Linear regression method based on privacy protection

Abstract

Embodiments of the present application provide a linear regression method based on privacy protection. The method comprises: a current participant receives an inverse decomposition factor matrix of a regularized symmetric matrix, or a transformed form thereof, wherein the regularized symmetric matrix comprises, as a submatrix, a column-encryption data transformation encryption matrix corresponding to private raw data of a preceding participant; the current participant cooperates with the preceding participant to determine respective product matrixes or transformed forms thereof of the current participant and the preceding participant; the current participant sends the inverse decomposition factor matrix or the transformed form thereof to a subsequent participant; or, the current participant obtains and utilizes the respective product matrixes or the transformed forms thereof of the preceding participant and the current participant, and cooperates with the preceding participant and a label data owner to determine a multiplicatively encrypted linear regression coefficient vector, wherein the multiplicatively encrypted linear regression coefficient vector is equal to the product of the respective inverse decomposition factor matrix of the preceding participant and the current participant and a first product vector. The method provided in the present application can reduce implementation complexity, satisfying practical application requirements.

Description

Privacy-preserving linear regression method TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning, and particularly relates to a privacy-preserving linear regression method. BACKGROUND

[0002] Vertical federated learning (VFL) is a distributed machine learning method that allows multiple participants to jointly train a shared machine learning model while protecting their respective data privacy. This method is particularly suitable for data sets with the same samples (such as users or transactions) but different features, such as banks and e-commerce companies in the same region. Their user bases may be similar, but their business features are different. Challenges faced by vertical federated learning include privacy protection, data alignment, communication efficiency, and security issues. To address these challenges, researchers have proposed a variety of techniques, such as additive homomorphic encryption, secure multi-party computation, and differential privacy. Vertical federated learning has wide applications in finance, healthcare, advertising, and recommendation systems. For example, banks and insurance companies can jointly train a credit scoring model without directly sharing their respective customer data. In vertical federated learning, data is vertically partitioned, i.e., each participant has a different feature set. For example, one participant may have transaction data for users, while another participant may have social network data for users. In this way, each participant can jointly train a more comprehensive model without directly accessing the other party's data.

[0003] In existing vertical federated learning techniques for implementing linear regression, in order to protect the data security of each data owner, an encryption service provider and an evaluator are often needed, or a garbled circuit is introduced to ensure the security of data calculation and interaction. However, the above methods have high complexity and are not conducive to practical implementation. SUMMARY

[0004] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0005] The embodiments of the present application provide a privacy-preserving linear regression method, which can reduce the implementation complexity and meet the actual application requirements.

[0006] To achieve the above object, a first aspect of the embodiment of the present application provides a linear regression method based on privacy protection, comprising: a current participant receiving an inverse decomposition factor matrix of a regular symmetric matrix of a matrix affected by column encryption data transformation encryption matrices corresponding to private original data of previous participants or a transformed form of the inverse decomposition factor matrix; the current participant cooperating with the previous participants to determine a product matrix of the column encryption data transformation encryption matrices of the previous participants and the current participant or a transformed form of the product matrix by using the column encryption data transformation encryption matrices corresponding to the private original data of each participant; the current participant sending the inverse decomposition factor matrix of the regular symmetric matrix of the matrix affected by the column encryption data transformation encryption matrices of the previous participants and the current participant to all or part of subsequent participants; or, the current participant obtaining and using the product matrix of the column encryption data transformation encryption matrices of the previous participants and the current participant or a transformed form thereof, and cooperating with the previous participants and a label data owner to determine a multiplication encryption linear regression coefficient vector, wherein the subsequent participant is a subsequent participant providing the private original data; the multiplication encryption linear regression coefficient vector is equal to a product of the inverse decomposition factor matrix of the regular symmetric matrix of the matrix affected by the column encryption data transformation encryption matrices of the previous participants and the current participant and a first product vector, and the first product vector is determined by a transpose of the inverse decomposition factor matrix and a product of the column encryption data transformation encryption matrix of the previous participants and a label and a product of the column encryption data transformation encryption matrix of the current participant and a label; the transformed form of the matrix satisfies that the matrix can be calculated without other information.

[0007] In some embodiments, the product matrix of the column encryption data transformation encryption matrices of the previous participants and the current participant is equal to a product of a transpose of the column encryption data transformation encryption matrix of the previous participant and the column encryption data transformation encryption matrix of the current participant, and the product matrix of the column encryption data transformation encryption matrices of the previous participants and the current participant or the transformed form thereof is determined by the previous participants cooperating with the current participant based on a preset secure multi-party computation protocol or directly calculated.

[0008] In some embodiments, the column-encrypted data transformation encryption matrix corresponding to the private original data of any of the participants is equal to the product of the column-encrypted data matrix of the any participant and the first mask matrix of the any participant; wherein the column-encrypted data matrix of the any participant is formed by the original data matrix of the private original data of the any participant as a sub-matrix, and the column-encrypted data matrix includes each sub-column in the original data matrix and a mask column generated by the any participant itself or obtained from a trusted node, the mask column contains the same number of items as each column of the original data matrix of the any participant itself; and the first mask matrix of the any participant is an invertible matrix generated by the any participant itself or obtained from a trusted node; wherein the multiplication encrypted linear regression coefficient vector is equal to the column vector obtained by right multiplying the block diagonal matrix composed of the first mask matrices of each participant after adding the influence of the mask column of each participant to the target linear regression coefficient column vector, wherein the block diagonal matrix contains the inverse matrices of the first mask matrices of each participant as sub-matrices located on the diagonal of the block diagonal matrix.

[0009] In some embodiments, the column-encrypted data transformation encryption matrix influence of the previous participants is equivalent to containing the column-encrypted data transformation encryption matrix of the previous participants as a sub-matrix, and the column-encrypted data transformation encryption matrix influence of the previous participants and the current participant is equivalent to containing the column-encrypted data transformation encryption matrix of the previous participants and the column-encrypted data transformation encryption matrix of the current participant as sub-matrices; wherein the regularization symmetric matrix of a matrix is the symmetric matrix of the matrix plus the sum of regularization terms, wherein the regularization term is a matrix containing the product of the symmetric matrix of the first mask matrix of the relevant participant and the preset regularization coefficient as a sub-matrix; the symmetric matrix of a matrix is equal to the product of the transpose of the matrix and the matrix itself; the inverse decomposition factor matrix of the regularization symmetric matrix is the decomposition factor matrix of the inverse matrix of the regularization symmetric matrix, and the decomposition factor matrix is one of a square root matrix or an LDL T decomposition L factor matrix.

[0010] In some embodiments, the current participant cooperates with the previous participants to determine a product matrix of the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version of the product matrix, using the column-encrypted data transformation encryption matrix corresponding to the respective private raw data of each participant; the current participant sends the inverse factor matrix of the regularized symmetric matrix containing the matrix affected by the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version of the inverse factor matrix to the subsequent participant(s) in whole or in part; or, the current participant obtains and uses the product matrix of the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version thereof to determine a multiplication-encrypted linear regression coefficient vector in cooperation with the previous participants and the label data owner, wherein the subsequent participant(s) are subsequent participants who provide the private raw data, including: the current participant cooperates with the previous participants to determine a product matrix of the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version thereof, using the column-encrypted data transformation encryption matrix of the current participant and the column-encrypted data transformation encryption matrix of the previous participants, and the product matrix or the transformed version thereof is obtained by the current participant; the current participant uses the product matrix of the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version thereof to obtain the inverse factor matrix of the regularized symmetric matrix containing the matrix affected by the column-encrypted data transformation encryption matrices of the previous participants and the current participant or a transformed version of the inverse factor matrix, and then sends all or part of the inverse factor matrix or the transformed version of the inverse factor matrix to the subsequent participant(s); when all the participants participate in the calculation to obtain the inverse factor matrix of the regularized symmetric matrix containing the matrix affected by the column-encrypted data transformation encryption matrices of each participant or a transformed version of the inverse factor matrix, the current participant then cooperates with the previous participants and the label data owner to determine a multiplication-encrypted linear regression coefficient vector using the inverse factor matrix or the transformed version of the inverse factor matrix of the current participant.

[0011] In some embodiments, the current participant obtains and utilizes the product matrix of the column-encrypted data transformation encryption matrices of the previous participants and the current participant respectively or a transformed version thereof, and collaborates with the previous participants and the label data owner to determine a multiply-encrypted linear regression coefficient vector, including: after all the participants participate in computing the inverse decomposition factor matrix of the regularized symmetric matrix containing matrices affected by the column-encrypted data transformation encryption matrices of the respective participants or a transformed version of the inverse decomposition factor matrix, determining the multiply-encrypted linear regression coefficient vector, using the inverse decomposition factor matrix of the regularized symmetric matrix containing matrices affected by the column-encrypted data transformation encryption matrices of the respective participants, the column-encrypted data transformation encryption matrix and label product of the previous participants, and the column-encrypted data transformation encryption matrix and label product of the current participant; the column-encrypted data transformation encryption matrix and label product of any participant is equal to the product between the transpose of the column-encrypted data transformation encryption matrix of the corresponding participant and the label column vector of the label owner; the column-encrypted data transformation encryption matrix and label product of any participant is determined or directly computed by the participant and the label owner based on a pre-set secure multi-party computation protocol.

[0012] In some embodiments, the determination of the multiply-encrypted linear regression coefficient vector using the inverse decomposition factor matrix of the regularized symmetric matrix containing matrices affected by the column-encrypted data transformation encryption matrices of the respective participants, the column-encrypted data transformation encryption matrix and label product of the previous participants, and the column-encrypted data transformation encryption matrix and label product of the current participant, the multiply-encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing matrices affected by the column-encrypted data transformation encryption matrices of the respective participants and a first product vector, the first product vector is a second product vector further determined by multiplying the transpose of the inverse decomposition factor matrix and a spliced vector containing the column-encrypted data transformation encryption matrix and label product of the previous participants and the column-encrypted data transformation encryption matrix and label product of the current participant as sub-vectors, when the decomposition factor matrix is a square root matrix, the first product vector is equal to the second product vector, or when the decomposition factor matrix is an LDL T decomposition L factor matrix, the first product vector is equal to the product of the LDL T decomposition D factor matrix and the second product vector.

[0013] In some embodiments, there are m participants providing respective said private original data, m is an integer greater than or equal to 2; the current participant is the ith participant, where i is an arbitrary integer greater than or equal to 2 and less than or equal to m; the preceding participant is the jth participant, where j is an arbitrary positive integer less than the i; the subsequent participant is the kth participant, where k is an arbitrary integer greater than i and less than or equal to m, the current participant collaborates with the preceding participant to determine a product matrix of the column encryption data transformation encryption matrices corresponding to the respective said private original data of the preceding participant and the current participant or a transformed form of the product matrix, comprising: the ith participant collaborates with the jth participant to determine a product matrix of the column encryption data transformation encryption matrices corresponding to the respective said private original data of the jth participant and the ith participant or a transformed form of the product matrix, where j takes an arbitrary positive integer less than i.

[0014] In some embodiments, when the current participant is the ith participant and i is less than or equal to m-1, the preceding participant is the (i-1)th participant and the subsequent participant is the (i+1)th participant, the (i-1)th participant sends to the ith participant, all or part of the inverse factor matrix of the regular symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the first to the (i-1)th participant, and the ith participant receives the inverse factor matrix or its transformation form; the ith participant cooperates with each of the first to the (i-1)th participant respectively, determines the product matrix or the transformation form of the product matrix of the column-encrypted data transformation encryption matrix of the ith participant and each of the first to the (i-1)th participant respectively by using the column-encrypted data transformation encryption matrix corresponding to the private original data of each participant, and then obtains and sends to the (i+1)th participant, all or part of the inverse factor matrix of the regular symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the first to the ith participant by using the product matrix or its transformation form; when the current participant is the ith participant and i is equal to m, the preceding participant is the (m-1)th participant, and the (m-1)th participant sends to the mth participant, all or part of the inverse factor matrix of the regular symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the first to the (m-1)th participant, and the mth participant receives the inverse factor matrix or its transformation form; the mth participant cooperates with each of the first to the (m-1)th participant respectively, determines the product matrix or the transformation form of the product matrix of the column-encrypted data transformation encryption matrix of the mth participant and each of the first to the (m-1)th participant respectively by using the column-encrypted data transformation encryption matrix corresponding to the private original data of each participant, and then determines the multiplication-encryption linear regression coefficient vector by cooperating with the label data owner and the first to the (m-1)th participant by using the product matrix or its transformation form.the product of the inverse decomposition factor matrix of the regularized symmetric matrix comprising the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and the first product vector, the first product vector being determined further from the second product vector being the product of the transpose of the inverse decomposition factor matrix and the concatenation vector comprising the product of the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and a label as a sub-vector, when the decomposition factor matrix is the square root matrix, the first product vector equals the second product vector, or when the decomposition factor matrix is LDL; T the product of the inverse decomposition factor matrix of the regularized symmetric matrix comprising the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and the first product vector, the first product vector being determined further from the second product vector being the product of the transpose of the inverse decomposition factor matrix and the concatenation vector comprising the product of the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and a label as a sub-vector, when the decomposition factor matrix is the square root matrix, the first product vector equals the second product vector, or when the decomposition factor matrix is LDL; T the product of the inverse decomposition factor matrix of the regularized symmetric matrix comprising the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and the first product vector, the first product vector being determined further from the second product vector being the product of the transpose of the inverse decomposition factor matrix and the concatenation vector comprising the product of the m column encrypted data transformation encrypted matrices of the m participants from the 1st participant to the mth participant and a label as a sub-vector, when the decomposition factor matrix is the square root matrix, the first product vector equals the second product vector, or when the decomposition factor matrix is LDL;

[0015] To achieve the above object, the second aspect of the present application proposes a privacy protection based linear regression system, which is used to execute the privacy protection based linear regression method of the first aspect.

[0016] To achieve the above object, the third aspect of the present application proposes a computer readable storage medium, which comprises a stored computer program; wherein the computer program, when executed, controls a device where the computer readable storage medium is located to execute the privacy protection based linear regression method of the first aspect.

[0017] The embodiments of the present application have at least the following beneficial effects: the participant who has the private original data encrypts the original data matrix by itself, no other participant knows the specific encryption mode except the participant itself, after all the participants complete the encryption, the participants are arranged, the first participant determines the inverse factor matrix of itself according to the column encryption transformation encryption matrix obtained by the original data matrix, the first participant sends the inverse factor matrix of itself or its transformation form to the second participant, the second participant determines the inverse factor matrix containing the column encryption transformation encryption matrix of the first participant and the second participant and sends it to the third participant according to the inverse factor matrix of the first participant, and the third participant is arranged in turn until the last participant calculates the inverse factor matrix containing the column encryption transformation encryption matrix of all the participants from the first participant to the last participant. The last participant can determine the multiplication encryption linear regression coefficient vector through the inverse factor matrix of the last participant and the label data of the label data owner. Compared with the prior art, the present application does not need to introduce a trusted computing node and an encryption service provider, and does not need to realize a very high complexity confusion circuit, so that the implementation complexity can be reduced, and the actual application requirements can be met.

[0018] Other features and advantages of the present application will be set forth in the description that follows, and in part will be apparent from the description, or can be learned by practice of the present application. The purposes and other advantages of the present application will be realized and attained by the structure particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings are included to provide a further understanding of the technical scheme of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical scheme of the present application, and do not constitute a limitation on the technical scheme of the present application.

[0020] Fig. 1 is an optional flow diagram of the linear regression method based on privacy protection provided by the embodiments of the present application. DETAILED DESCRIPTION

[0021] In order to make the purposes, technical schemes and advantages of the present application more clear, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and do not limit the present application.

[0022] In the description of the present application, the meaning of several is one or more, the meaning of multiple is two or more, greater than, less than, more than, etc. are understood as not including the number, above, below, etc. are understood as including the number.

[0023] It should be noted that although the functional modules are divided in the device schematic diagram, and the logical sequence is shown in the flowchart, in some cases, the steps shown or described can be performed in a manner different from the module division in the device or the sequence in the flowchart. The terms "first", "second", etc. in the specification, claims or above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0024] It should be noted that in each specific embodiment of the present application, when it is necessary to perform relevant processing on data related to the characteristics of the target object, such as target object attribute information or attribute information set, the permission or consent of the target object will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. Among them, the target object can be a user. In addition, when the embodiments of the present application need to obtain target object attribute information, the separate permission or separate consent of the target object will be obtained through a pop-up window or by jumping to a confirmation page, and after obtaining the separate permission or separate consent of the target object, the necessary target object related data for enabling the embodiments of the present application to normally run will be obtained.

[0025] In the existing longitudinal federated learning technology for implementing linear regression, in order to protect the data security of each data owner, an encryption service provider and an evaluator are often needed, or a garbled circuit is introduced to ensure the security of data calculation and interaction process, but the above-mentioned way has high complexity and is not conducive to implementation in actual application.

[0026] Based on this, the embodiments of the present application provide a linear regression method based on privacy protection, which can reduce the implementation complexity and meet the actual application requirements.

[0027] The linear regression method based on privacy protection provided by the embodiments of the present application is specifically described through the following embodiments. First, the linear regression method based on privacy protection in the embodiments of the present application is described.

[0028] The privacy protection based linear regression method provided in the embodiments of the present application relates to the technical field of computers. The privacy protection based linear regression method provided in the embodiments of the present application can be applied to a terminal, can be applied to a server end, and can also be software running in the terminal or the server end. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc.; the server end can be configured as a stand-alone physical server, can be configured as a server cluster or a distributed system composed of multiple physical servers, can also be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms; and the software can be an application for implementing the privacy protection based linear regression method, but is not limited to the above forms.

[0029] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0030] A secure inner product (Secure Inner Product) of two parties holding vectors x and y is adopted, that is, a party holding x and a party holding y can obtain the inner product of x and y through the privacy protection secure inner product, and the result of the inner product is placed in the party holding x and the party holding y respectively. The result of the party holding x and the party holding y is added to obtain the inner product of the vectors x and y.

[0031] A secure inner product joint calculation method supported by a trusted initializer, the security of which depends on the trusted initializer not colluding with a data provider, and the specific process is as follows:

[0032] Participants: data provider 1 is called P1, data provider 2 is called P2, and the trusted initializer is called TI.

[0033] Input: column vector x owned by P1; column vector y owned by P2.

[0034] Input: P1 gets s1, and P2 gets s2, which satisfy s1 + s2 = <x, y>, <x, y> represents the inner product of vectors x and y.

[0035] Scheme:

[0036] 1. TI generates random vectors a and b, and a random number r, and let z = <a, b> - r. TI sends (a, r) to P1, and sends (b, z) to P2.

[0037] 2. P1 sends x + a to P2.

[0038] 3. P2 sends y - b to P1.

[0039] 4. P1 calculates its partial output s1 = <x, y - b> - r.

[0040] 5. P2 calculates its partial output s2 = <x + a, b> - z.

[0041] It is easy to verify that s1 + s2 = <x, y - b> - r + <x + a, b> - z = <x, y> - <x, b> - r + <x, b> + <a, b> - z == <x, y> + <a, b> - r - z, and by substituting z = <a, b> - r, we can get s1 + s2 = <x, y>.

[0042] The above secure inner product joint calculation method is used to calculate A and b. It is easy to see that A = X T X + λI is a matrix symmetric about the diagonal line, so only half of the non-diagonal line items need to be calculated. Generally, By the user i who owns the data X i locally calculates; and (i ≠ j, here it is assumed that only half of the upper triangle is calculated, so i < j; actually, i > j can also be calculated) needs to be jointly calculated by the first participant user i with his own data X i and the second participant user j with his own data X j , based on the privacy-preserving SMM algorithm, and The calculation result can be obtained by transposing. Among them, Or The result is an additive share, and the result is saved by both party i and party j respectively. The participants can restore the local calculation part of the matrix by splicing the local calculation results, and the part without local calculation results is filled with 0: specifically, for Only user i has the result, and all other m-1 users fill this position with 0; for Only user i and user j save the result of the additive share respectively, and all other m-2 users fill this position with 0. After the above processing, each participant has the matrix Ai, which represents the symmetric matrix A = X T of the ith additive share of the matrix A = X

[0043] Assuming that the label vector y is at the mth user, then The component contained in (i = 1, 2, …, m-1) is obtained by the ith user and the mth user through two-party secure computation, and the result is placed in the ith user and the mth user respectively. The result obtained by adding the result owned by the ith user and the mth user respectively is And is obtained by the mth user using its own data. Each participant also fills the part without local calculation results with 0. After the above processing, each participant has the vector which represents the ith additive share of the vector y of the matrix A = X

[0044] The above participants can be referred to as data providers P1, P2, …, Pm, and each data provider Pi (i = 1, 2, …, m) obtains A i and A i is the ith additive share of the symmetric matrix A = X T X+λI, and is the ith additive share of the vector y .

[0045] This invention presents a privacy-preserving linear regression method. It addresses a scenario where m (m≥2) data owners providing private data and one label data owner jointly participate in vertical federated learning. The method aims to protect the data privacy of the data owners, where the m (m≥2) data owners providing private raw data are referred to as the m participants. The label data owner is referred to as the label owner, and can be one of the m participants or other participants. This privacy-preserving linear regression method can be understood as follows: the m participants in the vertical federated learning collaboratively calculate the regularized symmetric matrix X of the concatenated matrix X of the m participants' raw data matrices, using methods that protect the privacy of their respective private raw data. T The inverse matrix of X+λI (X T X+λI) -1 The factor matrix is ​​decomposed, and then the target linear regression coefficient vector is calculated based on the theory of linear regression coefficients in longitudinal federated learning. The process involves factoring the matrix into square root matrices and LDL. T One of the L-factor matrices decomposed, the process of calculating the target linear regression coefficient vector can be understood as follows: m participants in the longitudinal federated learning use their respective private original data X... i Privacy-preserving methods, cooperative computation to satisfy FF T =(X T X+λI) -1 The matrix F, or satisfying LDL T =(X T X+λI) -1 Let L and D be matrices, where F is a regularized symmetric matrix X formed by concatenating the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 The square root matrix, matrix L, and matrix D represent the regularized symmetric matrix X of the concatenated matrix X of the original data matrices of m participants. T The inverse matrix of X+λI (X T X+λI) -1 LDL T Decompose the factor matrix into L-factor and D-factor matrices; then... The target linear regression coefficient vector is calculated. Because of FF T =(X T X+λI) -1 Substitution It can be obtained On the other hand, it can also be derived from the L-factor matrix L and the D-factor matrix D. Compute the target linear regression coefficient vector

[0046] The embodiments of the present application are further described below with reference to the accompanying drawings.

[0047] As shown in FIG. 1, FIG. 1 is an optional flowchart of a privacy protection based linear regression method provided by the embodiments of the present application. The privacy protection based linear regression method can be executed by a server, or can be executed by a terminal, or can be executed by the server in cooperation with the terminal. The privacy protection based linear regression method includes, but is not limited to, the following steps S11 to S12:

[0048] In step S11, the current participant receives an inverse decomposition factor matrix of a regular symmetric matrix affected by column encryption data transformation encryption matrices corresponding to private original data of previous participants or a transformed form of the inverse decomposition factor matrix. The current participant cooperates with the previous participants to determine a product matrix of column encryption data transformation encryption matrices of the previous participants and the current participant or a transformed form of the product matrix by using column encryption data transformation encryption matrices corresponding to private original data of the respective participants. The current participant sends the inverse decomposition factor matrix of the regular symmetric matrix affected by column encryption data transformation encryption matrices of the previous participants and the current participant or the transformed form of the inverse decomposition factor matrix to all or part of subsequent participants.

[0049] In step S12, alternatively, the current participant obtains and uses the product matrix of column encryption data transformation encryption matrices of the previous participants and the current participant or the transformed form thereof to cooperate with the previous participants and the label data owner to determine a multiplication encryption linear regression coefficient vector. The subsequent participants are subsequent participants who provide private original data.

[0050] The multiplication encryption linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regular symmetric matrix affected by column encryption data transformation encryption matrices of the previous participants and the current participant and the first product vector. The transformed form of the arbitrary matrix satisfies that the arbitrary matrix is calculated from the transformed form without other information.

[0051] It can be understood that the participant who has the original data matrix encrypts the original data matrix by itself, and no other participant knows the specific encryption mode except the participant itself, after all the participants complete the encryption, the participants are arranged, the first participant determines the inverse decomposition factor matrix of the participant according to the column encryption transformation encryption matrix obtained by the original data matrix of the participant, the first participant sends or equivalently sends the column encryption transformation encryption matrix and the inverse decomposition factor matrix of the participant to the second participant, the second participant determines the inverse decomposition factor matrix containing the influence of the column encryption transformation encryption matrix of the first and second participants according to the column encryption transformation encryption matrix and the inverse decomposition factor matrix of the first participant and the column encryption transformation encryption matrix of the second participant, and sends or equivalently sends the inverse decomposition factor matrix to the third participant, and the same is true for the subsequent participants, until the last participant, i.e., the mth participant, calculates the inverse decomposition factor matrix of the participant, the inverse decomposition factor matrix of the last participant contains the influence of the column encryption transformation encryption matrix corresponding to the original data matrix of all m participants. The mth participant determines the multiplication encryption linear regression coefficient vector by cooperating with the label data owner and the other m-1 participants from the first participant to the m-1th participant, the multiplication encryption linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularization symmetric matrix containing the influence of the column encryption transformation encryption matrix of all m participants from the first participant to the mth participant and a vector. Compared with the prior art, the present application does not need to introduce a trusted computing node and an encryption service provider, and does not need to implement a very complex garbled circuit, so that the implementation complexity can be reduced, and the actual application requirements can be met.

[0052] First, an embodiment of the present application is introduced, which is referred to as embodiment one of the present application. Embodiment one of the present application includes steps S11 and S12, and step S11 further includes steps S111 and S112, which are introduced as follows.

[0053] In the specific implementation process, step S11 includes steps S111 to S112, step S111 includes sub-steps S111-a to S111-e, and step S112 includes sub-steps S112-a to S112-f; the sub-steps S111-a to S111-e included in step S111 are introduced as follows:

[0054] Sub-step S111-a: This sub-step is optional, involving adding mask columns. In this sub-step, the first participant adds one or more mask columns after its original data matrix X1. This is an optional step; the first participant chooses this step if it wants to achieve better privacy protection. Typically, a single mask vector is sufficient for privacy protection, but the first participant can also use multiple mask columns to achieve better privacy protection. The first participant generates the data matrix with added mask columns based on the original data matrix X1 composed of its private original data and the added-column encryption mask matrix Δ1. This will also be referred to as column-encrypted data matrix for short.

[0055] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. The original data matrix X1 of the first participant has τ1 columns containing τ1 features, while the additional column encryption mask matrix Δ1 has... The column can be generated by the first participant, and the added column encryption mask matrix Δ1 is usually randomly generated. This indicates adding a column τ1 to the end of the original data matrix X1. The column-adding encryption mask matrix Δ1 is used to obtain the common... Column-wise encrypted data matrix Notice It can be equal to 0, which is equivalent to the first participant not adding an additional column to the encryption mask matrix Δ1 to encrypt the original data; in addition, it is usually allowed to A value of 1 provides excellent encryption; in this case, there is... The column-adding encryption mask matrix Δ1 is actually a column vector of the column-adding encryption mask with only one column. If the first participant does not choose this optional column-adding mask step, then the following steps will be used...

[0056] Sub-step S111-b: This sub-step is an optional sub-step that multiplies by the first mask matrix for encryption. In this sub-step, the first participant uses a matrix containing its own original data matrix X1 as the sub-matrix (i.e., the column-encrypted data matrix). Multiplying by the first mask matrix Ω1 on the left yields the product of the column encrypted data matrix and the first mask matrix. The This is simply referred to as the first participant's column encryption data transformation encryption matrix. The aforementioned first mask matrix Ω i It is used for encryption and is an invertible matrix. The first mask matrix Ω1 can be an identity matrix, in which case we have... This means that this step involves no actual operation, which is equivalent to not selecting this step.

[0057] Sub-step S111-c: The first participant transforms the encryption matrix by using his own column encryption data Obtain the square root matrix P1 of the inverse matrix of the regularized symmetric matrix of the first participant's column encryption data transformation encryption matrix, which satisfies Here λ represents a scalar, called the regularization coefficient, which is usually a real number greater than or equal to zero, and represents the influence of the first mask matrix Ω1 used for transformation; when the first mask matrix Ω1 is an orthogonal matrix, the above can be simplified to the common regularization matrix, that is, Here I represents the identity matrix. Note that the first participant can use an arbitrary orthogonal matrix Θ 1右乘 P 1得到更新 After P1= P1Θ1; on the other hand, this sub-step calculates the matrix P1 that satisfies , and the specific calculation can be performed by various methods. The square root matrix of the inverse matrix of the regularized symmetric matrix of the first participant's column encryption data transformation encryption matrix is a decomposition factor matrix of the inverse matrix of the regularized symmetric matrix of the first participant's column encryption data transformation encryption matrix. Hereinafter, the square root matrix of the inverse matrix is referred to as the inverse square root, and the decomposition factor matrix of the inverse matrix is referred to as the inverse decomposition factor matrix. The inverse decomposition factor matrix is a simple form of the inverse matrix of the decomposition factor matrix, and is also a simple form of the decomposition factor matrix of the inverse matrix. In mathematics, the inverse matrix of a decomposition factor matrix is equal to the decomposition factor matrix of the inverse matrix.

[0058] In this application, (·) T represents the transpose of a real matrix (including a vector), or the conjugate transpose of a complex matrix (including a vector), such as in the above and in the above Two matrices are placed together, or a scalar and a matrix are placed together, to represent multiplication, such as in the above represents multiplication , and λI represents the scalar λ multiplied by the identity matrix I.

[0059] In this application, is referred to as the symmetric matrix of the first participant's column encryption data transformation encryption matrix, which is the transpose of the first participant's column encryption data transformation encryption matrix multiplied by the first participant's column encryption data transformation encryption matrix ; and The regularized symmetric matrix called the encryption matrix of the first participant's encrypted data transformation is also simply called the first regularized symmetric matrix of the first participant. Obviously, it is also the first regularized symmetric matrix of a single participant. This is called the inverse of the regularized symmetric matrix of the encryption matrix transformed by the first participant's encrypted data. The aforementioned regularized symmetric matrix... In this context, λI is a matrix related to regularization. In some cases, λI can take the form of... A diagonal matrix, where the terms on the diagonal can take different values.

[0060] To enhance secrecy, it is typically required that P1 is not a triangular matrix. If the inverse Cholesky decomposition algorithm is used to obtain the first regularized symmetric matrix of the first participant... (It contains) As a special case, if the inverse of the Cholesky decomposition matrix is ​​taken as P1, then P1 is a triangular matrix. In this case, P1 is usually right-multiplied by an arbitrary orthogonal matrix Θ1 to obtain the updated P1 = P1Θ1, making P1 non-triangular. To achieve encryption in this step, after the first participant obtains a P1, even if P1 is no longer a triangular matrix, they usually right-multiply P1 by an orthogonal matrix Θ1 known only to the first participant to obtain the updated P1 = P1Θ1.

[0061] Sub-step S111-d: When the first implementation of the sending step in this embodiment is adopted, the first participant sends the inverse decomposition factor matrix P1 of its first regularized symmetric matrix or a transformed form of the inverse decomposition factor matrix P1 to the second participant in this sub-step; or, when the second implementation of the sending step in this embodiment is adopted, the first participant sends P1 or its transformed form to the m-1 participants, namely participants 2, 3...m, in this sub-step. The transformed form of the inverse decomposition factor matrix P1 satisfies the condition that the inverse decomposition factor matrix P1 can be calculated from this transformed form without the need for other information.

[0062] Sub-step S111-e: The control variable i corresponding to the first participant (i.e., the first data owner) is equal to 1. In this sub-step, the value of i is first incremented by 1; then, if the value of i is greater than m, proceed to step S12; if the value of i is less than or equal to m, proceed to step S112. As mentioned earlier, vertical federated learning has m participants who own their own private original data, also called m data owners, where m is an integer greater than or equal to 1; in addition, there are label owners. This step is explained as follows: when i is greater than m, then the next step mainly involves the addition of the label data owner, and proceeds to step S12 accordingly; when i is less than or equal to m, then the next step mainly involves the addition of the i-th participant, i.e., the i-th data owner, and proceeds to step S112 accordingly.

[0063] In this invention, the concatenation matrix of encrypted data from the i (i ≤ m) participant columns is used. This can be simply referred to as a column-encrypted data matrix with i participants, noting that the column-encrypted data matrix belongs to the j-th participant (j is greater than or equal to 1 and less than or equal to i). The original data matrix X is composed of the original data privately owned by the j-th participant. j An additional encryption mask matrix Δ is added at the rear. j The result is obtained, and it is also possible to obtain it without adding an additional encryption mask matrix Δ. j Therefore, On the other hand, the column encryption data matrix of the j-th participant (j is greater than or equal to 1 and less than or equal to i) Left-multiply by the first mask matrix Ω of the j-th participant j The product of the column-encrypted data matrix and the first mask matrix is ​​obtained, which is the column-encrypted data transformation encryption matrix. This invention uses a concatenated matrix of encryption transformation encryption matrices for the i (i less than or equal to m) participant columns 1, 2, ..., i. It is simply referred to as the column encryption data transformation encryption matrix with i participants.

[0064] It is easy to see that the previous step S111 used... It can also be expressed as That is, a column-encrypted data matrix with one participant. The previous step S111 used... It can also be expressed as That is, the column encryption data transformation encryption matrix of a single participant.

[0065] In this application document, It is called a symmetric matrix that transforms the encrypted data of i participating parties into an encrypted matrix. Let be the regularized symmetric matrix of the encryption matrix transformed by the encrypting data of the i participating parties, or simply the first regularized symmetric matrix of the i participating parties, where It is along Ω [1:i] Place the matrix Ω1, Ω2, ..., Ω diagonally aligned. i The resulting block diagonal matrix can also be represented as Ω using the blkdiag function in the well-known MATLAB software. [1:i] =blkdiag(Ω1,Ω2,…,Ω) i ); because Ω1, Ω2, ..., Ω i These are the first mask matrices for participants 1, 2, ..., i. In this application, Ω is... [1:i]This is called the block diagonal matrix composed of the first mask matrices of each of the i participants, or simply the first mask matrix of the i participants. Clearly, when i is greater than or equal to 2, the above... It is the first regularized symmetric matrix involving multiple parties. Correspondingly, It is the inverse of the regularized symmetric matrix of the encryption matrix transformed by the encrypted data of the i participating parties, and is simply referred to as the inverse of the first regularized symmetric matrix of the i participating parties.

[0066] It is easy to see that the column encryption data of i participants is transformed into an encryption matrix. Regularized symmetric matrix It is a column-encrypted data transformation encryption matrix containing any one of the i participants from the 1st participant to the ith participant. Matrix as a submatrix The regularized symmetric matrix. middle, This is called the regularization term, and correspondingly, the regularization symmetric matrix. yes Symmetric matrix Add regularization term The sum of these terms can be derived from the regularization term. That is, regularization term The first mask matrix Ω contains any one of the i participants from the 1st participant to the ith participant. j Symmetric matrix The product with the preset regularization coefficient λ As a submatrix, where j = 1, 2, ..., i.

[0067] In this embodiment, the i-th participant is equivalent to calculating the inverse factor matrix P of the first regularized symmetric matrix of all i participants. i It is to satisfy The square root matrix. When Ω [1:i] If it is an orthogonal matrix, then the above... It can be simplified to When Ω [1:i] If it is an orthogonal matrix, then the above... It can be simplified to The above P i It is the square root matrix of the inverse of the regularized symmetric matrix of the orthogonal transformation result of the encrypted data of i participating parties. It is a type of factor matrix of the inverse of the regularized symmetric matrix of the orthogonal transformation result of the encrypted data of i participating parties, and can be simply referred to as the inverse factor matrix of the first regularized symmetric matrix of i participating parties.

[0068] The following sub-steps S112-a to S112-h describe how participant i (i = 2, 3, ..., m) receives P i-1 After its transformation, or the received P is used. i-1 Or its transformed form, and its own data matrix X i P was calculated. i The method; when i is less than or equal to m-1, then participant i calculates P. i After that, put P i Or send its transformed form to the next participant, i.e., participant i+1, or send P i Relative to P i-1 The added columns or their transformed forms are sent to the mi participants i+1, i+2, ..., m. To further protect the data privacy of participants 1, 2, ..., i-1, this embodiment includes an implementation using Secure Multi-Party Computation protocols, which can transform the encrypted data into an encryption matrix when participant i has not received the column encryption data from participants 1, 2, ..., i-1. In the case of P, the calculation is obtained. i .

[0069] In step S112, the i-th participant (i ≥ 2 ≤ m), i.e., the i-th data owner, receives the inverse factor matrix P of the first regularized symmetric matrix from a total of i-1 participants. i-1 The i-th participant uses its own column to encrypt the data matrix. (Note Δ) i It can be an empty matrix (as a special case), let P i-1 Updated to P i P here i It is the inverse factorization matrix of the first regularized symmetric matrix of the aforementioned i participants. When i is less than or equal to m-1, participant i calculates P. i After that, put P i Or send its transformed form to the next participant, i.e., participant i+1, or send P i Relative to P i-1 The matrix consisting of the added columns, or its transformed form, is sent to the mi participants i+1, i+2, ..., m. The transformed form of any of the above matrices satisfies the condition that the arbitrary matrix can be calculated from this transformed form without requiring other information.

[0070] The above step S112 includes the following sub-steps S112-a to S112-h, a total of 6 sub-steps:

[0071] Sub-step S112-a: The i-th participant, i.e., the i-th data owner, obtains the inverse factor matrix P of the first regularized symmetric matrix of the i-1 participants based on the received information. i-1 When the sending step in this embodiment adopts the first implementation method, the i-th participant receives the P sent by the (i-1)-th participant. i-1 Or its variant form; when the sending step of this embodiment adopts the second implementation method, the i-th participant receives P sent or equivalently sent by these participants from participants 1, 2...i-1 respectively. i-1 A portion of it or a transformed form thereof, which are then combined to obtain P i-1 .

[0072] Sub-step S112-b: This sub-step is optional and involves adding a mask column. In this sub-step, the data matrix X is... i The i-th participant in its own data matrix X i Adding one or more columns of masking is an optional step. The data matrix X constructed by the i-th participant based on its private original data... i and the addition of an encryption mask matrix Δ i The generated data matrix with added mask columns This will also be referred to as column-encrypted data matrix for short.

[0073] Specifically, a column-encrypted data matrix is ​​a data matrix with added mask columns. The original data matrix X of the i-th participant i There is τ i The column contains τ i The original data of each feature, and the added encryption mask matrix Δ i have The column can be generated by the i-th participant, usually by adding an encryption mask matrix Δ. i It is randomly generated. Indicates that there is τ i The original data matrix X of the column i Added later Column-adding encryption mask matrix Δ i To obtain shared ownership Column-wise encrypted data matrix in It can be equal to 0, which is equivalent to the i-th participant not adding an additional column to the encryption mask matrix Δ. i To encrypt the original data; in addition, it is usually made A value of 1 provides excellent encryption; in this case, there is... Column-adding encryption mask matrix Δ iIn reality, it's a single-column incrementing encryption mask column vector. If the i-th participant doesn't choose this optional incrementing mask column step, then the following steps will be used... It is easy to see that the added-column encryption mask matrix Δ i The number of items in each column compared to the original data matrix X i Each column contains the same number of items; the added column encryption mask matrix Δ i Each column can be generated by the i-th participant or obtained from a trusted node.

[0074] Sub-step S112-c: This sub-step is an optional sub-step that multiplies by the first mask matrix for encryption. In this sub-step, the i-th participant uses its own original data matrix X. i A matrix that serves as a submatrix (i.e., a column-encrypted data matrix). Left-multiply the first mask matrix Ω of the i-th participant i Obtain the product of the column encrypted data matrix of the i-th participant and the first mask matrix of the i-th participant. The This is simply referred to as the column encryption transformation encryption matrix for the i-th participant. The first mask matrix Ω i It is used for encryption, as mentioned before, Ω i This is called the first mask matrix for the i-th participant. It is an invertible matrix and is generated by the i-th participant itself or obtained from a trusted node. The i-th participant may also omit Ω. i Encryption, which is equivalent to Ω i The identity matrix I means that this step does not involve any actual operation; that is, this step was not selected.

[0075] Sub-step S112-d: Transform the encrypted data into an encryption matrix. The i-th participant, and the one who possesses the column-encrypted data transformation encryption matrix The j-th participating party collaborates to calculate and determine the product matrix based on a pre-defined secure multi-party computation protocol or by using direct computation. Or its transformed form, and the above R is obtained by the i-th participant. j,i Or its transformed form, where j is greater than or equal to 1 and less than or equal to i-1. For each j greater than or equal to 1 and less than or equal to i-1, perform this step, resulting in a total of i-1 product matrices R. j,i Or its transformed form, where j = 1, 2, ..., i-1. The above... It is the column encryption data transformation encryption matrix of the j-th participant. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of these matrices is simply referred to as the product matrix of the encrypted data transformation encryption matrices of the j-th participant and the i-th participant. The above i-1 matrices... (j=1,2…i-1) can be represented as a concatenated matrix It is easy to see that the above splicing matrix V i It is a column-encrypted data transformation encryption matrix with i-1 participants. transpose Transform the encrypted data of the i-th participant into an encryption matrix The product of In short, it is the product of the encryption matrix of the encrypted data transformation of the i-1 participating parties and the encryption matrix of the i-th participating party's encrypted data transformation. The i-1 participating parties are participants 1, 2, ..., i-1. When the i-th participating party obtains R... j,i If the transformation is such that the i-th participant is represented by R, then an easily known implementation method is that the i-th participant is represented by R. j,i The transformation form of R is obtained j,i Then it is used for subsequent calculations.

[0076] It is easy to see that the above R j,i The transformation form can be That is, the column encryption data of the i-th participant is transformed into an encryption matrix. transpose Transform the encrypted data of the j-th participant into an encryption matrix. If the product is , then the implementation method can be modified accordingly, which is an obvious variation of the implementation method.

[0077] This sub-step calculation The first implementation of this, or a variation thereof, uses secure multi-party computation protocols, particularly secure inner product protocols. These secure inner product protocols refer to confidential computation when calculating the inner product of two vectors to ensure that the information of the input data is not leaked. This is a well-known prior art and has various different implementation methods. Typically, the j-th participant and the i-th participant each obtain R through computation. j,i Or a portion of its transformed form, the j-th participant sends its partial result to the i-th participant, who then sums these two parts to obtain R. j,i Or its transformed form; and in the above calculation process, the j-th participant's It does not need to be sent directly to the i-th participant, but the i-th participant's It also does not need to be sent directly to the j-th participant, although it usually includes information about... and The ciphertext obtained through further encryption is then sent. Alternatively, this sub-step can be implemented by direct computation, with the j-th participant... Send it to the i-th participant, and then the i-th participant uses what it owns. and received Direct calculation Or its transformed forms.

[0078] Sub-step S112-e: The i-th participant uses the splicing matrix V obtained in the previous sub-step. i That is, the product matrix of the encryption transformation encryption matrix of the i-1 participating columns and the encryption transformation encryption matrix of the i-th participating column, which satisfies the following conditions. square root matrix In this step, an orthogonal matrix Θ can be used. i Right multiplication To put Updated to When the first mask matrix Ω of the i-th participant i It is an orthogonal matrix, as mentioned above. Simplified to

[0079] If the triangle is obtained using inverse Cholesky decomposition... Then we use an orthogonal matrix Θ i Right multiplication get Make It's not triangular. In this step, to achieve encryption, user i typically obtains a... After that, even Even if it's not a triangle, use an orthogonal matrix Θ that only you know. i Right multiply by G i get

[0080] The square root matrix mentioned above It is the inverse factorization matrix P of the regularized symmetric matrix of the encrypted data transformation of the encryption matrix with i participants. i The submatrix in the matrix, namely the inverse factorization matrix P of the first regularized symmetric matrix of the i participating parties. i Submatrices in, such as As shown, × represents a submatrix not covered in the current discussion.

[0081] Sub-step S112-f: In this sub-step, the i-th participant uses the inverse factorization matrix P of the first regularized symmetric matrix of the i participants. i submatrix in And the product matrix V of the encryption transformation encryption matrix of the i-1 participating columns and the encryption transformation encryption matrix of the i-th participating column. i The inverse factorization matrix P of the first regularized symmetric matrix with i-1 participants. i-1 Updated to the inverse factorization matrix P of the first regularized symmetric matrix with i participants. i A specific implementation method could be that the i-th data owner calculates... In P i-1 Add multiple columns to the right of In P i-1 Add a submatrix consisting entirely of zeros directly below P. i-1 Add a submatrix to the lower right. Thus, P i-1 Updated to P i .

[0082] Sub-step S112-g: If the value of i is less than or equal to m-1, the i-th participant adopts the first implementation method of the sending step to send P. i Alternatively, it can be sent to the next participant, i.e., the (i+1)th participant, or the i-th participant can use the second implementation of the sending step to send P. i Relative to P i-1 The added non-zero column is Or its transformed form, is sent to the m-i+1 participants i+1, i+2, ..., m. The transformed form of the above arbitrary matrix satisfies the condition that the arbitrary matrix can be calculated from this transformed form without the need for other information.

[0083] Sub-step S112-h (iteration-controlled sub-step): If the value of i is less than or equal to m-1, increment the value of i by 1 and return to sub-step S112-a to start the next iteration; otherwise, when the value of i is equal to m, proceed to the next step S12.

[0084] In this application, (·) T `x` represents the transpose of a real matrix (including vectors), or the conjugate transpose of a complex matrix (including vectors); placing two matrices together, or a scalar and a matrix together, represents multiplication. `λI` is a matrix related to regularization; in some cases, `λI` can take the form of... λI is a diagonal matrix, where the terms on the diagonal can take different values; even λI can be any matrix.

[0085] It is easy to see that in the above sub-steps S112-d, S112-e, S112-f, and S112-g, the i-th participant and the j-th participant cooperate to determine the product matrix of the column encrypted data transformation encryption matrices of the i-th participant and the j-th participant respectively, using the column encrypted data transformation encryption matrix corresponding to their respective private original data. Or a transformed form thereof, where j is greater than or equal to 1 and less than or equal to i-1; the i-th participant obtains and utilizes the above R j,i Or its transformed form, the inverse factorization matrix P of the first regularized symmetric matrix with i-1 participants. i-1 Updated to the inverse factorization matrix P of the first regularized symmetric matrix with i participants. i When the value of i is less than or equal to m-1, the i-th participant puts P... i Or send it in its transformed form to the next participant, i.e., the (i+1)th participant, or send P i Partially send P to several participants, including the (i+1)th participant, that is, send P i Relative to P i-1 The added non-zero column is sent to the m-i+1 participants i+1, i+2, ..., m.

[0086] Typically, if node 1 sends a message to node 2, and then node 2 forwards it to node 3, this is also considered as node 1 sending the message to node 3. Furthermore, the scenario of forwarding by a single node can be extended to a scenario of forwarding by multiple nodes. That is, if node 1 sends a message to node 2a, and then it is forwarded by at least one of the nodes (nodes 2b, 2c, etc.), and then forwarded by the last of these nodes to node 3, this is also considered as node 1 sending the message to node 3. Accordingly, in step S11, which includes steps S111 and S112, considering the effect of step S112 being executed m-1 times, the i-th participant, j-th participant, and k-th participant are respectively considered as the current participant, the preceding participant, and the subsequent participant, where i is any integer greater than or equal to 2 and less than or equal to m, j is any positive integer less than i, and k is any integer greater than i and less than or equal to m. It can be seen that the i-th participant, j-th participant, and k-th participant satisfy the following relationship:

[0087] When sub-steps S111-d and S112-g both adopt the first implementation method of the sending step in this embodiment, the j-th participant sends the inverse factor matrix of the regularized symmetric matrix or its transformation form of the column encrypted data transformation encryption matrix corresponding to the private original data of the j participants from the first participant to the j-th participant to the i-th participant. When j is less than or equal to i-2, there are forwardings from participants j+1, j+2, ..., i-1. The i-th participant receives the aforementioned inverse factor matrix or its transformation form sent by the j-th participant. Clearly, it is the inverse factor matrix or its transformation form of the regularized symmetric matrix that includes the influence of the column encrypted data transformation encryption matrix corresponding to the private original data of the j-th participant. The i-th participant collaborates with the j-th participant, utilizing... Using the column-encrypted data transformation encryption matrix corresponding to their respective private original data, the product matrix or its transformation form of the column-encrypted data transformation encryption matrix of each j-th participant and the i-th participant is determined. Then, the i-th participant uses the above product matrix or its transformation form to obtain and send to the k-th participant the inverse factor matrix of the regularized symmetric matrix of the column-encrypted data transformation encryption matrix corresponding to the private original data of the i participants from the first participant to the i-th participant. It is the inverse factor matrix of the regularized symmetric matrix or its transformation form that includes the influence of the column-encrypted data transformation encryption matrix of each j-th participant and the i-th participant. When k is greater than or equal to i+2, there are forwardings by participants i+1, i+2, ..., k-1. If we do not consider the effect of m-1 iterations of step S112, and only consider one execution of step S112 when i is any positive integer greater than or equal to 2 and less than or equal to m, then j is equal to i-1 and k is equal to i+1.

[0088] When sub-steps S111-d and S112-g both adopt the second implementation method of the sending step in this embodiment, the j-th participant transforms the column encrypted data corresponding to the private original data of the j participants from the first participant to the j-th participant into the inverse factor matrix of the regularized symmetric matrix of the encryption matrix or a part of its transformation form (i.e., P). j Relative to P j-1The added non-zero column (or its transformation form) is sent to the i-th participant; the i-th participant receives a portion of the aforementioned inverse factor matrix or its transformation form sent by the j-th participant, which is obviously a portion of the inverse factor matrix or its transformation form of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix corresponding to the j-th participant's private original data; the i-th participant and the j-th participant cooperate to determine the product matrix or its transformation form of the column encrypted data transformation encryption matrix of the j-th participant and the i-th participant respectively, using the aforementioned product matrix or its transformation form, and then the i-th participant uses the aforementioned product matrix or its transformation form to obtain and send to the k-th participant a portion of the inverse factor matrix or its transformation form of the regularized symmetric matrix corresponding to the column encrypted data transformation encryption matrix of the i participants from the first participant to the i-th participant (i.e., P). i Relative to P i-1 The added non-zero column (or its transformed form) is part of the inverse factor matrix of the regularized symmetric matrix, which contains the column encryption data of the j-th participant and the i-th participant, and is influenced by the encryption matrix. If we disregard the effect of m-1 iterations of step S112, and only consider one execution of step S112 when i is any positive integer greater than or equal to 2 and less than or equal to m, then j equals i-1, and k equals i+1.

[0089] When the value of i equals m, the m-th participant calculates P in the above sub-step S112-f. m In the next step S12, we have a label column vector. The tag data owner, and the encrypted square root matrix P which has a total of m participants. m and the encryption matrix of each column of encrypted data transformation m participants (i = 1, 2, ..., m) collaborate to calculate the multiplied encrypted linear regression coefficient vector. The This involves adding a mask column Δ for each participant to the target linear regression coefficient vector. i The column vector obtained by multiplying the influence of (i = 1, 2, ..., m) on the right by a multiplier of an encryption matrix, where the encryption matrix is ​​a block diagonal matrix Ω composed of the first mask matrices of m participants. [1:m] inverse matrix

[0090] The steps for calculating the encrypted linear regression coefficient vector in Embodiment 2 of this invention mainly include: the tag data owner using a privately owned tag column vector. The tag data is transformed into an encryption matrix with each of its own encrypted data columns. m participants (i = 1, 2, ..., m) collaborate to calculate each... (i = 1, 2...m), then calculate To obtain the multiplicative encrypted linear regression coefficient vector

[0091] Step S12 includes steps S121 to S122.

[0092] Step S121: Possess a label column vector The owner of the tag data and the owner of the encrypted data transformation encryption matrix The i-th participating party collaborates, based on a pre-defined secure multi-party computation protocol or direct computation, to determine... Where i is greater than or equal to 1 and less than or equal to m. For each i that is greater than or equal to 1 and less than or equal to m, perform this step, resulting in a total of m. Where i = 1, 2…m. The above... It is the column encryption data transformation encryption matrix of the i-th participant. transpose The tag column vector of the tag data owner The product of the encrypted data transformation encryption matrix and the tag of the i-th participating column is simply referred to as the product of the encryption matrix and the tag of the i-th participating column. This sub-step calculates the product of the encryption matrix and the tag of the encrypted data transformation encryption matrix of the i-th participating column. There are multiple ways to implement this; some possible implementations are listed below:

[0093] Implementation Method 1) Obtain the calculation result from the i-th specific node. (i = 1, 2…m). Secure multi-party computation protocols, especially secure inner product protocols, can be used to compute... The specific implementation could be that the i-th participant and the label data owner each obtain a portion of the result, and then they send their respective partial results to the i-th specific node, where the i-th specific node merges these two portions of the result to obtain the final result. On the other hand, it can also be done by the i-th participant. Send it to the tag data owner, who then uses their own tag column vector. and received Calculated using direct calculation method. Then it is sent to the i-th specific node. It is easy to see that when the i-th specific node is the i-th participant or the owner of the tag data, part of the above sending is sent to itself, which actually does not require any operation.

[0094] Implementation Method 2) Calculation Results (i = 1, 2, ..., m) is divided into two parts, i.e. and The above are placed on two nodes, named node A and node B, respectively. and satisfy This implementation typically uses secure multi-party computation protocols, especially secure inner product protocols, to compute... And the calculation results Divided into and By placing the values ​​on two nodes separately and then adding the results of the calculations on the two nodes, we can obtain the result. The two nodes, namely node i and node i, can be the owner of the tag data and the i-th participant, or two other trusted nodes.

[0095] The above m column vectors (i = 1, 2, ..., m) can be represented as a concatenated column vector. It satisfies That is, the encrypted data of each of the above participants is transformed into the product of the encryption matrix and the label. They can be combined into the above concatenated column vectors. It is a column-encrypted data transformation encryption matrix involving m participants. transpose With label column vector The product of the m-participants' column-encrypted data transformation encryption matrix and the tag is simply referred to as the product of the m-participants' column-encrypted data transformation encryption matrix and the tag.

[0096] This step has a simple implementation method: when using implementation method one, and the i-th specific node is the owner of the label data, then all calculation results... (i = 1, 2, ..., m) are all owned by the label data owner.

[0097] Step S122: Possess P m m participating parties and owners Several nodes (i = 1, 2, ..., m) cooperate to compute... To obtain the multiplicative encrypted linear regression coefficient vector It is easy to see that, as mentioned above The above can be obtained The multiplication encryption linear regression coefficient vector Equal to the column-encrypted data transformation of m participants, the regularized symmetric matrix of the encryption matrix, and the inverse factorization matrix P. m With the second product vector The product of the two factors, the second product vector ξ is equal to the inverse factor matrix P. m transpose The encrypted data of m participants is transformed into an encryption matrix and the product of the labels. The results, among which It is a concatenated vector containing the product of the encryption matrix and the label of the encrypted data transformed from each of the m participants, from the 1st to the mth participant, as a subvector. There are several possible implementations for this step; some are listed below:

[0098] Implementation Method 1) If step S121 adopts Implementation Method 1, then in this step, P has m m participating parties and owners The collaboration of each specific node i in (i = 1, 2, ..., m) yields the following results: With possession The collaboration of the i-th specific node can be that which owns P m The mth participant, or all of them possess at least a portion of P m All m participants, or all of them possess at least a portion of P m At least two parties are involved. The calculated... It can be placed on one node, or on multiple nodes.

[0099] let Then we can get And it can be represented as:

[0100] Right now Where Γ(:,i) (i = 1, 2, ..., m) represents the matrix Γ starting from the first...m... Listed to number All columns of the column. Correspondingly, the calculated... One implementation method that places them on multiple nodes is, The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node, which can be the i-th specific node, a participant, or other trusted nodes.

[0101] Implementation Method Two) If Implementation Method Two is adopted in step S121, then in this step, P has m The m participating parties and their respective shares Two nodes (i = 1, 2, ..., m), namely node i-th node A and node i-th node B, cooperate to calculate... Calculated It can be placed on one node, or on multiple nodes.

[0102] Bundle Substitution It can be obtained Correspondingly, One way to implement this is to place the elements on multiple nodes: The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node A, which can be the i-th node A, a participant, or other trusted nodes; The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node B, where the i-th coefficient storage node B can be the i-th node B, a participant, or another node.

[0103] From the above As you can see, It is obtained by calculating the product of three parts, which are: the inverse factor matrix P of the first regularized symmetric matrix of m participants (i.e., the regularized symmetric matrix containing the transformation effect of the column encryption data of m participants). m The transpose of the above inverse factorization matrix And a total of m participating columns of encrypted data transformation encryption matrix and label product It can also be owned by P m The m participants first calculate Then calculate

[0104] The multiplication encryption linear regression coefficient vector With the target linear regression coefficient vector The relationship between them is

[0105] That is, multiply the encrypted linear regression coefficient vector It is the target linear regression coefficient vector Right-multiply by the block diagonal matrix Ω composed of the first mask matrices of m participants. [1:m] inverse matrix The result is encrypted. If it is necessary for a node to obtain the entire P... m This can include the following scenarios: when a node is the m-th participant, then that node has already obtained P in the previous sub-step. m When a node is any one of the participants 1, 2, ..., m-1, then that node only has P. m Some items in the P list need to be handled by the relevant stakeholders. mIf a node does not have an item, it should be sent to that node. The relevant participant can be the m-th participant, all other participants besides that node, or at least two of the other participants besides that node. If a node is a node other than participants 1, 2, ..., m, then the relevant participant needs to send P... m The relevant participants are sent to this node. These participants can be the m-th participant, all m participants (participants 1, 2, ..., m), or at least two of the m participants. When the relevant participants include at least two participants, each of these participants sends P. m A portion of the data is given to a certain node, which then aggregates the data sent by several participants to obtain P. m .

[0106] When step S121 adopts the simple implementation method described above, that is, all calculation results (i = 1, 2, ..., m) are all owned by the label data owner, so this step can also be implemented in a simple way: that is, by the owner P m The mth participant and owner Collaborate with the tag data owner to calculate And put Placed in the m-th participant or the tag data owner. When If placed in the m-th participant, then the tag data owner will... Send to the m-th participant, who will then calculate the result. Or, when If the tag data is placed by the owner, then the m-th participant will place P. m Send it to the tag data owner, who will then calculate it.

[0107] The above-mentioned multiplicative encrypted linear regression coefficient vector is calculated. Subsequently, the effect achieved by the following steps in the above embodiments of the present invention is: if there are several participants from participant 1 to m that use an incremental encryption mask matrix with non-zero columns, then the several participants sequentially multiply the encryption square root matrix P. m Multiplication and encryption of linear regression coefficient vectors This at least partially eliminates the influence of its incrementing encryption mask matrix Δ. When each participant using a non-zero column incrementing encryption mask matrix multiplies the encryption linear regression coefficient vector... This at least partially eliminates the impact of the participant's added encryption mask matrix Δ, or, if there is no participant using a non-zero column added encryption mask matrix, then it possesses the most recently updated multiplied encryption linear regression coefficient vector. The participants or nodes, Several items corresponding to participant i (where i is greater than or equal to 1 and less than or equal to m) are sent to participant i, and participant i uses the inverse of its own private first mask matrix... The decryption process yields several terms corresponding to the target linear regression coefficient vector.

[0108] In this invention, for the sake of simplicity, it is assumed that the column encryption data matrix of the i-th participant is... The columns are arranged in the following order: The front τ i The column is the original data matrix X i ,then The column is an incremental encryption mask matrix Δ i In practice The columns can also be arranged in other ways, and the specific embodiments of the present invention can be slightly modified accordingly, which is well known to those skilled in the art.

[0109] Based on the implementation method of using square root decomposition for the inverse matrix of the regularized symmetric matrix in Embodiment 1 of the present invention, another commonly used LDL can be easily obtained. T The decomposed implementation method is, namely, Embodiment Two of this application. For example, the above-mentioned FF... T =(X T X+λI) -1 The matrix F is the inverse matrix (X) T X+λI) -1 The square root matrix can be viewed as a symmetric matrix (X). T X+λI) -1 One method of factorization matrix; the corresponding symmetric matrix can also be derived using another commonly used LDL method. T LDL in decomposition T Factor matrix replacement, and LDL T The factor matrix includes a triangular L-factor matrix and a diagonal D-factor matrix. The L-factor matrix can be extended to a general square matrix; that is, the L-factor matrix can be either triangular or not. The D-factor matrix remains a diagonal matrix. Based on this extended LDL... T The factor matrix can be slightly modified from Embodiment 1 of the present invention to obtain an LDL-based matrix. T The specific implementation of the factorization matrix is ​​referred to as Example 2. The main difference between Example 2 and Example 1 is that the matrix sent by the i-th participant to the (i+1)-th participant is different, where i = 1, 2, ..., m-1.

[0110] In Example 2, participant i equivalently calculates the LDL of the inverse matrix of the first regularized symmetric matrix (i.e., the regularized symmetric matrix of the column-encrypted data transformation encryption matrix of the i participants) of all i participants. T Decompose the factor matrix, including those that satisfy L-factor matrix and D factor matrix D i The above. The inverse L-factor of the first regularized symmetric matrix with i participants is called the D-factor. i This is called the inverse D-factor of the first regularized symmetric matrix with i participants, or simply the D-factor of the i participants. When i equals 1, D1 and D1 are also referred to as the inverse L factor and inverse D factor of the first regularized symmetric matrix of the first participant, respectively.

[0111] Use satisfaction L factor matrix L i and D factor matrix D i , represents the LDL of the inverse of the second regularized symmetric matrix with i participants. T Decomposition of the factor matrix, i.e., L factor matrix L i and D factor matrix D i Therefore, it can be deduced that the above matrix... and L i satisfy That is, matrix It is matrix L i Right multiply by a first invertible matrix The result after multiplication and encryption. Correspondingly, the matrix... This is called the multiplication encryption L-factor matrix with i participants; it is a type of multiplication encryption factorization matrix with i participants. Correspondingly, the matrix... It is called the multiplication encryption L-factor matrix of the first participant, or the multiplication encryption L-factor matrix of one participant. It is a type of multiplication encryption factor matrix of one participant.

[0112] Since some steps in Embodiment 3 are repeated in Embodiment 2, the following will be based on steps S11 and S12 in Embodiment 2, and will describe in detail the entire implementation process by introducing the specific modifications required relative to Embodiment 2.

[0113] In the aforementioned Embodiment 2, step S11 includes steps S111 and S112, and step S12 includes steps S121 and S122. To modify Embodiment 2 into an embodiment based on the LDLT decomposition method for the factor matrix, steps S111 and S112 in step S11 need to be modified to steps S111' and S112' as described below, and step S122 in step S12 needs to be modified to step S122' as described below, while step S121 in step S12 remains unchanged. The following describes steps S111' and S112' in step S11 and step S122' in step S12, respectively, obtained by the above modifications.

[0114] Step S111': To obtain step S111', the sub-steps S111-a, S111-b, and S111-e of step S111 in Embodiment 2 remain unchanged, while sub-steps S111-c and S111-d are modified into sub-steps S111'-c and S111'-d, respectively. Accordingly, step S111' sequentially includes the aforementioned sub-steps S111-a, S111-b, S111'-c, S111'-d, and S111-e, wherein sub-steps S111-c' and S111-d' are described as follows:

[0115] Sub-step S111'-c: In the first implementation of this sub-step, the first participant uses the well-known LDLT decomposition technique to obtain the result that satisfies... of and D1, of which Ω1 is the inverse L-factor of the first regularized symmetric matrix of the first participant, and D1 is the inverse D-factor of the first regularized symmetric matrix of the first participant; when the first invertible matrix Ω1 is an orthogonal matrix, then the above... It can be simplified to Correspondingly, The first regularized symmetric matrix of the first participant is called the inverse L factor, and D1 is called the inverse D factor of the first regularized symmetric matrix of the first participant. Alternatively, in the second implementation of this sub-step, the first participant uses sub-step S111-c of Embodiment 2 to obtain the condition that satisfies... The inverse factorization matrix P1 of the first regularized symmetric matrix of the first participant is obtained, and a diagonal matrix D1 with arbitrarily positive values ​​for each term on the diagonal is set. Then, using D1 and P1, the following is calculated:

[0116] The above can be verified satisfy Right now It is the encrypted L-factor matrix multiplied by the first participant. When the first participant has low requirements for protecting their own privacy data, they can also... It equals the identity matrix I, therefore we have

[0117] Sub-step S111'-d: When the first implementation method of the sending step in this embodiment is adopted, the first participant multiplies the encrypted L-factor matrix of the first participant in this sub-step. The first participant sends its D-factor matrix D1 or a transformed form thereof to the second participant; or, when using the second implementation of the sending step in this embodiment, the first participant sends the D-factor matrix D1 of the first participant to the second participant in this sub-step. And D1, or their transformed forms, are sent to participants 2, 3…m, the m-1 participants. The transformation form of D1 refers to Other forms of D1, where the receiver may not use other information, only... And other forms of D1 are obtained And D1, for example, send and One of these three forms.

[0118] Step S112': In order to obtain step S112', in the sub-steps S112-a, S112-b, S112-c, S112-d, S112-e, S112-f, S112-g and S112-h included in step S112 of embodiment two, sub-steps S112-b, S112-c, S112-d and S112-h remain unchanged, while sub-steps S112-a, S112-e, S112-f and S112-g are modified to sub-steps S112'-a, S112'-e, S112'-f and S112'-g respectively. Accordingly, step S112' sequentially includes the aforementioned sub-steps S112'-a, S112-b, S112-c, S112-d, S112'-e, S112'-f, S112'-g, and S112-h, wherein sub-steps S112'-a, S112'-e, S112'-f, and S112'-g are described as follows:

[0119] Sub-step S112-a: The i-th participant, i.e., the i-th data owner, obtains the encryption L-factor matrix multiplied by a total of i-1 participants based on the received information. The D-factor matrix D of i-1 participants i-1 When the sending step in this embodiment adopts the first implementation method, the i-th participant receives the message sent by the (i-1)-th participant. and D i-1 Or their transformed forms; when the sending step in this embodiment adopts the second implementation method, the i-th participant receives from participants 1, 2...i-1 respectively. and Di-1 Or a part of their transformed forms, thus merging to obtain and D i-1 .

[0120] Sub-step S112'-e: The i-th participant uses the splicing matrix V obtained in the previous sub-step. i That is, the product of the encryption matrix of the encrypted data transformation of the i-1 participating columns and the encryption matrix of the ith participating column, which satisfies the following conditions. LDL T Decomposition factors, including L factor and D factor The above It is the inverse L-factor of the first regularized symmetric matrix with i participants. The submatrix in, and the above D is the inverse D factor of the first regularized symmetric matrix with i participants. i The submatrix in the first invertible matrix Ω. i It is an orthogonal matrix, as mentioned above. Simplified to Then the above It is the inverse L-factor of the first regularized symmetric matrix of the encryption matrix transformed from the encrypted data of i participating parties. The submatrix in, and the above D is the inverse D factor of the first regularized symmetric matrix of the encrypted data transformation matrix with i participating parties. i Submatrices in.

[0121] The first implementation method for this sub-step uses the well-known LDL. T Decomposition technique. The second implementation of this sub-step follows sub-step S112-e from Example 2, calculating the condition that satisfies... square root matrix Then set up a diagonal matrix where each term on the diagonal is an arbitrary positive number. And calculate

[0122] Sub-step S112'-f: In this sub-step, the i-th participant uses the inverse L factor of the first regularized symmetric matrix of the i participants. submatrix in The inverse D factor of the first regularized symmetric matrix with i participants. i submatrix in And the product V of the encryption matrix of the encrypted data transformation of the i-1 participating columns and the encryption matrix of the i-th participating column. i The inverse L factor of the first regularized symmetric matrix of i-1 participants. Updated to the inverse L-factor of the first regularized symmetric matrix with i participants. And factor D of the inverse D of the first regularized symmetric matrix of the i-1 participating parties. i-1 Updated to the inverse D factor D of the first regularized symmetric matrix with i participants. i A specific implementation method could be that the i-th data owner... D i-1 Updated to D i On the other hand, the i-th data owner calculates... relatively The added non-zero columns are Then through Bundle Updated to That is, in Add multiple columns to the right of exist Add a submatrix consisting entirely of zeros directly below it. Add a submatrix to the lower right. Thus Updated to

[0123] Sub-step S112'-g: If the value of i is less than or equal to m-1, the i-th participant adopts the first implementation method of the sending step to... and D i Alternatively, their transformed forms can be sent to the next participant, i.e., the (i+1)th participant, or the i-th participant can use the second implementation method of the sending step to send... relatively The added non-zero column is Or its transformed form, and D i Relative to D i-1 The added diagonal matrix Or a transformed form thereof, sent to the m-i+1 participants i+1, i+2, ..., m. The above... and D i The transformation form refers to and D i Other forms, whereby the recipient may not use other information, by and D i Other forms of recovery and D i For example, sending and One of these three forms.

[0124] In this embodiment, step S12 includes steps S121 and S122', wherein step S121 is the same as step S121 in embodiment two, and step S122' is described in detail below:

[0125] Step S122': Possess and D m m participating parties and owners Several nodes (i = 1, 2, ..., m) cooperate to compute... To obtain the multiplicative encrypted linear regression coefficient vector The above It is the inverse L-factor of the first regularized symmetric matrix with m participants, and the above D m It is the inverse D factor of the first regularized symmetric matrix with m participants. It is easy to see that the multiplied encrypted linear regression coefficient vector... The inverse factor matrix (i.e., the inverse L-factor) of the regularized symmetric matrix of the encryption matrix, which is equal to the column-encrypted data transformation of m participants. The inverse D factor of this regularized symmetric matrix. m and the second product vector The product of the second product vector Equal to the inverse decomposition factor matrix transpose Multiply the encrypted data of m participating columns by the product of the encryption matrix and the label. The results, among which It is a concatenated vector that contains the product of the encryption matrix and the label of each of the m participants from the 1st to the mth participant, with each participant's column of encrypted data transformed into a subvector.

[0126] There are several possible ways to implement this step. Some of them are listed below:

[0127] Implementation Method 1) If step S121 adopts Implementation Method 1, then in this step, possessing and D m m participating parties and owners The collaboration of each specific node i in (i = 1, 2, ..., m) yields the following results: With possession The collaboration of the i-th specific node can be possessed by and D m The mth participant, or all of them possess at least part of and D m All m participants, or all of them possess at least a portion of the resources. and D m At least two parties are involved. The calculated... It can be placed on one node, or on multiple nodes.

[0128] let Then we can get And it can be represented as

[0129] Right now Where Γ(:,i) (i = 1, 2, ..., m) represents the matrix Γ starting from the first...m... Listed to number All columns of the column. Correspondingly, the calculated... One implementation method that places them on multiple nodes is, The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node, which can be the i-th specific node, a participant, or other nodes.

[0130] Implementation Method Two) If Implementation Method Two is adopted in step S121, then in this step, possessing and D m The m participating parties and their respective shares Two nodes (i = 1, 2, ..., m), namely node i-th node A and node i-th node B, cooperate to calculate... Calculated It can be placed on one node, or on multiple nodes.

[0131] Bundle Substitution It can be obtained Correspondingly, One way to implement this is to place the elements on multiple nodes: The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node A, which can be the i-th node A, a participant, or other nodes; The amount (i = 1, 2, ..., m) are placed in the i-th coefficient storage node B, where the i-th coefficient storage node B can be the i-th node B, a participant, or another node.

[0132] The multiplication encryption linear regression coefficient vector With the target linear regression coefficient vector The relationship between them is That is, multiply the encrypted linear regression coefficient vector It is the target linear regression coefficient vector Right multiplication The result is encrypted.

[0133] When it needs to be obtained from a specific node and D m Then, the following scenarios are possible: when a specific node is the m-th participant, then that specific node has already obtained [something] in the previous sub-step. and D m When a specific node is any one of the participants 1, 2, ..., m-1, then the specific node only has and D m Some items in the document need to be handled by the relevant parties. and D m Items not present at a specific node are sent to that specific node. The relevant participants can be the m-th participant, all other participants besides the specific node, or at least two of the other participants besides the specific node. If the specific node is a node other than participants 1, 2, ..., m, then the relevant participants need to... and D m Sending to a specific node, the aforementioned relevant participants can be the m-th participant, or all m participants (participants 1, 2, ..., m), or a number of participants of at least two among all m participants. When the relevant participants include a number of participants of at least two, each of the aforementioned participants sends... and D m A portion is given to a specific node, which then aggregates the data sent by several participants to obtain... and D m .

[0134] When step S121 adopts the simple implementation method described above, that is, all calculation results Since (i = 1, 2, ..., m) are all owned by the label data owner, this step can also be implemented in a simpler way: that is, by the owner... and D m The mth participant and owner Collaborate with the tag data owner to calculate And put Placed in the m-th participant or the tag data owner. When If placed in the m-th participant, then the tag data owner will... Send to the m-th participant, who will then calculate the result. Or, when If the data is placed by the tag data owner, then the m-th participant will... and D m Send it to the tag data owner, who will then calculate it.

[0135] The above-mentioned multiplicative encrypted linear regression coefficient vector is calculated. Subsequently, the effect achieved by the following steps in the above embodiments of the present invention is: if there are several participants from participant 1 to m that use an incrementing encryption mask matrix with non-zero columns, then the several participants sequentially... D m Multiplication and encryption of linear regression coefficient vectors This at least partially eliminates the influence of its incrementing encryption mask matrix Δ. When each participant using a non-zero column incrementing encryption mask matrix multiplies the encryption linear regression coefficient vector... This at least partially eliminates the impact of the participant's added encryption mask matrix Δ, or, if there is no participant using a non-zero column added encryption mask matrix, then it possesses the most recently updated multiplied encryption linear regression coefficient vector. The participants or nodes, Several items corresponding to participant i (where i is greater than or equal to 1 and less than or equal to m) are sent to participant i, and participant i uses the inverse of its own private first mask matrix... The decryption process yields several terms corresponding to the target linear regression coefficient vector.

[0136] Those skilled in the art will understand that the technical solutions shown in FIG1 do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0137] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0138] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0139] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0140] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A privacy-preserving linear regression method, characterized in that, include: The current participant receives the inverse factor matrix of the regularized symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the preceding participants, or the transformation form of the inverse factor matrix; the current participant collaborates with the preceding participants to determine the product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, or the transformation form of the product matrix, using the column-encrypted data transformation encryption matrices corresponding to their respective private original data; the current participant sends, in whole or in part, the inverse factor matrix of the regularized symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrices of the preceding participants and the current participant; or, the current participant obtains and utilizes the product matrix or its transformation form of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participants are the participants that subsequently provide the private original data; The encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix of the preceding participants and the current participant, and the first product vector. The first product vector is determined by the transpose of the inverse decomposition factor matrix and the product of the column encrypted data transformation encryption matrix and the label of the preceding participants and the column encrypted data transformation encryption matrix and the label of the current participant. The transformation form of the matrix satisfies the condition that the matrix can be calculated without other information from this transformation form.

2. The privacy-preserving linear regression method according to claim 1, characterized in that, The product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participants is equal to the product of the transpose of the column-encrypted data transformation encryption matrix of the preceding participants and the column-encrypted data transformation encryption matrix of the current participants. The product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participants, or its transformation form, is obtained by the preceding participants and the current participants through collaboration, direct calculation, or determination based on a preset secure multi-party computation protocol.

3. The privacy-preserving linear regression method according to claim 1, characterized in that, The column-encrypted data transformation encryption matrix corresponding to the private original data of any participant is equal to the product of the column-encrypted data matrix of that participant and the first mask matrix of that participant; wherein, the column-encrypted data matrix of that participant is submatrixed from the original data matrix formed by the private original data of that participant, and the column-encrypted data matrix includes each sub-column of the original data matrix and a mask column generated by the participant itself or obtained from a trusted node, and the number of items contained in the mask column is equal to the number of items in the original data matrix of that participant. The data matrix contains the same number of items in each column; and the first mask matrix of any participant is an invertible matrix, generated by the participant itself or obtained from a trusted node; wherein, the multiplication of the encrypted linear regression coefficient vector is equal to the column vector obtained by right-multiplying the target linear regression coefficient column vector by the influence of the mask columns of each participant, and then multiplying it by the block diagonal matrix composed of the first mask matrices of each participant, wherein the block diagonal matrix contains the inverse matrix of the first mask matrix of each participant as a submatrix located on the diagonal of the block diagonal matrix.

4. The privacy-preserving linear regression method according to claim 3, characterized in that, The influence of the column-encrypted data transformation encryption matrix of the preceding participants is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants as a submatrix. The influence of the column-encrypted data transformation encryption matrix of the preceding participants and the current participant is equivalent to including the column-encrypted data transformation encryption matrix of the preceding participants and the column-encrypted data transformation encryption matrix of the current participant as a submatrix. Wherein, the regularized symmetric matrix of a matrix is ​​the sum of the symmetric matrix of the matrix plus the regularization term, wherein the regularization term is a matrix containing the product of the symmetric matrix of the first mask matrix of the relevant participating party and a preset regularization coefficient as a submatrix; the symmetric matrix of a matrix is ​​equal to the product of the transpose of the matrix and the matrix itself; the inverse factor matrix of the regularized symmetric matrix is ​​the factor matrix of the inverse matrix of the regularized symmetric matrix, and the factor matrix is ​​a square root matrix or an LDL matrix. T One of the L-factor matrices in the decomposition.

5. The privacy-preserving linear regression method according to claim 1, characterized in that, The current participant collaborates with the preceding participants to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrix corresponding to their respective private original data, thereby determining the product matrix of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant; the current participant sends, in whole or in part, the inverse decomposition factor matrix or transformation form of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant; or, the current participant obtains and utilizes the product matrix or transformation form of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, in collaboration with the preceding participants and the tag data owner, to determine the multiplicative encrypted linear regression coefficient vector, wherein the subsequent participants are the participants that subsequently provide the private original data, including: The current participant collaborates with the preceding participants to determine the product matrix or its transformation form using the column encrypted data transformation encryption matrix of the current participant and the column encrypted data transformation encryption matrix of the preceding participants. The product matrix or its transformation form is obtained by the current participant. The current participant uses the product matrix or its transformation form of the encryption matrix of the column-encrypted data transformation of the preceding participants and the current participant to obtain the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix containing the influence of the encryption matrix of the column-encrypted data transformation of the preceding participants and the current participant, and then sends all or part of the inverse factor matrix or the transformation form of the inverse factor matrix to the subsequent participants. After all the participating parties have calculated the inverse factor matrix or the transformed form of the regularized symmetric matrix containing the influence of their respective column encrypted data transformation encryption matrix, the current participating party then uses its own inverse factor matrix or the transformed form of the inverse factor matrix to collaborate with the preceding participating parties and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector.

6. The privacy-preserving linear regression method according to claim 4, characterized in that, The current participant obtains and utilizes the product matrix or its transformed form of the encrypted data transformation matrix of the preceding participants and the current participant, and collaborates with the preceding participants and the tag data owner to determine the multiplicative encrypted linear regression coefficient vector, including: After all the participating parties have calculated the inverse factor matrix or the transformed form of the regularized symmetric matrix containing the influence of their respective column-encrypted data transformation encryption matrices, the multiplicative encrypted linear regression coefficient vector is determined. This is achieved using the inverse factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrices of the preceding and current participating parties, the product of the column-encrypted data transformation encryption matrices of the preceding participating parties and the label, and the product of the column-encrypted data transformation encryption matrix of the current participating party and the label. The product of the column-encrypted data transformation encryption matrix of any participating party and the label is equal to the product of the transpose of the corresponding participating party's column-encrypted data transformation encryption matrix and the label column vector of the label owner. The product of the column-encrypted data transformation encryption matrix of any participating party and the label owner is determined or directly calculated based on a preset secure multi-party computation protocol.

7. The privacy-preserving linear regression method according to claim 6, characterized in that, The determination of the multiplicative encrypted linear regression coefficient vector is achieved using the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, the product of the column encrypted data transformation encryption matrix and the label of the preceding participants, and the product of the column encrypted data transformation encryption matrix and the label of the current participant. The multiplicative encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrices of the preceding participants and the current participant, and a first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with a concatenated vector containing the products of the column encrypted data transformation encryption matrix and the label of the preceding participants and the current participant as subvectors, resulting in a second product vector. When the decomposition factor matrix is ​​a square root matrix, the first product vector equals the second product vector; or, when the decomposition factor matrix is ​​an LDL matrix... T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

8. The privacy-preserving linear regression method according to claim 7, characterized in that, There are m participants providing their respective private original data, where m is an integer greater than or equal to 2; the current participant is the i-th participant, where i is any integer greater than or equal to 2 and less than or equal to m; the preceding participants are the j-th participants, where j is any positive integer less than i; the subsequent participants are the k-th participants, where k is any integer greater than i and less than or equal to m. The current participant collaborates with the preceding participants, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or transformation form of the column-encrypted data transformation encryption matrices of the preceding participants and the current participant, including: The i-th participant and the j-th participant collaborate to use the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the j-th participant and the i-th participant, where j takes any positive integer less than i.

9. The privacy-preserving linear regression method according to claim 8, characterized in that, When the current participant is the i-th participant and i is less than or equal to m-1, then the preceding participant is the (i-1)-th participant, and the subsequent participant is the (i+1)-th participant. The (i-1)-th participant sends all or part of the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix affected by the transformation encryption matrix of the column encrypted data corresponding to the private original data of the i-1 participants from the 1-th participant to the (i-1)-th participant to the i-th participant. The i-th participant receives the inverse factor matrix or its transformation form. The i-th participant collaborates with each of the participants from the 1st participant to the (i-1)th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the i-th participant and each of the i-1 participants. Then, using the product matrix or its transformation form, it obtains and sends to the (i+1)th participant the inverse decomposition factor matrix or the transformation form of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column-encrypted data transformation encryption matrix corresponding to the private original data of the i participants from the 1st participant to the i-th participant, in whole or in part. When the current participant is the i-th participant and i equals m, then the preceding participant is the (m-1)-th participant. The (m-1)-th participant sends all or part of the inverse factor matrix or the transformation form of the regularized symmetric matrix of the matrix affected by the column-encrypted data transformation encryption matrix corresponding to the private original data of the m-1 participants from the 1-th participant to the (m-1)-th participant. The m-th participant receives the inverse factor matrix or its transformation form. The m-th participant collaborates with each of the m-1 participants from the 1-th participant to the (m-1)-th participant, using the column-encrypted data transformation encryption matrix corresponding to their respective private original data to determine the product matrix or the transformation form of the column-encrypted data transformation encryption matrix of the m-th participant and each of the m-1 participants, and then uses... The product matrix or its transformation form, in collaboration with the tag data owner and the m-1 participants from the 1st to the (m-1th)th participants, determines the encrypted linear regression coefficient vector. The encrypted linear regression coefficient vector is equal to the product of the inverse decomposition factor matrix of the regularized symmetric matrix containing the influence of the column encrypted data transformation encryption matrix of each of the m participants from the 1st to the mth participants, and the first product vector. The first product vector is further determined by multiplying the transpose of the inverse decomposition factor matrix with the concatenated vector containing the column encrypted data transformation encryption matrix and the tag product as sub-vectors of the m participants from the 1st to the mth participants. When the decomposition factor matrix is ​​the square root matrix, the first product vector equals the second product vector; or when the decomposition factor matrix is ​​an LDL matrix... T The L-factor matrix of the decomposition, where the first product vector is equal to the LDL. T The product of the decomposed D factor matrix and the second product vector.

10. A privacy-preserving linear regression system, characterized in that, The privacy-preserving linear regression system is used to perform the privacy-preserving linear regression method according to any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the privacy-preserving linear regression method as described in any one of claims 1-9.

Images