, setting: Subsequently, the calculation method uses random numbers Further perturb the comparison difference to construct a randomized comparison value: The ciphertext of the randomized comparison value is then sent to the decryptor. Because... A positive number does not change the sign relationship of the compared differences, but it can hide the specific magnitude of the compared differences. After decryption, the decryptor only judges the sign relationship between A and B.

[0057] When AB > 0, the decryptor sets: RE=0; Otherwise, the decryptor sets: RE=-1; Subsequently, the decryptor returns the encrypted RE to the computer. Since the order of the comparison objects is randomly controlled by RandomCoin, and the comparison value is further randomized... The process involves blinding the data, so the decryptor cannot determine the actual comparison. still It is also impossible to obtain information on whether the actual addition result of the current block produced a carry.

[0058] Furthermore, after receiving the comparison result returned by the decryptor, the computing party restores the comparison direction based on its own stored RandomCoin. If RandomCoin=1, the returned result remains unchanged; if RandomCoin=0, a direction restoration operation is performed on the returned result to make it correspond to the actual value again. and The comparative relationship.

[0059] Subsequently, the calculator combines the high-order bits returned by the decryptor. Random numbers high-level part And the comparison result after recovery [RE], calculate the carry flag corresponding to the current block: ; in: ; In the formula: Used to indicate the first Does adding up data blocks generate a carry over to higher-order data blocks?

[0060] like If a carry is generated, that carry will be used as the basis for calculation in the next data block. If no carry is generated, the calculation of the next block is unaffected by the current block. Preferably, this process ensures that multi-block data addition maintains the same carry propagation relationship as plaintext addition in the ciphertext field.

[0061] Furthermore, after obtaining the carry information of the current block, the computer recovers the ciphertext addition result of the current block, the carry of the previous block, and the carry of the current block. The final addition result of each data block. Specifically, the calculator calculates: It should be noted that the function of the above formula is to subtract the excess portion caused by cross-block carry from the temporary addition result of the current block, thereby obtaining a result that falls within the valid range of the current block. .

[0062] After completing the first After processing the first data block, the computational side continues processing the second data block. The process involves processing data blocks sequentially, starting from the least significant block and proceeding to the most significant block. By processing and passing the carry block by block, it can be guaranteed that the final result of each block is consistent with the addition result in the plaintext field.

[0063] Finally, after all data blocks have been computed, the computer, following the reverse process of the truncated mapping, recombines each data block according to its corresponding binary weights to obtain the complete ciphertext of the addition result: ; Understandably, the above reconstruction process corresponds to reassembling the low-order block, middle block, and high-order block into complete integer data. Since the carry relationships for each data block have been correctly handled in the preceding process, the reconstructed result is identical to that calculated directly in the plaintext domain. The results were consistent.

[0064] Preferably, in this embodiment, the computer can never obtain the decryption result from the decryptor, and the decryptor can never obtain the actual block data. Carry information and sign information are hidden through random masking and random swapping mechanisms. Each data block only exposes intermediate results after random perturbation during the computation process, and the final result can be accurately restored to the addition result of the original data. Therefore, this embodiment can achieve secure addition computation on block data while ensuring computational correctness, and effectively prevent privacy leakage risks caused by sign bits, zero-value information, and carry relationships.

[0065] In another specific implementation, executing the security comparison protocol also includes the following: B1: The calculator extracts the highest bit block of the difference between the data to be compared, adds a random mask, and sends it to the decryptor.

[0066] In this embodiment, for two data to be compared and The calculator will first construct its difference. The corresponding block data is represented, with a focus on utilizing the highest bit data block. The sign bit information in the data is compared and used for judgment. Among them, block data... highest bit The sign used to represent the difference satisfies the following relationship: Furthermore, when Sometimes, ;when ,but .

[0067] Therefore, based on the above properties, it is possible to determine the sign bit of the highest block of data. and Determine the size relationship.

[0068] Specifically: The computation method first starts from the set of integers Randomly select a number and from the set of integers Randomly select a number .

[0069] Calculate random numbers Perform integer division and calculate the quotient. : In the formula: for Divide by The integer obtained by rounding down.

[0070] The computing party then uses the public key right Encryption is performed to obtain ciphertext. .

[0071] The calculation method further calculates random numbers. right remainder : The computing party uses public key pk pairs Encryption is performed to obtain ciphertext. .

[0072] Subsequently, the calculation method uses random numbers Treating encrypted text Homomorphic randomization is performed to obtain the processed ciphertext. : After completing the above calculations, the calculating party will send the encrypted message. Send to the decryptor.

[0073] B2: The decryptor performs modulo operations and integer division, then returns the encrypted remainder and quotient.

[0074] Specifically, the decryptor receives the ciphertext. Then, use the private key corresponding to the public key pk to decrypt it and obtain... The corresponding plaintext value.

[0075] The decryptor performs a modulo operation on the decrypted plaintext to calculate... : That is, the decryption party will Divide the corresponding plaintext by The remainder obtained is determined as follows .

[0076] The decryptor then performs integer division to calculate... : That is, the decryption party will Divide the corresponding plaintext by The quotient obtained by rounding down is determined as Subsequently, the decryptor used the public key to PK the target. and Encryption is performed to obtain ciphertext. and And send both to the computing party.

[0077] B3: The computing party uses random bits to randomly swap the comparison order, and then uses random numbers to blind the comparison difference before sending it to the decryption party.

[0078] Specifically, the calculator generates a random bit, RandomCoin, where RandomCoin can be either 0 or 1.

[0079] When RandomCoin=1, the computer sets [AAA]=[z] and [BBB]=[R].

[0080] When RandomCoin=0, the computer sets [AAA]=[R] and [BBB]=[z].

[0081] By randomly swapping the order of [z] and [R], the decryptor cannot determine the true correspondence between the two compared data based on subsequent comparison values, thereby reducing the risk of data relationship leakage during the comparison process.

[0082] The calculator compares the ciphertext [AB] based on the set [AAA] and [BBB]. The calculation expression is: ; In the formula: Indicates ciphertext The inverse element; Used to represent and The difference between them; random numbers This is used to randomize the difference relationship in order to hide the true value of the data being compared.

[0083] The calculator will then compare the encrypted text. Send to the decryptor.

[0084] B4: After decryption, the decryptor checks whether the decryption result is greater than zero, and returns the encrypted comparison result based on the judgment result.

[0085] Specifically, after receiving the comparison ciphertext [AB], the decryptor uses the corresponding private key to decrypt it and obtain the plaintext comparison value AB.

[0086] When AB > 0, the decryptor sets the comparison result RE to 0; when AB ≤ 0, the decryptor sets the comparison result RE to -1.

[0087] The decryptor uses the public key pk to encrypt the comparison result RE, obtaining ciphertext [RE], and sends ciphertext [RE] to the computer.

[0088] B5: The computer recovers the true ciphertext of the comparison result based on the random bits.

[0089] Specifically, after receiving the ciphertext [RE] returned by the decryptor, the computing party recovers the comparison result based on the previously generated random bits RandomCoin.

[0090] When RandomCoin=1, the computer keeps the ciphertext [RE] returned by the decryptor unchanged.

[0091] When RandomCoin=0, the calculator reverses the comparison result according to the formula: ; Understandably, the above correction is used to eliminate the effect of randomly swapping the order of [z] and [R] in step three, thereby obtaining a result that reflects... and The encrypted result of the true comparison relationship.

[0092] Finally, the computer uses the ciphertext ciphertext The inverse and the corrected ciphertext [RE] are used to calculate the final ciphertext. : Based on this, the computing party can obtain the ciphertext corresponding to the final calculation result without directly knowing the relevant plaintext data. .

[0093] It is understandable that the comparison result bits Its function is also to reflect the symbolic information of the corresponding data.

[0094] S300: The computer and decryptor interact and iterate. In each iteration, the candidate dual variable is updated using a secure addition protocol and non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output.

[0095] In a specific embodiment, the iterative process uses a projected gradient ascent method to update dual variables, which specifically includes: C1: The computing party homomorphically calculates the gradient according to the current dual variable ciphertext and public system parameters.

[0096] Specifically, the computing party uses the public constraint matrix and the positive definite matrix to calculate four intermediate matrices for subsequent gradient iteration and final result recovery: ; ; ; ; Subsequently, the computing party performs on Ã1, Ã2, Ã3 and Ã4 respectively fixed-point range mapping and integer encoding to obtain Ā1, Ā2, Ā3 and Ā4.

[0097] It can be understood that since the above matrices are calculated from public model parameters, the computing party can hold their mapping results in plaintext.

[0098] C2: The computing party weights the gradient with the step size through a secure addition protocol and then adds it to the current dual variable to obtain a candidate dual variable ciphertext.

[0099] Specifically, the computing party selects the initial dual variable and performs scaling, fixed-point mapping, and truncation blocking processing on it to obtain initial mapped data , which is then encrypted with the public key pk to form . The computing party also processes the step size parameter by performing fixed-point range mapping and integer encoding to obtain an integer step size that can be used for ciphertext scalar multiplication .

[0100] ; and obtain .

[0101] Wherein, for each iteration k, where 0≤k<K, the computing party uses the current dual variable ciphertext , the data owner's input ciphertext and to calculate the encrypted gradient related quantity : ; It should be noted that all the above calculations are completed in the ciphertext domain.

[0102] In the formula: Indicates the use of plaintext matrix For ciphertext vectors Perform homomorphic scalar multiplication and accumulation; -1 Used to perform subtraction in a plaintext field. Coefficient and Used to unify the scaling scale generated by fixed-point encoding and matrix operations.

[0103] Furthermore, the computational method generates mutually independent sets of positive random numbers for each block. and Each random number is taken from It is used to blind the block data and carry relationships.

[0104] Specifically, the computational method first constructs candidate dual variables according to the form of ordinary homomorphic addition: ; Preferably, in this embodiment, the decryptor cannot know the actual block value, and the computer does not need to obtain the plaintext.

[0105] C3: Nonnegative projection is based on the computation party calling a secure comparison protocol to compare the ciphertext of the candidate dual variable with zero, and selects to retain the candidate value or set it to zero according to the comparison result.

[0106] Specifically, the computer and the decryptor execute... Agreement, by Output encryption comparison flag Based on the intended use of the master agreement, It is used to indicate whether a candidate value is negative and to decide whether to retain the candidate value or update it to zero in the subsequent safe selection process.

[0107] The expected semantics are: ; Understandably, since the output of the secure comparison protocol is still ciphertext [t], the computer cannot directly know the comparison result; the decryptor, whose access to the comparison data in the secure comparison protocol is subject to randomization and random reordering, also cannot know the real comparison object and its symbol.

[0108] Furthermore, the calculator selects two different random numbers for each element to be updated. , The algorithm generates a random bit, Rcoin. The computer randomly swaps the positions of the two sets of selection expressions based on the value of Rcoin to prevent the decryptor from inferring the comparison result based on the ciphertext position.

[0109] When Rcoin=0, the computer sets the four ciphertexts according to the following formula: ; ; When Rcoin=1, the computer sets the four ciphertexts according to the following formula: The calculation method will and Send to the decryptor. The decryptor uses their private key to decrypt and obtain the results. and However, since the data has been added with random numbers and the order of arrangement is randomly determined by Rcoin, the decryptor cannot determine the true correspondence between the candidate variables and the comparison markers.

[0110] Furthermore, the decryptor uses the four decrypted data points to calculate a combined value. : It should be noted that the above combination operation is used to achieve conditional selection in a blinded state: based on the symbolic relationship represented by the comparison markers, the combination result corresponds to a random blinded value of the candidate dual variable or a random blinded value of zero. The decryptor uses the public key pk to... Re-encrypt, and get [ ], and Return to the calculation method.

[0111] Furthermore, the computing party receives Then, using the random number it holds Comparison mark with ciphertext Perform unblinding and restore the updated dual variable ciphertext. The computer calculates according to the expression in the main protocol table: ; This update process performs a nonnegative projection of the dual variable into the ciphertext domain, with the expected plaintext semantics as follows: ; After completing the safe update of the current element, the computer repeats the above steps for the other elements in the candidate vector; after completing all elements, it proceeds to the next iteration, until all iterations are complete. The round or the agreed termination conditions are met.

[0112] In an optional implementation, the convergence condition is that the infinity norm of the difference between the dual variables in two adjacent iterations is less than a preset threshold.

[0113] In another alternative implementation, the convergence condition is reaching a preset maximum number of iterations.

[0114] S400: The computer calculates the target ciphertext based on the target dual variable ciphertext and sends it to the decryptor.

[0115] Specifically, after the iteration is complete, the computer uses the final dual variable ciphertext and the data owner's input ciphertext to compute the encryption optimization result. : ; Finally, the computing party will use the final ciphertext. Send to the decryptor.

[0116] It should be emphasized that the computing party still will not obtain the plaintext of the final result during the above process.

[0117] S500: After decryption, the decryptor performs a fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

[0118] It should be noted that fixed-point encoding inverse mapping is based on the decryptor restoring the integer result obtained from decryption to the corresponding real number according to the fixed-point representation parameters used during encoding.

[0119] Specifically, the decryptor uses the private key sk. Decryption yields the mapped integer result. .

[0120] Subsequently, the decryptor called Performing the inverse mapping and eliminating the scaling factor accumulated in the protocol computation restores the final real-valued optimization result. .

[0121] In summary, the beneficial effects of the privacy-preserving optimization method of this invention are that by converting real-number data into integer field representation and constructing an inverse mapping through fixed-point encoding and mapping mechanisms, it solves the problem that homomorphic encryption cannot directly support real-number optimization calculations while ensuring computational accuracy. Furthermore, by adopting a block-based truncation mapping method to divide the encoded data into blocks, a single data block cannot reflect the symbol and numerical information of the original data, thereby effectively suppressing the risk of privacy leakage caused by intermediate variables. Even further, by designing a secure addition protocol to implement ciphertext carry processing and a privacy-preserving comparison protocol to implement secure comparison of the ciphertext field, it is possible to ensure the correctness and security of the calculation process without leaking intermediate calculation results. In addition, this method completes the iterative solution of the quadratic optimization problem in the ciphertext field, which not only ensures data privacy but also obtains the optimal solution, while effectively reducing ciphertext expansion and computational overhead, thus improving overall computational efficiency and system practicality.

[0122] Example 2, refer to Figure 4To verify the effectiveness and feasibility of the proposed privacy protection optimization method, this embodiment establishes a multi-device collaborative experimental environment. The experimental system adopts a three-party computing architecture, corresponding to the data owner, the computing party, and the result decryption party, and is deployed using actual hardware devices.

[0123] a) Experimental equipment and configuration To verify the effectiveness and feasibility of the privacy-preserving secondary optimization scheme based on additive homomorphic encryption proposed in this invention, this embodiment establishes a multi-device collaborative experimental environment. The experimental system adopts a three-party computing architecture, corresponding to the data owner, the computer, and the result decryptor, and is deployed using actual hardware devices.

[0124] As shown in Table 1, this experiment uses one desktop computer, one laptop computer, and several Raspberry Pi devices as the main computing nodes. The desktop computer is configured with an AMD Ryzen 7 processor and 16GB of memory, serving as the computing party (Cloud) responsible for performing the main computing tasks in the ciphertext domain. The laptop computer is configured with an Intel Core i7-7500 processor and 8GB of memory, serving as the result decryption party (Target Node), used to decrypt and recover the final ciphertext result. The Raspberry Pi devices use a Cortex-A72 processor and are equipped with 4GB of memory, serving as the data owner (Agent), used to simulate resource-constrained edge devices, performing data acquisition, encoding processing, and encrypted upload operations.

[0125] Table 1. Equipment Configuration for the Third-Party Computing Architecture Experiment b) Computational complexity analysis The computational complexity of Protocol π is evaluated by statistically analyzing the number of executions of various fundamental cryptographic operations, including: encryption (Enc), modular multiplication (MM), modular exponentiation (ME), modular inverse (MI), decryption (Dec), truncation mapping (TM), and block carry operation (BCO). Based on the operational characteristics of Paillier additive homomorphic encryption, additive homomorphism corresponds to modular multiplication in the ciphertext field, while scalar multiplication corresponds to modular exponentiation. Therefore, by statistically analyzing the number of these operations, a quantitative analysis of the overall computational complexity of the protocol can be performed. Each participating party, i.e., the data owner... Calculation method and the result decryption method The main computational overhead during protocol execution is shown in Table 2.

[0126] Table 2. Statistics on the computational complexity of Protocol π According to the agreement The execution process, the data owner's handling of private data and After encoding, it is generated through truncation mapping. Each block of data is encrypted and then sent to the computer. This is to obtain the optimal solution. The computer and the decryptor need to interact. Round Agreement In each iteration, the SAP-BD secure addition protocol needs to be invoked. Secondly, and security comparison protocols Several times. Because the input data is mapped to Therefore, the SAP-BD secure addition protocol is called a certain number of times during the entire iteration process, given the number of data blocks. Second-rate.

[0127] For the result decryption party, its main role in the protocol execution process is to assist in decryption and comparison judgment. Its computational overhead mainly consists of encryption and decryption operations. In each iteration, the result decryption party needs to perform a limited number of encryption and decryption operations to assist the calculation party in completing carry judgment and obtaining the comparison result.

[0128] During the variable update phase, the computer needs to perform additional encryption, modular multiplication, and modular exponentiation operations to securely update the optimized variables; while the result decryption party only performs a small number of encryption and decryption operations during this phase. Therefore, overall, the protocol... The computational complexity is primarily borne by the computational side and increases with the problem size. Number of blocks of data ( ) and number of iterations ( The increase in ) shows a linear growth trend.

[0129] Furthermore, in security comparison agreements In this implementation, the computational party only needs to perform a limited number of basic cryptographic operations. Compared to traditional comparison methods based on the DGK mechanism (which typically require dozens of modular exponentiation operations), this implementation significantly reduces the use of modular exponentiation operations, thereby lowering the overall computational overhead. Under the premise of using the same additive homomorphic encryption foundation, this improvement can achieve a significant performance boost.

[0130] c) Communication complexity analysis protocol The communication complexity is calculated based on the data exchanged between the parties. Assume the ciphertext has a bit length of... So, the agreement The communication complexity is: In actual operation, the communication overhead of the protocol is mainly affected by the following factors: problem size (number of constraints). The variables include the dimension n, the number of participating agents, the number of iterations K, and the bit length and truncation mapping parameters used for data representation. As the above parameters increase, the communication complexity increases linearly.

[0131] Specifically, communication overhead can be divided into the following stages: (1) Agent to the computing party (initialization phase): The data owner will encode and encrypt the block data. ]and[ The communication overhead for uploading to the computing party is approximately [missing information]. .

[0132] This process is executed only once, is independent of the number of iterations K, and the communication volume increases linearly with the problem size. For multi-agent scenarios, the communication volume for each agent is... This effectively reduces the communication burden on resource-constrained cyber-physical system devices.

[0133] (2) Calculation and decryption (iteration phase): This stage is the main source of communication overhead, with a total communication volume of approximately Bits. In each iteration, we have: Secure addition (SAP-BD, Algorithm 1): This process involves Second-level swaps are used for carry propagation and randomization operations, while the target end performs... Each element is decrypted and then re-encrypted.

[0134] Safety comparison ( Updates: For each Each has two dual variables, and the computer will send four ciphertexts to the target. , , , The transmission amount for each iteration is [missing information]. Bits; the target end uses the encrypted sum [ In response, the amount of data transmitted in each iteration is... Bits. These ciphertexts are batch processed, overwriting... Use one element to reduce the number of rounds.

[0135] Overall situation for each iteration: Approximately 2–4 round trips are required between the computation side and the target side, due to matrix-vector operations (e.g. The number of bits transmitted is approximately .

[0136] (3) From the calculation party to the decryption party (result stage): After the iteration, the computer will determine the optimal decryption text. The communication overhead of sending the result to the decryptor is approximately Bits are a one-time cost and are relatively small.

[0137] Based on the above analysis, it can be concluded that the agreement The communication complexity increases with the number of iterations. Problem Scale and block data precision parameters It exhibits linear growth. In practical applications, quadratic optimization problems typically converge within a finite number of iterations (e.g., 50–200 iterations), and It can be set to a small constant, thereby effectively controlling the scale of communication.

[0138] Test Result 1: Protocol correctness verification To verify the privacy-preserving quadratic optimization solution protocol proposed in this invention To verify the correctness of the solution, without considering privacy protection mechanisms, a standard optimization solver is used as a reference benchmark to conduct comparative experiments on the same quadratic optimization problem. In this embodiment, a convex optimization solver in the Python environment is used to solve the original problem, while adhering to the protocol of this invention. The process implements the three-way computation. During the experiment, the difference between the dual variables of two adjacent iterations was used as the convergence criterion, and a convergence threshold was set. The initial dual variable is set as During the iteration process, the dual variable is updated progressively with each iteration, and iteration stops when the convergence condition is met. Experimental results are shown in the appendix. Figure 4 In the agreement During execution, the dual variable can converge stably after a finite number of iterations; in this embodiment, it can reach convergence after approximately several dozen iterations. Simultaneously, the protocol... Comparing the output results with those of the standard solver, it can be observed that the output results of both are consistent in the final stage, and their convergence trends are also consistent. Further analysis shows that the selection of initial variables has a certain impact on the algorithm's convergence speed, but does not affect the final convergence result. This proves that the protocol proposed in this invention... The protocol can correctly solve the quadratic optimization problem in a encrypted computing environment, and the calculation results are consistent with the plaintext solution results, thus verifying the correctness and effectiveness of the protocol.

[0139] Test Result 2: Performance of the protocol under large-scale problems To evaluate the privacy-preserving secondary optimization protocol proposed in this invention Scalability and practical performance under large-scale problems were experimentally verified under different scale parameters. The problem size parameter was set as follows: Number of iterations Number of participating data owners The tests were conducted in a unified experimental environment, including data ownership nodes based on Raspberry Pi devices and computing and decryption nodes based on general-purpose computing devices. During the experiments, 2048-bit Paillier encryption parameters were used, and fixed-point encoding and block parameters were set to ensure accuracy and computational stability, while using dual gaps... As a convergence criterion, the average value of multiple runs of the experimental results for each group was statistically analyzed.

[0140] Table 3. Performance test results of Protocol π under large-scale problems. The experimental results are shown in Table 3 above. As the problem size increases... Number of iterations and the number of participants The addition of the agreement The overall runtime, communication overhead, and memory usage all show a steady upward trend, demonstrating good scalability. In typical large-scale scenarios (e.g., Under this agreement The computation can still be completed within an acceptable timeframe, and the overall runtime is within the acceptable range for practical applications. Meanwhile, communication overhead and memory usage increase linearly with scale, consistent with the theoretical complexity analysis results. Furthermore, experimental results show that, under all test scales, the final calculated optimal solution maintains high accuracy, and the recovery error remains at an extremely low level, verifying the effectiveness and stability of the proposed encoding and block-based mechanism in large-scale iterative computation.

[0141] Test Result 3: Comparison of Different Solutions in Large-Scale Problem Scenarios To further verify the privacy protection secondary optimization protocol proposed in this invention Performance advantages in large-scale problem scenarios The present invention's method is compared with existing typical privacy computing schemes in the following experiments. The comparison metrics include overall runtime, communication overhead, and comparison computation time in each iteration.

[0142] Table 4 Performance Comparison of Different Privacy Computation Schemes The experimental results are shown in Table 4 above. The protocol proposed in this invention... The method exhibits significant advantages across various performance metrics: In terms of overall runtime, the method takes approximately 87.6 seconds, representing a speedup of over 2 to 10 times compared to some existing methods (e.g., approximately 214.8 seconds and 1047.3 seconds); in terms of communication overhead, the method uses approximately 712MB of communication, significantly lower than the comparative schemes (approximately 1850MB and 9620MB), reducing communication overhead by over 60% to 90%; and in terms of comparison operation efficiency, the secure comparison protocol designed in this invention has a single-round computation time of approximately 12.8 milliseconds, representing a speedup of over 5 times compared to traditional methods (approximately 67.3 milliseconds). Furthermore, all comparative schemes can recover the correct optimal solution. This invention, while maintaining computational accuracy, achieves privacy-preserving computation in a three-party collaborative computing environment without relying on complex obfuscation circuits or fully homomorphic encryption mechanisms, and can resist multi-party collusion attacks, demonstrating superior overall performance and practical application value.

[0143] Test Result 4: Experiment on the Economic Dispatch Problem of Smart Grid To verify the privacy protection secondary optimization protocol proposed in this invention The application effect of this invention in practical cyber-physical systems is verified through experiments using the economic dispatch problem of smart grids as a typical application scenario. In this experiment, a quadratic optimization model containing 200 generator nodes and 300 power balance and transmission constraints is constructed, and the method of this invention is compared and analyzed with existing typical privacy computing schemes under a unified experimental environment.

[0144] Table 5 Performance Comparison under Smart Grid Economic Dispatch Scenarios The experimental results are shown in Table 5 above. The protocol proposed in this invention... While maintaining computational accuracy, this invention significantly improves operational efficiency and communication performance: In terms of overall runtime, the method takes approximately 23 seconds, a significant reduction compared to some existing solutions (approximately 142 seconds and 168 seconds); in terms of communication overhead, the communication volume per iteration is approximately 8.2 MB, significantly lower than the comparative methods (approximately 42.7 MB and 51.3 MB); and in terms of computational overhead, the CPU computation time per iteration for each computing node is approximately 0.23 seconds, a significant advantage compared to existing methods (approximately 1.41 seconds and 1.67 seconds). Furthermore, experimental results show that the optimal scheduling result recovered by the method of this invention maintains a high degree of consistency with the plaintext computation result, with the error controlled within an extremely low range. It can converge within approximately 100 iterations, with a single-round delay of less than a few seconds, and the overall computation time meets the requirements of actual power grid scheduling cycles. Therefore, this invention not only possesses good theoretical security but also demonstrates good deployability and practical value in practical smart grid and other cyber-physical system applications.

[0145] Example 3: This example also provides a privacy protection optimization system, including: The encrypted transmission module is used by the data owner to perform fixed-point encoding on private real data to obtain integer data; to perform binary block truncation processing on the integer data to divide it into multiple blocks; to encrypt each block of data using an additive homomorphic encryption algorithm; and to send the encrypted block of data to the computing party. The interactive execution module is used by the computing party to interact with the decryption party to execute a secure addition protocol and a secure comparison protocol based on the received block data. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data. The iterative output module is used for the interaction between the computer and the decryptor to perform iterative processing. In each round of iteration, the candidate dual variable is updated using a secure addition protocol, and a non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output. The calculation and sending module is used by the computing party to calculate the target ciphertext based on the target dual variable ciphertext and send it to the decrypting party; The decryption and recovery module is used by the decryptor to perform fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

[0146] This embodiment also provides an electronic device suitable for privacy protection optimization, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the privacy protection optimization method proposed in the above embodiments.

[0147] This embodiment also provides a storage medium on which a computer program is stored, which, when executed by a processor, implements the privacy protection optimization method proposed in the above embodiments.

[0148] The storage medium proposed in this embodiment and the privacy protection optimization method proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0149] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0150] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A privacy protection optimization method, characterized in that: include: The data owner performs fixed-point encoding on the private real data to obtain integer data; Perform binary block truncation on integer data, dividing it into multiple blocks; Each block of data is encrypted using an additive homomorphic encryption algorithm, and the encrypted block data is then sent to the computing party. Based on the received block data, the computing party interacts with the decryption party to execute a secure addition protocol and a secure comparison protocol. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data. The computer and decryptor interact and iterate. In each iteration, the candidate dual variable is updated using a secure addition protocol and non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output. The computer calculates the target ciphertext based on the target dual variable ciphertext and sends it to the decryptor; After decryption, the decryptor performs a fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

2. The privacy protection optimization method as described in claim 1, characterized in that: The execution of the secure addition protocol includes: The computing party adds a random mask to each block of data and then sends it to the decryption party; After decryption, the decryptor performs modulo operations and integer division to obtain the blinded block value and carry auxiliary value, then re-encrypts and returns the result. The computer determines whether the current block addition produces a carry based on the returned result and recovers the ciphertext of the addition result block by block. During the carry determination process, random bits are used to confuse the comparison order to hide the true carry relationship.

3. The privacy protection optimization method as described in claim 2, characterized in that: Executing the security comparison protocol includes: The calculator extracts the highest-order bit block of the difference between the data to be compared, adds a random mask, and sends it to the decryptor. The decryptor performs modulo operations and integer division, then returns the encrypted remainder and quotient. The computing party uses random bits to randomly swap the comparison order and uses random numbers to blind the comparison difference before sending it to the decryption party; After decryption, the decryptor checks if the decryption result is greater than zero, and returns the encrypted comparison result based on the result. The computer recovers the true ciphertext of the comparison result based on the random bits.

4. A privacy protection optimization method as described in any one of claims 1-3, characterized in that: The iterative process uses the projective gradient ascent method to update the dual variables; The iterative process includes: The computer homomorphically calculates the gradient based on the current dual variable ciphertext and the public system parameters; The computer adds the gradient and step size weighted by the secure addition protocol to the current dual variable to obtain the ciphertext of the candidate dual variable; The nonnegative projection is based on the computation party calling the secure comparison protocol to compare the ciphertext of the candidate dual variable with zero, and selects to retain the candidate value or set it to zero according to the comparison result.

5. The privacy protection optimization method as described in claim 4, characterized in that: The binary block truncation process includes: Based on the data owner, the binary string of integer data is divided into multiple consecutive data blocks according to the preset number of blocks and the number of bits per block; The highest-order block contains sign bit information, and all data uses the same block parameters.

6. A privacy protection optimization method as described in claim 1 or 4, characterized in that: The fixed-point encoding inverse mapping is based on the decryptor restoring the integer result obtained from decryption to the corresponding real number according to the fixed-point representation parameters used during encoding.

7. The privacy protection optimization method as described in claim 6, characterized in that: The convergence condition is that the infinite norm of the difference between the dual variables in two adjacent iterations is less than a preset threshold.

8. A privacy protection optimization system, employing the method described in any one of claims 1-7, characterized in that, include: The encrypted transmission module is used by the data owner to perform fixed-point encoding on private real-number data to obtain integer data. Integer data is divided into multiple blocks by binary block truncation; each block is encrypted using an additive homomorphic encryption algorithm, and the encrypted block data is sent to the computing party. The interactive execution module is used by the computing party to interact with the decryption party to execute a secure addition protocol and a secure comparison protocol based on the received block data. The secure addition protocol is used to perform block data addition with carry processing in the ciphertext field, and the secure comparison protocol uses the highest bit of the block sign bit to determine the size relationship of the ciphertext field data. The iterative output module is used for the interaction between the computer and the decryptor to perform iterative processing. In each round of iteration, the candidate dual variable is updated using a secure addition protocol, and a non-negative projection is performed using a secure comparison protocol to obtain the updated dual variable ciphertext. The iteration is repeated until the convergence condition is met and the target dual variable ciphertext is output. The calculation and sending module is used by the computing party to calculate the target ciphertext based on the target dual variable ciphertext and send it to the decrypting party; The decryption and recovery module is used by the decryptor to perform fixed-point encoding inverse mapping on the decryption result to recover the target solution in real number form.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images