WO2023240934A1

WO2023240934A1 - Security processing method and apparatus for privacy vector

Info

Publication number: WO2023240934A1
Application number: PCT/CN2022/135285
Authority: WO
Inventors: 李漓春; 张祺智
Original assignee: 蚂蚁区块链科技(上海)有限公司
Priority date: 2022-06-14
Filing date: 2022-11-30
Publication date: 2023-12-21
Also published as: CN114978510A

Abstract

Provided in the embodiments of the present description are a security processing method and apparatus for a privacy vector, which method and apparatus are implemented by using secure muti-party computation. The method comprises: acquiring a present-party fragment of a privacy vector in a modulus-2 space; accumulating all bits of the present-party fragment to obtain a first summation result; determining a first sign bit according to an index corresponding to a present party; determining a first fragment of a first scalar according to the first summation result and the first sign bit; locally calculating an inner product of the present-party fragment and a plaintext vector, so as to obtain a second summation result; determining a first fragment of a second scalar according to the second summation result and the first sign bit; and jointly performing secure multiplication on the basis of the first fragment of the first scalar, the first fragment of the second scalar, and a second fragment of the first scalar and a second fragment of the second scalar, which are provided by an opposite party, so as to obtain a first fragment of a vector inner product result, wherein the vector inner product result corresponds to a product of the first scalar and the second scalar. Therefore, the communication volume can be reduced in security processing for a privacy vector.

Description

Security processing method and device for privacy vectors

This application claims priority to the Chinese patent application submitted to the State Intellectual Property Office of China on June 14, 2022, with application number 202210667898.2 and the application title "Secure processing method and device for privacy vectors", the entire content of which is incorporated by reference. in this application.

Technical field

One or more embodiments of this specification relate to the field of computers, and in particular, to methods and devices for secure processing of privacy vectors.

Background technique

Many current scenarios involve determining the vector inner product result of the privacy vector and the plaintext vector. The privacy vector is a one-hot encoding vector, which is distributed between two parties in the form of sum and sharing. Either party knows the plaintext vector. One-hot encoding vector is a One-hot vector, which is a vector whose elements in one dimension are 1 and the elements in other dimensions are all 0. If the k-th dimensional element of the one-hot encoding vector has a value of 1 and the plaintext vector is T, then the above vector inner product result h=T[k], which is the k-th dimensional element value of T. In the calculation to determine the vector inner product result, since the privacy vector needs to be protected, that is, the value of k cannot be leaked, secure multi-party computation needs to be used to achieve it.

In the prior art, the communication volume is very large in the process of determining the above-mentioned vector inner product result.

Therefore, it is hoped that there will be improved solutions that can reduce the traffic volume in the secure processing of privacy vectors.

Contents of the invention

One or more embodiments of this specification describe a secure processing method and device for privacy vectors, which can reduce communication volume during secure processing of privacy vectors.

In the first aspect, a secure processing method for privacy vectors is provided. The privacy vector is a one-hot encoding vector, which is distributed between the first party and the second party in the form of sum sharing. The method is used to obtain the The vector inner product result of the privacy vector and the plaintext vector is performed by any party, including:

Obtain the local slice of the privacy vector in modulo 2 space;

Accumulate the respective bits of the own slices to obtain the first summation result;

According to the corresponding index of this party, determine the first sign bit used to identify positive or negative numbers;

Determine a first fragment of the first scalar according to the first summation result and the first sign bit;

Locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result;

Determine the first slice of the second scalar according to the second summation result and the first sign bit;

According to the first fragment of the first scalar and the first fragment of the second scalar owned by the party, and the second fragment of the first scalar and the second fragment of the second scalar provided by the other party, a safe multiplication operation is jointly performed , obtain the first slice of the vector inner product result, which corresponds to the product of the first scalar and the second scalar.

In a possible implementation, obtaining the local slice of the privacy vector in modulo 2 space includes:

Through the locally performed secure modulo conversion operation, the fragments of the modulo q1 space of the privacy vector held by the party are converted into the fragments of the modulo 2 space.

In a possible implementation, determining the first sign bit used to identify a positive number or a negative number according to its corresponding index includes:

If the index corresponding to the local side is an even number, then determine the first sign bit to be 1;

If the index corresponding to the local party is an odd number, the first sign bit is determined to be -1.

In a possible implementation, determining the first slice of the first scalar according to the first summation result and the first sign bit includes:

After adding the first sign bit to the first summation result, the first constant is taken modulo to obtain the first slice of the first scalar.

Further, the selection of the first constant needs to make the following conditions hold:

The sum of the lowest bits of the first slice of the first scalar and the lowest bit of the second slice of the first scalar is 1, and there will be no carry;

When the first scalar is 1 and -1, the value of the second lowest bit of the first scalar is different.

Further, the first constant is a power of 2 and is not less than 4.

In a possible implementation, determining the first slice of the second scalar according to the second summation result and the first sign bit includes:

After adding the first sign bit to the second summation result, a first slice of the second scalar is obtained.

In a possible implementation, the safe multiplication operation includes:

Obtain the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result from a third party; the second fragment of the first random number, and the second fragment of the second random number. The second fragment of the fragmentation and random multiplication results is obtained by the other party; where the random multiplication result is the product of the first random number and the second random number;

Locally calculate the difference between the first fragment of the first scalar and the first fragment of the first random number to obtain the first fragment of the first difference;

Locally calculate the difference between the first fragment of the second scalar and the first fragment of the second random number to obtain the first fragment of the second difference;

Receive a second fragment of the first difference value and a second fragment of the second difference value from the other party; the second fragment of the first difference value is the second fragment of the first scalar and the second fragment of the first random number. The difference between two slices; the second slice of the second difference is the difference between the second slice of the second scalar and the second slice of the second random number;

Sum the first slice of the first difference and the second slice of the first difference to get the first difference; sum the first slice of the second difference and the second slice of the second difference. and get the second difference;

According to local calculations between the first difference, the second difference, the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result, the first The first slice of the product of the scalar and the second scalar; the other party gets the second slice of the product.

In a second aspect, a secure processing device for privacy vectors is provided. The privacy vector is a one-hot encoding vector, which is distributed between the first party and the second party in a shared form. The device is used to obtain the privacy vector. The result of the vector inner product of the vector and the plaintext vector, set on either side, including:

An acquisition unit, used to acquire the local slices of the privacy vector in modulo 2 space;

An accumulation calculation unit is used to accumulate each bit of the own slice obtained by the acquisition unit to obtain the first summation result;

The sign determination unit is used to determine the first sign bit used to identify the positive number or the negative number according to the corresponding index of the party;

A first scalar determination unit configured to determine the first slice of the first scalar based on the first summation result obtained by the accumulation calculation unit and the first sign bit obtained by the sign determination unit;

An inner product calculation unit, used to locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result;

A second scalar determination unit configured to determine the first slice of the second scalar based on the second summation result obtained by the inner product calculation unit and the first sign bit;

A joint operation unit, configured to provide the other side with the first fragment of the first scalar obtained by the first scalar determination unit and the first fragment of the second scalar obtained by the second scalar determination unit. The second slice of the first scalar and the second slice of the second scalar jointly perform a safe multiplication operation to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the first scalar sum The product of the second scalar.

A third aspect provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to perform the method of the first aspect.

A fourth aspect provides a computing device, including a memory and a processor. The memory stores executable code. When the processor executes the executable code, the method of the first aspect is implemented.

Through the methods and devices provided by the embodiments of this specification, first obtain the local fragments of the privacy vector in the modulo 2 space; then accumulate the respective bits of the local fragments to obtain the first summation result; and then according to The corresponding index of the local party determines the first sign bit used to identify the positive or negative number; and then determines the first slice of the first scalar based on the first summation result and the first sign bit; and then calculates locally The inner product of the local fragment and the plaintext vector is used to obtain a second summation result; and then the first fragment of the second scalar is determined based on the second summation result and the first sign bit; finally According to the first fragment of the first scalar and the first fragment of the second scalar owned by the party, and the second fragment of the first scalar and the second fragment of the second scalar provided by the other party, a safe multiplication operation is jointly performed , obtain the first slice of the vector inner product result, which corresponds to the product of the first scalar and the second scalar. It can be seen from the above that the embodiments of this specification only involve local calculations and safe multiplication operations of scalars. No communication is required in local calculations. The communication amount of safe multiplication operations of scalars is very small. By converting the safe inner product of two vectors into two Secure multiplication of scalars, enabling reduced traffic in secure processing of privacy vectors.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present invention more clearly, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting creative efforts.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

Figure 2 shows a flow chart of a security processing method for privacy vectors according to one embodiment;

Figure 3 shows a schematic diagram of safe multiplication in a fragmented state according to one embodiment;

Figure 4 shows a schematic block diagram of a security processing device for privacy vectors according to one embodiment.

Detailed ways

The solutions provided in this specification will be described below in conjunction with the accompanying drawings.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. This implementation scenario involves the secure processing of privacy vectors. The privacy vectors are one-hot encoding vectors, which are distributed between the first party and the second party in the form of sum sharing. The method is used to obtain the privacy vectors and plaintext vectors. The vector inner product result of . As shown in Figure 1, the scenario for secure processing of privacy vectors involves party A and party B, or the first party and the second party, or party A and party B. Each participant can be implemented as any device, platform, server or device cluster with computing and processing capabilities. Both parties must jointly determine the vector inner product result of the privacy vector and the plaintext vector while protecting the privacy vector from being leaked. The vector inner product result shall be distributed to both parties in the form of sum sharing. And sharing is a specific form of secret sharing.

Secret sharing means that n participants split and share a secret s. After the split, each share is managed by a different participant. The secret can only be fully restored when the number of participants is not less than m.

Two-party arithmetic secret sharing refers to the split sharing of a secret information by two participants. A single participant cannot recover the secret information, and the shares held by both parties must be combined to fully recover the secret. Usually the recovery operation is addition on a finite ring. The above secret information can also be called private data, and the secret information shared by two parties is also called private data in the form of sum sharing.

Referring to Figure 1, p represents an n-dimensional one-hot encoding vector, and T is a public n-dimensional plaintext vector. Party A holds one shard of p ₀ , and party B holds another shard of p _1. p＝ ₀ + _1. Both parties A and B know the plaintext vector. T. Party A and Party B find the size of the vector inner product of p and T without exposing the privacy vector, that is, calculate h = <p, T>, and Party A obtains a slice of the vector inner product result <h> ₀ =<<p,T>> ₀ , Party B obtains another fragment <h> ₁ of the inner product result of the vector =<<p,T>> ₁ . p is a vector whose elements in one dimension are 1 and elements in other dimensions are all 0. Assume that the k-th element of p is 1, then the inner product result of the above vectors is h=T[k], that is, T The kth dimension element value of . For example, p=(0,1,0), T=(3,5,7), then the vector inner product result is 5.

It can be understood that p represents an n-dimensional vector, which is composed of n elements. The slices of p can be regarded as a combination of slices of each element it contains. For example, P is a 4-dimensional vector (0 ,1,0,0), in order from right to left, if the slice of the first element 0 owned by Party A is 1, the slice of the second element 0 owned by Party A is 0, and Party A has The fragment of the third element 1 of is 1, the fragment of the fourth element 0 owned by party A is 1, then party A holds a fragment of p ₀ can be expressed as (1,1,0 ,1), Correspondingly, the fragment of the first element 0 that Party B has is 1, the fragment of the second element 0 that Party B has is 0, and the fragment of the third element 1 that Party B has is 0, the fragment of the fourth element 0 owned by party B is 1, then the other fragment ₁ held by party B can be expressed as (1,0,0,1).

In the embodiment of this specification, secure processing of privacy vectors is implemented through secure multi-party computation, which is used to obtain the vector inner product result of the privacy vector and the plaintext vector.

Secure multi-party computation is also called multi-party secure computation, that is, multiple parties jointly calculate the result of a function without leaking the input data of each party in the function, and the calculation result is disclosed to one or more parties.

The embodiments of this specification propose corresponding solutions in order to reduce the communication volume during security processing of privacy vectors.

One-hot encoded vectors are common in statistics and machine learning, and the above calculation to determine the vector inner product result can be used in related fields. The above calculation can also be used for table lookup calculation, that is, the element T[k] of the table T can be found from the input k: first convert the input k into a one-hot encoding vector p with the k-th element having a value of 1, and convert the table T is in the form of a vector, and then calculates the vector inner product result of p and T. Look-up table calculations can be used to calculate functions with a single input and a limited number of input values, such as factorials.

Figure 2 shows a flow chart of a security processing method for privacy vectors according to one embodiment. The method can be based on the implementation scenario shown in Figure 1. The privacy vector is a one-hot encoding vector, which is distributed in the form of and sharing. One party and the second party, the method is used to obtain the vector inner product result of the privacy vector and the plaintext vector, and is executed by either party. As shown in Figure 2, the security processing method for privacy vectors in this embodiment includes the following steps: Step 21, obtain the local fragments of the privacy vector in modulo 2 space; Step 22, obtain the local fragments of the privacy vectors Each bit is accumulated to obtain the first summation result; step 23, determine the first sign bit used to identify the positive or negative number according to the corresponding index of the local party; step 24, according to the first summation result and the The first sign bit determines the first fragment of the first scalar; Step 25, locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result; Step 26, according to the second The summation result and the first sign bit determine the first fragment of the second scalar; step 27, based on the first fragment of the first scalar and the first fragment of the second scalar owned by the party, provide the other party with the first fragment of the second scalar. The second slice of the first scalar and the second slice of the second scalar jointly perform a safe multiplication operation to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the first scalar sum The product of the second scalar. The specific execution methods of each of the above steps are described below.

First, in step 21, obtain the local slice of the privacy vector in modulo 2 space. It can be understood that if the privacy vector p is an n-dimensional vector, which is composed of n elements, the slices of p can be regarded as a combination of slices of each element it contains, and the slices of each element belong to modulo 2 space.

In the embodiment of this specification, any party holds a fragment _j of the privacy vector p. A fragment of the i-th element of the privacy vector p is recorded as <p[i]> _j , where j is the corresponding fragment of the party. Index, i is the index of the element. The indexes corresponding to the two parties are usually two integers that are adjacent in sequence. For example, the index corresponding to the first party is 0 and the index corresponding to the second party is 1; or, the index corresponding to the first party is 1 and the index corresponding to the second party is 1. The index of is 2. For example, if the index corresponding to the first party is 0 and the index corresponding to the second party is 1, then the first party holds one shard of p ₀ and the second party holds another shard of p ₁ , p＝ ₀ + ₁ . The index of each element is usually in the order of the elements in the vector from right to left, starting from 0 and increasing by 1. For an n-dimensional vector, the index of each element in the vector is from 0 to n-1.

In one example, obtaining the local slice of the privacy vector in modulo 2 space includes:

In this example, either the first party or the second party holds the slice of the privacy vector modulo q1 space. If q1 is equal to 2, the own slice of the privacy vector in the modulo 2 space can be directly obtained. ; If q1 is not equal to 2, the fragments of the privacy vector held by the party modulo q1 space can be converted into the fragments of the party modulo 2 space through a locally performed secure modulo conversion operation. Wherein, the above secure modulo conversion operation can be performed separately on the slices of the modulo q1 space of each element of the privacy vector. It will be appreciated that secure analog conversion operations performed locally do not require communication with the other party. Both parties can each determine the lowest bit (bit) of the modulo q1 space fragment of any element of their privacy vector as the modulo 2 space fragment of that element of the privacy vector. For example, if the modulo q1 space fragment of an element of the privacy vector is 1001, and its lowest bit is 1, then the modulo 2 space fragment of the element of the privacy vector is 1.

Each element of the privacy vector is one bit in the local slice of modulo 2 space, so the n-dimensional privacy vector is n bits in the local slice of modulo 2 space.

Then in step 22, each bit of the local slice is accumulated to obtain the first summation result. It can be understood that since the local slice is in modulo 2 space, the above accumulation calculation is also performed in modulo 2 space. Any bit of the local slice has two values, which are 0 or 1 respectively. The summation result also has two values: 0 or 1.

For example, any party holds a fragment _j of the privacy vector p, and a fragment of the i-th element of the privacy vector p is recorded as <p[i]> _j , where j is the corresponding index of the party. , i is the index of the element, and the first summation result can be expressed as

Next, in step 23, the first sign bit used to identify a positive number or a negative number is determined according to the corresponding index of the local party. It can be understood that the indexes of the first party and the second party are different, and their first sign bits are also different.

In one example, determining the first sign bit used to identify a positive number or a negative number according to its corresponding index includes:

For example, j is the index corresponding to this party, and the first sign bit can be expressed as (-1) ^j .

It can be understood that the status of the first party and the second party is equal, so the opposite method of determining the first sign bit can also be used. For example, if the index corresponding to the own party is an odd number, then the first sign bit is determined. The sign bit is 1; if the index corresponding to the local party is an even number, the first sign bit is determined to be -1. For example, j is the index corresponding to this side, and the first sign bit can be expressed as (-1) ^j+1 .

Then in step 24, determine the first slice of the first scalar according to the first summation result and the first sign bit. It can be understood that the manner of determining the first fragment of the first scalar is related to the desired value of the first scalar.

In one example, determining the first slice of the first scalar according to the first summation result and the first sign bit includes:

For example, any party holds a fragment _j of the privacy vector p, and a fragment of the i-th element of the privacy vector p is recorded as <p[i]> _j , where j is the corresponding index of the party. , i is the index of the element, and the first summation result is

The first sign bit is (-1) ^j , the first constant is d, and the first scalar is b, then the first slice of the first scalar can be expressed as

For example, j is the index corresponding to this side, j=0 or 1, and the first scalar is b, then the above condition can be expressed as ₀ [0] + ₁ [0] = 1 and will not Carry; when b is 1 and -1, the value of b[1] is different.

Further, the first constant is a power of 2 and is not less than 4.

It can be understood that the specific value of the first constant satisfies the above conditions, but the first constant that satisfies the above conditions does not necessarily have to be the specific value.

Then in step 25, the inner product of the local fragment and the plaintext vector is calculated locally to obtain a second summation result. It can be understood that the value of the second summation result not only depends on the value of each bit of the local fragment, but also depends on the value of each element of the plaintext vector. The value of the local fragment The value of any bit can only take two values: 0 and 1, and the value of any element of the plaintext vector is the modulus space in which it is located.

For example, any party holds a fragment _j of privacy vector p, a fragment of the i-th element of privacy vector p is denoted as <p[i]> _j , the plaintext vector is represented by T, and the plaintext The i-th element of vector T is recorded as T[i], where j is the index corresponding to this side, i is the index of the element, and the second summation result can be expressed as

Then in step 26, determine the first slice of the second scalar according to the second summation result and the first sign bit. It can be understood that the manner of determining the first fragment of the second scalar is related to the desired value of the second scalar.

In one example, determining the first slice of the second scalar according to the second summation result and the first sign bit includes:

For example, any party holds a fragment _j of privacy vector p, a fragment of the i-th element of privacy vector p is denoted as <p[i]> _j , the plaintext vector is represented by T, and the plaintext The i-th element of vector T is recorded as T[i], where j is the index corresponding to this side, i is the index of the element, and the second summation result is

The first sign bit is (-1) ^j and the second scalar is c, then the first fragment of the second scalar can be expressed as

Finally, in step 27, based on the first fragment of the first scalar and the first fragment of the second scalar owned by the party, and the second fragment of the first scalar and the second fragment of the second scalar provided by the other party, Safe multiplication operations are jointly performed to obtain a first slice of a vector inner product result, which corresponds to the product of the first scalar and the second scalar. It can be understood that the vector inner product result of the privacy vector and the plaintext vector can be obtained by calculating the product of the first scalar and the second scalar.

For example, the privacy vector p is an n-dimensional one-hot encoding vector, its k-th dimension element has a value of 1, and the other dimensional elements have a value of 0. The plaintext vector T is an n-dimensional vector, and the privacy vector p and the plaintext vector T The result of the vector inner product is recorded as h=<p,T>=T[k]. The first scalar is represented by b, and the second scalar is represented by c. It is necessary to verify that h=b×c. A simple proof process is given below.

Assume the slice of the first scalar

slice of second scalar

Among them, j=0 or 1; <x> _j represents the fragment of x in the fragmented state in the jth side; and <r> _j is the second lowest bit of _j , which is the first bit of _j;r＝<r> ₀ +<r> ₁ .

If p[i] is 0, then the two slices of p[i] <p[i]> ₀ and <p[i]> ₁ have two possible value combinations, <p[i]> ₀ and <p[i]> ₁ is both 0, or <p[i]> ₀ and <p[i]> ₁ are both 1, then (-1) ⁰ <p[i]> ₀ +(-1) ¹ <p[i]> ₁ =0.

If the value of the k-th dimension element of p is 1 and the values of other dimensional elements are all 0, then b＝<p[k]> ₀ -<p[k]> ₁ =(-1) ^r , c＝(- 1) ^r ×T[k], where r=1 or 0.

Obviously, b×c=T[k], that is, h=b×c.

In addition, the conditions that need to be met for the selection of constant d are explained.

Assume that d is 4, then the binary bit of b is 01 or 11, then ₀ [0] + ₁ [0] = 1 and there will be no carry;

In other words, when b is 1 and -1, the value of b[1] is different.

Through the above proof process, we can know that the slices of the vector inner product result can be obtained through safe multiplication of two scalars.

In one example, the safe multiplication operation includes:

Figure 3 shows a schematic diagram of safe multiplication in the fragmented state according to one embodiment. Referring to Figure 3, the third party sends u0, v0, z0 to the first party, and sends u1, v1, z1 to the second party, where (u0+u1)×(v0+v1)=(z0+z1); The first party locally calculates e0 = b0-u0 based on a fragment b0 of b it holds and a fragment u0 of u received from the third party; the first party calculates e0 = b0-u0 based on a fragment c0 of c it holds. , and a fragment v0 of v received from the third party, locally calculate f0 = c0-v0; the first party sends e0 and f0 to the second party; the second party holds a fragment b1 of b, And a fragment u1 of u received from the third party, the local calculation e1 = b1-u1; the second party based on a fragment c1 of c held by itself, and a fragment v1 of v received from the third party, locally Calculate f1=c1-v1; the second party sends e1 and f1 to the first party; the first party and the second party locally calculate e=b-u, f=c-v; the first party locally calculates h0=ef+u0f+ ev0+z0, use h0 as a slice of the multiplication result of bc; the second party locally calculates h1=u1f+ev1+z1, and use h1 as a slice of the multiplication result of bc. It can be proved that h0+h1=ef+uf+ev+uv=(e+u)(f+v)=bc.

It can be understood that u corresponds to the aforementioned first random number, u0 corresponds to the first fragment of the aforementioned first random number, v corresponds to the aforementioned second random number, and v0 corresponds to the first fragment of the aforementioned second random number. , z0 corresponds to the first fragment of the random multiplication result, u1 corresponds to the second fragment of the first random number, v1 corresponds to the second fragment of the second random number, z1 corresponds to the second fragment of the random multiplication result , b corresponds to the first scalar, and c corresponds to the second scalar.

In addition, it should be noted that if you need to obtain the slices of the vector inner product result in the modulo q2 space, q2>2, you can perform the modulo conversion operation on the result after the safe multiplication operation, or you can perform the modular conversion operation on the result before the safe multiplication operation. The slices of the first scalar and the slices of the second scalar are modulo converted so that the result is a slice in modulo q2 space.

For example, the slices of b and c are both set to slices in modulo q2 space, and h = bc is calculated directly, and the result is a slice in modulo q2 space.

Through the method provided by the embodiments of this specification, first obtain the local fragment of the privacy vector in the modulo 2 space; then accumulate each bit of the local fragment to obtain the first summation result; and then according to the local fragment The corresponding index determines the first sign bit used to identify a positive or negative number; and then determines the first slice of the first scalar based on the first summation result and the first sign bit; and then locally calculates the The inner product of the local fragment and the plaintext vector is used to obtain the second summation result; and then the first fragment of the second scalar is determined based on the second summation result and the first sign bit; finally, the first fragment of the second scalar is determined according to the second summation result and the first sign bit. The first fragment of the first scalar and the first fragment of the second scalar owned by the party are combined with the second fragment of the first scalar and the second fragment of the second scalar provided by the other party to perform a safe multiplication operation, and we get A first slice of a vector inner product result corresponding to the product of the first scalar and the second scalar. It can be seen from the above that the embodiments of this specification only involve local calculations and safe multiplication operations of scalars. No communication is required in local calculations. The communication amount of safe multiplication operations of scalars is very small. By converting the safe inner product of two vectors into two Secure multiplication of scalars, enabling reduced traffic in secure processing of privacy vectors.

According to an embodiment of another aspect, a secure processing device for a privacy vector is also provided. The privacy vector is a one-hot encoding vector, which is distributed between the first party and the second party in the form of sharing. The device uses After obtaining the vector inner product result of the privacy vector and the plaintext vector, the device is arranged on either side, and the device is used to perform the actions performed by any one of the methods provided by the embodiment shown in Figure 2 of this specification. Figure 4 shows a schematic block diagram of a security processing device for privacy vectors according to one embodiment. As shown in Figure 4, the device 400 includes:

The acquisition unit 41 is used to acquire the local slices of the privacy vector in modulo 2 space;

The accumulation calculation unit 42 is used to accumulate each bit of the own slice obtained by the acquisition unit 41 to obtain the first summation result;

The sign determination unit 43 is used to determine the first sign bit used to identify a positive number or a negative number according to its corresponding index;

The first scalar determination unit 44 is configured to determine the first slice of the first scalar according to the first summation result obtained by the accumulation calculation unit 42 and the first sign bit obtained by the sign determination unit;

The inner product calculation unit 45 is used to locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result;

The second scalar determination unit 46 is configured to determine the first slice of the second scalar according to the second summation result obtained by the inner product calculation unit 45 and the first sign bit;

The joint operation unit 47 is configured to use the first slice of the first scalar obtained by the first scalar determination unit 44 and the first slice of the second scalar obtained by the second scalar determination unit 46, Combined with the second fragment of the first scalar and the second fragment of the second scalar provided by the other party, a safe multiplication operation is performed to obtain the first fragment of the vector inner product result, and the vector inner product result corresponds to the first fragment of the vector inner product. The product of one scalar and the second scalar.

Optionally, as an embodiment, the acquisition unit 41 is specifically configured to convert the fragments of the modulo q1 space of the privacy vector held by the party into modulo 2 space through a locally performed secure modulo conversion operation. Sharding on our side.

Optionally, as an embodiment, the symbol determining unit 43 is specifically configured to determine the first symbol bit to be 1 if the index corresponding to the own party is an even number; if the index corresponding to the own party is an odd number, Then it is determined that the first sign bit is -1.

Optionally, as an embodiment, the first scalar determination unit 44 is specifically configured to add the first sign bit to the first summation result, and then modulo the first constant to obtain the first scalar First shard.

Further, the first constant is a power of 2 and is not less than 4.

Optionally, as an embodiment, the second scalar determination unit 46 is specifically configured to add the first sign bit to the second summation result to obtain the first slice of the second scalar.

Optionally, as an embodiment, the joint operation unit 47 is specifically used for:

Through the device provided by the embodiment of this specification, first the acquisition unit 41 obtains the local slice of the privacy vector in the modulo 2 space; then the accumulation calculation unit 42 accumulates each bit of the local slice to obtain the first and the result; then the sign determination unit 43 determines the first sign bit used to identify the positive or negative number according to its corresponding index; the first scalar determination unit 44 then determines the first sign bit according to the first summation result and the first sign bit to determine the first fragment of the first scalar; then the inner product calculation unit 45 locally calculates the inner product of the local fragment and the plaintext vector to obtain a second summation result; the second scalar determination unit 46 then calculates The second summation result and the first sign bit determine the first slice of the second scalar; finally, the joint operation unit 47 has the first slice of the first scalar and the first slice of the second scalar. The fragments are combined with the second fragment of the first scalar and the second fragment of the second scalar provided by the other party to perform a safe multiplication operation to obtain the first fragment of the vector inner product result. The vector inner product result corresponds to The product of the first scalar and the second scalar. It can be seen from the above that the embodiments of this specification only involve local calculations and safe multiplication operations of scalars. No communication is required in local calculations. The communication amount of safe multiplication operations of scalars is very small. By converting the safe inner product of two vectors into two Secure multiplication of scalars, enabling reduced traffic in secure processing of privacy vectors.

According to an embodiment of another aspect, a computer-readable storage medium is also provided, a computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to perform the method described in conjunction with FIG. 2 .

According to yet another aspect of the embodiment, a computing device is also provided, including a memory and a processor, executable code is stored in the memory, and when the processor executes the executable code, the method described in conjunction with FIG. 2 is implemented. method.

Those skilled in the art should realize that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware, or any combination thereof. When implemented using software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The above-described specific embodiments further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above-mentioned are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims

A security processing method for privacy vectors. The privacy vector is a one-hot encoding vector, which is distributed between the first party and the second party in the form of sum sharing. The method is used to obtain the relationship between the privacy vector and the plaintext vector. Vector inner product results, performed by either party, including:

Obtain the local slice of the privacy vector in modulo 2 space;

Accumulate the respective bits of the own slices to obtain the first summation result;

According to the corresponding index of this party, determine the first sign bit used to identify positive or negative numbers;

Determine a first fragment of the first scalar according to the first summation result and the first sign bit;

Locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result;

Determine the first slice of the second scalar according to the second summation result and the first sign bit;

According to the first fragment of the first scalar and the first fragment of the second scalar owned by the party, and the second fragment of the first scalar and the second fragment of the second scalar provided by the other party, a safe multiplication operation is jointly performed , obtain the first slice of the vector inner product result, which corresponds to the product of the first scalar and the second scalar.
The method according to claim 1, wherein said obtaining the local slice of the privacy vector in modulo 2 space includes:

Through the locally performed secure modulo conversion operation, the fragments of the modulo q1 space of the privacy vector held by the party are converted into the fragments of the modulo 2 space.
The method according to claim 1, wherein determining the first sign bit used to identify a positive number or a negative number according to its corresponding index includes:

If the index corresponding to the local side is an even number, then determine the first sign bit to be 1;

If the index corresponding to the local party is an odd number, the first sign bit is determined to be -1.
The method of claim 1, wherein determining the first slice of the first scalar according to the first summation result and the first sign bit includes:

After adding the first sign bit to the first summation result, the first constant is taken modulo to obtain the first slice of the first scalar.
The method according to claim 4, wherein the selection of the first constant needs to make the following conditions hold:

The sum of the lowest bits of the first slice of the first scalar and the lowest bit of the second slice of the first scalar is 1, and there will be no carry;

When the first scalar is 1 and -1, the value of the second lowest bit of the first scalar is different.
The method of claim 5, wherein the first constant is a power of 2 and not less than 4.
The method of claim 1, wherein determining the first slice of the second scalar according to the second summation result and the first sign bit includes:

After adding the first sign bit to the second summation result, a first slice of the second scalar is obtained.
The method of claim 1, wherein the safe multiplication operation includes:

Obtain the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result from a third party; the second fragment of the first random number, and the second fragment of the second random number. The second fragment of the fragmentation and random multiplication results is obtained by the other party; where the random multiplication result is the product of the first random number and the second random number;

Locally calculate the difference between the first fragment of the first scalar and the first fragment of the first random number to obtain the first fragment of the first difference;

Locally calculate the difference between the first fragment of the second scalar and the first fragment of the second random number to obtain the first fragment of the second difference;

Receive a second fragment of the first difference value and a second fragment of the second difference value from the other party; the second fragment of the first difference value is the second fragment of the first scalar and the second fragment of the first random number. The difference between two slices; the second slice of the second difference is the difference between the second slice of the second scalar and the second slice of the second random number;

Sum the first slice of the first difference and the second slice of the first difference to get the first difference; sum the first slice of the second difference and the second slice of the second difference. and get the second difference;

According to local calculations between the first difference, the second difference, the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result, the first The first slice of the product of the scalar and the second scalar; the other party gets the second slice of the product.
A security processing device for privacy vectors. The privacy vector is a one-hot encoding vector, which is distributed between the first party and the second party in the form of sum sharing. The device is used to obtain the relationship between the privacy vector and the plaintext vector. Vector inner product result, set on either side, including:

An acquisition unit, used to acquire the local slices of the privacy vector in modulo 2 space;

An accumulation calculation unit is used to accumulate each bit of the own slice obtained by the acquisition unit to obtain the first summation result;

The sign determination unit is used to determine the first sign bit used to identify the positive number or the negative number according to the corresponding index of the party;

A first scalar determination unit configured to determine the first slice of the first scalar based on the first summation result obtained by the accumulation calculation unit and the first sign bit obtained by the sign determination unit;

An inner product calculation unit, used to locally calculate the inner product of the local fragment and the plaintext vector to obtain the second summation result;

A second scalar determination unit configured to determine the first slice of the second scalar based on the second summation result obtained by the inner product calculation unit and the first sign bit;

A joint operation unit, configured to provide the other side with the first fragment of the first scalar obtained by the first scalar determination unit and the first fragment of the second scalar obtained by the second scalar determination unit. The second slice of the first scalar and the second slice of the second scalar jointly perform a safe multiplication operation to obtain the first slice of the vector inner product result, and the vector inner product result corresponds to the first scalar sum The product of the second scalar.
The device according to claim 9, wherein the acquisition unit is specifically configured to convert the fragments of the modulo q1 space of the privacy vector held by the party into the modulo 2 space through a locally performed secure modulo conversion operation. own shards.
The device of claim 9, wherein the symbol determining unit is specifically configured to determine the first symbol bit to be 1 if the index corresponding to the local party is an even number; if the index corresponding to the local party is an odd number , then it is determined that the first sign bit is -1.
The device of claim 9, wherein the first scalar determination unit is specifically configured to add the first sign bit to the first summation result, and then modulo the first constant to obtain the first scalar of the first shard.
The device according to claim 12, wherein the selection of the first constant needs to make the following conditions hold:

The sum of the lowest bits of the first slice of the first scalar and the lowest bit of the second slice of the first scalar is 1, and there will be no carry;

When the first scalar is 1 and -1, the value of the second lowest bit of the first scalar is different.
The device of claim 13, wherein the first constant is a power of 2 and not less than 4.
The device of claim 9, wherein the second scalar determination unit is specifically configured to add the first sign bit to the second summation result to obtain the first slice of the second scalar.
The device according to claim 9, wherein the joint operation unit is specifically used for:

Obtain the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result from a third party; the second fragment of the first random number, and the second fragment of the second random number. The second fragment of the fragmentation and random multiplication results is obtained by the other party; where the random multiplication result is the product of the first random number and the second random number;

Locally calculate the difference between the first fragment of the first scalar and the first fragment of the first random number to obtain the first fragment of the first difference;

Locally calculate the difference between the first fragment of the second scalar and the first fragment of the second random number to obtain the first fragment of the second difference;

Receive a second fragment of the first difference value and a second fragment of the second difference value from the other party; the second fragment of the first difference value is the second fragment of the first scalar and the second fragment of the first random number. The difference between two slices; the second slice of the second difference is the difference between the second slice of the second scalar and the second slice of the second random number;

Sum the first slice of the first difference and the second slice of the first difference to get the first difference; sum the first slice of the second difference and the second slice of the second difference. and get the second difference;

According to local calculations between the first difference, the second difference, the first fragment of the first random number, the first fragment of the second random number, and the first fragment of the random multiplication result, the first The first slice of the product of the scalar and the second scalar; the other party gets the second slice of the product.
A computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to perform the method described in any one of claims 1-8.
A computing device includes a memory and a processor. The memory stores executable code. When the processor executes the executable code, the method of any one of claims 1-8 is implemented.