Systems and methods for efficient computation for split data and split algorithms

Abstract

The disclosed concept achieves privacy for algorithmically operated data in an efficient manner. The method includes receiving a first algorithm subset, receiving a second algorithm subset, generating two shares of a first mathematical set based on the first algorithm subset, and transmitting the two shares of the first mathematical set from a first entity to a second entity. The method may include generating two shares of a second mathematical set based on the second algorithm subset, transmitting the two shares of the second mathematical set from the second entity to the first entity, receiving a first split data subset of the complete data set, and receiving a second split data subset of the complete data set. Based on these data subsets, the system generates a first output subset and a second output subset that are combined for a final output.

Description

[Technical Field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Patent Application No. 16 / 828,216, filed March 24, 2020, which claims priority to U.S. Provisional Patent Application No. 62 / 948,105, filed December 13, 2019, entitled "Systems and Methods for Encryption," the disclosure of which is incorporated herein by reference.

[0002] Related Applications This disclosure is related to Application Nos. 16 / 828,085 (Docket No. 213-0100), 16 / 828,354 (Docket No. 213-0102), and 16 / 828,420 (213-0103), each filed on March 24, 2020, each of which is incorporated herein by reference.

[0003] The technology relates to encrypting data, algorithms, neural networks, and other information, and performing complex operations on the split or encrypted data accurately and more efficiently. [Background technology]

[0004] There are many situations in which a person, entity, or company may interact with another person, entity, or company. In these situations, to work on a job, project, or task, a first entity may need to exchange information with a second entity, and the second entity may need to exchange information with the first entity. However, the first entity may want to restrict the second entity's ability to view that information because that information may contain proprietary information. Furthermore, the second entity may want to restrict the first entity's ability to view that information because that information may contain proprietary information.

[0005] In order to describe the manner in which the above-enumerated and other advantages and features of the present disclosure can be obtained, a more particular description of the principles briefly described above will be made by reference to specific embodiments thereof which are illustrated in the accompanying drawings. It being understood that these drawings depict only exemplary embodiments of the present disclosure and therefore should not be considered limiting of its scope, the principles herein will be described and explained with additional specificity and detail through the use of the accompanying drawings. [Brief explanation of the drawings]

[0006] [Figure 1] 1 illustrates an exemplary computing environment, according to various embodiments. [Figure 2] 1 illustrates a data provider and an algorithm provider, according to various embodiments. [Figure 3] 1 illustrates a data provider that partitions data and an algorithm provider that partitions algorithms, according to various embodiments. [Figure 4A] 1 illustrates a data provider and an algorithm provider collaboratively computing an algorithm, according to various embodiments. [Figure 4B] 1 illustrates the communication of information between a data provider and an algorithm provider. [Figure 4C] 1 illustrates the communication of data between algorithm providers, data providers, and aggregators. [Figure 4D] 1 illustrates the communication of data between algorithm providers, data providers, and aggregators, including the application of a secure multi-party computation approach. [Figure 5] 1 illustrates multiple data providers and multiple algorithm providers, according to various embodiments. [Figure 6] 1 illustrates an exemplary circuit associated with an algorithm, according to various embodiments. [Figure 7] 1 illustrates an exemplary algorithm that is converted into a hidden circuit, according to various embodiments. [Figure 8]1 illustrates a hidden circuit divided into a first split and a second split, according to various embodiments. [Figure 9A] 10 illustrates an exemplary method for hiding or encrypting an algorithm from a data provider that provides data to the algorithm, or for hiding or encrypting data from an algorithm provider that provides an algorithm that operates on the data. [Figure 9B] Another exemplary method is shown. [Figure 9C] 10 illustrates yet another exemplary method for using a Beaver Set. [Figure 9D] Another exemplary method is shown. [Figure 10] 1 illustrates an exemplary neural network. [Figure 11] 1 illustrates another example of various layers used in neural networks. [Figure 12] 1 illustrates an exemplary method associated with using filters in a neural network. [Figure 13] 1 illustrates an exemplary computing device in accordance with various embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0007] Description of exemplary embodiments Various embodiments of the present disclosure are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustrative purposes. A person skilled in the art will recognize that other components and configurations can be used without departing from the spirit and scope of the present disclosure.

[0008] Overview Additional features and advantages of the present disclosure will be set forth in the description that follows, and in part will be obvious from the description, or may be learned by practice of the principles disclosed herein. The features and advantages of the present disclosure may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the present disclosure will become more fully apparent from the following description and the appended claims, or may be learned by practice of the principles set forth herein.

[0009] Disclosed herein are systems, methods, and computer-readable media for encrypting data, algorithms, neural networks, and other information and accurately and more efficiently performing complex operations on the split or encrypted data. According to at least one example, a system for achieving privacy for both the data and the algorithms operating on the data is provided. The system can be at least one computing device including a memory and at least one processor for executing instructions stored by the memory. The at least one computing device can receive an algorithm from an algorithm provider and can receive data from a data provider. The algorithm can be selected from a list of algorithms provided by the algorithm provider, and the data can be retrieved by the data provider from a database. The database can be accessed from any type of memory, such as a disk, RAM, or cache. Furthermore, the computing device can encrypt the algorithm and encrypt the data. In one example, the computing device can be a computing device associated with the algorithm provider. In another example, the computing device can be a computing device associated with the data provider. In a further example, the computing device can be a third-party computing device and not associated with the algorithm provider or the data provider.

[0010] The following disclosure describes how an algorithm that will operate on data can be split or divided into at least two sub-portions. The data can also be divided into sub-portions. The algorithm sub-portion operates on the data sub-portion to maintain privacy between the algorithm provider and the data provider. The process of dividing the algorithm and subsequent processing can be accomplished in several different ways. For example, the algorithm can be converted into a set of Boolean logic gates, or can be represented as a neural network or an algebraic or non-Boolean circuit. These various approaches each apply to the more general idea of ​​processing data via an algorithm in a new way.

[0011] The at least one computing device can divide the algorithms into a first algorithm subset and a second algorithm subset, and can divide the data into a first data subset and a second data subset. The at least one computing device can send the first algorithm subset and the first data subset to an algorithm provider, and can send the second algorithm subset and the second data subset to a data provider. The at least one computing device can then receive a first partial result based on the first algorithm subset and the first data subset from the algorithm provider, and can receive a second partial result based on the second algorithm subset and the second data subset from the data provider. The at least one computing device can determine a combined result based on the first partial result and the second partial result.

[0012] In a further example, there may be a Boolean logic gate set associated with an algorithm. The algorithm may be converted to the Boolean logic gate set. A computing device may convert a first algorithm subset to a first Boolean logic gate subset from the Boolean logic gate set, and a second algorithm subset to a second Boolean logic gate subset from the Boolean logic gate set. This is an approach used for non-neural networks. The original Boolean logic gate subset(s) may include AND gates and XOR gates, and the subsets are simply assigned shares of the encoding. For example, if the system encodes an AND gate as 1, 1, the first subset may be 0, 1, and the second subset may be 1, 0. As discussed herein, the algorithm provider may include at least one first computing device, and the data provider may include at least one second computing device. In one example, the combined result may be sent to the data provider, and the data provider may display a representation of the combined result. In another example, the combined result may be transmitted to an algorithm provider, who may display a representation of the combined result. In another example, the combined result may be transmitted to another computing device, who may display a representation of the combined result.

[0013] In the case of neural networks, the present disclosure introduces the concept of splitting an algorithm according to weights, where the Boolean logic gate set is replaced by the structure of the network. Essentially, the neural network is treated as a (non-Boolean) circuit itself. In another aspect, this concept can be generalized to an algebraic decomposition of the algorithm (rather than simply decomposing the algorithm into a Boolean logic gate set). For example, in the case of a neural network, the system can treat the neural network's nodal architecture as a circuit itself, where the nodes represent gates and the connections between them represent wires. The present disclosure also encompasses representing algorithms in purely algebraic structures. Thus, algorithms can be represented in these three ways (circuit, neural network, algebraic structure). It is further contemplated that algorithms can be transformed or represented as other structures as well. The present disclosure is not limited to the three listed ways of representing algorithms.

[0014] In another example, a method for achieving privacy for both data and algorithms operating on the data is provided. The system may include receiving, by at least one processor, an algorithm from an algorithm provider; receiving, by at least one processor, data from a data provider; dividing, by at least one processor, the algorithms into a first algorithm subset and a second algorithm subset; dividing, by at least one processor, the data into a first data subset and a second data subset; transmitting, by at least one processor, the first algorithm subset and the first data subset to the algorithm provider; transmitting, by at least one processor, the second algorithm subset and the second data subset to the data provider; receiving, by the at least one processor, a first partial result based on the first algorithm subset and the first data subset from the algorithm provider and a second partial result based on the second algorithm subset and the second data subset from the data provider; and determining, by the at least one processor, a combined result based on the first partial result and the second partial result.

[0015] An exemplary system can include one or more processors and a computer-readable storage device that stores computer instructions that, when executed by at least one processor, cause the processor to perform operations including receiving an algorithm from an algorithm provider, receiving data from a data provider, dividing the algorithm into a first algorithm subset and a second algorithm subset, dividing the data into the first data subset and the second data subset, and transmitting the first algorithm subset and the first data subset to the algorithm provider. The operations further include transmitting the second algorithm subset and the second data subset to the data provider, receiving a first partial result based on the first algorithm subset and the first data subset from the algorithm provider, receiving a second partial result based on the second algorithm subset and the second data subset from the data provider, and determining a combined result based on the first partial result and the second partial result.

[0016] In another example, a non-transitory computer-readable storage medium for achieving privacy for both data and algorithms operating on the data is provided. The non-transitory computer-readable storage medium can store instructions that, when executed by one or more processors, cause the one or more processors to perform the methods and / or operations described above. For example, the instructions can cause the one or more processors to receive an algorithm from an algorithm provider, receive data from a data provider, divide the algorithm into a first algorithm subset and a second algorithm subset, divide the data into a first data subset and a second data subset, send the first algorithm subset and the first data subset to the algorithm provider, send the second algorithm subset and the second data subset to the data provider, receive a first partial result based on the first algorithm subset and the first data subset from the algorithm provider, receive a second partial result based on the second algorithm subset and the second data subset from the data provider, and determine a combined result based on the first partial result and the second partial result.

[0017] Another exemplary method includes receiving, by at least one processor, an algorithm from an algorithm provider, receiving, by at least one processor, data from a data provider, dividing, by the at least one processor, the algorithm into a first algorithm subset and a second algorithm subset, and dividing, by the at least one processor, the data into a first data subset and a second data subset. The method may include processing, by the at least one processor, the first algorithm subset and the first data subset, and processing, by the at least one processor, the second algorithm subset and the second data subset. The method may also include receiving, by the at least one processor, a first partial result based on the first algorithm subset and the first data subset, receiving a second partial result based on the second algorithm subset and the second data subset, and determining, by the at least one processor, a combined result based on the first partial result and the second partial result.

[0018] Another aspect of the present disclosure relates to providing additional efficiency when processing a data subset with an algorithm subset. The algorithm is split into two parts and then distributed between two parties in a transaction. Control bits would be used between two different spots or locations that perform calculations on different data subsets and algorithm subsets that ultimately decipher what the actual final evaluation of the circuit is.

[0019] One approach disclosed herein uses Beaver sets to enable multiplication with fewer communication hops by moving communication hops to a pre-processing step. Beaver sets are used at the time of calculation (e.g., after the algorithm has been encrypted and / or distributed) to reduce the amount of exchange between different devices or locations where calculations are occurring. This approach allows more calculations to be performed faster before an exchange is required. This approach is described in the context of filters in various layers of a neural network.

[0020] An exemplary method includes dividing, via one or more computing devices, a plurality of filters in a first layer of a neural network into a first filter set and a second filter set, applying, via the one or more computing devices, each of the first filter sets to an input of the neural network to generate a first set of outputs, and obtaining a second set of outputs associated with the second filter set, the second set of outputs being based on application of each of the second filter sets to the input of the neural network. For each filter in the first filter set and the second filter set corresponding to the same filter from the plurality of filters, the method includes aggregating, via the one or more computing devices, in the second layer of the neural network, a respective one of the first output sets associated with the first filter in the filter set and a respective one of the second output sets associated with the second filter in the filter set to generate an aggregated set of outputs associated with the first filter set and the second filter set.

[0021] The method further includes splitting, via one or more computing devices, each weight of a specific neuron activated in each remaining layer of the neural network to generate a first set of weights and a second set of weights, the specific neuron being activated based on one or more activation functions applied to the aggregated output set. For each specific neuron from each remaining layer, the method includes applying, via one or more computing devices, a respective filter associated with each specific neuron and a first corresponding weight from the first weight set to generate a first set of neuron outputs, and obtaining a second set of neuron outputs associated with the specific neuron, the second set of neuron outputs being based on application of the respective filter associated with each specific neuron to a second corresponding weight from the second weight set; aggregating, for each specific neuron, one of the first set of neuron outputs associated with the specific neuron and one of the second set of neuron outputs associated with the specific neuron to generate an aggregated neuron output associated with the specific neuron; and generating an output of the neural network based on one or more of the aggregated neuron outputs. The method may include any one or more of the identified steps in any order.

[0022] In one example, the use of Beaver sets (or similar mathematical structures) can be used to split algorithms and data and reduce the amount of computation required to perform the operations disclosed herein. Beaver sets have typically been used in the past to perform multiplication securely. This disclosure extends the state of the art by applying Beaver sets in a new way to achieve multiplication with fewer communication hops. Generally, Beaver sets are used to compute multiplication. This disclosure extends the use of Beaver sets to apply them to division and exponential calculations. An exemplary method includes each party or entity receiving an algorithm subset, generating, by a first party, two shares of a first Beaver set based on the properties of the first algorithm (or other factors), generating, by a second party, two shares of a second Beaver set based on the properties of the second algorithm subset (or other factors), then providing the first data subset to the first party and the second data subset to the second party, executing the first algorithm subset on the first data subset based on the two shares of the first Beaver set to obtain a first output subset, and executing the second algorithm subset on the second data subset based on the two shares of the second Beaver set to obtain a second output subset. The system then combines the first output subset and the second output subset as a final result.

[0023] This brief introduction is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used alone to determine the scope of the claimed subject matter, which subject matter should be understood by reference to appropriate portions of the entire specification of this patent, any or all drawings, and each claim.

[0024] The above, together with other features and embodiments, will become more apparent with reference to the following specification, claims, and accompanying drawings.

[0025] MODE FOR CARRYING OUT THE INVENTION The disclosed technology involves systems, methods, and computer-readable media for encrypting data, algorithms, neural networks, and other information, and for accurately and more efficiently performing complex operations on the split or encrypted data. The technology is described in the following disclosure as follows: The discussion begins with an introduction to general scenarios in which the technology can be applied, followed by an overview of multi-party computation.

[0026] One exemplary scenario in which the concepts disclosed herein can be applied is in a healthcare context. Personal medical data is protected by laws such as the Health Insurance Portability and Accountability Act (HIPAA). In some cases, convolutional neural networks (CNNs) are valuable for identifying patterns in images. A patient may need to have an electrocardiogram (EKG) evaluated. Typically, a CNN (algorithm) "sees" the EKG data, which may lead to the patient's identification. In another aspect, proprietary CNN features may also be obtained from the data provider. Companies may not only want to protect patient data from identification, but may also want to protect proprietary algorithms from disclosure. The concepts disclosed herein enable algorithms to operate on data in a way that protects both the data and the algorithm from identification. This disclosure will address various scenarios, such as healthcare, credit cards, insurance, etc., more fully below.

[0027] We next provide a description of an exemplary multi-party computing environment, as shown in FIG. 1, as well as a description of exemplary methods and techniques for achieving privacy for both data and algorithms operating on the data, as shown in FIGS. 2-9B. FIGS. 9C-12 provide further illustrations of embodiments disclosed herein, including convolutional neural networks and flow diagrams of various methods related to achieving privacy for both algorithms and data in an efficient manner. The discussion concludes with a description of an exemplary computing device architecture, as shown in FIG. 13, including exemplary hardware components suitable for performing multi-party computing operations. In one aspect, standard or unencrypted algorithms may also be processed with secure multi-party computing. This is in addition to the use of homomorphic encryption, a secure element (hardware-based or otherwise)-based approach, as described herein. Systems can interact with homomorphically encrypted data (without using secure multi-party computation), or even using secure enclaves, by using encrypted standard algorithms. The disclosure now moves to an introductory overview of multi-party computation.

[0028] As shown in FIG. 1 , the approach herein provides a system and / or process for hiding or encrypting an algorithm 106 from a data provider 102 that provides data 108 to the algorithm 106, and for hiding or encrypting data 108 from an algorithm provider 102 that provides an algorithm 106 that operates on the data 108. In some examples, the algorithm 106 may be divided or split among at least one party that jointly executes the algorithm. Further, in some examples, the data 108 may be split or divided among at least one party. In one aspect, a communication network 110 may be configured between the data provider 102 and the algorithm provider 104. The system discussed herein may achieve privacy through encryption of both the data and the algorithm that operates on the data. As an example, a proprietary algorithm 106 provided by a first party may be kept secret from a second party, and proprietary data 108 from the second party may be kept secret from the first party. In another example, a third party may be involved.

[0029] As an example, secure multi-party computation (MPC) may enable the operation of a function on two data sets without the owner or administrator of each data set obtaining any proprietary information. MPC is based on a number of cryptographic tools and strategies, such as secret sharing. As an example, a first party may possess data representing a number, such as 10. The number 10 may be represented using multiple numbers, such as the operation 6 + 4. A second party may possess data representing a number, such as 5. The number 5 may be represented using multiple numbers, such as the operation 7 + (-2). As an example, the first and second parties may perform an operation on the data, such as addition, without discerning the data.

[0030] The first party may send some of their data to a second party, and the second party may send some of their data to the first party. The first party may send one of two numbers representing the data, for example, 4, to the second party. The second party may send one of two numbers representing the data, for example, 7, to the first party. The first party may add the remaining number, for example, 6, to one of the two numbers from the second party, for example, 7, to determine a sum of 13. The second party may add the remaining number, for example, −2, to one of the two numbers from the first party, for example, 4, to determine a sum of 2. Either the first party or the second party may add the sums to determine a result of 15.

[0031] Secure multi-party computation as discussed herein provides several advantages in several scenarios, such as those discussed below, based on exemplary protocols. In one example, as described above, a physician may obtain data associated with a patient, such as electrocardiogram (EKG) information. Traditionally, a physician may analyze the EKG information and make a diagnosis of whether the EKG information has any abnormalities. The abnormalities may indicate the presence of one or more conditions associated with the patient, such as atrial fibrillation. Making such a determination can be very difficult. However, there are ways to improve the diagnosis, and each patient may have certain attributes that make each diagnosis different from one another. As an example, the patient's age, the patient's gender, and other information may be relevant to the diagnosis. The physician can utilize multi-party computation to potentially improve the diagnosis.

[0032] The physician may represent a first party and may wish to communicate with a second party that has access to an algorithm to perform a more detailed analysis of the data. The data may include identifying information associated with the patient. The second party may be an algorithm holder that performs an analysis of the EKG information by comparing the EKG information to a library of EKG information to determine whether there may be an abnormality associated with the patient. The CNN may be an algorithm for evaluating the EKG information. As an example, the second party may be able to perform image analysis by comparing the patient's EKG information with each instance of EKG information in a library. This may allow the physician to provide a more accurate diagnosis by comparing the EKG information with the library of EKG information. In another aspect, the owner or entity providing the CNN for analysis of the EKG information may want details about their algorithm not to be disclosed or made public. The approach disclosed herein allows data to be processed by an algorithm in a specific technical manner that protects both the data and the algorithm from being identifiable to the other party while the data is being processed.

[0033] The above example is not limited to analyzing EKG information. In another example, a physician may obtain medical images representing a patient, such as X-rays, magnetic resonance imaging (MRI) images, computed tomography (CT) scans, or another type of image. The physician may obtain the medical images and wish to perform a diagnosis based on the medical images. The physician may utilize multi-party computation to potentially improve the diagnosis. The physician may represent a first party and may wish to communicate with a second party that has access to an algorithm to perform a detailed analysis of the data. By way of example, the second party may be an algorithm holder that performs an analysis of the medical images by comparing them to a library of medical images to determine whether there may be an abnormality associated with the patient. The algorithm may be a CNN or machine learning or artificial intelligence system trained on various medical images for the purpose of diagnosing problems with the presented medical data. The systems and methods discussed herein may enable a physician to communicate medical images with an algorithm holder in a manner that maintains the patient's privacy and the algorithm holder's privacy. The identification data and medical images associated with the patient may be HIPAA-protected data. Similarly, the algorithm holder may perform analysis on the medical images without sharing the algorithm with the physician, so that the algorithm remains proprietary.

[0034] In another example, a retailer may have a customer who wants to open a credit account, and the customer may be required to provide data associated with the customer, such as name, address, and unique identification information that describes the customer, such as a Social Security number. The retailer may be a first party. The retailer may be able to analyze the data, but may be able to perform a more thorough analysis of the data by obtaining access to additional information and algorithms. The retailer may utilize multi-party computing to potentially improve the analysis. The retailer may want to communicate with a second party that has access to one or more algorithms to perform a detailed analysis of the customer data and determine whether to open a credit account. The systems and methods discussed herein may enable the retailer to communicate customer data with an algorithm holder in a manner that maintains customer privacy. Similarly, the algorithm holder may perform analysis on customer data without sharing the algorithm with the retailer, so that the algorithm remains proprietary.

[0035] As another example, a customer may be in the process of obtaining insurance, such as vehicle or property insurance. The customer may be requested to provide data associated with the customer, such as name, address, and unique identification information representing the customer, such as a Social Security number. An insurance agent may be the first party. The insurance agent may be able to analyze the data, but may be able to perform a more thorough analysis of the data by obtaining access to additional information and algorithms. The insurance agent may utilize multi-party computation to perhaps improve the analysis. The insurance agent may wish to communicate with a second party that has access to one or more algorithms to perform a detailed analysis of the customer data and determine whether to provide insurance to the customer. The systems and methods discussed herein may enable the insurance agent to communicate customer data with an algorithm holder in a manner that maintains customer privacy. Similarly, the algorithm holder may perform analysis on customer data without sharing the algorithm with the insurance agent, so that the algorithm remains proprietary.

[0036] As noted above, FIG. 1 illustrates an exemplary computing environment 100, according to some examples. As shown in FIG. 1, the exemplary computing environment may include at least one data provider computing device 102 and may include at least one algorithm provider computing device 104. The at least one algorithm provider computing device 104 may have access to and / or store information associated with one or more algorithms 106. The at least one data provider computing device 102 may have access to and / or store data 108. The data 108 may be stored in one or more databases. The at least one data provider computing device 102 may communicate with the at least one algorithm provider computing device 104 using a communications network 110.

[0037] At least one data provider computing device 102 is configured to receive data from and / or transmit data to at least one algorithm provider computing device 104 over communication network 110. Although at least one data provider computing device 102 is shown as a single computing device, it is envisioned that at least one data provider computing device 102 may include multiple computing devices.

[0038] The communication network 110 can be the Internet, an intranet, or another wired or wireless communication network. For example, the communication network 110 can include a Global System for Mobile Communications (GSM) network, a Code Division Multiple Access (CDMA) network, a Third Generation Partnership Project (GPP) network, an Internet Protocol (IP) network, a Wireless Application Protocol (WAP) network, a WiFi network, a Bluetooth network, a satellite communication network, or an IEEE 802.11 standard network, and variations thereof. Other conventional and / or later developed wired and wireless networks can also be used.

[0039] At least one data provider computing device 102 includes at least one processor for processing data and memory for storing data. The processor processes communications, constructs communications, retrieves data from memory, and stores data in memory. The processor and memory are hardware. The memory may include computer-readable storage media such as volatile and / or non-volatile memory, e.g., cache, random access memory (RAM), read-only memory (ROM), flash memory, or other memory for storing data and / or computer-readable executable instructions, such as portions or components of an application. Additionally, at least one data provider computing device 102 further includes at least one communication interface for sending and receiving communications, messages, and / or signals.

[0040] At least one algorithm provider computing device 104 includes at least one processor for processing data and memory for storing data. The processor processes communications, constructs communications, retrieves data from memory, and stores data in memory. The processor and memory are hardware. The memory may include computer-readable storage media such as volatile and / or non-volatile memory, e.g., cache, random access memory (RAM), read-only memory (ROM), flash memory, or other memory for storing data and / or computer-readable executable instructions, such as portions or components of an application. Additionally, at least one algorithm provider computing device 104 further includes at least one communication interface for sending and receiving communications, messages, and / or signals.

[0041] The at least one data provider computing device 102 can be a laptop computer, a smartphone, a personal digital assistant, a tablet computer, a standard personal computer, or another processing device. The at least one data provider computing device 102 may include a display such as a computer monitor for displaying data and / or a graphical user interface. The at least one data provider computing device 102 may also include an input device such as a camera, a keyboard, or a pointing device (e.g., a mouse, trackball, pen, or touchscreen) for inputting data into or interacting with the graphical and / or other type of user interface. In an exemplary embodiment, the display and input device may be incorporated together as a touchscreen on a smartphone or tablet computer.

[0042] The at least one algorithm provider computing device 104 can be a laptop computer, a smartphone, a personal digital assistant, a tablet computer, a standard personal computer, or another processing device. The at least one data provider computing device 102 may include a display such as a computer monitor for displaying data and / or a graphical user interface. The at least one algorithm provider computing device 104 may also include an input device such as a camera, a keyboard, or a pointing device (e.g., a mouse, trackball, pen, or touchscreen) for inputting data into or interacting with the graphical and / or other type of user interface. In an exemplary embodiment, the display and input device may be incorporated together as a touchscreen on a smartphone or tablet computer.

[0043] A computing device or devices that operate to implement an algorithm or algorithms disclosed herein to process data by a proprietary algorithm are considered special-purpose computing devices. For example, a computing device that executes the algorithm described in connection with Figure 13 is a special-purpose computing device as defined by the steps or operations that the computing device is programmed to perform.

[0044] 2 shows another representation 200 of an exemplary computing environment 100. As shown in FIG. 2, at least one data provider computing device 102 may have access to and / or store plaintext data 206. At least one data provider computing device 102 may encrypt the plaintext data into encrypted data 204. Additionally, at least one algorithm provider computing device 104 may have access to and / or store algorithm 214. At least one algorithm provider computing device 104 may encrypt the algorithm to generate encrypted algorithm 212. At least one data provider computing device 102 may transmit the encrypted data 204 to a user or aggregator 202. Additionally, at least one algorithm provider computing device 104 may transmit the encrypted algorithm 212 to the user or aggregator 202. The user or aggregator 202 may execute the encrypted algorithm on the encrypted data 208 to perform a proprietary process 210. A user or aggregator 202 may be at least one data provider computing device 102, although the user or aggregator 202 may be a different entity. In another example, the user or aggregator 202 may be an algorithm provider computing device 104. In this example, the algorithm provider encrypts the algorithm, but this is optional. Additionally, in this example, the data provider encrypts the data, but this is optional. If the algorithm and / or data are not encrypted, this may allow for improved performance such that the algorithm may run proportionately faster.

[0045] In one example, aggregator 202 can be thought of as an entity that enables an algorithm provider, such as an entity that developed a proprietary convolutional neural network (CNN), to offer its algorithm for evaluating EKGs in the proprietary manner disclosed herein, such that aggregator 202 can receive EKG data from physicians, process the EKG data, and provide output to designated recipients of the output data. In this manner, aggregator 202 can operate a "marketplace" in which data and algorithms can run together under a configuration that allows privacy to be maintained for both the data and the algorithms.

[0046] 3 illustrates a data provider computing device 102 that divides data and an algorithm provider computing device 104 that divides algorithms to set up a secure multi-party computing approach, according to various embodiments. As shown in FIG. 3, the data provider computing device 102 can retrieve data from a database 302 and perform operations to divide the data into a first subset or first share 304 and a second subset or second share 306. Further, as shown in FIG. 3, the algorithm provider computing device 104 can perform operations to obtain an algorithm 308, which may be a representation of the algorithm in the form of a Boolean logic gate set in which the original algorithm is binarized, anonymize the algorithm 309, and divide the algorithm 309 into a first subset or first algorithm 310 and a second subset or second algorithm 312. For example, the system may first convert the algorithm into a Boolean logic set 309, which may then be split into a first Boolean logic subset 310 and a second Boolean logic subset 212. Computing devices can perform operations by reducing computer-readable instructions to binary decisions or Boolean logic operations or gates 309. Thus, the data provider computing device 102 and the algorithm provider computing device 104 can reduce algorithms to emulated or virtualized circuits that represent the data and / or algorithms and can anonymize the circuits. In another example, the circuits can be represented by hardware. As an example, the first data subset and the second data subset can be meaningless splits of data. Furthermore, the first algorithm subset 310 and the second algorithm subset 312 can be meaningless splits. Two parties can operate on their respective splits of the algorithm. Neither party runs the entire algorithm on the entire data set and understands what the entire algorithm determines. The splitting of data and / or the splitting of algorithms can occur in any of the components disclosed herein.For example, an entity may provide programming to data provider 102 that can pre-process or prepare data in terms of one or more of encryption and data splitting before the data is sent to an entity such as aggregator 202. The aggregator may simply receive the data and also perform the encryption and splitting on its computing system. A similar process can occur for algorithm provider 104.

[0047] 4A illustrates a computing device that processes data 302 and an algorithm 308 in the form of a Boolean logic gate set, according to various embodiments. As an example, the database 302 may be divided into a first data subset 304 and a second data subset 306. Furthermore, the algorithm 308 may be converted into an anonymization circuit (a Boolean logic gate set 309) and then divided into a first algorithm subset 310 (by dividing the Boolean logic gate set 309 into a first Boolean logic gate subset) and a second algorithm subset 312 (by dividing the Boolean logic gate set 309 into a second Boolean logic gate subset). The data provider computing device 102 may transmit the second data subset to the algorithm provider computing device 104 or the aggregator 202. The algorithm provider computing device 104 may transmit the first algorithm subset 310 to the data provider computing device 102 or the aggregator 202. The data provider computing device 102 or the aggregator 202 may run a first algorithm subset 310 on the first data subset 304. Additionally, the algorithm provider computing device 104 or the aggregator 202 may run a second algorithm subset 312 on the second data subset 306. The data provider computing device 102 and the algorithm provider computing device 104 (or the aggregator 202) may merge their partial results together to form a final result or answer 402.

[0048] As outlined above, the context of this disclosure relates to Party A having a database containing some private information that it is not allowed to share with other parties. Party B has an algorithm, and for some security reasons, Party B cannot share or disclose that algorithm. To address this problem arising from this context, several solutions are available. For example, if Party A is a hospital and Party B has a cancer diagnosis algorithm, Party A can send an encrypted version of the patient's medical record, and Party B can homomorphically apply the algorithm to Party A's input and send the results back to Party A. Finally, Party A decrypts the results. In another scenario, assume Party A has a face dataset and Party B wants to train a model based on Party A's database. Secure multi-party computation (SMPC) is a possible solution. However, a drawback of MPC is that Party A learns information about Party B's trained algorithm. Disclosed herein is a new SMPC scheme that is faster than previous schemes. Also disclosed is a new circuit-hiding scheme that converts gate information into inputs to a circuit. The disclosed idea of ​​SMPC is to use the Chinese Remainder Theorem in polynomial rings to keep the degree of the polynomial low and ensure that the resulting polynomial is reconstructible after the computation. This approach also ensures that Party A does not learn anything about Party B's algorithm. These ideas are built upon next.

[0049] FIG. 4B illustrates 408 the interaction between an algorithm provider 410 and a data provider 414. The algorithm provider 410 selects parameters and builds a context associated with processing data using an algorithm. The context 416 is communicated to the data provider 414. The algorithm provider synthesizes the algorithm into logic gates 418 and "hides" the algorithm 420 using principles disclosed herein, such as in FIG. 7 . The result of the hiding process includes gates 422 and general or generic circuits 424. The algorithm provider 410 sends the general circuits 426 to the data provider 414. The algorithm provider then generates shares 428 as disclosed herein, and the data provider 414 generates shares from inputs 436. The algorithm provider 410 sends shares 434 to the data provider 414, and the data provider 414 sends shares 442 to the algorithm provider 410. The algorithm provider 410 executes a process that uses the algorithm provider's gate shares 430 and the data provider's gate shares 432. The data provider 414 runs the process using the algorithm provider's input share 438 and the data provider's input share 440. After the algorithm provider generates the share from the data provider's input, the two parties are ready to begin the MPC protocol. See Figure 6 and related discussion herein.

[0050] "Hiding" occurs when the algorithm provider replaces each gate in the anonymized circuit with a generic circuit, generating a function "general circuit" 424, and stores each gate's information in a separate table. Replacing each gate with a generic circuit hides the circuit and transfers most of the circuit's information to the gate table. All that remains are the locations of each gate, as shown in Figure 7. The hidden circuit 702 in Figure 7 shows an example of what is publicly available, where only the location of each gate can be seen. The general structure of the circuit is revealed. The security of this approach relies on the security of the MPC scheme used on top of the circuit-hiding method, since information about each gate is stored separately in the gate table. Because the actual output of each gate is not available to the opposing party, only a portion of it is available, the opposing party cannot use the calculated output of each gate to reverse-engineer the circuit. The circuit provider only allows the possibility to calculate the output of those gates.

[0051] One of the problems with MPC is the number of communications between different parties. MPC protocols can involve a lot of communications during computation. The main reason is the computational complexity of "multiplication" or "AND" operations. Using Beaver Triplets is one practical way to handle multiplication (AND gates). However, this approach adds some preprocessing computations to the protocol and requires two communications for each multiplication, the same problem as with the Goldreich-Micali-Wigderson (GMW) protocol.

[0052] Disclosed herein is a system that supports addition and multiplication on shares of data without any communication. In other words, if the system splits a data set A into A1 and A2, and another data set B into B1 and B2, how does the system efficiently calculate A*B? The most desirable solution would be to be able to calculate A*B using A1*B1 and A2*B2, and also to be able to calculate A+B using A1+B1 and A2+B2. Currently, there are no SMPC schemes that can do this.

[0053] GMW only supports addition and requires online communication to compute multiplication. The reason GMW does not support multiplication is that when a system adds two polynomials, the degree of the polynomial does not increase, but when a system multiplies two polynomials, the degree increases, so GMW requires communication to keep the degree of the polynomial low. The main idea of ​​this disclosure is to use a quotient polynomial ring to keep the degree of a polynomial low so that it can be reconstructed using available points (Lagrange polynomial reconstruction). The Chinese Remainder Theorem (CRT) provides a powerful tool for computing the reduction of any polynomial to a principal ideal (if the principal ideal has enough roots) by knowing the roots of the principal ideal.

[0054] The BGW (Ben-Or, Goldwasser, Wigderson) protocol builds on the GMW protocol and considers secure multiparty computation in a computational setting. The BGW protocol uses the idea of ​​polynomial secret shares, which naturally supports homomorphic computation. If a system stores data in several polynomials as constant values ​​of those polynomials, it can be expected that after multiplying two polynomials, the stored data will be multiplied.

[0055] For example, consider the following two data sets: Data A: 4 Corresponding polynomial: P1(x)=2x 2 +3x+4 Data B: 7 Corresponding polynomial: P2(x)=x+7 Multiplying p1 and p2 gives: p1*p2=2x 3 +17x 2 +25x+28. We can verify that the constant value of p1*p2 is indeed equal to dataA*dataB=28. However, the problem is that the degree of the polynomial increases and the system needs more points to reconstruct the final polynomial.

[0056] A solution to needing more data to reconstruct the final polynomial can be found in the use of a quotient polynomial ring with coefficients in the ring of integers, to keep the degree of the polynomial small. Unfortunately, this approach creates two other problems. First, it does not retain constant values ​​after reduction. The second problem is that the secret polynomial can be reduced to another polynomial when the system only has a few points.

[0057] As an example of the first problem, consider the following. Data A: 4 Corresponding polynomial: P1(x)=x+4 Data B: 7 Corresponding polynomial: P2(x)=x+7 Principal ideal = x 2 Think +1 coeff.modulus(q)=1001 p1*p2=x 2 +11x+28=11x+27 mod(x 2 +1) The constant value of p1*p2mod x^2+1 is 27, which is not equal to 28.

[0058] However, when using the above ring polynomials, there is other information that is preserved after the reduction, namely:

number

number

[0059] In one example, x=10. p1*p2(10)=11x+27=137=36 mod 101 p1(10)*p2(10)=36 mod 101 101 is the evaluation of x^2+1 in 10. The following point is worth making and forms the basis of the solution: if there is an overflow in the coefficients, this fact is no longer valid. Therefore, if instead of coeff modulus=1001, the system uses a smaller coeff, such as 17, the results will be wrong.

[0060] As an example, let x=1 be the evaluation point, and let the cyclotomic polynomial order 2 k Let be the principal ideal.

[0061] These decisions allow the system to hide bits in a polynomial as a sum of coefficients, a cyclotomic polynomial of order 2 k teeth,

number

[0062] Using this approach, some information is preserved after reducing a polynomial by another polynomial, so the process requires other techniques to hide data in the polynomial. However, the second problem identified above still exists: how can one reduce a polynomial to another when only a few points of the polynomial are known?

[0063] One solution to this problem may be to apply the Chinese Remainder Theorem. To make this idea clearer, this disclosure provides an example of the Chinese Remainder Theorem for polynomial rings. Data A: 4 Corresponding polynomial: P1(x)=x+4 Data B: 7 Corresponding polynomial: P2(x)=x+7 Principal ideal (I)=x 2 +1 Business ring=Z 17 [x] / I p1*p2=11x+27 mod x 2 +1=11x+10 mod(x2+1,17) The system could have calculated 11x+10 in another way. x 2 +1=(x+4)(x+12) mod 17, and the roots are 4 and -4. P1(4)=8,P1(-4)=0, P2(4)=11, P1(-4)=3 To calculate the multiplication, the system can multiply p1(root1)*p2(root1)=A and p1(root2)*p2(root2)=B and reconstruct the polynomial at two points (root1,A) and (root2,B). The line that passes through (4,88)=(4,3) and (-4,0) is 11x+10 mod 17.

[0064] This disclosure next considers multi-party computation (MPC) protocols in more detail. The protocols are described between two parties, for one bit a∈{1,0} from party A and one bit b∈{1,0} from party B, to perform only one gate (XOR or AND). q=coeff.modulus n=Form 2 k The degree of the polynomial B = bounds on polynomial coefficients

[0065] In the protocol, Z q Any number reduced to

number

number

number

[0066] In step (3), Party A:

number

number

number

number

[0067] Furthermore, Party B

number

number

number

number

number

number

[0068] In step (8), to calculate the final result, P R (1)∈Z q [X] mod 2 is calculated.

[0069] This protocol works if there is no overflow in the coefficients of the polynomial (coefficients larger than q). Such overflows can occur after evaluating many gates. Two methods have been proposed to avoid overflows. The first method is to choose parameters large enough to support the computation. For example, if the system is large enough to support the polynomial, say x 2 When calculating, the modulus q is 3B 2 It is useful to have the domain of the polynomial large enough to achieve acceptable security, where B is a bound on the polynomial coefficients.

[0070] Due to computational limitations, the system cannot simply choose q as large as might be desired to allow the system to correctly compute the circuit. We then propose a method for reducing the coefficient to prevent overflow. This disclosure notes that the coefficients referred to here are different from shares referenced elsewhere. Shares can overflow.

[0071] The proposed method involves updating a polynomial ring P. Based on Lagrange polynomial reconstruction, which is exactly equivalent to the Chinese Remainder Theorem (CRT) in polynomial rings, we assume that

number

[0072] λ i is easily calculated and is public information. i are secret shares, half of which are held by party A and the other half by party B. S i If both parties share the same coefficients, the polynomial can be reconstructed and the bit values ​​revealed. Using the following protocol, two parties can update a polynomial. Another way to describe this process is to replace the polynomial with a new one with smaller coefficients.

[0073] In step (1), Party A:

number

number

number

[0074] In step (2), party A AB ,S sA +rand(1,0) to Party B. In step (3), Party B

number

number

number

number

number

[0075] After running this protocol, both parties have a share of an updated polynomial that is decoded as the original noise polynomial, but whose coefficients are bounded by 2B.

[0076] For three or more parties, the idea is similar in that each party controls some root of the ring polynomial. In the following sections, this disclosure describes the application of this protocol. Figure 4C shows the application 450 of MPC to a "multi-party problem" in which there is a group of data providers 414 and aggregators 462 who want to execute a private function (provided by an algorithm provider 410) on new input 464 and some private database. The parties must reach an agreement on which party will be responsible for which root of the polynomial ring, and then the protocol begins with the algorithm provider 410. Both parties take some of the same steps as the two-party problem, sharing a "gate share" 458 and a "general circuit" 458 with the other party. The database provider 414 provides a share of the database 460 to the aggregator 462. The only difference between this protocol and the two-party protocol is that there is a share of the new inputs 454, 456 and the evaluation of the polynomial at the root is held by different parties.

[0077] FIG. 4D illustrates an approach 470 for applying SMPC. New input 472 is provided to an aggregator 478. The aggregator 478 receives encrypted data from a data provider 474 using the data provider's public key KPd 476. The aggregator also receives an encrypted function f from an algorithm provider 482, encrypted under the algorithm provider's public key KPa 480. Both encryptions are homomorphic encryption, which allows a user to calculate the encrypted result using only the encrypted data without requiring decryption. The aggregator 478 calculates a result 484 using homomorphic encryption. The result may include a function result based on the new input and data. At the end of the calculation, the data provider 474 and the algorithm provider 482 calculate a decryption algorithm using SMPC. The SMPC 486 can be used to decrypt the results, KSd and KSa. In the SMPC protocol, the algorithm provider input is its corresponding private key KSa, and the data provider input is private key KSd.

[0078] FIG. 5 illustrates multiple data providers and multiple algorithm providers according to various embodiments. The approaches discussed herein are not limited to one data provider or one algorithm provider. As an example, data may be provided by multiple providers, and algorithms may be provided by multiple providers. As an example, FIG. 5 illustrates an arrangement 500 having a first data provider 502 and a second data provider 508. Additionally, FIG. 5 illustrates a first algorithm provider 518 and a second algorithm provider 524. As shown in FIG. 5, first data 506 from the first data provider 502 and second data 512 from the second data provider 504 may be encrypted (504, 510). Additionally, algorithm 522 from the first algorithm provider 518 and algorithm 528 from the second algorithm provider 524 may be encrypted (520, 526). As a result, multiple data providers and multiple algorithm providers may communicate and function with each other.

[0079] A user or aggregator 510 may receive encrypted data 504 from a first data provider 502 and second encrypted data 510 from a second data provider 508, and may receive an encrypted algorithm 520 from a first algorithm provider 518 and a second encrypted algorithm 526 from a second algorithm provider 524. The user or aggregator 510 may run an algorithm on the data and determine a result, which may include a proprietary business process 516. As noted above, the user or aggregator 510 may be one of the first data provider 502 or second data provider 508, the first algorithm provider 518, or the second algorithm provider 524, or may be a different entity. The aggregator 510 may also be a combination or hybrid of the respective data providers and / or respective algorithm providers. The aggregator 510, in one aspect, may also receive unencrypted data or algorithms and perform encryption operations within the aggregator 510.

[0080] FIG. 6 illustrates an exemplary circuit 600 associated with an algorithm according to various embodiments. In some secure multi-party computations (MPCs), circuit garbling is used for secure communication between two participants, such as a garbler and an evaluator. The embodiments discussed herein differ from circuit garbling. Multi-party computations (MPCs) can perform two operations, including multiplication (AND) and addition (XOR). As a result, to perform complex operations and functions, the operations and functions are decomposed into AND and XOR operations. The exemplary circuit 600 illustrated in FIG. 6 includes only XOR and NOT gates. The NOT gates are replaced by XOR gates with a "1" bit, allowing the circuit to represent only AND and XOR gates.

[0081] According to an embodiment, to hide the algorithm, gates may be replaced with inputs including A and B with a general purpose circuit as shown in Figure 6. Inputs g0 and g1 in Figure 6 may act as control bits such that when g1g0=11, the entire circuit may act as an AND gate for A and B. When g1g0 is equal to 01, the entire circuit may be equal to A EXOR B, and when g1g0=10, the entire circuit may act as NOT A.

[0082] An algorithm can be encoded into a logic circuit or emulated circuit by converting the algorithm into a specific circuit 600, such as that shown in FIG. 6. The circuit can contain the correct number and arrangement of gates such that it represents the algorithm. Each specific gate in the circuit can be replaced with a generic gate slot. Each generic gate slot can be filled with the correct bit pattern to make the gate function as is. The gate information can then be copied into a matrix.

[0083] In one example, a truth table can be used to describe or resolve the gate shown in Figure 6 into an actual gate. For example, the following truth table can be used: [Table 1]

[0084] 7 illustrates an exemplary algorithm 308 being converted 700 into a hidden circuit 309, according to various embodiments. The hidden circuit may be, for example, the Boolean logic gate set 309 shown in FIG. 3. As an example, information associated with the gates in the circuit shown in FIG. 6 may be anonymized and replaced with a hidden representation 309, as shown in FIG. 7. As an example, the algorithm 308 may be converted into the hidden representation 309. This provides one exemplary method of anonymizing a circuit structure. Other approaches to anonymization may be applicable as well.

[0085] 8 illustrates a hidden circuit 309 divided 800 into a first split or subset 310 and a second split or subset 312, according to various embodiments. In other words, the hidden representation 309 may be divided into two splits or subsets. The first algorithm subset 310 may be evaluated by a first party, a first computing device, or a first virtual computing environment, and the second algorithm subset 312 may be evaluated by a second party, a second computing device, or a second virtual computing environment. Generally speaking, these different splits of the Boolean logic gate set 309 are separated into different computational spots, locations, parts, physical or virtual components, such that their separated operations may be performed in a separated manner.

[0086] FIG. 9A illustrates an example method 900 for hiding or encrypting an algorithm from a data provider that provides data to an algorithm and for hiding or encrypting data from an algorithm provider that provides an algorithm that operates on the data. The method may include any one or more steps performed in any order. The order disclosed herein is by way of example. According to the example method, in step 902, an algorithm provider may send an algorithm to a computing device. Further, the data provider may send data to the computing device. The computing device may receive an algorithm and receive the data. The algorithm may be selected from a list of algorithms provided by the algorithm provider, and the data may be retrieved from a database by the data provider. Further, the computing device may encrypt the algorithm and encrypt the data. In one example, the computing device may be a computing device associated with the algorithm provider. In another example, the computing device may be a computing device associated with the data provider. In a further example, the computing device may be a third-party computing device and may not be associated with the algorithm provider or the data provider.

[0087] In step 904, the computing device may divide the algorithms into a first algorithm subset and a second algorithm subset. The first algorithm subset and the second algorithm subset may not be subsets of equal size. As an example, the first algorithm subset may include one-third of the operations associated with the algorithm, and the second algorithm subset may include two-thirds of the operations associated with the algorithm. Alternatively, the first algorithm subset and the second algorithm subset may be divided into subsets of equal size. As noted above, an alternative step generally includes anonymizing the algorithms or algorithm subsets.

[0088] Further, the computing device may divide the data into a first data subset and a second data subset. As an example, the first data subset may include one-third of the data, and the second data subset may include two-thirds of the data. Alternatively, the first data subset and the second data subset may be divided into subsets of equal size. In step 906, the computing device may send the first algorithm subset and the first data subset to the algorithm provider. In step 908, the computing device may send the second algorithm subset and the second data subset to the data provider. In step 910, the computing device may receive a first partial result from the algorithm provider. The first partial result may be based on the first algorithm subset and the first data subset. Further, the computing device may receive a second partial result from the data provider. The second partial result may be based on the second algorithm subset and the second data subset. In step 912, the computing device may determine a combined result based on the first partial result and the second partial result.

[0089] In a further example, there may be a Boolean logic gate set associated with an algorithm. The algorithm may be converted into a Boolean logic gate set. This may be performed by an algorithm provider. The computing device may convert a first algorithm subset into a first Boolean logic gate subset from the Boolean logic gate set, and may convert a second algorithm subset into a second Boolean logic gate subset from the Boolean logic gate set. The first Boolean logic gate subset and the second Boolean logic gate subset include AND gates and XOR gates. As discussed herein, the algorithm provider may include at least one first computing device, and the data provider may include at least one second computing device. In one example, the combined result may be sent to the data provider, and the data provider may display a representation of the combined result. In another example, the combined result may be sent to the algorithm provider, and the algorithm provider may display a representation of the combined result. In another example, the combined result may be sent to another computing device, and the other computing device may display a representation of the combined result.

[0090] In another aspect, the computing device may retain or transmit the first algorithm subset and first data subset and the second algorithm subset and second data subset to any entity. For example, an entity such as aggregator 202 may perform the dividing and processing steps to obtain first and second partial results. In general, the system may separately process the first algorithm subset with the first data subset and the second algorithm subset with the second data subset, preventing the respective algorithms and data from being disclosed to each other.

[0091] 9B shows another example method 918. This example method includes receiving, by at least one processor, an algorithm from an algorithm provider in step 920, and receiving, by at least one processor, data from a data provider in step 922. The method may also include dividing, by the at least one processor, the algorithms into a first algorithm subset and a second algorithm subset in step 924, dividing, by the at least one processor, the data into a first data subset and a second data subset in step 926, processing, by the at least one processor, the first algorithm subset and the first data subset in step 928, and processing, by the at least one processor, the second algorithm subset and the second data subset in step 930. The method may also include, in step 932, receiving, by at least one processor, a first partial result based on the first algorithm subset and the first data subset, and receiving a second partial result based on the second algorithm subset and the second data subset, and, in step 934, determining, by the at least one processor, a combined result based on the first partial result and the second partial result.

[0092] The process of dividing the algorithm and subsequent processing can be accomplished in several different ways: for example, the algorithm can be converted into a set of Boolean logic gates, or can be represented as a neural network or an algebraic or non-Boolean circuit.

[0093] In some embodiments, algorithms can include large, complex algebraic expressions, including algorithms with thousands of operations strung together in a row (e.g., common among CNNs). To handle such complex algorithms, Beaver set-based mathematical techniques can be used, for example, to perform much faster computations of large numbers of arbitrary operations using fewer communication exchanges between two or more parties (e.g., fewer communication exchanges between data providers, algorithm providers, aggregators, etc.). Beaver sets, typically used for multiplication, can be applied in novel ways to the concepts disclosed herein to convert the calculation into a preprocessing step. Beaver sets typically use preprocessing. Additional concepts disclosed herein to the overall process include the ability to process differently to support division and exponentiation, as well as faster multiplication. Figure 9C illustrates an exemplary method associated with using Beaver sets to improve computational requirements, for example, when implementing the principles disclosed herein.

[0094] One issue with multi-party computation can be associated with the number of communications that can be transmitted over the communications network 110 between the data provider computing device 102 and the algorithm provider computing device 104. The communications can be associated with the computational complexity of multiplication and "AND" operations. While MPCs can support addition and multiplication, multiplication is typically limited. As the numbers being multiplied continue to increase in size, the computational power of the MPC begins to approach and reach an upper limit due to integer size limitations and computational storage limitations. When a limit is encountered, the MPC seeks to exchange information between the computing devices performing the operations. This exchange reduces overall computational performance.

[0095] The embodiments discussed herein utilize Beaver set multiplication to limit communication between the data provider computing device 102 and the algorithm provider computing device 104 to reduce communication and network overhead. The use of Beaver set multiplication may apply to any two devices or virtual machines used to split data and split algorithms for processing as described herein. Thus, problems may arise between any two devices, virtual or physical, that may be used in conjunction with the principles disclosed herein. In some embodiments, one Beaver set triple may be used for each operation (e.g., a multiplication operation or an AND gate). Beaver set triples may be pre-generated by one party or one computing device when the two parties work together to determine a combined result. As an example, the data provider computing device 102 may pre-generate a Beaver set, and the algorithm provider computing device 104 may pre-generate a Beaver set. In another aspect, the aggregator 202 may pre-generate various Beaver sets for one or more of the algorithm, the data, a subset of the algorithm, and a subset of the data.

[0096] According to embodiments, Beaver sets can be utilized at the time of computation (e.g., after an algorithm has been encrypted and distributed between the data provider computing device 102 and the algorithm provider computing device 104). For example, after an algorithm has been encrypted, split, and distributed to two parties, Beaver sets can be used when one or both parties are ready to perform the computation. Because encrypted circuits are slow to compute, reducing the amount of information exchanged between the two parties by using Beaver sets (allowing each party to perform more mathematical computations before making the exchange) increases the speed and efficiency of the algorithm and the overall data processing. In other words, the following Beaver set-based technique can perform complex operations on split data and / or algorithms much faster than previous approaches because it allows more operations to be computed while the two parties are separated before an exchange between them is necessary (e.g., exceeding a threshold error).

[0097] 9C may include each party or entity receiving, by at least one processor, an algorithm subset from an algorithm provider in step 940. The algorithm subset may be, for example, a first algorithm subset from algorithms divided into a first algorithm subset and a second algorithm subset. In step 942, the first party may generate two shares of the Beaver set based on properties of the first algorithm subset or based on other parameters.

[0098] For example, a first party (e.g., user A, such as a data provider computing device 102 or an algorithm provider computing device 104) may generate an Nx3 matrix, Beav A It is possible to generate Beav Amay include first and second sequences that are randomly generated, and the third sequence may include the behavior of the algorithm subset. A may be partially randomly generated, or possibly generated based on a non-random process. In this exemplary embodiment, the third column comprises the multiplication of the first two columns. The first two columns of the Beaver set may be randomly generated to mask the actual data (EKG share), and the third column may be calculated depending on the application (multiplication, division, exponential function, etc.). It is preferable to randomly generate the first two columns so that the actual data can be hidden.

[0099] Next, user A uses Beav A Two shares of [Beav A ] A and [Beav A ] B User A can then use the public key and encryption to generate

number

number

number

[0100] In some embodiments, ENC supports homomorphic encryption for one multiplication and one addition. Homomorphic encryption is a form of encryption that allows computations on ciphertext that, when decrypted, produce an encrypted result that matches the result of an operation performed on plaintext. Homomorphic encryption is a form of encryption that has the additional evaluation capability to compute over encrypted data without access to the private key. The result of such computations remains encrypted.

[0101] In step 944, a second party (User B) can generate its two shares of the Beaver set based on properties of the second algorithm subset or based on other factors. User B, such as the data provider computing device 102 or the algorithm provider computing device 104, generates an N×3 matrix, Beaver B , and a random matrix R having the same size (Nx3) as the Beaver set. The matrix R can also be generated based on a non-random process. A As well as Beav B may include first and second columns that are randomly generated or generated based on some non-random process, and the third column may include an operation of the algorithm subset. In this exemplary embodiment, the third column includes a multiplication of the first two columns.

[0102] User B then uses Beav B Two shares of [Beav B ] A and [Beav B ] B Then, user B can generate [Beav] B =[Beav A ] B ×[Beav B ] B -R and

number

[0103] The first and second party data provider computing devices 102 and algorithm provider computing devices 104 can perform the following: User A:

number

number

[0104] The first party (user A) and / or second party (user B) can generate an Nx3 matrix Beaver triple set where the third column contains the first column divided by the second column. User A and user B can then collaboratively calculate x' = x x d and y' = y x e (e.g., both parties would know the values ​​of x' and y'). User A can then calculate [x d] AUser B can calculate [xd] B Then, both user A and user B can jointly reconstruct xd.

[0105] In one aspect, the data provider computing device 102 and the algorithm provider computing device 104 perform the division

number

number

[0106] In step 946, the data provider may provide the split data sets to the two parties and run a splitting algorithm on the split data sets using the corresponding Beaver sets. In some embodiments, the data may be split into random shares of the full data set to further hide sensitive information (e.g., patterns that reveal demographics, gender, age, race, or other biometrics that reveal patient identity). In this regard, the method may include running a first algorithm subset on the first split data subset based on two shares of the first mathematical set to generate a first output subset, and running a second algorithm subset on the second split data subset based on two shares of the second mathematical set to generate a second output subset. The method may then include combining the first output subset and the second output subset.

[0107] In some embodiments, computation speed can be further increased through one or more memoization techniques, which are optimization techniques that can be used to speed up computation by remembering the results of expensive function calls and returning the cached results when the same inputs are encountered again. A memoized function can, for example, cache results corresponding to some set of specific inputs. Subsequent calls with the remembered inputs (from the cache) can return the remembered results without recomputing them, so the primary cost of a call with given parameters is eliminated, except for the first call made to the function with those parameters. Thus, memoization can transparently populate its result cache on the fly, as needed, rather than upfront.

[0108] In another example, suppose in a chess game, one player wants to calculate the number of opening moves available. After the first move, the player calculates the possible moves as a result of that first move, and so on. Instead of recalculating all possible moves as a result of that move, the player keeps a list of all possible moves that can be made according to a particular setting, making the chess game faster. Instead of recalculating the possible moves each time, the player keeps a memo. This exemplary model applies to beaver sets, which involve memoizing actions, allowing the system to accumulate as little error as possible. Each party generates their own beaver set. In the algorithm example, the system generates a beaver set and runs the algorithm on the data.

[0109] As another example, memoization techniques can be applied to each transaction between two parties. In one example, a number of EKGs (e.g., 50 EKGs) can be specified for batch processing. The same Beaver Set can be used for all 50 EKGs rather than being recalculated for each EKG in the set. However, to prevent pattern recognition, the Beaver Set is regenerated with the next transaction (e.g., the next batch of EKGs) in a distributed manner.

[0110] Another aspect of the present disclosure relates to providing additional efficiency when processing a data subset with an algorithm subset. The algorithm is split into two parts and then distributed between two parties in a transaction. Control bits would be used between two different spots or locations that perform calculations on different data subsets and algorithm subsets that ultimately decipher what the actual final evaluation of the circuit is.

[0111] One approach disclosed herein uses Beaver sets to enable multiplication with fewer communication hops. Beaver sets (or similar mathematical structures) were introduced above and can be used during computation (e.g., after the algorithm has been encrypted and / or distributed) to reduce the amount of exchange between devices or different locations where computation is occurring. This approach allows computations to be performed faster before an exchange is required. This approach will now be described in the context of filters in various layers of a neural network.

[0112] 9D shows an example method 948. The method includes, in step 950, dividing a plurality of filters in a first layer of a neural network into a first filter set and a second filter set via one or more computing devices; in step 952, applying, via one or more computing devices, each of the first filter sets to an input of the neural network to generate a first output set; and in step 954, obtaining a second output set associated with the second filter set, the second output set being based on application of each of the second filter sets to the input of the neural network. In step 956, for each filter in the first filter set and the second filter set corresponding to the same filter from the plurality of filters, the method includes, in the second layer of the neural network, aggregating, via one or more computing devices, a respective one of the first output sets associated with the first filter in the filter set and a respective one of the second output sets associated with the second filter in the filter set to generate an aggregated output set associated with the first filter set and the second filter set.

[0113] The method further includes, in step 958, splitting, via one or more computing devices, the respective weights of the particular neurons activated in each remaining layer of the neural network to generate a first set of weights and a second set of weights, the particular neurons being activated based on the one or more activation functions applied to the aggregated output set. For each particular neuron from each remaining layer, the method includes applying, via one or more computing devices, a respective filter and a first corresponding weight from a first weight set associated with each particular neuron to generate a first set of neuron outputs in step 960, obtaining a second set of neuron outputs associated with the particular neuron in step 962, the second set of neuron outputs based on application of a respective filter associated with each particular neuron to a second corresponding weight from the second weight set, aggregating, for each particular neuron, one of the first set of neuron outputs associated with the particular neuron and one of the second set of neuron outputs associated with the particular neuron in step 964 to generate an aggregated neuron output associated with the particular neuron, and generating an output of the neural network based on one or more of the aggregated neuron outputs in step 966. The method may include any one or more of the identified steps in any order.

[0114] FIG. 10 illustrates an example neural network 1000 that can represent an algorithm processed as described herein. Neural networks are often used to analyze or evaluate visual images, or may be used for image recognition, video recognition, speech or natural language processing, etc. A convolutional neural network (CNN) has an input layer 1002 that receives an input, convolves the input, and passes it to the next hidden layer 104A or a group of hidden layers 1004A, 1004B, 1004C. Each layer receives input from a previous layer, which may be a restricted subarea of ​​the previous layer. The hidden layers of a CNN 1000 may include a series of convolutional layers that convolve with multiplication or other dot products. An activation function, or Re-LU layer, is then followed by additional convolutions, such as pooling layers, fully connected layers, and normalization layers, referred to as hidden layers 1004A, 1004B, 1004C. The term "hidden" is used because the input and output are masked by the activation function and the final convolution. The final convolution may involve backpropagation to more accurately weight the final product at the output layer 1006. Mathematically, "convolution" may involve applying a sliding dot product or cross-correlation.

[0115] Each neuron in a neural network calculates an output value. It applies a specific function to the input values ​​from the previous layer. The function applied may be determined by a vector of weights and biases. The training process involves iteratively making adjustments to the biases and weights. In one aspect, the weight and bias vectors are called filters and represent specific features in the input. For example, features may include the color or shape of an image. In a CNN, some neurons may share the same filter, which can reduce memory requirements because a single filter can be used across a group or across all receptive fields that share the filter. In other aspects, each receptive field may have its own bias and vector weighting. The output layer 1006 provides the results of the neural network process.

[0116] Although CNNs are primarily referred to in this disclosure, this disclosure is not limited to any particular type of neural network or machine learning technique.

[0117] FIG. 11 illustrates an exemplary application of a CNN 1100. The input layer 1102 begins processing an image or a particular portion of an image as shown. The image is processed as described above by one or more convolutional hidden layers 1104A and then communicated to a pooling hidden layer 1104B. The pooling layer can reduce the dimensionality of the data by combining the outputs of neuron clusters in one layer into a single neuron in the next layer. Global pooling can operate on all neurons in a convolutional layer. Additionally, pooling may calculate a maximum or an average. Max pooling uses the maximum value from each of the neuron clusters in the previous layer. Average pooling uses the average value from each of the neuron clusters in the previous layer. The pooling layer 1104A can perform any of these operations.

[0118] The fully connected layer 1104C connects all neurons in one layer to all neurons in another layer. This layer is similar to a traditional multilayer perceptron neural network (MLP). The flattened matrix is ​​passed through the fully connected layer to classify the image. The flattening layer is a rearrangement of the data, possibly involving rearrangement of shares. The output image 1110 can then be classified. For example, the output may identify the image as a park, a city, etc.

[0119] Convolutional neural networks process data through many different layers. The system first applies a convolution operation in one layer of the CNN 1100. Then, the next layer can be max pooling, where the system takes the maximum value after applying the convolution operation to each matrix. In the first layer of the CNN, the system is performing a convolution operation, but it is also performing a split version of the CNN. For image data, for example, the system still runs the same window per pixel across the entire image. However, the filters (weights, biases, or in other words, numbers) are transformed into two splits, so that filter 1 becomes 0.5 and 0.5, filter 2 becomes 1 and 1, and filter 3 becomes 2 and 1. This is how an image can be split.

[0120] The system then performs operations on this split version of the image again. In one example, the system can randomly split pixel values ​​for each color channel. In the color context, the value can be any value between 0 and 256. Similarly, the system can perform a convolution operation where the other side knows that some operation is occurring but does not know specifically what the filter is. Aggregation can then occur in the next layer, a max pooling layer. Specific points in the neural network can then be activated based on how the convolution and max pooling operations occur. These points are typically called neurons in the neural network, and the activation function can be a Re-LU function, a sigmoid function, or other functions.

[0121] In an exemplary application of the Re-LU function, the Re-LU function essentially turns on a specific point in the neural network, up to a certain .0 [point 0], after which the neuron is 1. The neuron is either on or off. Depending on the input value of the image, the Re-LU function turns on specific points in the neural network, essentially splitting neurons into on and off, and those different neurons are weighted differently. In accordance with this disclosure, the system splits the weights here so that the entities participating in the exchange do not know what they are doing themselves.

[0122] The system proceeds to process the data layer by layer, with the layer applying these types of operations. The final layer can be a softmax layer. The approach is that the system performs complex mathematics and hides it, yet outputs the same softmax layer. The softmax layer is what reveals the output of the neural network. One technical advantage of this process is that it obtains results in fewer network hops.

[0123] Further referring to FIG. 11 and the various layers of the CNN, the present disclosure proceeds with the next step through an exemplary evaluation of the CNN 1100. In one example, assume an input A: n*m*d. The convolutional layer 1104A can be hidden by hiding the weights corresponding to each kernel. Thus, each kernel travels along each layer of the input with a size of (m*n) and a depth of d. In this example, there are multiplications and additions within and between layers. To minimize the number of communications, the present disclosure provides for computing all multiplications first, and then computing the additions. For each kernel, the system requires communication.

[0124] A flattening layer can be used to rearrange the shares. A max pooling layer 1104B can be used. There are two exemplary approaches to max pooling. First, A > Input B If the function f=max(input A ,input B) output is A. In such a case, the system can ask for up to two inputs in two communications using SMPC. In another example, the input A > Input B If the function f=max(input A ,input B ) output is the input A In this case, the system needs to create a comparison circuit and output the larger value using ((1-(A>B))*B+(A>B)*A. The advantage of this method over the first method is that no party learns the location of the maximum value, but on the other hand, it is expensive in terms of computation and time.

[0125] The sigmoid function was mentioned above. The sigmoid function is e x / (1+e x ) To evaluate this function for an input X, a new idea is applied as follows. The process is divided into two parts. First, the system uses the Beaver Set idea disclosed herein to find e x There is a preprocessing part that includes: User A and user B are assigned random values ​​for the first column, random values ​​for the second column, and 1 / e r A and 1 / e r Generate two random Beaver sets such that B and r A and r B is the value in the first column. User A uses enc(r A ) and enc A (1 / e r A) is sent to user B. User B selects a random sequence [a], which is User B's share from the final Beaver set. B =m1 and [b] B =m2. User B enc A (m1-(r A +r B )) and enc A (m2-(1 / e rAx1 / e r B)) and send them to user A. User A's share is [a] A =(r A +r B )-m1 and [b] A =(1 / e r Ax1 / e r B)-m2.

[0126] Next, e x We present an approach to calculate User A is [x] A +[a] A where a is the first column and n is the nth column (n is a counter for each a that the system consumes across a row). User B: [x] B +[a] B where both parties learn x+a. e x User A's share of (e (x+a) )x[b] A and e x User B's share of (e (x+a) x[b] B )

[0127] Nest shows an example of a division algorithm for x / y. User A and User B generate two random numbers [r] A and [r] B Select , and jointly calculate yr and 1 / yr. User A and User B are [xr] A and [xr] B are calculated jointly. Divide user A's share by [xr] A / yr and User B's share is [xr] B / yr.

[0128] Because the sigmoid function consists of division and exponential functions, the system can calculate it as described above. This disclosure uses the exponential invention to then calculate the ReLU activation for the neural network. This is achieved by approximating ReLU via a sigmoid-like function. The ReLU function functions as a sigmoid-like function and can also be calculated as the derivative of the above idea. There are several possible approaches to calculating ReLU. First, both parties learn whether x is greater than or less than zero. If it is greater than zero, the parties do not change their shares. If it is less than zero, their shares are replaced with 0. This approach has several security issues. In another approach, the parties do not learn anything but operate at the gate level, which is slower.

[0129] In the fully connected layer 1104C, each layer acts as a matrix multiplication on the inputs, and SMPC supports addition and multiplication. To hide this layer, the system adds several dummy nodes with input weights equal to all zero, so that neither the weights nor the structure of the network are learned.

[0130] The basic idea of ​​a convolutional neural network is that the system does not need the output of the convolutional net until the next layer. The system can postpone multiplication communication. In other words, for each filter, f i For input I and I, the system can move the filter along and compute the multiplications in parts, or it can do whatever is necessary before communication to the next layer occurs.

[0131] 12 illustrates a method 1200 for processing a neural network according to the principles disclosed herein. In step 1202, the method includes dividing a plurality of filters in a first layer of the neural network into a first filter set and a second filter set. In step 1204, the method includes applying each of the first filter sets to an input of the neural network to generate a first output set, and in step 1206, obtaining a second output set associated with the second filter set, the second output set being based on application of each of the second filter sets to the input of the neural network. In step 1208, for each filter in the first filter set and the second filter set corresponding to the same filter from the plurality of filters, the method includes aggregating, in a second layer of the neural network, a respective one of the first output sets associated with the first filter in the filter set and a respective one of the second output sets associated with the second filter in the filter set to generate an aggregated output set associated with the first filter set and the second filter set. In step 1210, the method includes splitting weights of each activated specific neuron in each remaining layer of the neural network to generate a first set of weights and a second set of weights, where the specific neuron is activated based on one or more activation functions applied to the aggregated output set. In step 1212, the method includes applying, to each specific neuron from each remaining layer, a respective filter associated with each specific neuron and a first corresponding weight from the first weight set to generate a first set of neuron outputs. In step 1214, the method includes obtaining a second set of neuron outputs associated with the specific neuron, where the second set of neuron outputs is based on application of a respective filter associated with each specific neuron to a second corresponding weight from the second weight set.The method includes, in step 1216, for each particular neuron, aggregating one of the first set of neuron outputs associated with the particular neuron and one of the second set of neuron outputs associated with the particular neuron to generate an aggregated neuron output associated with the particular neuron, and in step 1218, generating an output of the neural network based on one or more of the aggregated neuron outputs.

[0132] In one aspect, the plurality of filters can include a plurality of filter values, with the first filter set including a first set of values ​​and the second filter set including a second set of values. As described above, the input of the neural network can include image data or any other type of data. The first output set can further include a first respective output from each filter in the first filter set.

[0133] In one embodiment, the first layer of the neural network can include a convolutional layer, and the neural network can include a convolutional neural network. However, as mentioned above, the present disclosure is not limited to a specific convolutional neural network. At least one remaining layer in the neural network can include at least one of a pooling layer, a normalization layer, a fully connected layer, and an output layer. The normalization layer can be one of the hidden layers. Training state-of-the-art deep neural networks can be computationally expensive. One way to reduce training time is to normalize the activity of neurons in the neural network. Batch normalization uses the distribution of the summed inputs to a neuron over a mini-batch of training cases to calculate the mean and variance and use this to normalize the summed inputs to that neuron for each training case. This significantly reduces the training time of a feedforward neural network. In one embodiment, using a normalization layer can stabilize the dynamics of the hidden state.

[0134] In another embodiment, the one or more activation functions may include at least one of a rectified linear unit function, a sigmoid function, a hyperbolic tangent function, and a softmax function.

[0135] The input of the neural network can include an image, and the output of the neural network can include at least one of an indication of one or more features detected in the image and / or a classification of one or more features in the image.

[0136] In another aspect, dividing the plurality of filters into a first filter set and a second filter set may include randomly dividing each filter in the plurality of filters into a set of first and second values ​​that, when combined, equal the value of the filter.

[0137] The method can further include transmitting the second filter set to a remote computing device and obtaining a second set of outputs associated with the second filter set from the remote computing device. In another aspect, the method can include transmitting the second set of weights to the remote computing device and obtaining a second set of neuron outputs associated with the particular neuron from the remote computing device.

[0138] FIG. 13 illustrates an exemplary computing system architecture for a system 1300 that may be used to process data operations and requests, store data content and / or metadata, and perform other computing operations. In this example, the components of the system 1300 communicate electrically with each other using a connection 1305, such as a bus. The system 1300 includes a processing unit (CPU or processor) 1310 and connections 1305 that couple various system components to the processor 1310, including memory 1315, such as read-only memory (ROM) 1320 and random access memory (RAM) 1325. The system 1300 may include a cache of high-speed memory directly connected to the processor 1310, in close proximity to the processor 1310, or integrated as part of the processor 1310. The system 1300 can copy data from the memory 1315 and / or storage device 1330 to a cache 1312 for quick access by the processor 1310. In this manner, the cache can provide a performance boost that avoids delays to the processor 1310 while waiting for data. These and other modules may control or be configured to control processor 1310 to perform various actions. Other memory 1315 may be available as well. Memory 1315 may include multiple different types of memory with different performance characteristics. Processor 1310 may include any general-purpose processor configured to control processor 1310, as well as hardware or software services, such as service 1 1332, service 2 1334, and service 3 1336, stored on storage device 1330, and special-purpose processors in which software instructions are embedded in the actual processor design. Processor 1310 may also be a completely self-contained computing system, including multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0139] To enable user interaction with computing system 1300, input device(s) 1345 can represent any number of input mechanisms, such as a microphone for speaking, a touch-sensitive screen for gesture or graphical input, a keyboard, a mouse, motion input, speech, etc. Output device(s) 1335 can also be one or more of several output mechanisms known to those skilled in the art. In some cases, a multimodal system can allow a user to provide multiple types of input to communicate with computing system 1300. Communications interface 1340 can generally orchestrate and manage user input and system output. There is no limitation to operation to any particular hardware arrangement, and therefore the basic features herein can be easily substituted with improved hardware or firmware arrangements as they are developed.

[0140] The storage device 1330 is a non-volatile memory and may be a hard disk or other type of computer-readable medium capable of storing data accessible by a computer, such as a magnetic cassette, a flash memory card, a solid-state memory device, a digital versatile disk, a cartridge, random access memory (RAM) 1325, read-only memory (ROM) 1320, and hybrids thereof.

[0141] The storage device 1330 may include services 1332, 1334, 1336 for controlling the processor 1310. Other hardware or software modules are contemplated. The storage device 1330 may be connected to the connection 1305. In one aspect, hardware modules that perform specific functions may include software components stored in a computer-readable medium in association with the necessary hardware components, such as the processor 1310, the connection 1305, the output device 1335, etc., to perform the functions.

[0142] For clarity of explanation, in some examples, the technology may be presented as including individual functional blocks, including devices, device components, method steps or routines implemented in software, or combinations of hardware and software.

[0143] In some embodiments, computer-readable storage devices, media, and memories can include cables or wireless signals containing bitstreams, etc. However, when referred to, non-transitory computer-readable storage media explicitly excludes media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0144] The methods according to the above-described examples can be implemented using computer-executable instructions stored on or otherwise available from a computer-readable medium. Such instructions can include, for example, instructions and data that cause or otherwise configure a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a particular function or group of functions. Portions of the computer resources used may be accessible over a network. The computer-executable instructions may be, for example, binaries, intermediate form instructions such as assembly language, firmware, or source code. Examples of computer-readable media that can be used to store instructions, information used, and / or information created during the methods according to the described examples include magnetic or optical disks, flash memory, USB devices with non-volatile memory, network storage devices, etc.

[0145] Devices implementing methods according to these disclosures can include hardware, firmware, and / or software and can take any of a variety of form factors. Typical examples of such form factors include laptops, smartphones, small form factor personal computers, personal digital assistants, rack-mounted devices, standalone devices, etc. The functionality described herein can also be embodied in peripheral devices or add-in cards. Such functionality can also be implemented on a circuit board among different chips or different processes running on a single device, as further examples.

[0146] The instructions, media for carrying such instructions, computational resources for executing them, and other structures for supporting such computational resources are means for providing the functionality described in these disclosures.

[0147] While various examples and other information have been used to describe aspects within the appended claims, those skilled in the art will be able to derive a wide variety of implementations using these examples, and therefore, no limitations on the claims are implied based on the specific features or arrangements of such examples. Moreover, while some subject matter may be described in language specific to example structural features and / or method steps, it should be understood that the subject matter defined in the appended claims is not necessarily limited to these described features or acts. For example, such functionality may be distributed differently or embodied in components other than those identified herein. Rather, the described features and steps are disclosed as example components of systems and methods within the appended claims.

[0148] Claim language reciting "at least one of" a set indicates that one member of the set or multiple members of the set satisfy the claim. For example, claim language reciting "at least one of A and B" means A, B, or A and B.

[0149] Statement Bank Statement 1. A method for implementing a system comprising the steps of: receiving, at a first entity via at least one processor, a first algorithm subset from an algorithm provider, the first algorithm subset representing a first portion of the algorithm that is less than the entire algorithm; receiving, at a second entity via at least one processor, a second algorithm subset from an algorithm provider, the second algorithm subset representing a second portion of the algorithm that is less than the entire algorithm, the second portion of the algorithm being different from the first portion of the algorithm; generating, via the first entity, two shares of the first mathematical set based on first parameters associated with the first algorithm subset; transmitting at least a portion of the two shares of the first mathematical set from the first entity to the second entity; a second algorithm for generating a second output subset based on the two shares of the second mathematical set; a second algorithm for generating a second output subset based on the two shares of the second mathematical set; a second algorithm for generating a second output subset based on the two shares of the second mathematical set; a second algorithm for generating a second output subset based on the two shares of the second mathematical set; a second algorithm for generating a second output subset based on the two shares of the second mathematical set;

[0150] Statement 2. The method of statement 1, wherein a first subset of algorithms from the algorithms is divided into a third subset of algorithms and a fourth subset of algorithms.

[0151] Statement 3. The method of any one of the preceding statements, wherein the first parameter includes a first characteristic of a first subset of algorithms and the second parameter includes a second characteristic of a second subset of algorithms.

[0152] Statement 4. The method of any one of the preceding statements, wherein the first parameter relates to a property of a first algorithm subset and the second parameter both relates to a property of a second algorithm subset.

[0153] Statement 5. The method of any one of the preceding statements, wherein the first split data subset is randomly generated as a portion of the complete data set.

[0154] Statement 6. The method of any one of the preceding statements, wherein the second split data subset is randomly generated as a portion of the complete data set.

[0155] Statement 7. The method of any one of the preceding statements, wherein the first entity and the second entity comprise one of two separate physical computing devices or two separate virtual computing devices.

[0156] Statement 8. The method of any one of the preceding statements, wherein the first mathematical set and the second mathematical set each comprise a Beaver set.

[0157] Statement 9. The method of any one of the preceding statements, wherein the first mathematical set and the second mathematical set each include an NxM matrix.

[0158] Statement 10. The method of any one of the preceding statements, wherein executing a first algorithm subset on a first split data subset based on two shares of a first mathematical set to generate a first output subset, and executing a second algorithm subset on a second split data subset based on two shares of a second mathematical set to generate a second output subset, occurs using memoization techniques.

[0159] Statement 11. A system including at least one processor and a computer-readable storage medium storing instructions that, when executed by the at least one processor, cause the at least one processor to perform one or more of the following actions in any order: receiving, at a first entity, a first algorithm subset from an algorithm provider, the first algorithm subset representing a first portion of the algorithm that is less than the entire algorithm; receiving, at a second entity, a second algorithm subset from an algorithm provider, the second algorithm subset representing a second portion of the algorithm that is less than the entire algorithm, the second portion of the algorithm being different from the first portion of the algorithm; generating, via the first entity, two shares of a first mathematical set based on first parameters associated with the first algorithm subset; transmitting at least a portion of the two shares of the first mathematical set from the first entity to a second entity; transmitting, via the second entity, at least a portion of the two shares of the first mathematical set. generating two shares of a second mathematical set based on second parameters associated with the algorithm subset; transmitting at least a portion of the two shares of the second mathematical set from the second entity to the first entity; receiving at the first entity a first split data subset of the complete data set; receiving at the second entity a second split data subset of the complete data set; running a first algorithm on the first split data subset based on the two shares of the first mathematical set to generate a first output subset; running a second algorithm on the second split data subset based on the two shares of the second mathematical set to generate a second output subset; and / or combining the first output subset and the second output subset.

[0160] Statement 12. The system of statement 11, wherein a first subset of algorithms from the algorithms is divided into a third subset of algorithms and a fourth subset of algorithms.

[0161] Statement 13. The system of any one of the preceding statements, wherein the first parameter includes a first characteristic of a first subset of algorithms and the second parameter includes a second characteristic of a second subset of algorithms.

[0162] Statement 14. The system of any one of the preceding statements, wherein the first parameter relates to a property of a first algorithm subset and the second parameters both relate to a property of a second algorithm subset.

[0163] Statement 15. The system of any one of the preceding statements, wherein the first split data subset is randomly generated as a portion of the complete data set.

[0164] Statement 16. The system of any one of the preceding statements, wherein the second split data subset is randomly generated as part of the complete data set.

[0165] Statement 17. The system of any one of the preceding statements, wherein the first entity and the second entity comprise one of two separate physical computing devices or two separate virtual computing devices.

[0166] Statement 18. The system of any one of the preceding statements, wherein the first mathematical set and the second mathematical set each include a Beaver set.

[0167] Statement 19. The system of any one of the preceding statements, wherein the first mathematical set and the second mathematical set each include an NxM matrix.

[0168] Statement 20. The system of any one of the preceding statements, wherein executing a first algorithm subset on a first split data subset based on the two shares of a first mathematical set to generate a first output subset, and executing a second algorithm subset on a second split data subset based on the two shares of a second mathematical set to generate a second output subset, occurs using memoization techniques.

Claims

1. 1. A method comprising: At the algorithm provider, dividing an algorithm into a first algorithm subset and a second algorithm subset, the first algorithm subset representing a first portion of the algorithm that is less than the entire algorithm, and the second algorithm subset representing a second portion of the algorithm that is less than the entire algorithm, the second portion of the algorithm being different from the first portion of the algorithm; receiving, at a first entity via at least one processor, the first subset of algorithms from the algorithm provider; receiving, at a second entity via at least one processor, the second algorithm subset from the algorithm provider, wherein the first entity does not receive the second algorithm subset and the second entity does not receive the first algorithm subset; generating, via the first entity, two shares of a first mathematical set based on first parameters associated with the first algorithm subset; transmitting at least a portion of the two shares of the first mathematical set from the first entity to the second entity; generating, via the second entity, two shares of a second mathematical set based on second parameters associated with the second algorithmic subset; transmitting at least a portion of the two shares of the second mathematical set from the second entity to the first entity; receiving, at the first entity, a first split data subset of a complete data set; receiving, at the second entity, a second split data subset of the complete data set, wherein the first split data subset of the complete data set and the second split data subset of the complete data set are generated by splitting the complete data set; at the first entity, executing the first subset of algorithms on the first split data subset based on the two shares of the first mathematical set to generate a first subset of output; at the second entity, executing the second subset of algorithms on the second split data subset based on the two shares of the second mathematical set to generate a second subset of output; combining, by the algorithm provider, the first output subset and the second output subset.

2. The method of claim 1 , wherein the first subset of algorithms from the algorithms is divided into a third subset of algorithms and a fourth subset of algorithms.

3. 2. The method of claim 1 , wherein the first parameter comprises a first characteristic of the first subset of algorithms related to the complexity of the first subset of algorithms, and the second parameter comprises a second characteristic of the second subset of algorithms related to the complexity of the second subset of algorithms.

4. 2. The method of claim 1, wherein the first parameter relates to a property of the first algorithm subset related to the secrecy of the first algorithm subset, and the second parameter both relates to a property of the second algorithm subset related to the secrecy of the second algorithm subset.

5. The method of claim 1 , wherein the first split data subset is randomly generated as part of the complete data set.

6. The method of claim 1 , wherein the second split data subset is randomly generated as part of the complete data set.

7. The method of claim 1 , wherein the first entity and the second entity comprise one of two separate physical computing devices or two separate virtual computing devices.

8. The method of claim 1 , wherein the first mathematical set and the second mathematical set each comprise a Beaver set.

9. The method of claim 1 , wherein the first mathematical set and the second mathematical set each include an N×M matrix.

10. 2. The method of claim 1, wherein executing the first algorithm subset on the first split data subset based on the two shares of the first mathematical set to generate the first output subset, and executing the second algorithm subset on the second split data subset based on the two shares of the second mathematical set to generate the second output subset, occurs using memoization techniques.

11. 1. A system comprising: Algorithm providers; a first entity; a second entity; The system comprises: at the algorithm provider, dividing algorithms into a first algorithm subset and a second algorithm subset, the first algorithm subset representing a first portion of the algorithm that is less than the entire algorithm, the second algorithm subset representing a second portion of the algorithm that is less than the entire algorithm, the second portion of the algorithm being different from the first portion of the algorithm; receiving, at the first entity, the first subset of algorithms from the algorithm provider; the second entity receives the second algorithm subset from the algorithm provider, the first entity does not receive the second algorithm subset, the second entity does not receive the first algorithm subset; generating, via the first entity, two shares of a first mathematical set based on first parameters associated with the first algorithm subset; transmitting at least a portion of the two shares of the first mathematical set from the first entity to the second entity; generating, via the second entity, two shares of a second mathematical set based on second parameters associated with the second algorithmic subset; transmitting at least a portion of the two shares of the second mathematical set from the second entity to the first entity; receiving, at the first entity, a first split data subset of the complete data set; receiving, at the second entity, a second split data subset of the complete data set, wherein the first split data subset of the complete data set and the second split data subset of the complete data set are generated by splitting the complete data set; at the first entity, executing the first subset of algorithms on the first split data subset based on the two shares of the first mathematical set to generate a first subset of output; at the second entity, executing the second subset of algorithms on the second split data subset based on the two shares of the second mathematical set to generate a second subset of output; A system configured to combine, by the algorithm provider, the first output subset and the second output subset.

12. The system of claim 11 , wherein the first subset of algorithms from the algorithms is divided into a third subset of algorithms and a fourth subset of algorithms.

13. 12. The system of claim 11, wherein the first parameter comprises a first characteristic of the first subset of algorithms related to a complexity of the first subset of algorithms, and the second parameter comprises a second characteristic of the second subset of algorithms related to a complexity of the second subset of algorithms.

14. 12. The system of claim 11, wherein the first parameter relates to a property of the first algorithm subset related to a secrecy of the first algorithm subset, and the second parameter both relates to a property of the second algorithm subset related to a secrecy of the second algorithm subset.

15. The system of claim 11 , wherein the first split data subset is randomly generated as part of the complete data set.

16. The system of claim 11 , wherein the second split data subset is randomly generated as part of the complete data set.

17. The system of claim 11 , wherein the first entity and the second entity comprise one of two separate physical computing devices or two separate virtual computing devices.

18. The system of claim 11 , wherein the first mathematical set and the second mathematical set each include a Beaver set.

19. The system of claim 11 , wherein the first mathematical set and the second mathematical set each include an N×M matrix.

20. 12. The system of claim 11, wherein executing the first algorithm subset on the first split data subset based on the two shares of the first mathematical set to generate a first output subset and executing the second algorithm subset on the second split data subset based on the two shares of the second mathematical set to generate a second output subset occurs using memoization techniques.

Images