Data processing method, apparatus, and system, device, medium, and program product

Abstract

A data processing method, comprising: receiving a first fragment among two fragments obtained by performing secret fragmentation on input data (S602); dividing an original calculation function for processing the input data into a non-linear function in a symmetric interval and a linear function in an asymmetric interval (S604); obtaining a first representation vector of the first fragment on the basis of a Fourier series expression of the non-linear function, sending to a second computing service provider a first ciphertext obtained by performing homomorphic encryption on the first representation vector, receiving a blinded ciphertext returned by the second computing service provider on the basis of the first ciphertext and a second fragment among the two fragments, and decrypting the blinded ciphertext to obtain a result fragment of the non-linear function corresponding to the first fragment (S606); and, on the basis of the result fragment of the non-linear function corresponding to the first fragment and a result fragment of the linear function corresponding to the first fragment, obtaining a first result fragment, which is used for, together with a second result fragment obtained by the second computing service provider on the basis of the second fragment, generating a computing result corresponding to the input data (S608).

Description

Data processing method, device, system, apparatus, medium and program product

[0001] The present application claims priority to the Chinese patent application No. 202411118116.5, filed on August 15, 2024, and entitled "Data processing method, device, system, apparatus, medium and program product", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of computers, and in particular to a data processing method, device, system, apparatus, medium and program product. BACKGROUND

[0003] Secure Multi-Party Computation (MPC) is a cryptographic technology that allows multiple computing service providers to use the same computing function to perform collaborative computation while ensuring that each computing service provider can only obtain its own computing result and cannot obtain the input and output data of other computing service providers through interaction data in the computing process, thereby ensuring data security.

[0004] At present, some computing services are becoming more and more popular, such as cloud computing, deep learning models or large model inference, etc. Users enjoy cloud computing services or model inference computing services, but do not want their data to be obtained and saved by computing service providers. How to ensure the normal operation of such computing services and guarantee data security is a continuous topic. In related technologies, secure multi-party computation is usually used for non-linear functions, which finds a polynomial approximation of the function in a certain interval, securely computes the polynomial, and obtains the approximate calculation result of the function in the interval. However, the power operation brought by the polynomial approximation of the function in a certain interval will increase the number of multi-party interactions, resulting in large computing cost and large communication cost. How to efficiently and quickly implement secure multi-party computation is a relatively difficult problem. SUMMARY

[0005] A data processing method, the method is executed by a first computing service provider of secure multi-party computation, comprising:

[0006] receiving a shard of input data, the shard of input data being a first shard of two shards obtained by a data provider by secret-sharding the input data;

[0007] segment the original calculation function for processing the input data according to intervals of a domain of the original calculation function, to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, obtain a Fourier series expression of the nonlinear function, and the range of the original calculation function has a boundary;

[0008] obtain a first feature vector of the first segment based on the Fourier series expression, send first ciphertext obtained by homomorphic encryption on the first feature vector to a second calculation service provider of secure multi-party computation, receive blinded ciphertext returned by the second calculation service provider according to the first ciphertext and a second segment of the two segments, and decrypt the blinded ciphertext to obtain a result segment corresponding to the nonlinear function of the first segment;

[0009] obtain a first result segment according to the result segment corresponding to the nonlinear function of the first segment and a result segment corresponding to the linear function of the first segment; and the first result segment is used to generate a calculation result corresponding to the input data together with a second result segment obtained by the second calculation service provider, wherein the second result segment is obtained by the second calculation service provider according to a result segment corresponding to the nonlinear function of the second segment and a result segment corresponding to the linear function of the second segment.

[0010] A data processing apparatus comprises:

[0011] a receiving module configured to receive a segment of input data, the segment of input data being a first segment of two segments obtained by a data provider by secret segmentation on the input data;

[0012] a segmenting module configured to segment an original calculation function for processing the input data according to intervals of a domain of the original calculation function, to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, obtain a Fourier series expression of the nonlinear function, and the range of the original calculation function has a boundary;

[0013] a first obtaining module configured to obtain a first feature vector of the first segment based on the Fourier series expression, send first ciphertext obtained by homomorphic encryption on the first feature vector to a second calculation service provider of secure multi-party computation, receive blinded ciphertext returned by the second calculation service provider according to the first ciphertext and a second segment of the two segments, and decrypt the blinded ciphertext to obtain a result segment corresponding to the nonlinear function of the first segment;

[0014] The second obtaining module is configured to obtain a first result slice according to a result slice corresponding to the nonlinear function of the first slice and a result slice corresponding to the linear function of the first slice; and the first result slice is used to generate a calculation result corresponding to the input data together with a second result slice obtained by the second calculation service provider, wherein the second result slice is obtained by the second calculation service provider according to a result slice corresponding to the nonlinear function of the second slice and a result slice corresponding to the linear function of the second slice.

[0015] A data processing method of segmenting an original calculation function according to intervals of a domain of the original calculation function, the method being performed by a data provider of secure multi-party computation, and the method comprising:

[0016] secretly slicing input data to obtain a first slice and a second slice, sending the first slice to a first calculation service provider of the secure multi-party computation, and sending the second slice to a second calculation service provider of the secure multi-party computation;

[0017] The first calculation service provider segments the original calculation function according to intervals of a domain of the original calculation function to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval after obtaining the first slice, obtains a Fourier series expression of the nonlinear function, the range of the original calculation function has a boundary, and obtains a first feature vector of the first slice based on the Fourier series expression, sends first ciphertext obtained by homomorphic encryption of the first feature vector to the second calculation service provider of the secure multi-party computation, receives blinded ciphertext returned by the second calculation service provider according to the first ciphertext and the second slice, decrypts the blinded ciphertext to obtain a result slice corresponding to the nonlinear function of the first slice, and obtains a first result slice according to the result slice corresponding to the nonlinear function of the first slice and a result slice corresponding to the linear function of the first slice; the second calculation service provider obtains a second result slice according to a result slice corresponding to the nonlinear function of the second slice and a result slice corresponding to the linear function of the second slice after obtaining the second slice;

[0018] obtaining the first result slice returned by the first calculation service provider and the second result slice returned by the second calculation service provider, and generating a calculation result corresponding to the input data according to the first result slice and the second result slice.

[0019] A data processing apparatus comprises:

[0020] a fragmentation module, configured to secret fragment input data to obtain a first fragment and a second fragment, and send the first fragment to a first computing service provider of secure multi-party computation and send the second fragment to a second computing service provider of the secure multi-party computation;

[0021] The first computing service provider is configured to, after obtaining the first fragment, segment an original computing function used for processing the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, obtain a Fourier series expression of the nonlinear function, the range of the original computing function has a boundary, and obtain a first representation vector of the first fragment based on the Fourier series expression, send first ciphertext obtained by homomorphic encryption of the first representation vector to the second computing service provider of the secure multi-party computation, receive blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second fragment, decrypt the blinded ciphertext to obtain a result fragment corresponding to the nonlinear function of the first fragment, and obtain a first result fragment according to the result fragment corresponding to the nonlinear function of the first fragment and a result fragment corresponding to the linear function of the first fragment; and the second computing service provider is configured to, after obtaining the second fragment, obtain a second result fragment according to a result fragment corresponding to a nonlinear function of the second fragment and a result fragment corresponding to a linear function of the second fragment.

[0022] a generation module, configured to obtain the first result fragment returned by the first computing service provider and the second result fragment returned by the second computing service provider, and generate a computing result corresponding to the input data according to the first result fragment and the second result fragment.

[0023] A data processing system, the system comprising a data provider, a first computing service provider and a second computing service provider of secure multi-party computation:

[0024] The data provider is configured to secret fragment input data to obtain a first fragment and a second fragment, send the first fragment to the first computing service provider of the secure multi-party computation, and send the second fragment to the second computing service provider of the secure multi-party computation.

[0025] The first computing service provider is configured to receive the first fragment sent by the data provider, segment an original computing function used for processing the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, obtain a Fourier series expression of the nonlinear function, and the range of the original computing function has a boundary.

[0026] The first computing service provider is further configured to obtain a first feature vector of the first shard based on the Fourier series expression, and send first ciphertext obtained by homomorphic encryption of the first feature vector to a second computing service provider of the secure multi-party computation;

[0027] The second computing service provider is configured to receive the second shard sent by the data provider, obtain the first ciphertext sent by the first computing service provider, determine blinded ciphertext based on the first ciphertext and the second shard, and return to the first computing service provider;

[0028] The first computing service provider is further configured to receive the blinded ciphertext returned by the second computing service provider, decrypt the blinded ciphertext, and obtain a result shard of the first shard corresponding to the nonlinear function;

[0029] The first computing service provider is further configured to obtain a first result shard based on the result shard of the first shard corresponding to the nonlinear function and the result shard of the first shard corresponding to the linear function, and send the first result shard to the data provider;

[0030] The second computing service provider is configured to obtain a second result shard based on the result shard of the second shard corresponding to the nonlinear function and the result shard of the second shard corresponding to the linear function, and send the second result shard to the data provider;

[0031] The data provider is further configured to obtain the first result shard and the second result shard, and generate a computing result corresponding to the input data based on the first result shard and the second result shard.

[0032] A computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above data processing method when executing the computer readable instructions.

[0033] A computer readable storage medium having stored thereon computer readable instructions, the computer readable instructions being executed by a processor to implement the steps of the above data processing method.

[0034] A computer program product includes computer readable instructions, the computer readable instructions being executed by a processor to implement the steps of the above data processing method. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application or the related art. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained based on these drawings without creative labor.

[0036] FIG. 1 is a schematic diagram of a floating-point number encoding process in an embodiment;

[0037] FIG. 2 is a schematic diagram of a two-party truncation process in an embodiment;

[0038] FIG. 3 is a schematic diagram of interaction between a data owner and a data provider in the related art;

[0039] FIG. 4 is a schematic diagram of secure computation in an embodiment;

[0040] FIG. 5 is an application environment diagram of a data processing method in an embodiment;

[0041] FIG. 6 is a flowchart of a data processing method in an embodiment;

[0042] FIG. 7 is a flowchart of a first result shard determination step in an embodiment;

[0043] FIG. 8 is a flowchart of a first result shard determination step in another embodiment;

[0044] FIG. 9 is a flowchart of a second result shard determination step in an embodiment;

[0045] FIG. 10 is a flowchart of a data processing method in another embodiment;

[0046] FIG. 11 is a schematic diagram of a data processing system in an embodiment;

[0047] FIG. 12 is a schematic diagram of a data processing process in an embodiment;

[0048] FIG. 13 is a structural block diagram of a data processing apparatus in an embodiment;

[0049] FIG. 14 is a structural block diagram of a data processing apparatus in another embodiment;

[0050] FIG. 15 is an internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present application clearer, the following will further describe the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0052] Before introducing the present application, the terms involved are explained:

[0053] Encode: input a floating-point number x∈R and a stretching factor Δ∈R, calculate i.e. multiply Δ and x and round off, here it is required that the absolute value of t cannot exceed 2 l-1 When t≥0, output Otherwise output The encoding process is recorded as: t=Encode(x,Δ).

[0054] As shown in FIG. 1, it is a schematic diagram of the floating-point number encoding process in an embodiment. For a floating-point number x, including an integer part and a decimal part, after floating-point number encoding, 64 bits are obtained, wherein the 64 bits contain a stretching factor Δ.

[0055] Decode: input and a stretching factor Δ∈R, if t≥0 and t<2 l-1 , output x=t / Δ; otherwise output x=(t-p) / Δ, the decoding process is recorded as: x=Decode(t,Δ).

[0056] Two-party secret fragmentation of data: after floating-point number x∈R is encoded, the element in is obtained. Party A obtains Party B obtains Here it is required that Encode(x,Δ)=(x A +x B )mod 2 l . Then (x A ,x B ) is called two-party fragmentation of floating-point number x∈R, recorded as <x>Represents the secret slice (x) of a floating-point number x∈R A ,x B Secret partitioning generally exhibits linear properties (also known as linearity). For example, the superposition of a partition of a floating-point number x ∈ R with a partition of another floating-point number y yields a partition of data z, i.e. <x> + <y> ＝ <z>; and, for example, the slicing of a floating-point number x e R by the product of a constant γ is equivalent to the slicing of the product of the floating-point number x e R by the constant, i.e., γ · <x>= < γ · x >. mod is the modulo operation.

[0057] Two-party secure comparison: Given a constant a and secret shares of an input floating-point number x = (x A ,x B ), i.e. A inputs x A , B inputs x B , outputs shares (b A ,b B ), i.e. A gets b A , B gets b B , such that where, is the XOR operation, for example, means x < a is true, otherwise, means x < a is false.

[0058] Two-party secure mux (multiplexer): Given secret shares of an input floating-point number b = (b A ,b B ), shares of x = (x A ,x B ) and y = (y A ,y B ), where A owns and inputs (b A ,x A ,y A ), B owns and inputs (b B ,x B ,y B ), outputs shares of another floating-point number z = (z A ,z B ), such that A can get Z A , B can get Z B , and . For example, if then z A +z B = (x A +x B ) mod 2 l , i.e. the shares of z are determined by the shares of x, if then z A +z B = (y A +y B ) mod 2 l , i.e. the shares of z are determined by the shares of y. That is, according to the XOR result of the two shares of b, from the shares of x and y, the shares of one floating-point number are selected to determine the shares of z, denoted as <z>=mux( , <x> , <y>), at which time the last two terms in mux(.) can be combined as follows: <x>and <y>, respectively, as two paths, based on the first term in mux(.): Select one of the two paths to determine the slice of z.

[0059] Two-party Truncate operation: Given the slice of input floating-point number x e R (x A , x B ) and a constant f, i.e. A-party input x A , B-party input x B , output slice (y A , y B ), i.e. A-party gets y A , B-party gets y B , such that y A +y B =Encode(Decode(x, Delta) / 2 l , Delta), i.e. Decode(x, Delta) is converted to binary, then truncated to the left 2 l bits (i.e. left shift 2 l bits), then encoded by the stretching factor to get y A +y B . Thus, the lower f (i.e. 2 l ) bits of x are truncated. Two-party Truncate operation generally needs two-party secure comparison as a submodule.

[0060] Two-party secure multiplication: Let A-party have x, B-party have y, after secure computation, A-party gets Z A , B-party gets z B , such that x y = (z A +z B ) mod 2 l .

[0061] Wherein, generally, two-party secure multiplication needs to use multiplication triplets, i.e. A-party has random numbers a and c A , B-party has random numbers b and c B , satisfying c A +c B =a b mod 2 l . Under the premise of having multiplication triplets, the calculation process of slice multiplication is as follows: A-party calculates t0=a+x mod 2 l and sends it to B-party; B-party calculates t1=b+y mod 2 l , and B-party sends it to A-party, then A-party calculates z A =x t1+c0 mod 2 l , B-party calculates z B =c1-t0 b mod 2 l . <z> ＝ <x> · <y>Its implementation requires the use of two multiplications triplets. Note that <x>and <y>is the secret share of floating-point number x after encoding, as shown in FIG. 2, which is a schematic diagram of a two-party truncation process in an embodiment, after floating-point number x and floating-point number y are multiplied by secure multiplication, the stretching factor Δ1 in the result is Δ 2 , that is, before and after multiplication, the stretching factor becomes Δ 2 At this time, Δ 2 needs to be changed to Δ by secure Truncate, here Δ = 2 f is required, and the truncation length of Truncate is f, and the stretching factor Δ2 in the result after truncation is Δ.

[0062] Fully homomorphic encryption: the encryption algorithm has the homomorphic property, that is, after the homomorphic addition of two ciphertexts Enc(x) and Enc(y), the result Emc(x+y) is obtained, that is, the ciphertext corresponding to the plaintext (x+y); after homomorphic multiplication, Enc(x*y) is obtained, that is, the ciphertext corresponding to the plaintext (x*y). The fully homomorphic encryption algorithm based on the RLWE (Ring Learning with Errors) assumption is defined on the polynomial residue class ring R q = Z q [X] / (X N +1), where Z q [X] represents the set of polynomials with coefficients X in Z q , at this time, the plaintext is a polynomial with algebraic degree less than N, where N is a power of 2. Taking the BGV (a kind of homomorphic encryption algorithm) fully homomorphic encryption algorithm as an example, the ciphertext is (ct0, ct1) ∈ R q × R q , the private key is sk ∈ R3, which satisfies ct0+ct1·sk=m0+p·e, where p ∈ Z is the plaintext modulus, m0 is the plaintext polynomial, each coefficient of which does not exceed p, e is an error polynomial, which can also be understood as noise, each component of which obeys a discrete Gaussian distribution χ σ When p≡1 mod 2N and p is a prime number, the plaintext polynomial m corresponds to N elements on Z p , and the addition (multiplication) of plaintext polynomials corresponds to the addition (multiplication) of the components of .

[0063] In the related art, a party owning data wants to get a computing result or an inference result about the data by means of a computing service or an inference service provided by a computing service provider, at this time, the party owning the data as a data provider sends the owned data to the computing service provider, as shown in FIG. 3, which is an interaction diagram of a data owning party and a data providing party in the related art. Then, the computing service provider performs outsourcing computing or AI (Artificial Intelligence) inference (such as deep learning or large language model), specifically, the function involved in outsourcing computing or AI inference is used to calculate the obtained data to obtain a computing result, and the computing result is returned to the data providing party, and the computing service provider does not know the input, output and intermediate result throughout the process.

[0064] For example, as shown in FIG. 4, which is a schematic diagram of secure multi-party computation in an embodiment, the data providing party secretly shares data data1 to datak to the computing service provider, and the computing service provider respectively performs secure linear computation, secure nonlinear computation, …, secure linear computation, secure nonlinear computation based on the obtained sensitive data data1 to datak, obtains k computing results, and sends the k computing results to the data providing party, for example, the secure nonlinear computation is a common complex function such as sigmoid function, arctan function, gelu function. That is, the computation performed can be linear function computation (secure linear computation) or nonlinear function computation (secure nonlinear computation).

[0065] Among them, the linear function computation can be directly calculated by using the linear property of the secret fragmentation, for example, see the explanation of the linear property in the secret fragmentation of the two parties in the foregoing.

[0066] The nonlinear function computation can be divided into polynomial computation and non-polynomial computation. Among them, for the polynomial computation, the secret fragmentation can be used to calculate the secret polynomial computation. A polynomial of algebraic degree n generally needs n-2 secret fragmentations, that is, about 2(n-2) multiplication triplets and about log2n interaction rounds. It is worth mentioning that the greater the power index, the greater the result of the power operation, and there is a risk of exceeding the modulus 2 of the lth power, which may lead to incorrect calculation results, wherein the range of the input x and the algebraic degree should not be too large.

[0067] For non-polynomial calculation, one method is to find a polynomial approximation of the function in a certain interval, to securely compute the polynomial, and to obtain the approximate calculation result of the function in the interval. Another method is to convert it into a Boolean circuit, and then perform the calculation using a garbled circuit. The precision of the polynomial approximation method is generally not as good as that of the Boolean circuit description method. However, the Boolean circuit description leads to a large amount of calculation or communication, which makes it difficult to use in practice. In order to ensure high precision, the approximation polynomial generally has a high algebraic degree, which means that the selected interval for function approximation cannot be too large.

[0068] Taking the sigmoid function as an example, when using polynomial approximation, if the approximation interval is large, the algebraic degree of the selected polynomial is generally high, although the precision is high, but it is easy to cause the problem of out-of-bound (exceeding the modulus 2 l ); When the approximation interval is small, the algebraic degree of the selected polynomial is generally small, but the approximation effect in the remaining interval is not necessarily good (for example, the value of (-∞, -τ] is selected as ε, then the error between ∈ and the value of the sigmoid function at -τ is high). If the out-of-bound problem can be solved (for example, the algebraic degree is k, then it is required that 2 l > Δ·τ k At the same time, after each secure multiplication, a secure Truncate operation needs to be called once), the higher the algebraic degree of the polynomial, the more the number of interaction rounds, and the more the number of interaction rounds required for secure power calculation using secret sharing (related to the logarithm of the algebraic degree), and the larger the communication amount (related to the algebraic degree). Specifically, the number of multiplication triplets generated and the number of secure comparisons required for secure Truncate will increase linearly with the increase of the algebraic degree. Therefore, the calculation or communication overhead will increase.

[0069] In summary, in the related art, it is a relatively difficult problem to ensure high precision and efficient and fast implementation of secure multi-party computation based on secret sharing.

[0070] Therefore, the embodiment of the present application provides a data processing method. After a first computing service provider of secure multi-party computation receives a first shard of input data, the first shard is processed by using an original computing function with a bounded value domain. First, the first computing service provider segments the original computing function used for processing the input data according to intervals of a definition domain of the original computing function, to obtain a non-linear function in a symmetric interval and a linear function in an asymmetric interval. For the non-linear function, to avoid power operation caused by using a polynomial to approximate the non-linear function, a Fourier series is used to approximate the non-linear function, which can reduce the overhead and communication overhead. Then, the first computing service provider obtains a first representation vector of the first shard based on a Fourier series expression, and sends first ciphertext obtained by homomorphic encryption of the first representation vector to a second computing service provider of secure multi-party computation. The first computing service provider decrypts blinded ciphertext returned by the second computing service provider according to the first ciphertext and a second shard of two shards, to obtain a result shard of the non-linear function corresponding to the first shard. The first computing service provider obtains a first result shard according to the result shard of the non-linear function corresponding to the first shard and a result shard of the linear function corresponding to the first shard. By converting the value of the first shard of the input data on the Fourier series to homomorphic calculation, the computing process can be simplified. According to the first result shard and a second result shard obtained by the second computing service provider (the second result shard is obtained by the second computing service provider according to a result shard of a non-linear function corresponding to the second shard and a result shard of a linear function corresponding to the second shard), the data provider can more quickly determine the computing result corresponding to the input data. In this way, the secure multi-party computation is efficiently and quickly implemented.

[0071] The data processing method provided by the embodiment of the present application can be applied to an application environment as shown in FIG. 5. The data provider 502 communicates with the first computing service provider 504 through a network, the data provider 502 communicates with the second computing service provider 506 through a network, and of course, the first computing service provider 504 and the second computing service provider 506 can also communicate through a network. The data provider 502 can be a terminal or a server for providing data. The first computing service provider 504 and the second computing service provider 506 are two different computing service providers, and both can provide computing services, for example, cloud computing services or inference services. The first computing service provider 504 and the second computing service provider 506 can be regarded as servers.

[0072] In one embodiment, the data provider 502, the first computing service provider 504 and the second computing service provider 506 participating in secure multi-party computation are taken as an example for illustration. The data provider 502 secretly shards the input data to obtain a first shard and a second shard, and sends the first shard and the second shard to the first computing service provider 504 and the second computing service provider 506 respectively.

[0073] The first computing service provider 504 segments the original computing function for processing the input data according to intervals of a definition domain of the original computing function, to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, and obtains a Fourier series expression of the nonlinear function, and the range of values of the original computing function has a boundary. The first computing service provider 504 obtains a first representation vector of the first shard based on the Fourier series expression, and sends first ciphertext obtained by homomorphic encryption of the first representation vector to the second computing service provider 506 of the secure multi-party computation.

[0074] The second computing service provider 506 determines blinded ciphertext according to the first ciphertext and the second shard, and returns to the first computing service provider 504. The second computing service provider 506 also obtains a second result shard according to the second shard, and sends the second result shard to the data provider 502.

[0075] The first computing service provider 504 decrypts the blinded ciphertext to obtain a result shard of the nonlinear function corresponding to the first shard, and obtains a first result shard according to the result shard of the nonlinear function corresponding to the first shard and a result shard of the linear function corresponding to the first shard, and sends the first result shard to the data provider 502.

[0076] The data provider 502 generates a computing result corresponding to the input data according to the first result shard and the second result shard.

[0077] In other embodiments, the data provider 502 can also be regarded as a computing service provider, that is, it involves interaction on both ends. Referring to FIG. 4, in this embodiment, the computing service provider in FIG. 4 is the first computing service provider 504. At this time, the data provider 502 sends the first shard to the first computing service provider 504 after obtaining the first shard and the second shard, and the first computing service provider 504 sends the first ciphertext to the data provider 502 after obtaining the first shard, as described above.

[0078] The data provider 502 determines blinded ciphertext according to the first ciphertext and the existing second shard, and sends the blinded ciphertext to the first computing service provider 504, and the first computing service provider 504 determines the first result shard based on the obtained blinded ciphertext, and returns to the data provider 502, as described above.

[0079] The data provider 502 obtains a second result shard according to the existing second shard, and generates a calculation result corresponding to the input data according to the second result shard and the obtained first result shard.

[0080] In some other embodiments, in order to improve the operation efficiency of the calculation service provider, any two calculation service providers are taken as a group of calculation service providers, for example, the first calculation service provider 504 and the second calculation service provider 506 are taken as a group of calculation service providers. Each group of calculation service providers can batch process the outsourcing calculation of multiple data providers.

[0081] Referring to FIG. 5, the data provider 502 has a first shard and a second shard of input data data1, and sends the first shard of the input data data1 to the first calculation service provider 504 and the second shard of the input data data1 to the second calculation service provider 506; at the same time, the data provider 508 has a first shard and a second shard of input data data2, and sends the first shard of the input data data2 to the first calculation service provider 504 and the second shard of the input data data2 to the second calculation service provider 506.

[0082] After the first calculation service provider 504 determines the first characteristic vector of each first shard, the first calculation service provider 504 can simultaneously homomorphically encrypt the two first characteristic vectors to obtain a ciphertext matrix, the ciphertext matrix including the first ciphertext corresponding to each first shard, at this time, the ciphertext matrix is sent to the second calculation service provider 506, the second calculation service provider 506 obtains each first ciphertext from the ciphertext matrix, and determines the corresponding blinded ciphertext by using the corresponding second ciphertext, and sends the two blinded ciphertexts to the first calculation service provider 504, the first calculation service provider 504 processes each blinded ciphertext to obtain the first result shard corresponding to each first shard, and the second calculation service provider 506 determines the corresponding second result shard based on each second shard.

[0083] In this way, batch processing of the data processing requirements of multiple data providers is realized, and the data processing efficiency is improved. The data provider 508 can also be a server and communicate with the first calculation service provider 504 and the second calculation service provider 506 respectively.

[0084] The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle-mounted device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0085] In an exemplary embodiment, as shown in FIG. 6, a data processing method is provided, which is taken as an example of being executed by the first computing service provider 504 in FIG. 5, and includes the following steps S602 to S608. Among them:

[0086] Step S602, receiving a shard of input data, the shard of input data being a first shard of two shards obtained by a data provider performing secret sharding on input data.

[0087] The input data is data to be input into a function for function calculation. Exemplarily, the function calculation can be a process of cloud computing or model inference. The input data can be a floating-point number or a non-floating-point number, and the specific type is not limited.

[0088] The input data can be business data belonging to a specific business scenario.

[0089] For example, in a financial scenario, a financial institution hopes to evaluate the credit of a customer without revealing the customer's privacy. The server of the financial institution can be regarded as a data provider, and the financial data (such as expenditure data, etc.) of any customer of the financial institution can be regarded as input data.

[0090] For another example, in a medical scenario, a computer device of a medical institution is regarded as a data provider, and an artificial intelligence model is used to assist in diagnosing a target object. The medical data (such as medical records, object information) of the target object is regarded as input data of the medical scenario.

[0091] For another example, in a content pushing scenario such as video pushing, audio pushing, etc., a content platform is regarded as a data provider, and an artificial intelligence model is used to push content to a target object. The interaction data (such as content attention data, content purchase data) of the target object is regarded as input data of the content pushing scenario.

[0092] In some embodiments, the input data can be split into multiple pieces of data by a data provider participating in secure multi-party computation, each piece of data being regarded as a shard, for example, the input data is split into a first shard and a second shard. The first shard and the second shard both belong to a part of the input data.

[0093] Exemplarily, in secure multi-party computation, a data provider participating in secure multi-party computation generates a first shard and a second shard according to the input data through secret sharing, wherein the secret sharing includes an arithmetic secret sharing for generating an arithmetic shard. For example, the input data is a number on a fixed ring , the input data is split into two arithmetic shards, i.e., a first shard x A and a second shard x B . The first shard x A and the second shard x B are also numbers on the fixed ring.

[0094] The first shard and the second shard are respectively transmitted to different computing service providers, for example, a first computing service provider obtains the first shard, and a second computing service provider obtains the second shard.

[0095] In step S604, the original computing function for processing the input data is segmented according to the interval of the domain of definition to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, and a Fourier series expression of the nonlinear function is obtained, and the range of the original computing function has a boundary.

[0096] The original computing function can be a common complex function such as a sigmoid function, an arctan function, a gelu function, etc.

[0097] The interval of the domain of definition of the original computing function includes a symmetric interval, for example, it can be [-τ,τ], it can be [-τ, +∞), and (-∞,τ], or it can be (-∞,∞).

[0098] According to the interval of the domain of definition, the original computing function can be divided into multiple segments, that is, the original computing function includes a nonlinear function in a symmetric interval, and the relationship between the dependent variable and the independent variable in the nonlinear function is not a linear relationship, but a very complex nonlinear relationship.

[0099] For example, the original computing function is a gelu function, the interval of the domain of definition is [-τ, +∞), and the domain of definition is divided into multiple intervals, and the original computing function is segmented according to the interval of the domain of definition of the original computing function to obtain a nonlinear function in [-τ,τ] and a linear function in [τ, +∞).

[0100] In other embodiments, the original calculation function can also be segmented according to the interval of the domain of definition to obtain a nonlinear function in a symmetric interval and a constant function in an asymmetric interval. Taking the original calculation function as a sigmoid function as an example, the interval of the domain of definition is (-∞, +∞), wherein the original calculation function is segmented according to the interval of the domain of definition to obtain a nonlinear function in [-τ, τ], a constant function 1 in (-∞, -τ], and a constant function 2 in [τ, +∞). The value in (-∞, -τ] is always constant 1, and the value in [τ, +∞) is always constant 2.

[0101] The range of the original calculation function has a boundary, such as not exceeding the modulus 2 l .

[0102] As described above, when a polynomial is used to represent (approximate) a nonlinear function, the calculation cost is large due to the high algebraic degree of the polynomial. At this time, a Fourier series expression is used to represent the nonlinear function, and the Fourier series expression is shown in formula (1):

[0103] wherein w i is the coefficient of the i-th Fourier series, |w i |≤1, and L is a constant. It should be noted that L is a different constant from l in the foregoing description, and x is the independent variable.

[0104] In step S606, the first representation vector of the first segment is obtained based on the Fourier series expression. The first ciphertext obtained by homomorphic encryption of the first representation vector is sent to the second calculation service provider of the secure multi-party computation. The blinded ciphertext returned by the second calculation service provider according to the first ciphertext and the second segment of the two segments is received. The blinded ciphertext is decrypted to obtain the result segment of the nonlinear function corresponding to the first segment.

[0105] Before describing the first representation vector of the first segment, the association between the first segment and the second segment of the input data and the sine term is introduced.

[0106] As described above, for an input data x, secret sharing is performed to obtain a first segment x A and a second segment x B . Assuming that x A +x B =x mod 2 l , then x=d·2 l +(x A +x B ), d∈{-1,0}, l≥L. The sine term can be derived as formula (2) as follows:

[0107] Thus, the sine term may be considered as an inner product of a vector factor and a vector factor .

[0108] Since the Fourier series expression may be considered as a superposition of a plurality of expansion terms, each expansion term can be regarded as a sine term, such as the expansion term of the i-th term Thus, the Fourier series expression can be converted into an inner product of a first original vector originating from the first computing service provider and a second original vector originating from the second computing service provider.

[0109] wherein the first original vector comprises n first vector factors, each first vector factor comprising two corresponding components corresponding to the first original vector, such as the first original vector wherein the first first vector factor is the second first vector factor is the n-th first vector factor is x1 is an independent variable of the first original vector (may be regarded as an independent variable of each first vector factor), which can be a shard of a certain input data owned by the first computing service provider, i.e., a first shard.

[0110] wherein the second original vector comprises n second vector factors, each second vector factor comprising two components corresponding to the second original vector, such as the second original vector wherein the first second vector factor is the n-th second vector factor is x2 is an independent variable of the second original vector (may be regarded as an independent variable of each second vector factor), which can be another shard of a certain input data owned by the second computing service provider, i.e., a second shard.

[0111] In some embodiments, the Fourier series expression is a superposition of a plurality of expansion terms, each expansion term being an inner product of a first vector factor and a second vector factor. Obtaining a first representation vector of the first shard based on the Fourier series expression comprises: inputting the first shard to the first vector factor in each expansion term to obtain the first representation vector of the first shard.

[0112] As described above, each expansion term can be considered as a product of a first vector factor of the same serial number and a second vector factor, such as the product of the first first vector factor and the first second vector factor being the first expansion term, and such as the product of the i-th first vector factor and the i-th second vector factor being the i-th expansion term.

[0113] The first computing service provider inputs the first shard x A As the independent variable of the first original vector, each variable is substituted into the first vector factor of the first original vector to obtain the first representation vector, i.e.

[0114] In other examples, the second computing service provider will use the second shard x B As the independent variable of the second original vector, each variable is substituted into the second vector factor of the second original vector to obtain the second representation vector, i.e.

[0115] In this embodiment, when approximating the nonlinear function using a Fourier series expression, each expansion term is regarded as the inner product of the first vector factor and the second vector factor. In this way, the first computing service provider can determine the first representation vector based on the obtained first slice. As a result, the nonlinear function can be converted into the product of the first representation vector and the second representation vector without the need for exponentiation, thus reducing the computational overhead.

[0116] The first ciphertext is the ciphertext obtained by the first computing service provider through homomorphic encryption based on the first fragment.

[0117] In some embodiments, the step of homomorphically encrypting the first representation vector to obtain the first ciphertext includes: performing floating-point encoding on each component of the first representation vector to obtain a first encoding vector; and performing homomorphic encryption on each component of the first encoding vector to obtain the first ciphertext.

[0118] For ease of explanation, the first component of the first representation vector is referred to as... Treat it as a0, and treat the second component as a0. Consider it as a1, ..., and the 2nth component Considered as a m-1 The first representation vector (a0, a1, ..., a) is obtained. m-1 The range of the first representation vector is [-1, 1]. m .

[0119] For example, the first computing service provider provides a first representation vector (a0, a1, ..., a...). m-1 Each component in (x0, ..., x) is encoded using floating-point numbers to obtain the first encoded vector, i.e., (x0, ..., x). i ... x m-1 Each component in the first encoding vector belongs to Z. p (The set of integers modulo p) can be understood to mean that, at this point, the first encoded vector belongs to The first computing service provider obtains noise (random polynomial) and, based on the noise and the first encoding vector, performs homomorphic encryption using a public key to obtain the first ciphertext. The first ciphertext comprises m ciphertexts (i.e., Enc1, ..., Enc...). m ).

[0120] In this embodiment, the first computing service provider encodes each component in the first representation vector using floating-point numbers and then performs homomorphic encryption to obtain the first ciphertext. In this way, based on the homomorphic property of homomorphic encryption, the first ciphertext can be directly subjected to corresponding homomorphic operations without decryption, thus improving the convenience of data processing.

[0121] Blinded ciphertext refers to the ciphertext obtained after blinding processing. The result slice of the nonlinear function corresponding to the first slice refers to the result obtained by the first computing service provider after calculating the nonlinear function using the first slice. Blinding processing refers to generating "blinded ciphertext" after data encryption through mathematical transformations (such as multiplication masking, random perturbation), so that it hides the original information but retains computability. In some embodiments, the step of the second computing service provider calculating the blinded ciphertext based on the first ciphertext and the second slice of the two slices includes: obtaining the second representation vector of the second slice based on the Fourier series expression; performing floating-point encoding on each component of the second representation vector to obtain the second encoding vector; performing homomorphic multiplication on the first ciphertext and the second encoding vector to obtain the second ciphertext; and performing blinding processing on the second ciphertext based on random numbers to obtain the blinded ciphertext.

[0122] In this context, after the second computing service provider determines the second representation vector, for ease of explanation, the first component of the second representation vector is... Consider it as b0, ..., and the 2nth component Considered as b m-1 The second representation vector (b0, b1, ..., b) is obtained. m-1 The second representation vector takes values ​​in the range [-1, 1]. m .

[0123] The second computing service provider provides the second representation vector (b0, b1, ..., b) m-1 Each component in the vector is encoded using floating-point numbers to obtain the second encoded vector, i.e., (y0, ..., y0). i ... y m-1 After the second computing service provider receives the first ciphertext sent by the first computing service provider, the second computing service provider performs a homomorphic multiplication of each vector (which can be considered as plaintext) in the second encoded vector with the ciphertext in the first ciphertext, resulting in m ciphertexts, namely Enc1·y0, ..., Enc m ·y m-1 Then, summing these m ciphertexts using a homomorphic method is equivalent to... The corresponding ciphertext, i.e., the second ciphertext Enc., wherein p is the plaintext modulus.

[0124] The second computing service provider randomly obtains a random number as a first random number r used for blinding, and blinds the second ciphertext using the first random number to obtain blinded ciphertext Enc * For example, the second ciphertext is homomorphically subtracted from the first random number r to obtain the blinded ciphertext Enc * The blinded ciphertext Enc * is used for sending to the first computing service provider.

[0125] It should be noted that based on the homomorphic property of the homomorphic encryption algorithm, the blinded ciphertext Enc * corresponds to the plaintext

[0126] In this embodiment, the second computing service provider performs homomorphic multiplication on the first ciphertext and the second encoding vector to obtain the second ciphertext. Based on the homomorphic property of homomorphic encryption, it can be known that the second ciphertext is essentially ciphertext related to the product of the first encoding vector and the second encoding vector. Then, the blinding of the second ciphertext is implemented based on the random number to strengthen the privacy protection of the second ciphertext and ensure data security.

[0127] In some embodiments, the first random number r can only blind the plaintext part in the second ciphertext. At this time, a second random value r2 is randomly selected, and r2 is directly used as the first random number.

[0128] Of course, the plaintext part and the noise part in the second ciphertext can also be blinded at the same time. In some embodiments, the random number determination step includes: obtaining an upper bound value of the variance of the error corresponding to the second ciphertext; determining a first random value subject to uniform distribution according to the upper bound value of the variance, the first random value being used for blinding the noise part in the second ciphertext; obtaining a second random value, the second random value being used for blinding the plaintext part in the second ciphertext; and fusing the first random value and the second random value to obtain the random number.

[0129] It should be noted that the random number determined in this embodiment is the first random number r used for blinding.

[0130] Considering that the BFV (a kind of homomorphic encryption algorithm, mainly focusing on processing homomorphic encryption on integers, allowing calculation on encrypted data without decrypting the data, and the calculation result is still encrypted) or BGV (another kind of homomorphic encryption algorithm, mainly managing noise through modulus switching) is a kind of encryption algorithm with noise, that is, when the first computing service provider performs homomorphic encryption, noise will be added to ensure the randomness of the encrypted result, and when the first computing service provider decrypts, the noise needs to be eliminated. Taking the BGV algorithm as an example, let the blind ciphertext to be decrypted be (ct0, ct1), and the private key be sk, satisfying ct0+ct1·sk=m+p·e * mod q.

[0131] When the plaintext m is decrypted, the first computing service provider can obtain the noise e * , where e * ∈Rq, since the first computing service provider knows the noise e added during encryption, where e∈R q , therefore, according to the determined e * and e, the first computing service provider can obtain part of the information of the second computing service provider's encoded plaintext polynomial, which leads to the risk of data leakage of the second computing service provider.

[0132] In order to avoid data leakage, not only the plaintext but also the noise needs to be blinded during the blinding process. Specifically, a second random value r2 is randomly obtained for blinding the plaintext, where r2

[0133] Next, the first random value r1 for blinding the noise is determined, as follows:

[0134] When blinding the noise, the noise can be superimposed with a first random value r1 (where the maximum value of the first random value r1 is 2 τ′ ·σ e , σ e is the standard deviation of the noise e before encryption, and τ' is a public parameter and not the endpoint of the interval mentioned above), so that the superimposed noise has randomness, and the statistical distance between the superimposed noise and the noise is less than 2- τ′。

[0135] Since the second computing service provider performs homomorphic multiplication on each vector (which can be regarded as plaintext) in the second encoding vector and the ciphertext in the first ciphertext, the upper bound (maximum value) of the variance of the error corresponding to the ciphertext after homomorphic addition is , that is, the upper bound of the standard deviation is

[0136] Therefore, the value range of the first random value r1 is​ At this time, a first random value r1 is determined from the value range, and then r = r1 p + r2 is determined to determine the first random number r. In this way, the distribution of the noise can be concealed based on the first random number r, so as to avoid the risk of leakage of the second computing service provider data. At this time, it is required that

[0137] For example, τ' = 40 and σ = 3.2 are generally selected in practice. When N is 4096 and n is 8, p is selected as a prime number of no more than 30 bits, q is at least a modulus of 109 bits, and then the parameters corresponding to BGV are N = 4096, q = 60 bits and 49 bits prime number product, which satisfies 128-bit security. e If the absolute value of w in the Fourier series expression is not large (for example, no more than 1), and the output range of the expression is between [-1, 1], then f = 15 can be selected to realize the secure calculation of the Fourier series expression (the values of sin and cos are all between [-1, 1], and the plaintext corresponding to the ciphertext after homomorphic calculation i Here, z ∈ [-1, 1]).

[0138] In the embodiment, the first random value is selected by the upper bound of the variance of the error corresponding to the second ciphertext, to ensure that the noise distribution can be concealed, and the decrypted noise is random, thereby avoiding the leakage of the second computing service provider information based on the specific distribution of the decrypted noise, and ensuring the security of the data processing process.

[0139] The result slice of the nonlinear function corresponding to the first slice is the slice of the result of the input data in the nonlinear function. For example, the nonlinear function is F1(.), and the input data x is substituted into the nonlinear function to obtain the result F1(x); the first slice x A corresponds to the result slice F1(x A ) of the nonlinear function, and F1(x A ) is a slice of F1(x).

[0140] In some embodiments, after the first computing service provider obtains the blinded ciphertext Enc * , the blinded ciphertext is decrypted according to the private key to obtain the decryption result s.

[0141] Since the second computing service provider has the first random number r, the sum of s and r indicates the inner product of the first encoding vector and the second encoding vector under the plaintext modulus p, that is,

[0142] In the case that a i and b i are both positive numbers, there are ​Wherein, the stretch factor Δ is

[0143] The process of converting the inner product of the first encoding vector and the second encoding vector into the inner product of the first representation vector and the second representation vector will be introduced below:

[0144] The first computing service provider calculates the ratio of the plaintext modulus p and 2 l , rounds the product of the decryption result s and the ratio to obtain the first conversion fragment c0, that is, The second computing service provider calculates the product of the first random number r and the ratio and rounds it to obtain the second conversion fragment c1, that is,

[0145] At this time,

[0146] Since the stretch factors required for floating-point number a i and b i encoding are both , wherein the value of t is known, f in the embodiment can be a decimal number, and is ignored, it is ensured that Then, the first computing service provider and the second computing service provider respectively call the truncation operator with the truncation length of l-t+f to perform two-party fragment truncation calculation to obtain the corresponding first target conversion fragment and the second target conversion fragment , wherein the truncation operator is an operator capable of realizing two-party truncation operation and can be understood as a code program realizing truncation operation.

[0147] At this time, it is satisfied that The conversion of the inner product of the first encoding vector and the second encoding vector into the inner product of the first representation vector and the second representation vector is completed. It needs to be noted that the fragment is generally in the form of a power of 2, and the plaintext modulus p is usually a prime number and is generally not in the form of a power of 2. Therefore, the plaintext modulus p can also be converted into the form of a power of 2 through the above process.

[0148] Finally, the first computing service provider takes the first target conversion fragment as the result fragment F1(x A ) of the first fragment corresponding to the nonlinear function, and the second computing service provider takes the second target conversion fragment as the result fragment F1(x B ) of the second fragment corresponding to the nonlinear function.

[0149] It should be noted that, compared with the inner product of the multiplication triple security calculation in the related art, the application can reduce the calculation amount and the communication amount by combining the Fourier series approximation and the vector inner product calculation. This is because when the related art adopts a full homomorphic encryption algorithm such as BGV to generate a multiplication triple, if p is a 30-bit prime number, at least ciphertexts are required, where l represents the exponent part of the modulus 2 l .

[0150] In step S608, the first result slice is obtained according to the result slice of the first slice corresponding to the nonlinear function and the result slice of the first slice corresponding to the linear function. The first result slice is used to generate a calculation result corresponding to the input data together with a second result slice obtained by a second computing service provider.

[0151] The result slice of the first slice corresponding to the linear function refers to a slice of the result of the input data in the linear function. For example, the input data x is substituted into the linear function F0(.) to obtain the result F0(x). The first slice x A is substituted into the linear function F0(.) to obtain F0(x A ), and F0(x A ) is a slice of the result F0(x).

[0152] The first result slice is a slice of the calculation result corresponding to the input data, and the second result slice is another slice of the calculation result corresponding to the input data.

[0153] It should be noted that the data provider needs to let the first computing service provider determine a result of the first slice in the original calculation function by comprehensively considering the result slice of the first slice corresponding to the nonlinear function and the result slice of the first slice corresponding to the linear function, without knowing the range of the input data (for example, the data provider calls a model for calculation based on demand, an input data is calculated in the middle layer of the model, the input data is directly divided into the first slice and the second slice according to the preset slicing rule, and is directly sent to the first computing service provider and the second computing service provider. The entire process is unknown to the data provider, and the specific value of the input data is also unknown.

[0154] Similarly, the second computing service provider needs to determine another result of the second slice in the original calculation function by comprehensively considering the result slice of the second slice corresponding to the nonlinear function and the result slice of the second slice corresponding to the linear function, so as to obtain the calculation result of the input data in the original calculation function by fusing the two results.

[0155] In some embodiments, as shown in FIG. 7, a flowchart for determining the first result shard in an embodiment is shown. The first result shard is obtained according to the result shard of the first shard corresponding to the nonlinear function and the result shard of the first shard corresponding to the linear function, including:

[0156] At step S702, based on the first shard and the lower bound value in the symmetric interval, a secure comparison operator is invoked to perform a secure size comparison between the input data and the lower bound value, to obtain a comparison shard corresponding to the first secure size comparison of the first shard.

[0157] The secure comparison operator refers to an operator used for comparing two numerical values without revealing the specific content of the numerical values in secure multi-party computation. The secure comparison operator can be understood as a code program for implementing secure size comparison, and the secure comparison operator ensures that multiple participants perform comparison without knowing the data of the other party. The comparison shard corresponding to the first secure size comparison of the first shard can be regarded as a shard of the result of the first secure size comparison, and the first secure size comparison result is obtained by performing a secure size comparison between the input data and the lower bound value in the symmetric interval. The comparison shard is related to the first shard and the lower bound value.

[0158] For example, for the symmetric interval [-τ, τ], the lower bound value in the symmetric interval is -τ, and the first computing service provider substitutes -τ and x A into the secure comparison operator to obtain the comparison shard b 01 corresponding to the first secure size comparison of the first shard.

[0159] At the same time, the second computing service provider substitutes -τ and x B into the secure comparison operator to obtain the comparison shard b 02 corresponding to the first secure size comparison of the second shard.

[0160] At this time, b 01 and b 02 are two comparison shards of b0, and b0 reflects the result of the first secure size comparison. If x is greater than or equal to -τ, b0 is 0, that is, the XOR result of b 01 and b 02 is 0; if x is less than -τ, b0 is 1, that is, the XOR result of b 01 and b 02 is 1.

[0161] It should be noted that b 01 is only owned by the first computing service provider, and b 02 is only owned by the second computing service provider.

[0162] At step S704, based on the first fragment and the upper bound value in the symmetric interval, a secure comparison operator is invoked to perform a secure size comparison between the input data and the upper bound value, to obtain a comparison fragment corresponding to the second secure size comparison of the first fragment.

[0163] The comparison fragment corresponding to the second secure size comparison of the first fragment can be regarded as a fragment of the result of the second secure size comparison, which is obtained by performing a secure size comparison between the input data and the upper bound value of the symmetric interval. The comparison fragment is related to the first fragment and the upper bound value.

[0164] For example, the upper bound value of the symmetric interval is τ, and the first computing service provider substitutes τ and x A into the secure comparison operator to obtain the comparison fragment b 11 corresponding to the second secure size comparison of the first fragment.

[0165] Meanwhile, the second computing service provider substitutes τ and x B into the secure comparison operator to obtain the comparison fragment b 12 corresponding to the second secure size comparison of the first fragment.

[0166] At this time, b 11 and b 12 are two comparison fragments of b1, and b1 reflects the result of the second secure size comparison. If x is greater than or equal to τ, b1 is 0, that is, the exclusive-OR result of b 11 and b 12 is 0; if x is less than τ, b1 is 1, that is, the exclusive-OR result of b 11 and b 12 is 1.

[0167] It should be noted that b 11 is only owned by the first computing service provider, and b 12 is only owned by the second computing service provider.

[0168] At step S706, based on the result fragment of the first fragment corresponding to the nonlinear function, the result fragment of the first fragment corresponding to the linear function, the comparison fragment of the first fragment corresponding to the first secure size comparison, and the comparison fragment of the first fragment corresponding to the second secure size comparison, the first result fragment is determined.

[0169] For example, to distinguish from the random number mentioned above for blinding (i.e., the first random number r), the random number in the fragment of the random number sent by the data provider is regarded as a second random number δ, and the fragment of the random number sent by the data provider obtained by the first computing service provider is regarded as a fragment δ1 of the second random number δ.

[0170] In the case that the interval of the original computing function is (-∞, +∞), there is a first linear function F0(.) for (-∞, -τ] and a second linear function F2(.) for [τ, +∞).

[0171] The first slice x A is input to the first linear function F0(.) to obtain a result slice of the first linear function corresponding to the first slice F0(x A ), and the first slice is input to the second linear function F2(.) to obtain a result slice of the second linear function corresponding to the first slice F2(x A ).

[0172] The first computing service provider determines the first result slice according to F0(x A ), F2(x A ), δ1, b 01 , b 11 , F1(x A ).

[0173] In this embodiment, the comparison slice corresponding to the first slice is determined in combination with the two end point values (upper bound and lower bound) in the symmetric interval, and the first result slice is quickly determined based on the determined comparison slice, the result slice of the nonlinear function corresponding to the first slice, and the result slice of the linear function corresponding to the first slice.

[0174] In some embodiments, as shown in FIG. 8, a flowchart of the step of determining the first result slice in another embodiment is shown. The determination of the first result slice based on the result slice of the nonlinear function corresponding to the first slice, the result slice of the linear function corresponding to the first slice, the comparison slice of the first safe size comparison corresponding to the first slice, and the comparison slice of the second safe size comparison corresponding to the first slice includes:

[0175] In step S802, a slice of a random number is obtained, and the slice of the random number is taken as a first path input slice for the first time multiplexing. The result slice of the linear function corresponding to the first slice, the result slice of the nonlinear function corresponding to the first slice, and the first path input slice are used to obtain a second path input slice for the first time multiplexing.

[0176] The first time multiplexing is a multiplexing based on the lower bound of the interval, and the second path input slice is calculated based on b 01 The multiplexing result about the first slice and the lower bound is obtained, that is, the output slice of the first slice corresponding to the first time multiplexing. The first path input slice and the second path input slice in this step are two path inputs for the first time multiplexing of the first slice.

[0177] For example, the first computing service provider directly takes δ1 as the first path input slice, superimposes F0(x A ), δ1 minus F1(x A ), thus obtaining the second input fragment, i.e. (F0(x A )+δ1-F1(x A )).

[0178] Step S804: Based on the comparison fragment corresponding to the first security size comparison, the first input fragment and the second input fragment used for the first multiplexing, perform the first multiplexing to obtain the output fragment corresponding to the first multiplexing.

[0179] For example, the first computing service provider, according to b 01 First input segment δ1, second input segment (F0(x) A )+δ1-F1(x A The first multi-way selection is performed by the multi-way selection operator, resulting in the output slice α1 corresponding to the first multi-way selection.

[0180] Among them, the multiplexing operator is an operator used to determine the slice of the result after multiplexing. This operator can be understood as the code program that implements multiplexing.

[0181] Step S806: Based on the result slice of the linear function corresponding to the first slice and the first input slice used for the first multiplexing, calculate the first input slice used for the second multiplexing; based on the result slice of the nonlinear function corresponding to the first slice and the first input slice used for the first multiplexing, calculate the second input slice used for the second multiplexing.

[0182] The second multi-way selection is based on the upper bound of the interval, and is based on b. 11 Calculate the multiplexing result for the first slice and the lower bound value, i.e., the output slice of the second multiplexing corresponding to the first slice. The first input slice and the second input slice in this step are the two inputs for the second multiplexing of the first slice.

[0183] For example, the first computing service provider will use F2(x) A The difference between δ1 and F2 is determined as the first input slice used for the second multiplexing, i.e., F2(x) A )-δ1. F1(x A )-δ1 is used as the second input fragment for the second multiplexing.

[0184] Step S808: Based on the comparison fragment corresponding to the second security size comparison of the first fragment, the first input fragment and the second input fragment used for the second multiplexing, perform the second multiplexing to obtain the output fragment corresponding to the second multiplexing of the first fragment.

[0185] For example, the first computing service provider performs the first multi-selection according to b 11 , (F2(x A )-δ1), (F1(x A )-δ1) through the multi-selection operator, performs the second multi-selection, and obtains the output slice β1 of the first slice corresponding to the second multi-selection.

[0186] In step S810, the first result slice is obtained according to the output slice of the first slice corresponding to the first multi-selection and the output slice of the first slice corresponding to the second multi-selection.

[0187] For example, the first computing service provider superimposes the output slice of the first slice corresponding to the first multi-selection and the output slice of the first slice corresponding to the second multi-selection, and obtains the first result slice.

[0188] In this embodiment, based on the lower bound value and the comparison slice determined by the first slice, the output slice related to the lower bound value is calculated through the first multi-selection, and based on the upper bound value and the comparison slice determined by the first slice, the output slice related to the upper bound value is calculated through the second multi-selection, and the first result slice determined by the two output slices can more accurately represent a slice of the calculation result corresponding to the input data.

[0189] In some embodiments, the step of obtaining the second result slice by the second computing service provider includes: determining the result slice of the second slice corresponding to the nonlinear function according to the first random number used for the blinding process; and obtaining the second result slice according to the result slice of the second slice corresponding to the nonlinear function and the result slice of the second slice corresponding to the linear function.

[0190] The result slice of the second slice corresponding to the linear function is a slice of the result of the value input data in the linear function, for example, the second slice x B is substituted into the linear function F0(.), and F0(x B ) is obtained, and F0(x B ) is another slice of the result F0(.). The determination step of the result slice of the second slice corresponding to the nonlinear function is described above, and the determination process of the second result slice is described below.

[0191] In some embodiments, the second result slice is obtained according to the second slice corresponding to the result slice of the non-linear function and the second slice corresponding to the result slice of the linear function, including: based on the second slice and the lower limit value in the symmetric interval, calling the secure comparison operator to perform a secure size comparison between the input data and the lower limit value to obtain a comparison slice of the first secure size comparison corresponding to the second slice; based on the second slice and the upper limit value in the symmetric interval, calling the secure comparison operator to perform a secure size comparison between the input data and the upper limit value to obtain a comparison slice of the second secure size comparison corresponding to the second slice; and determining the second result slice based on the second slice corresponding to the result slice of the non-linear function, the second slice corresponding to the result slice of the linear function, the comparison slice of the first secure size comparison corresponding to the second slice, and the comparison slice of the second secure size comparison corresponding to the second slice.

[0192] The comparison slice of the first secure size comparison corresponding to the second slice can be regarded as another slice of the first secure size comparison result, and the comparison slice is related to the second slice and the lower limit value.

[0193] The comparison slice of the second secure size comparison corresponding to the second slice can be regarded as another slice of the second secure size comparison result. The comparison slice is related to the second slice and the upper limit value.

[0194] Exemplarily, the second computing service provider determines b 02 and b 12 After that, the second computing service provider obtains another slice δ2 of the second random number δ sent by the data provider.

[0195] In the case where the interval of the domain of the original computing function is (-∞, +∞), there are a first linear function F0(.) of (-∞, -τ] and a second linear function F2(.) of [τ, +∞).

[0196] The second slice x B is input into the first linear function F0(.) to obtain a result slice F0(x B ) of the second slice corresponding to the first linear function, and the second slice is input into the second linear function F2(.) to obtain a result slice F2(x B ) of the second slice corresponding to the second linear function.

[0197] The second computing service provider determines the second result slice according to F0(x B ), F2(x B ), δ2, b 02 , b 12 , and F1(x B ).

[0198] Thus, in combination with the two end point values (upper bound value and lower bound value) in the symmetric interval, the comparison slice corresponding to the second slice is determined respectively, and the second result slice is quickly determined based on the determined comparison slice, and the result slice of the nonlinear function and the result slice of the linear function corresponding to the second slice.

[0199] In the embodiment, the second result slice can be quickly calculated based on the result slice of the nonlinear function corresponding to the second slice and the result slice of the linear function corresponding to the second slice without the power operation of the second computing service provider, so that the data provider can quickly and accurately determine the calculation result corresponding to the input data based on the obtained second result slice, and the data processing efficiency is improved.

[0200] In some embodiments, as shown in FIG. 9, a flowchart of a second result slice determination step in an embodiment is shown. The second result slice is determined based on the result slice of the nonlinear function corresponding to the second slice, the result slice of the linear function corresponding to the second slice, the comparison slice of the first secure size comparison corresponding to the second slice, and the comparison slice of the second secure size comparison corresponding to the second slice, including:

[0201] In step S902, the slice of the second random number is obtained, and the slice of the second random number is taken as the first path input slice for the first time multiplexing. The result slice of the linear function corresponding to the second slice and the first path input slice, and the result slice of the nonlinear function corresponding to the second slice are obtained to obtain the second path input slice for the first time multiplexing.

[0202] Based on b 11 The multiplexing result about the second slice and the lower bound value is calculated, that is, the output slice of the second time multiplexing corresponding to the second slice. The first path input slice and the second path input slice in this step are two path inputs for the first time multiplexing of the second slice.

[0203] For example, the second computing service provider obtains another slice δ2 of the second random number, directly takes δ2 as the first path input slice, superimposes F0(x B ), and subtracts F1(x B ) after superimposing δ2 to obtain the second path input slice, that is, (F0(x B + δ2 - F1(x B )).

[0204] In step S904, the first time multiplexing is performed based on the comparison slice of the first secure size comparison corresponding to the second slice, the first path input slice and the second path input slice for the first time multiplexing to obtain the output slice of the first time multiplexing corresponding to the second slice.

[0205] For example, the second computing service provider performs the first time multiplexing based on b 11 , the first input slice δ2, the second input slice (F0(x B ) + δ2 - F1(x B )), and the first input slice for the first time multiplexing is input into the multiplexing operator to obtain the output slice α2 corresponding to the first time multiplexing of the second slice.

[0206] In step S906, the first input slice for the second time multiplexing is calculated according to the result slice of the linear function corresponding to the second slice and the first input slice for the first time multiplexing, and the second input slice for the second time multiplexing is calculated according to the result slice of the nonlinear function corresponding to the second slice and the first input slice for the first time multiplexing.

[0207] Based on b 12 , the multiplexing result of the lower bound value of the second slice is calculated, that is, the output slice α2 corresponding to the second time multiplexing of the second slice. The first input slice and the second input slice in this step are two input slices for the second time multiplexing of the second slice.

[0208] For example, the second computing service provider determines the difference between F2(x B ) and δ2 as the first input slice for the second time multiplexing, that is, (F2(x B ) - δ2). (F1(x B ) - δ2) is taken as the second input slice for the second time multiplexing.

[0209] In step S908, the output slice β2 corresponding to the second time multiplexing of the second slice is obtained by performing the second time multiplexing according to the comparison slice of the second safe size comparison corresponding to the second slice, the first input slice and the second input slice for the second time multiplexing.

[0210] For example, the second computing service provider performs the second time multiplexing according to b 12 , (F2(x B ) - δ2, (F1(x B ) - δ2) through the multiplexing operator to obtain the output slice β2 corresponding to the second time multiplexing of the second slice.

[0211] In step S910, the second result slice is obtained according to the output slice of the first time multiplexing corresponding to the second slice and the output slice of the second time multiplexing corresponding to the second slice.

[0212] For example, the second computing service provider superimposes the output slice of the first time multiplexing and the output slice of the second time multiplexing corresponding to the second slice respectively to obtain the second result slice.

[0213] It should be noted that in the case of the asymmetric interval function is a constant function, for example, the value of (-∞, -τ] is constant ε, under this interval, the sum of the first slice corresponding to the constant function result slice and the second slice corresponding to the constant function result slice is ε; the constant function of [τ, +∞) is constant 1-ε, under this interval, the sum of the first slice corresponding to the constant function result slice and the second slice corresponding to the constant function result slice is 1-ε. At this time, similar operations can be performed by substituting the above process to obtain the corresponding first result slice and second result slice.

[0214] The accuracy of the first result slice and the second result slice is explained below. For ease of understanding, the sigmoid function will be used as an example. The sigmoid function is a piecewise function, that is, b0·ε+(1-b0)·b1·F1(x)+(1-b1)·(1-ε); that is, when x is in the interval (-∞, -τ], b0 is 1, b1 is 1, at this time, the value is ε; when x is in the interval [τ, -τ], b0 is 0, b1 is 1, at this time, the value is F1(x); when x is in the interval [τ, +∞), b0 is 0, b1 is 0, at this time, the value is 1-ε.

[0215] Based on this, the expression of the first multiplexer is constructed as follows: <α>=mux( <b0>,δ,ε+δ-<F1(x)> And construct the second multiplexing expression: <β> = mux( <b1>, 1 - ∈ - δ, <F1(x)> - δ); the sum of <α> and <β> is the calculation result corresponding to the input data.

[0216] For example, b0 is 1, b1 is 1, <α> = ∈ + δ - <F1(x)>; <β> = <F1(x)> - δ, and the calculation result is ∈;

[0217] b0 is 0, b1 is 1, <α> = δ; <β> = <F1(x)> - δ, and the calculation result is F1(x);

[0218] b0 is 0, b1 is 0, <α> = δ; <β> = 1 - ∈ - δ, and the calculation result is 1 - ∈.

[0219] Thus, for the first calculation service provider, according to the F0(x A ), F2(x A ), δ1, b 01 , b 11 , F1(x A ) possessed, referring to the foregoing steps S802-S810, the first result fragment, i.e., α1+β1, can be calculated through the multiplexing selection operator.

[0220] For the second calculation service provider, according to the F0(x B ), F2(x B ), δ2, b 02 , b 12 , F1(x B ) possessed, referring to the foregoing steps S902-S910, the second result fragment, i.e., α2+β2, can be calculated through the multiplexing selection operator.

[0221] Since α1 and α2 are the secret fragments of α, and β1 and β2 are the secret fragments of β, thus, superimposing the first result fragment and the second result fragment is equivalent to the calculation result corresponding to the input data.

[0222] In the embodiment, the lower bound value and the comparison fragment determined by the second fragment are used to calculate the output fragment related to the lower bound value through the first multiplexing selection, and then the upper bound value and the comparison fragment determined by the second allocation are used to calculate the output fragment related to the upper bound value through the second multiplexing selection, and the first result fragment determined by the two output fragments can more accurately represent the other fragment of the calculation result corresponding to the input data.

[0223] In the above data processing method, after the first computing service provider of the secure multi-party computation receives the first shard of the input data, the first shard is processed by using the original computing function with a bounded value domain. First, the first computing service provider segments the original computing function used for processing the input data according to intervals of the domain of the original computing function, to obtain a non-linear function in a symmetric interval and a linear function in an asymmetric interval. For the non-linear function, to avoid the power operation caused by using a polynomial to approximate the non-linear function, the Fourier series is used to approximate the non-linear function, which can reduce the overhead and communication overhead. Then, the first computing service provider obtains a first representation vector of the first shard based on the Fourier series expression, and sends first ciphertext obtained by homomorphic encryption of the first representation vector to the second computing service provider of the secure multi-party computation. The first computing service provider receives blinded ciphertext returned by the second computing service provider according to the first ciphertext and a second shard of the two shards, and obtains a result shard corresponding to the non-linear function of the first shard by decrypting the blinded ciphertext. The first computing service provider obtains a first result shard according to the result shard corresponding to the non-linear function of the first shard and a result shard corresponding to the linear function of the first shard. By converting the value of the first shard of the input data on the Fourier series to homomorphic calculation, the calculation process can be simplified. Similarly, the second result shard is obtained by the second computing service provider according to a result shard corresponding to a non-linear function of a second shard and a result shard corresponding to a linear function of the second shard. The first computing service provider generates a calculation result corresponding to the input data according to the first result shard and the second result shard obtained by the second computing service provider, so that the data provider can obtain the calculation result corresponding to the input data more quickly. In this way, the secure multi-party computation is efficiently and quickly implemented.

[0224] In some embodiments, the method further includes sending the first result shard to a data provider of the input data, for the data provider to decode the first result shard and a second result shard sent by the second computing service provider after superposition, to obtain a calculation result corresponding to the input data.

[0225] For example, the data provider decodes the sum (α1+β1+α2+β2) superimposed to obtain F(x), that is, the calculation result of the input data x substituted into the original computing function.

[0226] In this embodiment, in the case that each party (such as the data provider, the first computing service provider and the second computing service provider) in the secure multi-party computation does not know the specific value of the input data, the secure multi-party computation is efficiently and quickly implemented without high-order power operation.

[0227] In some embodiments, after the data provider determines that the input data is in the symmetric interval and obtains the result slice of the first slice corresponding to the nonlinear function, the method further comprises: sending the result slice of the first slice corresponding to the nonlinear function to the data provider of the input data, so that the data provider superimposes the result slice of the first slice corresponding to the nonlinear function and the result slice of the second slice corresponding to the nonlinear function sent by the second computing service provider, to obtain the calculation result corresponding to the input data.

[0228] For example, when the data provider knows the specific value of the input data, the interval can be determined in advance. If the input data is in the symmetric interval, the data provider only needs to obtain the calculation result of the input data in the symmetric interval. At this time, referring to the process of determining F1(x A ), F1(x B ), the first computing service provider and the second computing service provider directly return F1(x A ), F1(x B ) to the data provider respectively, and the data provider superimposes F1(x A ) and F1(x B ) to obtain the sum, which is the calculation result.

[0229] In this embodiment, when the data provider determines that the input data is in the symmetric interval, the result slice corresponding to the linear function is not needed, and only the result slice corresponding to the nonlinear function calculated by each computing service provider is needed, so that the calculation process is more simple and the data processing efficiency is improved.

[0230] In an exemplary embodiment, as shown in FIG. 10, a data processing method is provided, which is applied to the data provider 502 in FIG. 5 as an example, and comprises the following steps S1002 to S1004. Wherein:

[0231] Step S1002, secret slicing is performed on the input data to obtain a first slice and a second slice, the first slice is sent to a first computing service provider of secure multi-party computation, and the second slice is sent to a second computing service provider of secure multi-party computation; wherein, after obtaining the first slice, the first computing service provider segments the original computing function used for processing the input data according to intervals of a definition domain of the original computing function to obtain a non-linear function in a symmetric interval and a linear function in an asymmetric interval, obtains a Fourier series expression of the non-linear function, the value range of the original computing function has a boundary, and obtains a first representation vector of the first slice based on the Fourier series expression, sends first ciphertext obtained by homomorphic encryption of the first representation vector to the second computing service provider of secure multi-party computation, receives blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second slice, decrypts the blinded ciphertext to obtain a result slice of the non-linear function corresponding to the first slice, and obtains a first result slice according to the result slice of the non-linear function corresponding to the first slice and a result slice of the linear function corresponding to the first slice; after obtaining the second slice, the second computing service provider obtains a second result slice according to a result slice of a non-linear function corresponding to the second slice and a result slice of a linear function corresponding to the second slice.

[0232] Step S1004, the first result slice returned by the first computing service provider and the second result slice returned by the second computing service provider are obtained, and a computing result corresponding to the input data is generated according to the first result slice and the second result slice.

[0233] For detailed description of each step in this embodiment, please refer to the relevant content in the foregoing.

[0234] In the data processing method, after the data provider of the secure multi-party computation performs secret sharing on the input data to obtain a first shard and a second shard, the data provider sends the first shard to the first computing service provider of the secure multi-party computation and sends the second shard to the second computing service provider of the secure multi-party computation. After the first computing service provider receives the first shard of the input data, the first computing service provider processes the first shard by using the original computing function with a bounded value domain. First, the original computing function used to process the input data is segmented according to intervals of a domain of the original computing function, to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval. For the nonlinear function, to avoid power operation caused by using a polynomial to approximate the nonlinear function, a Fourier series is used to approximate the nonlinear function, which can reduce the overhead and communication overhead. Then, a first feature vector of the first shard is obtained based on a Fourier series expression, and first ciphertext obtained by homomorphic encryption of the first feature vector is sent to the second computing service provider of the secure multi-party computation. The blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second shard of the two shards is decrypted to obtain a result shard of the nonlinear function corresponding to the first shard. A first result shard is obtained according to the result shard of the nonlinear function corresponding to the first shard and a result shard of the linear function corresponding to the first shard. By converting the value of the first shard of the input data on the Fourier series to homomorphic calculation, the calculation process can be simplified. According to the first result shard and the second result shard obtained by the second computing service provider, the data provider can more quickly determine the calculation result corresponding to the input data. In this way, the secure multi-party computation is efficiently and quickly implemented.

[0235] In some embodiments, as shown in FIG. 11, a data processing system is provided, and the system includes a data provider 1102, a first computing service provider 1104 of secure multi-party computation, and a second computing service provider 1106 of secure multi-party computation.

[0236] The data provider 1102 is configured to perform secret sharing on input data to obtain a first shard and a second shard, and send the first shard to the first computing service provider 1104 of secure multi-party computation and send the second shard to the second computing service provider 1106 of secure multi-party computation.

[0237] The first computing service provider 1104 is configured to receive the first shard sent by the data provider 1102, segment an original computing function used to process the input data according to intervals of a domain of the original computing function, to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, obtain a Fourier series expression of the nonlinear function, and the value domain of the original computing function is bounded.

[0238] The first computing service provider 1104 is further configured to obtain the first feature vector of the first shard based on the Fourier series expression, and send first ciphertext obtained by homomorphic encryption of the first feature vector to the second computing service provider 1106 of secure multi-party computation.

[0239] The second computing service provider 1106 is configured to receive the second shard sent by the data provider 1102, obtain the first ciphertext sent by the first computing service provider 1104, determine the blinded ciphertext according to the first ciphertext and the second shard, and return to the first computing service provider 1104.

[0240] The first computing service provider 1104 is further configured to receive the blinded ciphertext returned by the second computing service provider 1106, and decrypt the blinded ciphertext to obtain the result shard of the non-linear function corresponding to the first shard.

[0241] The first computing service provider 1104 is further configured to obtain the first result shard according to the result shard of the non-linear function corresponding to the first shard and the result shard of the linear function corresponding to the first shard, and send the first result shard to the data provider 1102.

[0242] The second computing service provider 1106 is configured to obtain the second result shard according to the result shard of the non-linear function corresponding to the second shard and the result shard of the linear function corresponding to the second shard, and send the second result shard to the data provider 1102.

[0243] The data provider 1102 is further configured to obtain the first result shard and the second result shard, and generate the calculation result corresponding to the input data according to the first result shard and the second result shard.

[0244] The related description of each component in this embodiment can refer to the foregoing.

[0245] In the above data system, after the data provider of secure multi-party computation secret-shares the input data to obtain a first shard and a second shard, the data provider sends the first shard to the first computing service provider of secure multi-party computation and sends the second shard to the second computing service provider of secure multi-party computation. After receiving the first shard of the input data, the first computing service provider processes the first shard by using the original computing function with a bounded value domain. First, the first computing service provider segments the original computing function used to process the input data according to the interval of the domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval. For the nonlinear function, to avoid the power operation caused by using a polynomial to approximate the nonlinear function, the Fourier series is used to approximate the nonlinear function, which can reduce the overhead and communication overhead. Then, the first computing service provider obtains a first representation vector of the first shard based on the Fourier series expression, sends the first representation vector homomorphically encrypted to the second computing service provider of secure multi-party computation, decrypts the blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second shard of the two shards, and obtains a result shard corresponding to the nonlinear function of the first shard. According to the result shard corresponding to the nonlinear function of the first shard and the result shard corresponding to the linear function of the first shard, the first computing service provider obtains a first result shard. By converting the value of the first shard of the input data on the Fourier series to homomorphic calculation, the calculation process can be simplified. According to the first result shard and the second result shard obtained by the second computing service provider, the data provider can obtain the computing result corresponding to the input data more quickly. In this way, the secure multi-party computation is efficiently and quickly implemented by segmenting the original computing function according to the interval of the domain of the original computing function.

[0246] The application also provides an application scenario of the data processing method. Specifically, in a financial scenario, a financial institution wants to determine the credit score of a customer without revealing the customer's privacy, in combination with a first computing service provider and a second computing service provider that can provide credit computing services, wherein the computer device of the financial institution can be regarded as a data provider, the financial data (such as expenditure data) of any customer of the financial institution as input data, and the computer device of the financial institution performs secret sharing on the input data to obtain a first shard and a second shard, and sends them to the first computing service provider and the second computing service provider, respectively. The first computing service provider segments the original computing function used to process the input data according to the intervals of the domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in an asymmetric interval, obtains the Fourier series expression of the nonlinear function, and the range of the original computing function has a boundary; based on the Fourier series expression, the first computing service provider obtains a first feature vector of the first shard, sends the first ciphertext obtained by homomorphically encrypting the first feature vector to the second computing service provider of the secure multi-party computation, receives the blinded ciphertext returned by the second computing service provider based on the first ciphertext and the second shard, decrypts the blinded ciphertext to obtain the result shard of the nonlinear function corresponding to the first shard, and obtains the first result shard based on the result shard of the nonlinear function corresponding to the first shard and the result shard of the linear function corresponding to the first shard, and returns it to the computer device of the financial institution. Similarly, the second computing service provider processes in a similar manner to obtain the second result shard based on the result shard of the nonlinear function corresponding to the second shard and the result shard of the linear function corresponding to the second shard, and returns it to the computer device of the financial institution. The computer device of the financial institution can generate the credit score of the customer based on the received first result shard and second result shard.

[0247] Of course, it is not limited to this, the data processing method provided by the application can also be applied to other application scenarios, for example, in a medical scenario, the input data is the medical data (such as medical records, object information) of the target object, and the data processing method provided by the application is used to determine the calculation result, and then the calculation result is input into an artificial intelligence model to diagnose and score the target object, thereby realizing reasonable and effective auxiliary diagnosis of the target object.

[0248] For example, in a content pushing scenario, the interaction data of the target object is used as input data, and the data processing method provided by the application is used to determine the calculation result, and then the calculation result is input into a model for evaluating object description information to determine the object description information of the target object.

[0249] The application scenarios described above are only illustrative. It can be understood that the data processing method provided by the embodiments of the present application is not limited to the above scenarios.

[0250] In a specific embodiment, as shown in FIG. 12, it is a schematic diagram of the data processing process in an embodiment.

[0251] Step 1, the data provider needs to calculate the calculation result of the original calculation function F(x) (a complex function, such as sigmoid) on the input data x. Specifically, the input data x is secret-sharded to obtain a first shard x A and a second shard x B , and the interval of the domain of the original calculation function and x A are sent to the first calculation service provider, and the interval of the domain of the original calculation function and x B are sent to the second calculation service provider. The range of the original calculation function has a boundary.

[0252] Step 2, the first calculation service provider performs interval segmentation based on the interval according to a preset segmentation rule. For example, if the interval of the domain of the original calculation function is (-∞, +∞), it is divided into three segments by default, namely (-∞, -τ], [-τ, τ], and [τ, +∞). The function in (-∞, -τ] is a simple function 1, denoted as F0(.), such as a linear function, or a constant function, or a simple polynomial. The function in [-τ, τ] is a complex function, such as a nonlinear function F1(.). The nonlinear function adopts polynomial approximation, which involves a high algebraic degree of polynomial. Since the number of security comparisons increases linearly with the increase of the algebraic degree, the use of polynomial approximation will result in a large calculation overhead. Fourier series expression is used for approximation. The function in [τ, +∞) is a simple function 2, denoted as F2(.), such as a linear function, or a constant function, or a simple polynomial. The above process is essentially an interval approximation of a complex function.

[0253] The Fourier series expression is a superposition of a plurality of expansion terms, and each expansion term is an inner product of a first vector factor and a second vector factor. The Fourier series expression can be converted into an inner product of a first original vector originating from the first calculation service provider and a second original vector originating from the second calculation service provider. The first original vector is The second original vector is

[0254] Step 3, the first calculation service provider inputs x A into the first original vector to obtain a first feature vector For convenience of description, the first component a0 in the first feature vector is regarded as a0, and the second component a1 is regarded as a1. ​ Consider a1, …, the 2n-th component Consider a m-1 , get the first feature vector (a0, a1, …, a m-1 ).

[0255] Step 4, the first computing service provider performs floating-point number encoding on (a0, a1, …, a m-1 ), to get the first encoding vector, that is, (x0, …, x i , …, x m-1 ); homomorphically encrypts each component in (x0, …, x i , …, x m-1 ) to get the first ciphertext, and the first ciphertext includes m ciphertexts (that is, Enc1, …, Enc m ), and sends to the second computing service provider.

[0256] Step 5, the second computing service provider inputs x B into the second original vector to get the second feature vector For the convenience of description, the first component of the second feature vector Consider b0, …, the 2n-th component Consider b m-1 , get the second feature vector (b0, b1, …, b m-1 ).

[0257] The second computing service provider performs floating-point number encoding on each component in (b0, b1, …, b m-1 ), to get the second encoding vector, that is, (y0, …, y i , …, y m-1 ), respectively homomorphically multiplies each vector in (y0, …, y i , …, y m-1 ) with the ciphertext in the first ciphertext to get m ciphertexts, respectively Enc1·y0, …, Enc m ·y m-1 , and then homomorphically sums the m ciphertexts, which is equivalent to The corresponding ciphertext, that is, the second ciphertext Enc.

[0258] In order to improve the running efficiency of the algorithm, the BFV / BGV full homomorphic encryption is used to perform batch processing of the function, that is, using the feature that one ciphertext of the BFV / BGV full homomorphic encryption corresponds to a plaintext vector, the secure calculation of Q Fourier approximation expressions is regarded as a calculation on the ciphertext. For example, the corresponding slices of x i are (x A，i , x B，i ), then each x A，i or x B，i Corresponding to 2n-dimensional floating-point number vector, here i = 0, 1, …, Q-1, the Q pieces correspond to a Qx2n matrix, and each column is encrypted to obtain a ciphertext, so a total of 2n ciphertexts are obtained. In other words, the homomorphic calculation ciphertext corresponds to the secure calculation of the Fourier approximation expression of simultaneously processing Q input pieces.

[0259] It should be noted that the above steps are essentially based on the secure inner product operation of BGV homomorphism, and the secure inner product operation can also be applied to the generation of multiplication triplets of modulus p, and then converted into secure multiplication operation for small numbers in [-1, 1].

[0260] Step 6, the second computing service provider randomly selects a second random value r2, and determines the upper bound (maximum value) of the variance of the ciphertext corresponding error as After homomorphic addition, the upper bound of the variance of the ciphertext corresponding error is That is, the upper bound of the standard deviation is Therefore, the value range of the first random value r1 is determined as Based on the value range, the first random value r1 is determined, and then r = r1 p + r2 is determined.

[0261] Step 7, the second computing service provider performs blind processing on the second ciphertext Enc based on the first random number r to obtain a blind ciphertext Enc * , and returns it to the first computing service provider.

[0262] Step 8, the first computing service provider calculates the ratio of the plaintext modulus p and 2 l , and rounds the product of the decryption result s and the ratio to obtain the first conversion piece c0, and then calls the truncation operator with the truncation length l-t+f to obtain the first target conversion piece , which can be regarded as the result piece F1(x A ) of the first piece corresponding to the nonlinear function (which is a piece of F1(x), that is, <F1(x)).

[0263] Step 9, the first computing service provider substitutes -τ and x A into the secure comparison operator to obtain the comparison piece b 01 corresponding to the first secure size comparison of the first piece. The first computing service provider substitutes τ and x A into the secure comparison operator to obtain the comparison piece b 11 corresponding to the second secure size comparison of the first piece. That is, based on -τ, τ, x A , the secure size comparison is performed to determine the comparison pieces, which are b 01 b 11 .

[0264] Step 10: The first computing service provider obtains the fragment δ1 of the second random number δ and uses δ1 as the first input fragment for the first multiplexing.

[0265] The first computing service provider will x A The input is fed into F0(.), which performs a secure computation, and the resulting fragment F0(x) is obtained. A (a partition belonging to F0(x) is)<F0(x)> ), x A The input is fed into F2(.), which performs a secure computation to obtain the result fragment F2(x). A (a piece belonging to F2(x), that is)<F2(x)> ).

[0266] The first computing service provider directly uses δ1 as the first input segment, and superimposes F0(x) A ), δ1 minus F1(x A ), thus obtaining the second input fragment, i.e. (F0(x A )+δ1-F1(x A According to b) 01 First input segment δ1, second input segment (F0(x) A )+δ1-F1(x A The first multi-way selection is performed by the multi-way selection operator, resulting in the output slice α1 corresponding to the first multi-way selection.

[0267] The first computing service provider will use F2(x) A The difference between δ1 and F2 is determined as the first input slice used for the second multiplexing, i.e., F2(x) A )-δ1)). (F1(x) A )-δ1) is used as the second input fragment for the second multiplexing. According to b 11 F2(x) A )-δ1),(F1(x A α1) is multiplied by a multi-way operator to perform a second multi-way selection, resulting in the output fragment β1 corresponding to the second multi-way selection of the first fragment. The first computing service provider superimposes α1 and β1 to obtain the first result fragment and returns it to the data provider.

[0268] It should be noted that part of the security calculation flow in FIG. 12 is the process of determining the result fragment of any calculation service provider, and the process of steps 8-10 is to perform security calculation on simple functions 1 and 2 to obtain <F0(x)> and <F2(x)> corresponding to the first calculation service provider. Based on the security inner product operation of BGV homomorphic encryption and the Fourier series expression, <F1(x)> corresponding to the first calculation service provider is determined, and then based on <F0(x)>, <F1(x)> and <F2(x)>, multi-selection is performed by comparing fragments b 01 , b 11 to obtain the first result fragment corresponding to the first calculation service provider.

[0269] Step 11, the second calculation service provider inputs x B into F0(.) to obtain F0(x B ), which is another fragment of F0(x) and can also be denoted as <F0(x)>, and inputs x B into F2(.) to perform security calculation and obtain result fragment F2(x B ), which is another fragment of F2(x) and can also be denoted as <F2(x)>.

[0270] The second calculation service provider inputs -τ and x B into the security comparison operator to obtain comparison fragment b 02 . The second calculation service provider inputs τ and x B into the security comparison operator to obtain comparison fragment b 12 . That is, based on -τ, τ, x B , security size comparison is performed to determine comparison fragments b 02 and b 12 .

[0271] The second calculation service provider calculates the ratio of the plaintext modulus p to 2 l , rounds off the product of the first random number r and the ratio to obtain the second conversion fragment c1, and calls the truncation operator on the second conversion fragment c1 with the truncation length l-t+f to obtain the second target conversion fragment , which can be regarded as the result fragment F1(x B ) of the second fragment corresponding to the nonlinear function (another fragment of F1(x) and can also be denoted as <F1(x)>).

[0272] Step 12, the second calculation service provider obtains another fragment δ2 of the second random number δ. The second calculation service provider directly takes δ2 as the first input fragment, superimposes F0(x B ) and δ2, and then subtracts F1(x B ) to obtain the second input fragment, i.e., (F0(x B )+δ2-F1(x B ))。

[0273] The second computing service provider performs the second multi-path selection according to b 11 , the first-path input slice F2(x B )+δ2-F1(x B ), and obtains an output slice α2 of the first multi-path selection corresponding to the second slice through a multi-path selection operator. B The difference between F2(x B ) and δ2 is determined as a first-path input slice for the second multi-path selection, i.e., (F2(x B )-δ2). (F1(x 12 )-δ2) is taken as a second-path input slice for the second multi-path selection.

[0274] The second computing service provider performs the second multi-path selection according to b B , (F2(x B )-δ2), and (F1(x )-δ2), and obtains an output slice β2 of the second multi-path selection corresponding to the second slice through a multi-path selection operator.

[0275] The second computing service provider superimposes α2 and β2 to obtain a second result slice, and returns the second result slice to the data provider.

[0276] Step 13: The data provider superimposes the first result slice and the second result slice to obtain the computing result corresponding to the input data.

[0277] It should be noted that the above steps 1-13 are implemented in a case where the data provider does not know the interval in which the input data is located.

[0278] Step 14: In a case where the data provider determines that the input data is located in a symmetric interval, the data provider directly superimposes the result slice of the first slice corresponding to the nonlinear function and the result slice of the second slice corresponding to the nonlinear function to determine the computing result corresponding to the input data after the above steps are referred to and the result slice of the first slice corresponding to the nonlinear function and the result slice of the second slice corresponding to the nonlinear function are determined.

[0279] In the data processing method, after the first computing service provider of the secure multi-party computation receives the first shard of the input data, the first shard is processed by using the original computing function with a bounded value domain. First, the original computing function used to process the input data is segmented according to intervals of a definition domain of the original computing function, to obtain a non-linear function in a symmetric interval and a linear function in an asymmetric interval. For the non-linear function, to avoid power operation caused by using a polynomial to approximate the non-linear function, a Fourier series is used to approximate the non-linear function, which can reduce the overhead and communication overhead. Then, a first representation vector of the first shard is obtained based on a Fourier series expression, and first ciphertext obtained by homomorphic encryption of the first representation vector is sent to a second computing service provider of the secure multi-party computation. The blinded ciphertext returned by the second computing service provider according to the first ciphertext and a second shard of the two shards is decrypted to obtain a result shard of the non-linear function corresponding to the first shard. The first result shard is obtained according to the result shard of the non-linear function corresponding to the first shard and a result shard of the linear function corresponding to the first shard. By converting the value of the first shard of the input data on the Fourier series into homomorphic calculation, the calculation process can be simplified, and the data provider can more quickly determine the calculation result corresponding to the input data according to the first result shard and a second result shard obtained by the second computing service provider. In this way, the secure multi-party computation is efficiently and quickly implemented. By reasonably selecting the first random number and the parameter, the risk of data information leakage caused by the error after decryption can be avoided, and the calculation or communication overhead can be effectively reduced.

[0280] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0281] Based on the same inventive concept, the embodiments of the present application also provide a data processing apparatus for implementing the above-mentioned data processing method. The implementation scheme for solving the problem provided by the apparatus is similar to the implementation scheme described in the above method, and therefore the specific limitations in one or more data processing apparatus embodiments provided below can refer to the limitations of the data processing method described above, which will not be described here again.

[0282] In one example embodiment, as shown in FIG. 13, a data processing apparatus 1300 is provided, comprising: a receiving module 1302, a segmenting module 1304, a first obtaining module 1306 and a second obtaining module 1308, wherein:

[0283] The receiving module 1302 is configured to receive a first fragment of fragments of input data, the first fragment being a first fragment of two fragments of the input data obtained by a data provider by secret fragmentation of the input data.

[0284] The segmenting module 1304 is configured to segment an original calculation function used for processing the input data according to intervals of a domain of the original calculation function, to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, and to obtain a Fourier series expression of the nonlinear function, the range of the original calculation function having a boundary.

[0285] The first obtaining module 1306 is configured to obtain a first representation vector of the first fragment based on the Fourier series expression, to send first ciphertext obtained by homomorphic encryption of the first representation vector to a second calculation service provider of secure multi-party computation, to receive blinded ciphertext returned by the second calculation service provider according to the first ciphertext and a second fragment of the two fragments, and to decrypt the blinded ciphertext to obtain a result fragment of the nonlinear function corresponding to the first fragment.

[0286] The second obtaining module 1308 is configured to obtain a first result fragment from the result fragment of the nonlinear function corresponding to the first fragment and a result fragment of the linear function corresponding to the first fragment, and to generate a calculation result corresponding to the input data from the first result fragment and a second result fragment obtained by the second calculation service provider, wherein the second result fragment is obtained by the second calculation service provider from a result fragment of a nonlinear function corresponding to the second fragment and a result fragment of a linear function corresponding to the second fragment.

[0287] In some embodiments, the Fourier series expression is a superposition of a plurality of expansion terms, each expansion term being an inner product of a first vector factor and a second vector factor, and the first obtaining module 1306 is configured to input the first fragment into the first vector factor in each expansion term to obtain the first representation vector of the first fragment.

[0288] In some embodiments, the first obtaining module 1306 is further configured to perform floating-point number encoding on each component in the first representation vector to obtain a first encoded vector, and to perform homomorphic encryption on each component in the first encoded vector to obtain the first ciphertext.

[0289] In some embodiments, the first obtaining module 1306 is further configured to obtain the second representation vector of the second segment based on the Fourier series expression, perform floating-point number encoding on each component in the second representation vector to obtain a second encoded vector, perform homomorphic multiplication processing on the first ciphertext and the second encoded vector to obtain a second ciphertext, and perform blinding processing on the second ciphertext based on a random number to obtain a blinded ciphertext.

[0290] In some embodiments, the first obtaining module 1306 is further configured to obtain an upper bound value of a variance of an error corresponding to the second ciphertext, determine a first random value subject to a uniform distribution according to the upper bound value of the variance, the first random value being used to blind a noise part in the second ciphertext, obtain a second random value, the second random value being used to blind a plaintext part in the second ciphertext, and fuse the first random value and the second random value to obtain the random number.

[0291] In some embodiments, the second obtaining module 1308 is configured to call a secure comparison operator to perform secure size comparison between input data and a lower bound value in the symmetric interval based on the first segment and the lower bound value, to obtain a comparison segment corresponding to a first secure size comparison of the first segment, call the secure comparison operator to perform secure size comparison between the input data and an upper bound value in the symmetric interval based on the first segment and the upper bound value, to obtain a comparison segment corresponding to a second secure size comparison of the first segment, and determine the first result segment based on a result segment corresponding to a nonlinear function of the first segment, a result segment corresponding to a linear function of the first segment, the comparison segment corresponding to the first secure size comparison of the first segment, and the comparison segment corresponding to the second secure size comparison of the first segment.

[0292] In some embodiments, the second obtaining module 1308 is configured to obtain a shard of the random number, take the shard of the random number as a first input shard for first multiway selection, obtain a second input shard for the first multiway selection according to a result shard of a first shard corresponding to a linear function, a result shard of the first shard corresponding to a nonlinear function, and the first input shard, perform the first multiway selection according to a comparison shard of a first shard corresponding to a first secure size comparison, the first input shard, and the second input shard for the first multiway selection, and obtain an output shard of the first multiway selection corresponding to the first shard; obtain a first input shard for second multiway selection according to the result shard of the first shard corresponding to the linear function and the first input shard for the first multiway selection, obtain a second input shard for the second multiway selection according to the result shard of the first shard corresponding to the nonlinear function and the first input shard for the first multiway selection, perform the second multiway selection according to the comparison shard of the first shard corresponding to a second secure size comparison, the first input shard, and the second input shard for the second multiway selection, and obtain an output shard of the second multiway selection corresponding to the first shard; and obtain the first result shard according to the output shard of the first multiway selection corresponding to the first shard and the output shard of the second multiway selection corresponding to the first shard.

[0293] In some embodiments, the second obtaining module 1308 is further configured to determine the result shard of the second shard corresponding to the nonlinear function according to the first random number used to perform the blinding process, and obtain the second result shard according to the result shard of the second shard corresponding to the nonlinear function and the result shard of the second shard corresponding to the linear function.

[0294] In some embodiments, the second obtaining module 1308 is further configured to call a secure comparison operator to perform a secure size comparison between input data and a lower bound value in the symmetric interval based on the second shard and the lower bound value, to obtain a comparison shard of a first secure size comparison corresponding to the second shard, call the secure comparison operator to perform a secure size comparison between the input data and an upper bound value in the symmetric interval based on the second shard and the upper bound value, to obtain a comparison shard of a second secure size comparison corresponding to the second shard, and determine the second result shard based on the result shard of the second shard corresponding to the nonlinear function, the result shard of the second shard corresponding to the linear function, the comparison shard of the first secure size comparison corresponding to the second shard, and the comparison shard of the second secure size comparison corresponding to the second shard.

[0295] In some embodiments, the second obtaining module 1308 is further configured to obtain a shard of the second random number, take the shard of the second random number as a first input shard for the first multiplexing, obtain a second input shard for the first multiplexing according to a result shard of a second shard corresponding linear function and the first input shard, a result shard of a second shard corresponding non-linear function, perform the first multiplexing according to a comparison shard of a first secure size comparison corresponding to the second shard, the first input shard and the second input shard for the first multiplexing, and obtain an output shard of the first multiplexing corresponding to the second shard; obtain the first input shard for the second multiplexing according to the result shard of the second shard corresponding linear function and the first input shard for the first multiplexing, obtain the second input shard for the second multiplexing according to the result shard of the second shard corresponding non-linear function and the first input shard for the first multiplexing, perform the second multiplexing according to the comparison shard of a second secure size comparison corresponding to the second shard, the first input shard and the second input shard for the second multiplexing, and obtain an output shard of the second multiplexing corresponding to the second shard; and obtain the second result shard according to the output shard of the first multiplexing corresponding to the second shard and the output shard of the second multiplexing corresponding to the second shard.

[0296] In some embodiments, the apparatus further includes a sending module configured to send the first result shard to a data provider of the input data, so that the data provider superimposes the first result shard and a second result shard sent by a second computing service provider to obtain a computing result corresponding to the input data.

[0297] In some embodiments, when the data provider determines that the input data is in a symmetric interval, the sending module is further configured to send the result shard of the first shard corresponding non-linear function to the data provider of the input data, so that the data provider superimposes the result shard of the first shard corresponding non-linear function and a result shard of a second shard corresponding non-linear function sent by a second computing service provider to obtain a computing result corresponding to the input data.

[0298] In one exemplary embodiment, as shown in FIG. 14, a data processing apparatus 1400 is provided, including a shard module 1402 and a generation module 1404, wherein:

[0299] The shard module 1402 is configured to secret-shard input data to obtain a first shard and a second shard, send the first shard to a first computing service provider of secure multiparty computation, and send the second shard to a second computing service provider of secure multiparty computation;

[0300] The first computing service provider segments the original computing function used for processing the input data into a nonlinear function in a symmetric interval and a linear function in an asymmetric interval according to intervals of a definition domain of the original computing function after obtaining the first shard, obtains a Fourier series expression of the nonlinear function, the range of the original computing function has a boundary, and obtains a first feature vector of the first shard based on the Fourier series expression, and sends first ciphertext obtained by homomorphic encryption of the first feature vector to a second computing service provider of secure multi-party computation, and decrypts blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second shard to obtain a result shard corresponding to the nonlinear function of the first shard, and obtains a first result shard according to the result shard corresponding to the nonlinear function of the first shard and a result shard corresponding to the linear function of the first shard; the second computing service provider obtains a second result shard according to the result shard corresponding to the nonlinear function of the second shard and a result shard corresponding to the linear function of the second shard after obtaining the second shard.

[0301] The generating module 1404 is configured to obtain the first result shard returned by the first computing service provider and the second result shard returned by the second computing service provider, and generate a computing result corresponding to the input data according to the first result shard and the second result shard.

[0302] The above-mentioned various modules in the data processing apparatus can be realized by software, hardware and combinations thereof in whole or in part. The above-mentioned various modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to call and execute the operations corresponding to the above-mentioned various modules by the processor.

[0303] In an exemplary embodiment, a computer device is provided, which can be a server, and an internal structure diagram thereof can be as shown in FIG. 15. The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions and a database. The internal memory provides an environment for running the operating system and computer readable instructions in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through network connection. The computer readable instructions are executed by the processor to implement the above-mentioned data processing method.

[0304] Those skilled in the art can understand that the structure shown in FIG. 15 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0305] In one embodiment, a computer device is also provided, including a memory and a processor, the memory storing computer readable instructions, and the processor implementing the steps in the above method embodiments when executing the computer readable instructions.

[0306] In one embodiment, a computer readable storage medium is provided, storing computer readable instructions, and the processor implementing the steps in the above method embodiments when executing the computer readable instructions.

[0307] In one embodiment, a computer program product is provided, including computer readable instructions, and the processor implementing the steps in the above method embodiments when executing the computer readable instructions.

[0308] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0309] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through computer readable instructions, and the computer readable instructions can be stored in a non-volatile computer readable storage medium. When the computer readable instructions are executed, the processes of the above-mentioned embodiments can be included. Any reference to memory, database or other medium used in each embodiment provided by the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (Resistive Random Access Memory, ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. The volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in each embodiment provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., and is not limited thereto. The processor involved in each embodiment provided by the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (Artificial Intelligence, AI) processor, etc., and is not limited thereto.

[0310] Each technical feature of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of each technical feature in the above embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0311] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims. < / y> < / x> < / y> < / x> < / z> < / y> < / x> < / y> < / x> < / z> < / x> < / z> < / y> < / x> < / x> ​

Claims

1. A data processing method, the method being performed by a first computing service provider of secure multi-party computation, the method comprising: receiving a first shard of input data, the first shard of input data being a first of two shards of the input data secret-sharded by a data provider; segmenting an original computing function for processing the input data according to intervals of a domain to obtain a non-linear function in symmetric intervals and a linear function in asymmetric intervals, and obtaining a Fourier series expression of the non-linear function, the range of the original computing function having a boundary; obtaining a first representation vector of the first shard based on the Fourier series expression, sending a first ciphertext obtained by homomorphic encryption of the first representation vector to a second computing service provider of the secure multi-party computation, receiving blinded ciphertext returned by the second computing service provider according to the first ciphertext and a second shard of the two shards, and decrypting the blinded ciphertext to obtain a result shard of the first shard corresponding to the non-linear function; obtaining a first result shard according to the result shard of the first shard corresponding to the non-linear function and a result shard of the first shard corresponding to the linear function; the first result shard is used to generate a computing result corresponding to the input data together with a second result shard obtained by the second computing service provider, wherein the second result shard is obtained by the second computing service provider according to a result shard of the second shard corresponding to the non-linear function and a result shard of the second shard corresponding to the linear function.

2. The method of claim 1, wherein, the Fourier series expression is a superposition of a plurality of expansion terms, and each expansion term is an inner product of a first vector factor and a second vector factor; the obtaining of the first representation vector of the first shard based on the Fourier series expression comprises: inputting the first shard into the first vector factor in each expansion term to obtain the first representation vector of the first shard.

3. The method of claim 1, wherein, the step of obtaining the first ciphertext by homomorphic encryption of the first representation vector comprises: performing floating-point number encoding on each component in the first representation vector to obtain a first encoded vector; performing homomorphic encryption on each component in the first encoded vector to obtain the first ciphertext.

4. The method of claim 1, wherein, the step of calculating blinded ciphertext by the second computing service provider according to the first ciphertext and the second shard of the two shards comprises: obtaining a second representation vector of the second shard based on the Fourier series expression, performing floating-point number encoding on each component in the second representation vector to obtain a second encoded vector; performing homomorphic multiplication processing on the first ciphertext and the second encoded vector to obtain a second ciphertext; performing blinding processing on the second ciphertext based on a random number to obtain blinded ciphertext.

5. The method of claim 4, wherein, the random number determining step comprises: obtaining an upper bound value of variance of error corresponding to the second ciphertext; determining a first random value subject to uniform distribution according to the upper bound value of variance, the first random value being used to blind a noise part in the second ciphertext; obtaining a second random value, the second random value being used to blind a plaintext part in the second ciphertext; fusing the first random value and the second random value to obtain the random number.

6. The method of claim 1, wherein, The first result slice is obtained according to the result slice of the first slice corresponding to the nonlinear function and the result slice of the first slice corresponding to the linear function. A secure comparison operator is invoked based on the first slice and a lower limit value in the symmetric interval to perform a secure size comparison between the input data and the lower limit value, and a comparison slice corresponding to a first secure size comparison of the first slice is obtained. A secure comparison operator is invoked based on the first slice and an upper limit value in the symmetric interval to perform a secure size comparison between the input data and the upper limit value, and a comparison slice corresponding to a second secure size comparison of the first slice is obtained. The first result slice is determined based on the result slice of the first slice corresponding to the nonlinear function, the result slice of the first slice corresponding to the linear function, the comparison slice corresponding to the first secure size comparison of the first slice, and the comparison slice corresponding to the second secure size comparison of the first slice.

7. The method of claim 6, wherein, The first result slice is determined based on the result slice of the first slice corresponding to the nonlinear function, the result slice of the first slice corresponding to the linear function, the comparison slice corresponding to the first secure size comparison of the first slice, and the comparison slice corresponding to the second secure size comparison of the first slice. A slice of the random number is obtained, and the slice of the random number is used as a first input slice for first-time multiplexing. The second input slice for first-time multiplexing is obtained according to the result slice of the first slice corresponding to the linear function, the result slice of the first slice corresponding to the nonlinear function, and the first input slice. First-time multiplexing is performed according to the comparison slice corresponding to the first secure size comparison of the first slice, the first input slice and the second input slice for first-time multiplexing, and the output slice of the first slice corresponding to first-time multiplexing is obtained. The first input slice for second-time multiplexing is calculated according to the result slice of the first slice corresponding to the linear function and the first input slice for first-time multiplexing. The second input slice for second-time multiplexing is calculated according to the result slice of the first slice corresponding to the nonlinear function and the first input slice for first-time multiplexing. Second-time multiplexing is performed according to the comparison slice corresponding to the second secure size comparison of the first slice, the first input slice and the second input slice for second-time multiplexing, and the output slice of the first slice corresponding to second-time multiplexing is obtained. The first result slice is obtained according to the output slice of the first slice corresponding to first-time multiplexing and the output slice of the first slice corresponding to second-time multiplexing.

8. The method of claim 1, wherein, The second calculation service provider obtains the second result slice, and the steps include: The result slice of the second slice corresponding to the nonlinear function is determined according to the first random number used for blind processing. According to the result slice corresponding to the second slice of the nonlinear function and the result slice corresponding to the second slice of the linear function, a second result slice is obtained.

9. The method of claim 8, wherein, The method further comprises: Based on the second slice and the lower limit value in the symmetric interval, a secure comparison operator is called to perform a secure size comparison between the input data and the lower limit value, and a comparison slice corresponding to the first secure size comparison of the second slice is obtained; Based on the second slice and the upper limit value in the symmetric interval, a secure comparison operator is called to perform a secure size comparison between the input data and the upper limit value, and a comparison slice corresponding to the second secure size comparison of the second slice is obtained; Based on the result slice corresponding to the second slice of the nonlinear function, the result slice corresponding to the second slice of the linear function, the comparison slice corresponding to the first secure size comparison of the second slice, and the comparison slice corresponding to the second secure size comparison of the second slice, a second result slice is determined.

10. The method of claim 9, wherein, The method further comprises: A slice of a second random number is obtained, and the slice of the second random number is used as a first path input slice for first-time multi-selection; according to the result slice corresponding to the second slice of the linear function and the first path input slice, and the result slice corresponding to the second slice of the nonlinear function, a second path input slice for first-time multi-selection is obtained; According to the comparison slice corresponding to the first secure size comparison of the second slice, the first path input slice and the second path input slice for first-time multi-selection, first-time multi-selection is performed, and an output slice corresponding to the first-time multi-selection of the second slice is obtained; According to the result slice corresponding to the second slice of the linear function and the first path input slice for first-time multi-selection, a first path input slice for second-time multi-selection is calculated, and according to the result slice corresponding to the second slice of the nonlinear function and the first path input slice for first-time multi-selection, a second path input slice for second-time multi-selection is calculated; According to the comparison slice corresponding to the second secure size comparison of the second slice, the first path input slice and the second path input slice for second-time multi-selection, second-time multi-selection is performed, and an output slice corresponding to the second-time multi-selection of the second slice is obtained; According to the output slice corresponding to the first-time multi-selection of the second slice and the output slice corresponding to the second-time multi-selection of the second slice, a second result slice is obtained.

11. The method of claim 1, wherein, The method further comprises: sending the first result shard to a data provider of the input data for the data provider to decode after superimposing the first result shard and a second result shard sent by the second computing service provider, to obtain a computing result corresponding to the input data.

12. The method according to any one of claims 1 to 11, characterized in that, In a case where the data provider determines that the input data is in the symmetric interval, after obtaining the result shard of the first shard corresponding to the nonlinear function, the method further comprises: sending the result shard of the first shard corresponding to the nonlinear function to the data provider of the input data for the data provider to obtain a computing result corresponding to the input data after superimposing the result shard of the first shard corresponding to the nonlinear function and a result shard of the second shard corresponding to the nonlinear function sent by the second computing service provider.

13. A data processing method, the method being performed by a data provider of secure multi-party computation, the method comprising: secretly splitting input data to obtain a first shard and a second shard, and sending the first shard to a first computing service provider of the secure multi-party computation and sending the second shard to a second computing service provider of the secure multi-party computation; wherein, after obtaining the first shard, the first computing service provider segments an original computing function for processing the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, obtains a Fourier series expression of the nonlinear function, the range of the original computing function has a boundary, and obtains a first representation vector of the first shard based on the Fourier series expression, sends first ciphertext obtained by homomorphic encryption on the first representation vector to the second computing service provider of the secure multi-party computation, receives blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second shard, decrypts the blinded ciphertext to obtain a result shard of the first shard corresponding to the nonlinear function, and obtains a first result shard according to the result shard of the first shard corresponding to the nonlinear function and a result shard of the first shard corresponding to the linear function; after obtaining the second shard, the second computing service provider obtains a second result shard according to a result shard of the second shard corresponding to the nonlinear function and a result shard of the second shard corresponding to the linear function; obtaining the first result shard returned by the first computing service provider and the second result shard returned by the second computing service provider, and generating a computing result corresponding to the input data according to the first result shard and the second result shard.

14. A data processing system, the system comprising a data provider, a first computing service provider and a second computing service provider of secure multi-party computation: The data provider is configured to secret-shares input data to obtain a first share and a second share, and sends the first share to a first computing service provider of secure multiparty computation and sends the second share to a second computing service provider of secure multiparty computation. The first computing service provider is configured to receive the first share sent by the data provider, segment an original computing function used for processing the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, and obtain a Fourier series expression of the nonlinear function, and a range of the original computing function has a boundary. The first computing service provider is further configured to obtain a first feature vector of the first share based on the Fourier series expression, and send first ciphertext obtained by homomorphic encryption of the first feature vector to the second computing service provider of secure multiparty computation. The second computing service provider is configured to receive the second share sent by the data provider, obtain the first ciphertext sent by the first computing service provider, determine blinded ciphertext according to the first ciphertext and the second share, and return to the first computing service provider. The first computing service provider is further configured to obtain the blinded ciphertext returned by the second computing service provider, decrypt the blinded ciphertext to obtain a result share corresponding to the nonlinear function of the first share. The first computing service provider is further configured to obtain a first result share according to the result share corresponding to the nonlinear function of the first share and a result share corresponding to the linear function of the first share, and send the first result share to the data provider. The second computing service provider is configured to obtain a second result share according to the result share corresponding to the nonlinear function of the second share and a result share corresponding to the linear function of the second share, and send the second result share to the data provider. The data provider is further configured to obtain the first result share and the second result share, and generate a computing result corresponding to the input data according to the first result share and the second result share.

15. A data processing apparatus, comprising: a receiving module configured to receive a first share of a share of input data, the first share being one of two shares obtained by a data provider secret-sharing the input data; a segmenting module configured to segment an original computing function used for processing the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, and obtain a Fourier series expression of the nonlinear function, and a range of the original computing function has a boundary; The first obtaining module is configured to obtain a first feature vector of the first shard based on the Fourier series expression, perform homomorphic encryption on the first feature vector to obtain first ciphertext, send the first ciphertext to a second computing service provider of the secure multi-party computation, receive blinded ciphertext returned by the second computing service provider according to the first ciphertext and a second shard of the two shards, and decrypt the blinded ciphertext to obtain a result shard corresponding to the nonlinear function of the first shard. The second obtaining module is configured to obtain a first result shard according to the result shard corresponding to the nonlinear function of the first shard and a result shard corresponding to the linear function of the first shard. The first result shard is used to generate a computing result corresponding to the input data together with a second result shard obtained by the second computing service provider, wherein the second result shard is obtained by the second computing service provider according to a result shard corresponding to the nonlinear function of the second shard and a result shard corresponding to the linear function of the second shard.

16. A data processing apparatus, comprising: a sharding module configured to secret-shard input data to obtain a first shard and a second shard, send the first shard to a first computing service provider of the secure multi-party computation, and send the second shard to a second computing service provider of the secure multi-party computation; wherein, after obtaining the first shard, the first computing service provider segments an original computing function used to process the input data according to intervals of a domain of the original computing function to obtain a nonlinear function in a symmetric interval and a linear function in a non-symmetric interval, obtains a Fourier series expression of the nonlinear function, the range of the original computing function has a boundary, and obtains a first feature vector of the first shard based on the Fourier series expression, performs homomorphic encryption on the first feature vector to obtain first ciphertext, sends the first ciphertext to the second computing service provider of the secure multi-party computation, receives blinded ciphertext returned by the second computing service provider according to the first ciphertext and the second shard, decrypts the blinded ciphertext to obtain a result shard corresponding to the nonlinear function of the first shard, and obtains a first result shard according to the result shard corresponding to the nonlinear function of the first shard and a result shard corresponding to the linear function of the first shard; after obtaining the second shard, the second computing service provider obtains a second result shard according to a result shard corresponding to the nonlinear function of the second shard and a result shard corresponding to the linear function of the second shard; a generating module configured to obtain the first result shard returned by the first computing service provider and the second result shard returned by the second computing service provider, and generate a computing result corresponding to the input data according to the first result shard and the second result shard. 17.A computer device, comprising a memory and a processor, wherein the memory stores computer readable instructions, and the processor implements steps of the method in any one of claims 1 to 13 when executing the computer readable instructions. 18.A computer readable storage medium, having stored thereon computer readable instructions, wherein the computer readable instructions, when executed by a processor, implement steps of the method in any one of claims 1 to 13. 19.A computer program product, comprising computer readable instructions, wherein the computer readable instructions, when executed by a processor, implement steps of the method in any one of claims 1 to 13.

Images