TWI814642B - Privacy computing method based on homomorphic encryption - Google Patents

Abstract

The present disclosure provides a privacy computing method based on homomorphic encryption, which includes steps as follows. The ciphertext data is received, where the ciphertext data has a floating-point homomorphic encryption data structure, and the floating-point homomorphic encryption data structure of the ciphertext data includes the ciphertext mantissa, exponent parameter and gain parameter. The gain parameter sets the precision of the floating point corresponding to the ciphertext mantissa. The exponent parameter is suitable for multiplication or division. The artificial intelligence model performs operations on the ciphertext data to return the ciphertext result.

Description

Privacy computing method based on homomorphic encryption

The present invention relates to an operation method, and in particular to a privacy operation method based on homomorphic encryption.

There are currently two common ways to use neural networks. (1) The data owner provides data to the model owner for calculation, and then returns the results to the data owner. (2) The model owner transmits the model to the data owner, and the data owner calculates the model and obtains the results. Both methods expose either party to the risk of privacy leakage.

There are currently three common privacy calculation methods. (1) Confidential Computing allows both parties to jointly calculate data and models in a Trust Execution Environment. The hardware will allocate an isolated memory space to this environment and reject any neural network model. Reading of external instructions ensures privacy. (2) Secure Multi-Party Computation (Secure Multi-Party Computation) solves the problem of a group of mutually distrustful participants each holding secret data and collaboratively calculating a given function. At present, secure multi-party computing is mainly implemented through confusion circuits, which allow two participants to calculate a certain function without knowing each other's data. This requires a huge amount of calculation and communication, and is more suitable for simple logical operations. (3) Homomorphic encryption supports calculations on the encrypted ciphertext, and the decrypted content of the calculation results is similar to the calculation results of the plaintext.

However, existing fully homomorphic encryption methods that support the operation of nonlinear functions on encrypted data within neural network models are usually implemented using the following two methods. (1) Approximate Computing Homomorphic Encryption Algorithm (CKKS) uses Taylor expansion to approximate non-occurring functions. This method requires a large number of multiplication operations and cannot be completely approximated (can only be approximated in small intervals), so it will reduce the accuracy of neural network operations. Spend. (2) Use the Fully Homomorphic Encryption Based On GSW (FHEW) solution based on GSW technology to construct a lookup table (Lookup Table) during the bootstrapping process to implement nonlinear functions. This method currently only supports The integer encryption scheme based on Learning with Errors (LWE) does not support floating point operations and cannot be effectively used in neural network operations.

The present invention proposes a privacy computing method based on homomorphic encryption to improve the problems of the prior art.

In some embodiments of the present invention, the privacy computing method based on homomorphic encryption proposed by the present invention includes the following steps: encoding and encrypting plaintext data into ciphertext data, and the ciphertext data has floating-point homomorphic encryption data Structure, the homomorphic encryption data structure of floating point numbers of ciphertext data includes ciphertext mantissa, exponent parameter and gain parameter. The gain parameter sets the precision of the floating point number corresponding to the ciphertext mantissa. The exponent parameter is suitable for multiplication or division; the ciphertext is The data is sent to the artificial intelligence model, which allows the artificial intelligence model to perform operations on the ciphertext data to return the ciphertext result; it decodes and decrypts the ciphertext result into a plaintext result.

In some embodiments of the present invention, the plaintext data includes real numbers with decimals, and the step of encoding and encrypting the plaintext data into ciphertext data includes: multiplying the real numbers with decimals by the gain parameter and dividing by the exponent parameter to obtain the plaintext mantissa. ; Encrypt the plaintext mantissa into the ciphertext mantissa, and the ciphertext mantissa is an integer.

In some embodiments of the present invention, the ciphertext result has a floating-point homomorphically encrypted data structure, and the floating-point homomorphically encrypted data structure of the ciphertext result includes another ciphertext mantissa, another exponent parameter, and another gain. parameter, the steps of decoding and decrypting the ciphertext result into the plaintext result include: decrypting the other ciphertext mantissa into the plaintext mantissa; dividing the plaintext mantissa by the other gain parameter and multiplying by the other exponent parameter to obtain the plaintext result.

In some embodiments of the present invention, the privacy computing method based on homomorphic encryption proposed by the present invention includes the following steps: receiving ciphertext data, the ciphertext data has a floating-point number homomorphic encryption data structure, and the ciphertext data The homomorphic encryption data structure of floating point numbers includes ciphertext mantissa, exponent parameter and gain parameter. The gain parameter sets the precision of the floating point number corresponding to the ciphertext mantissa. The exponent parameter is suitable for multiplication or division; the ciphertext data is processed through the artificial intelligence model. Operate to return the ciphertext result.

In some embodiments of the present invention, the ciphertext data includes a first ciphertext data and a second ciphertext data, and the floating-point homomorphically encrypted data structure of the first ciphertext data includes a first ciphertext mantissa, an exponent parameter and Gain parameter, the floating point homomorphic encryption data structure of the second ciphertext data includes the second ciphertext mantissa, exponent parameter and gain parameter. The operation performed by the artificial intelligence model on the ciphertext data includes addition operation, and the addition operation includes: when When the exponent parameter of the first ciphertext data is the same as the exponent parameter of the second ciphertext data, the first ciphertext mantissa of the first ciphertext data and the second ciphertext mantissa of the second ciphertext data are added to obtain the third The third ciphertext mantissa of the ciphertext data, and the floating-point number homomorphically encrypted data structure of the third ciphertext data include the third ciphertext mantissa, exponent parameter and gain parameter.

In some embodiments of the present invention, the ciphertext data includes first ciphertext data and second ciphertext data, and the floating-point homomorphically encrypted data structure of the first ciphertext data includes a first ciphertext mantissa and a first exponent parameter. and gain parameters. The floating-point homomorphic encryption data structure of the second ciphertext data includes the second ciphertext mantissa, the second exponent parameter and the gain parameter. The operation performed by the artificial intelligence model on the ciphertext data includes an addition operation. The operation includes: when the first exponent parameter is different from the second exponent parameter, divide the first exponent parameter by the second exponent parameter to obtain a multiplier, and multiply the first ciphertext mantissa by the multiplier to obtain a new first Ciphertext mantissa, replace the second exponent parameter of the first ciphertext data with the first exponent parameter; add the new first ciphertext mantissa of the first ciphertext data and the second ciphertext mantissa of the second ciphertext data. The third ciphertext mantissa of the third ciphertext data is obtained. The floating-point homomorphically encrypted data structure of the third ciphertext data includes the third ciphertext mantissa, the first exponent parameter and the gain parameter.

In some embodiments of the present invention, the operation performed by the artificial intelligence model on the ciphertext data includes a multiplication operation, and the multiplication operation includes: multiplying the exponent parameter of the ciphertext data by a multiplier to obtain a new exponent parameter of the ciphertext data. .

In some embodiments of the present invention, the operation performed by the artificial intelligence model on the ciphertext data includes: removing noise from the ciphertext mantissa through functional bootstrapping of the artificial intelligence model and performing a table lookup function to achieve nonlinearity. Function operations.

In some embodiments of the present invention, the privacy computing method based on homomorphic encryption further includes: after the training of the artificial intelligence model is completed, adjusting the contents of the lookup table in the artificial intelligence model and the encoding of extraction in function bootstrapping Encoder to avoid overflow during operation.

In some embodiments of the present invention, the privacy computing method based on homomorphic encryption further includes: after the training of the artificial intelligence model is completed, searching the artificial intelligence model layer by layer for a value suitable for zeroing the weight of the neuron as a valve. value; reset the weights in the neurons of the artificial intelligence model that are smaller than the threshold to zero.

To sum up, the technical solution of the present invention has obvious advantages and beneficial effects compared with the existing technology. The privacy computing method based on homomorphic encryption of the present invention can allow the encrypted data to run an artificial intelligence model (such as a neural network) to obtain accurate answers. Different from plaintext operations, this invention does not leak the privacy of data owners and model owners. Compared with confidential computing, the present invention does not require a trusted execution environment supported by special hardware. Compared with secure multi-party computation, the present invention can perform complex operations without requiring a large amount of interaction between the model owner and the data owner. Compared with past homomorphic encryption solutions, the present invention improves the efficiency and accuracy of homomorphic encryption in artificial intelligence models (such as neural network models).

The above description will be described in detail in the following embodiments, and a further explanation of the technical solution of the present invention will be provided.

In order to make the description of the present invention more detailed and complete, reference may be made to the attached drawings and the various embodiments described below. The same numbers in the drawings represent the same or similar components. On the other hand, well-known components and steps are not described in the embodiments to avoid unnecessary limitations on the present invention.

Please refer to Figure 1. The technical aspect of the present invention is a private computing method based on homomorphic encryption, which can be applied to various operations or widely used in related technical links. The privacy computing method based on homomorphic encryption of this technical aspect can achieve considerable technological progress and has widespread industrial utilization value. The following will illustrate the specific implementation of the privacy computing method based on homomorphic encryption with the help of Figure 1.

In some embodiments, various implementations of the privacy computing method based on homomorphic encryption are described with reference to Figure 1 . In the following description, for convenience of explanation, numerous specific details are further set forth to provide a comprehensive explanation of one or more embodiments. However, the technology may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to effectively describe the embodiments. The word "for example" used here means "as an example, instance or illustration". Any embodiment described herein is "by way of example" and is not necessarily to be construed as preferred or superior to other embodiments.

Figure 1 is a flow chart of a privacy computing method based on homomorphic encryption according to an embodiment of the present invention. As shown in Figure 1, the privacy operation method based on homomorphic encryption includes steps S101~S105, S111~S114 (it should be understood that the steps mentioned in this embodiment, unless the order is specifically stated, are The sequence can be adjusted according to actual needs, and can even be executed simultaneously or partially simultaneously).

In step S101, the computer device of the data owner provides plain text data. In step S102, the computer device of the data owner executes the encoding and encryption module to encode and encrypt the plaintext data into ciphertext data, and the ciphertext data has a floating-point homomorphically encrypted data structure. In step S103, the computer device of the data owner transmits the encrypted data to the computer device of the model owner. In step S113, the computer device of the model owner receives the ciphertext data and executes an artificial intelligence model (such as a neural network model) to operate on the ciphertext data to obtain a ciphertext result; in some embodiments, the artificial intelligence model Execute the ciphertext-ciphertext addition module, ciphertext-plaintext multiplication module and ciphertext table lookup module. In step S114, the computer device of the model owner returns the ciphertext result to the computer device of the data owner. In step S104, the computer device of the data owner executes the decryption and decoding module to decode and decrypt the ciphertext result into a plaintext result. In step S105, the data owner's computer device stores the plaintext result.

On the other hand, in step S111, the computer device of the model owner trains the artificial intelligence model in advance. After the training of the artificial intelligence model is completed, in step S112, the computer device of the model owner executes a functional bootstrapping parameter automatic adjustment module to adjust the content of the lookup table in the artificial intelligence model and the parameters extracted from the functional bootstrapping ( Extraction) encoder (Encoder) to avoid overflow during the operation, which will be further explained in the following examples. The computer device of the model owner executes the neuron weight adjustment threshold search module to search the artificial intelligence model layer by layer for a value suitable for zeroing the weight of the neurons as a threshold, and executes the neuron weight adjustment module to adjust the artificial intelligence The weights in the neurons of the model that are smaller than the threshold are reset to zero to reduce errors in operations.

Figure 2 is a block diagram of a privacy computing method based on homomorphic encryption according to another embodiment of the present invention. As shown in Figure 2, the privacy operation method based on homomorphic encryption includes steps S201 to S207 (it should be understood that, unless the order of the steps mentioned in this embodiment is specifically stated, all of them can be changed according to actual needs. Adjust the order before and after, and even execute them simultaneously or partially simultaneously).

In step S201, the plaintext data m ₁ is encoded, whereby the plaintext data m ₁ is multiplied by the gain parameter Gain (for example: g) and divided by the exponent parameter Exponent (for example: 1) to obtain the mantissa Mantissa (for example: the plaintext mantissa is m ₁ *g). In step S202, the mantissa Mantissa is encrypted into the ciphertext mantissa LWE(m ₁ *g) (for example: the ciphertext mantissa based on a fault-tolerant learning problem). In some embodiments, the floating-point homomorphic encryption data structure of the ciphertext data includes the ciphertext mantissa LWE(m ₁ *g), the exponent parameter Gain, and the gain parameter Exponent. The gain parameter Gain sets the ciphertext mantissa LWE(m ₁ * g) The precision of the corresponding floating point number (digits after the decimal point). The exponent parameter Exponent (can be preset to 1) is suitable for multiplication or division.

In step S203, the artificial intelligence model performs matrix operations (such as addition operations, multiplication operations, etc.) on the ciphertext data to obtain the ciphertext mantissa LWE (m ₂ ) and the exponent parameter Exponent is n, and the gain parameter Gain is still g. . In step S204, the exponential parameter Exponent is rescaled (such as division operation) so that the exponential parameter Exponent is m.

In step S205, noise is removed from the ciphertext mantissa LWE(m ₂ ) through functional bootstrapping of the artificial intelligence model and a table lookup function is performed to implement nonlinear function operations, thereby obtaining the ciphertext mantissa LWE(m) of the ciphertext result. _2/2 ). In some embodiments, the floating-point homomorphic encryption data structure of the ciphertext data includes the ciphertext mantissa LWE (m ₂ /2), the exponent parameter Exponent (such as: m), and the gain parameter Gain (such as: g).

In step S206, the ciphertext result is decrypted, thereby decrypting the ciphertext mantissa LWE (m ₂ /2) into the mantissa Mantissa (for example: the plaintext mantissa is m ₂ /2). In step S207, decoding is performed, whereby the mantissa Mantissa (for example: the plaintext mantissa is m ₂ /2) is divided by the gain parameter (for example: m) and multiplied by the exponent parameter Exponent (for example: g) to obtain the plaintext result (m ₂ /2)*(m/g).

Figure 3 is a flow chart of an encoding and encryption module according to an embodiment of the present invention. As shown in Figure 3, plaintext data m ₁ contains real numbers with decimals (eg: 200.2). In step S201, the plaintext data m ₁ (that is, a real number with decimals) is multiplied by the gain parameter Gain and divided by the exponent parameter Exponent to obtain the mantissa Mantissa (for example: the plaintext mantissa is 20020). In step S202, the mantissa Mantissa is encrypted into the ciphertext mantissa ciphertext(20020), the ciphertext mantissa is an integer, the gain parameter Gain is still the plaintext gain parameter plaintext(100), and the exponent parameter Exponent is still the plaintext exponent parameter plaintext(1).

Figure 4 is a flow chart of a decryption and decoding module according to an embodiment of the present invention. As shown in Figure 4, the floating-point homomorphic encryption data structure of the ciphertext result includes the ciphertext mantissa ciphertext(20020), the exponent parameter Exponent (such as: plaintext exponent parameter plaintext(1)) and the gain parameter Gain (such as: plaintext gain parameter plaintext(100)). In step S206, the ciphertext mantissa ciphertext (20020) is decrypted into the plaintext mantissa (eg: 200.2). In step S207, the mantissa Mantissa (for example: the plaintext mantissa is 200.2) is divided by the gain parameter Gain (for example: 100) and multiplied by the exponent parameter Exponent (for example: 1) to obtain the plaintext result m ₃ (for example: 200.2).

Figure 5 is a flow chart of a ciphertext-ciphertext addition module according to an embodiment of the present invention. As shown in Figure 5, the ciphertext data includes the first ciphertext data Ciphertext ₃ and the second ciphertext data Ciphertext _4. The floating point number homomorphic encryption data structure of the first ciphertext data Ciphertext ₃ contains the mantissa Mantissa (such as: numerical value The first ciphertext mantissa is 20000), the exponent parameter Exponent and the gain parameter Gain. The floating-point homomorphic encryption data structure of the second ciphertext data Ciphertext ₄ contains the mantissa Mantissa (for example: the second ciphertext mantissa with a value of 10000) , exponential parameter Exponent (eg: 1) and gain parameter Gain (eg: 100). In the addition operation of step S501, when the exponent parameter Exponent of the first ciphertext data Ciphertext ₃ is the same as the exponent parameter Exponent of the second ciphertext data Ciphertext ₄ , the first ciphertext mantissa of the first ciphertext data Ciphertext ₃ (such as : 20000) and the second ciphertext mantissa (such as: 10000) of the second ciphertext data Ciphertext ₄ are added to obtain the third ciphertext mantissa (such as: 30000) of the third ciphertext data. The point homomorphic encryption data structure includes the third ciphertext mantissa (for example: 30000), the exponent parameter Exponent and the gain parameter Gain.

Figure 6 is a flow chart of a ciphertext-ciphertext addition module according to another embodiment of the present invention. As shown in Figure 6, the ciphertext data includes the first ciphertext data Ciphertext ₅ and the second ciphertext data Ciphertext _6. The floating-point homomorphic encrypted data structure of the first ciphertext data Ciphertext ₅ includes the first ciphertext mantissa Mantissa. ₁ (for example: 2000), the first exponent parameter Exponent ₁ (for example: 10) and the gain parameter Gain ₁ (for example: 100), the floating point homomorphic encryption data structure of the second ciphertext data Ciphertext ₆ contains the second ciphertext The mantissa Mantissa ₂ (eg: 20000), the second exponential parameter Exponent ₂ (eg: 2) and the gain parameter Gain ₂ (eg: 100). When the first exponent parameter Exponent ₁ and the second exponent parameter Exponent ₂ are different, in step S601, the exponent parameters are made consistent. In some embodiments, the first exponent parameter Exponent ₁ is divided by the second exponent parameter Exponent ₂ to obtain the multiplier Multiplier; for example, the multiplier Multiplier=round(Exponent ₁ / Exponent ₂ ), where round() such as Can be a function taking an integer. Next, multiply the first ciphertext mantissa Mantissa ₁ (for example: 2000) by the multiplier Multiplier to obtain the new first ciphertext mantissa Mantissa ₁ (for example: 10000), and change the second exponent parameter of the first ciphertext data Exponent ₂ (e.g.: 10) is replaced by the first exponent parameter (e.g.: 2); for example, the second exponent parameter Exponent ₂ (e.g.: 10) is divided by the multiplier Multiplier to get the first exponent parameter (e.g.: 2 ).

In the addition operation in step S602, the new first ciphertext mantissa Mantissa ₁ (for example: 10000) of the first ciphertext data Ciphertext ₅ and the second ciphertext mantissa Mantissa ₂ (for example: 20000) of the second ciphertext data Ciphertext ₆ ) are added to obtain the mantissa of the third ciphertext data (for example: the third ciphertext mantissa with a value of 30000). The floating-point homomorphic encrypted data structure of the third ciphertext data contains the third ciphertext mantissa (for example: 30000), exponential parameter Exponent (such as: 2) and gain parameter Gain (such as: 100).

Figure 7 is a flow chart of a ciphertext-plaintext multiplication module according to an embodiment of the present invention. In step S701, the exponent parameter Exponent (eg: 1) of the ciphertext data Ciphertext ₁ is multiplied by the multiplier Multiplier (eg: 4) to obtain a new exponent parameter Exponent (eg: 4) of the ciphertext data.

In step S702, the exponent parameter Exponent (eg: 1) of the ciphertext data Ciphertext ₂ is multiplied by the multiplier Multiplier (eg: 0.2) to obtain a new exponent parameter Exponent (eg: 0.2) of the ciphertext data. Since the multiplier Multiplier (eg: 0.2) is a positive number less than 1, so the multiplication operation in step S702 can optionally be regarded as substantial division, but is not limited to this. Since the multiplication operations in steps S701 and S702 do not need to operate on the ciphertext (for example, the ciphertext mantissa with a value of 200), the calculation time is greatly saved.

Figure 8 is a flow chart of a ciphertext table lookup module according to an embodiment of the present invention. In step S801, the ciphertext mantissa Lwe _(Qin,Pin) (m ₁ ), which has a relatively large data dimension, is obtained by using the key and mode switch (key & Mod Switch) to obtain the ciphertext mantissa Lwe _(q1) , which has a relatively small data dimension. _,p1) (m ₁ ), where q1 and p1 can be range-related parameters, for example: q1 can represent the module, and p1 can represent the information space parameter, but it is not limited to this. In step S802, noise is removed from the ciphertext mantissa Lwe _(q1,p1) (m ₁ ) through function bootstrapping of the artificial intelligence model and a table lookup function is performed to implement the operation of the nonlinear function, thereby obtaining the ciphertext mantissa Lwe _{( Qin, Pin)} (m ₂ ).

Figure 9 is a flow chart of a neuron weight adjustment module F(x) according to an embodiment of the present invention. As shown in Figure 9, after the training of the artificial intelligence model is completed, the multiple obtained by dividing the maximum value Max by the minimum value Min in the table is 683.9. Since the multiple Multiple exceeds the preset range (such as the experience value range), the multiple The weights in the neurons of the artificial intelligence model that are smaller than the threshold are reset to zero to help remove noise. In some embodiments, as shown in Figure 9, for example, the maximum value Max is divided by 8 to obtain the threshold value Threshold. After weight adjustment by the above-mentioned neuron weight adjustment module F(x), the maximum value Max remains unchanged, and the multiple obtained by dividing the maximum value Max by the new minimum value Min is 7.159, which falls within the above preset range.

Regarding the method of determining the threshold value, refer to Figures 10 and 11. After the training of the artificial intelligence model is completed, the artificial intelligence model is searched layer by layer for a value suitable for zeroing the weight of the neuron as the threshold.

Figure 10 is a flow chart of a neuron weight adjustment threshold search module according to an embodiment of the present invention. As shown in Figure 10, in steps S1001, S1002, and S1003, from the following fully connected layers FC3, FC2, and FC1 to the previous convolutional layer Conv1, for example, the above maximum value Max is divided by different magnifications in the preset range. Different values, search layer by layer for the most suitable value (such as: Max/8) converted from the multiplier of neuron weight zeroing (such as: 8) as the threshold, for example, choose to maximize the accuracy of the artificial intelligence model. The best threshold, but not limited to this. Since the previous layers can be determined by empirical rules in practice, and the later layers have a greater impact on accuracy, the embodiment in Figure 10 searches from back to front.

Figure 11 is a flow chart of a neuron weight adjustment threshold search module according to another embodiment of the present invention. Compared with the embodiment in Figure 10, as shown in Figure 11, in steps S1101, S1102, and S1103, from the previous convolutional layer Conv1 to the later fully connected layers FC1, FC2, and FC3, for example, the above-mentioned maximum value Max is used. Divide the different values obtained by different magnifications in the preset range, and search layer by layer for the value converted from the magnification that is most suitable for zeroing the weight of the neuron as a threshold, for example, choosing to optimize the accuracy of the artificial intelligence model. threshold, but not limited to this. Since the previous layers will affect the subsequent output, the embodiment in Figure 11 searches from front to back.

Figure 12 is a flow chart of functional bootstrapping in a ciphertext table lookup module according to an embodiment of the present invention. Regarding the functional bootstrapping of step S802, as shown in Figure 12, the ciphertext mantissa Lwe _(q,p) (m ₁ ) is accumulated (Accumulator) through step S1201 using the effective update key 1201 (for example: a decoding-like operation ), to facilitate step S1202 to use the lookup table 1202 to search for the corresponding value. In step S1202, the content of the lookup table 1202 in the artificial intelligence model and the encoder (Encoder) 1203 extracted in the functional bootstrapping are adjusted to avoid overflow during the operation, thereby obtaining the ciphertext mantissa Lwe _{(Q ,P)} (m ₂ ). In some embodiments, for example, the encoder 1203 rescales the ciphertext mantissa (such as dividing the ciphertext mantissa by 2) to prevent the data calculated through the lookup table 1202 from exceeding the range of the relevant parameters p and q. A limited range, but not limited to this.

Figure 13 is a diagram illustrating a selection example of the lookup table 1202 and the encoder 1203 in a ciphertext table lookup module according to an embodiment of the present invention. In Figure 13, the ordinate corresponds to the ciphertext mantissa Lwe _(Q,P) (m ₂ ), and the abscissa corresponds to the ciphertext mantissa Lwe _(q,p) (m ₁ ). Figure 13 shows different zoom ratios. The scaling results are below, and values that are not within the predetermined range can be reset to zero.

Regarding the adjustment method of the lookup table 1202 and the encoder 1203, refer to Figures 14 and 15. Figure 14 is a flow chart of a function bootstrap parameter automatic adjustment module according to an embodiment of the present invention. Figure 15 is a flow chart of a function bootstrap parameter automatic adjustment module according to an embodiment of the present invention. A flow chart of a function bootstrap parameter automatic adjustment module according to another embodiment.

As shown in Figure 14, in steps S1401, S1402, and S1403, from the fully connected layers FC3, FC2, and FC1 at the back to the convolutional layer Conv1 at the front, using different values, the layer-by-layer search is most suitable for the lookup table 1202 and the encoder. 1203 parameters, such as selecting scaling parameters that allow the function to bootstrap without overflow and have the best accuracy, but are not limited to this. Since the previous layers can be determined by empirical rules in practice, and the later layers have a greater impact on accuracy, the embodiment in Figure 14 searches from back to front.

On the other hand, as shown in Figure 15, in steps S1501, S1502, and S1503, from the previous convolutional layer Conv1 to the following fully connected layers FC1, FC2, and FC3, different values are used to search layer by layer for the most suitable lookup table. The parameters of 1202 and encoder 1203 are, for example, selecting scaling parameters that allow function bootstrapping without overflow and optimal accuracy, but are not limited to this. Since the previous layers will affect the subsequent output, the embodiment in Figure 15 searches from front to back.

Figure 16 is a block diagram of a homomorphic encryption-based privacy computing system according to an embodiment of the present invention. The homomorphic encryption-based privacy computing system can execute the above-mentioned privacy computing method based on homomorphic encryption. As shown in Figure 16, the private computing system based on homomorphic encryption includes a computer device 1600 of the data owner and a computer device 1610 of the model owner.

The data owner's computer device 1600 includes a storage device 1601, a processor 1602, and a transmission device 1605; the model owner's computer device 1610 includes a storage device 1611, a processor 1612, and a transmission device 1615. For example, the storage devices 1601 and 1611 can be hard disks, flash storage devices or other storage media, the processors 1602 and 1612 can be central processing units, controllers or other circuits, and the transmission devices 1605 and 1615 can be transmission interfaces, Transmission lines, network devices, communication devices or other transmission media.

Regarding the architecture of the computer device 1600 of the data owner, the storage device 1601 is electrically connected to the processor 1602, and the processor 1602 is electrically connected to the transmission device 1605; regarding the architecture of the computer device 1610 of the model owner, the storage device 1611 is electrically connected to the processor 1612. The processor 1612 is electrically connected to the transmission device 1615. It should be understood that in the embodiments and the scope of the patent application, the description of "electrical connection" can generally refer to one component being indirectly electrically coupled to another component through other components, or one component being directly electrically coupled to another component without going through other components. electrically connected to another component.

When in use, the storage device 1601 stores plaintext data, encoding and encryption modules, ciphertext data with a floating-point homomorphic encryption data structure, decryption and decoding modules, and plaintext results. The processor 1602 can execute the encoding and encryption modules. and decryption and decoding modules. The storage device 1611 stores the artificial intelligence model, function bootstrapping parameter automatic adjustment module, neuron weight adjustment module, neuron weight adjustment threshold search module, ciphertext-ciphertext addition module, ciphertext-plaintext multiplication module , a ciphertext table lookup module and a ciphertext result with a floating-point homomorphic encryption data structure. The processor 1612 can execute an artificial intelligence model, a function bootstrapping parameter automatic adjustment module, a neuron weight adjustment module, and a neuron weight Adjust the threshold search module, ciphertext-ciphertext addition module, ciphertext-plaintext multiplication module and ciphertext table lookup module. Data can be transmitted between the transmission device 1605 and the transmission device 1615.

To sum up, the technical solution of the present invention has obvious advantages and beneficial effects compared with the existing technology. The privacy computing method based on homomorphic encryption of the present invention can allow the encrypted data to run an artificial intelligence model (such as a neural network model) to obtain accurate answers. Different from plaintext operations, this invention does not leak the privacy of data owners and model owners. Compared with confidential computing, the present invention does not require a trusted execution environment supported by special hardware. Compared with secure multi-party computation, the present invention can perform complex operations without requiring a large amount of interaction between the model owner and the data owner. Compared with past homomorphic encryption solutions, the present invention improves the efficiency and accuracy of homomorphic encryption in artificial intelligence model (such as neural network) operations.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make various modifications and modifications without departing from the spirit and scope of the present invention. Therefore, the protection of the present invention is The scope shall be determined by the appended patent application scope.

In order to make the above and other objects, features, advantages and embodiments of the present invention more obvious and easy to understand, the description of the attached symbols is as follows: 1201: Valid update key 1202: Lookup table 1203: Encoder 1600: Data owner's computer Device 1610: model owner's computer device 1601, 1611: storage device 1602, 1612: processor 1605, 1615: transmission device ciphertext(20020): ciphertext mantissa Ciphertext ₁ , Ciphertext ₂ : ciphertext data Ciphertext ₃ , Ciphertext ₅ : First ciphertext data Ciphertext ₄ , Ciphertext ₆ : Second ciphertext data Conv1: Convolution layer Exponent: Exponent parameter Exponent ₁ : First exponent parameter Exponent ₂ : Second exponent parameter F(x): Neuron weight adjustment module FC1 , FC2, FC3: Fully connected layer Gain: gain parameter LWE (m ₁ *g): ciphertext mantissa LWE (m ₂ ): ciphertext mantissa Lwe _(Qin,Pin) (m ₁ ): ciphertext mantissa Lwe _{(q1, p1)} (m ₁ ): ciphertext mantissa Lwe _(Qin,Pin) (m ₂ ): ciphertext mantissa m ₁ : plaintext data (m ₂ /2)*(m/g): plaintext result m ₃ : plaintext result Mantissa :Mantissa Mantissa ₁ :Mantissa of the first ciphertext Mantissa ₂ :Mantissa of the second ciphertext Max: Maximum value Min: Minimum value Multiple: Multiple Multiplier: Multiplier q, p, q1, p1: Range related parameters plaintext(100): Plaintext Gain parameter plaintext(1): plaintext index parameters S101~S105, S111~S114: steps S201~S207: step S501: step S601, S602: step S701, S702: step S801, S802: step S1001, S1002, S1003: step S1101 , S1102, S1103: Step S1201, S1202: Step S1401, S1402, S1403: Step S1501, S1502, S1503: Step Threshold: Threshold

In order to make the above and other objects, features, advantages and embodiments of the present invention more apparent and understandable, the accompanying drawings are described as follows: Figure 1 is a flow chart of a privacy computing method based on homomorphic encryption according to an embodiment of the present invention; Figure 2 is a block diagram of a privacy computing method based on homomorphic encryption according to another embodiment of the present invention; Figure 3 is a flow chart of an encoding and encryption module according to an embodiment of the present invention; Figure 4 is a flow chart of a decryption and decoding module according to an embodiment of the present invention; Figure 5 is a flow chart of a ciphertext-ciphertext addition module according to an embodiment of the present invention; Figure 6 is a flow chart of a ciphertext-ciphertext addition module according to another embodiment of the present invention; Figure 7 is a flow chart of a ciphertext-plaintext multiplication module according to an embodiment of the present invention; Figure 8 is a flow chart of a ciphertext table lookup module according to an embodiment of the present invention; Figure 9 is a flow chart of a neuron weight adjustment module according to an embodiment of the present invention; Figure 10 is a flow chart of a neuron weight adjustment threshold search module according to an embodiment of the present invention; Figure 11 is a flow chart of a neuron weight adjustment threshold search module according to another embodiment of the present invention; Figure 12 is a flow chart of functional bootstrapping in a ciphertext table lookup module according to an embodiment of the present invention; Figure 13 is a diagram illustrating an example of lookup table and encoder selection in a ciphertext table lookup module according to an embodiment of the present invention; Figure 14 is a flow chart of a function bootstrap parameter automatic adjustment module according to an embodiment of the present invention; Figure 15 is a flow chart of a function bootstrap parameter automatic adjustment module according to another embodiment of the present invention; and Figure 16 is a block diagram of a privacy computing system based on homomorphic encryption according to an embodiment of the present invention.

S101~S105, S111~S114: steps

Claims (9)

A privacy computing method based on homomorphic encryption, including the following steps: encoding and encrypting a plaintext data into a ciphertext data, the ciphertext data has a floating point number homomorphic encryption data structure, the floating point number of the ciphertext data The homomorphic encryption data structure includes a ciphertext mantissa, an exponent parameter and a gain parameter. The gain parameter sets the precision of the floating point number corresponding to the ciphertext mantissa. The exponent parameter is suitable for multiplication or division; the ciphertext data is transmitted Give an artificial intelligence model, and enable the artificial intelligence model to perform operations on the ciphertext data to return a ciphertext result; decode and decrypt the ciphertext result into a plaintext result; after the training of the artificial intelligence model is completed, the The artificial intelligence model searches layer by layer for a value suitable for zeroing the weight of the neuron as a threshold; and zeroes the weight of the neuron of the artificial intelligence model that is smaller than the threshold. The privacy computing method based on homomorphic encryption as described in request item 1, wherein the plaintext data contains real numbers with decimals, and the step of encoding and encrypting the plaintext data into the ciphertext data includes: multiplying the real numbers with decimals by The gain parameter is divided by the exponent parameter to obtain a plaintext mantissa; and the plaintext mantissa is encrypted into the ciphertext mantissa, the ciphertext mantissa is an integer Count. The privacy operation method based on homomorphic encryption as described in claim 1, wherein the ciphertext result has a floating-point homomorphically encrypted data structure, and the floating-point homomorphically encrypted data structure of the ciphertext result contains another ciphertext The mantissa, another exponent parameter and another gain parameter, the steps of decoding and decrypting the ciphertext result into the plaintext result include: decrypting the other ciphertext mantissa into a plaintext mantissa; and dividing the plaintext mantissa by the other A gain parameter and multiplied by the other exponential parameter to obtain the plaintext result. A privacy computing method based on homomorphic encryption, including the following steps: receiving a ciphertext data, the ciphertext data has a floating point homomorphic encryption data structure, the floating point number homomorphic encryption data structure of the ciphertext data includes A ciphertext mantissa, an exponent parameter and a gain parameter. The gain parameter sets the precision of the floating point number corresponding to the ciphertext mantissa. The exponent parameter is suitable for multiplication or division; the ciphertext data is operated through an artificial intelligence model. to return a ciphertext result; after the training of the artificial intelligence model is completed, the artificial intelligence model is searched layer by layer for a value suitable for zeroing the weight of the neuron as a threshold; and the artificial intelligence model is The weight in this neuron is less than the threshold Return to zero. The privacy computing method based on homomorphic encryption as described in claim 4, wherein the ciphertext data includes a first ciphertext data and a second ciphertext data, and a floating-point homomorphic encryption of the first ciphertext data The data structure includes a first ciphertext mantissa, the exponent parameter and the gain parameter, and a floating-point homomorphically encrypted data structure of the second ciphertext data includes a second ciphertext mantissa, the exponent parameter and the gain parameter, The operation performed by the artificial intelligence model on the ciphertext data includes an addition operation, and the addition operation includes: when the exponent parameter of the first ciphertext data is the same as the exponent parameter of the second ciphertext data, The first ciphertext mantissa of the first ciphertext data and the second ciphertext mantissa of the second ciphertext data are added to obtain a third ciphertext mantissa of the third ciphertext data, the third ciphertext A floating-point homomorphically encrypted data structure of the data includes the third ciphertext mantissa, the exponent parameter and the gain parameter. The privacy computing method based on homomorphic encryption as described in claim 4, wherein the ciphertext data includes a first ciphertext data and a second ciphertext data, and a floating-point homomorphic encryption of the first ciphertext data The data structure includes a first ciphertext mantissa, a first exponent parameter and the gain parameter, and a floating-point homomorphically encrypted data structure of the second ciphertext data includes a second ciphertext mantissa, a second exponent parameter and The gain parameter, the operation performed by the artificial intelligence model on the ciphertext data includes an addition operation, and the addition operation includes: When the first exponent parameter is different from the second exponent parameter, the first exponent parameter is divided by the second exponent parameter to obtain a multiplier, and the first ciphertext mantissa is multiplied by the multiplier to obtain A new first ciphertext mantissa, replace the second exponent parameter of the first ciphertext data with the first exponent parameter; and replace the new first ciphertext mantissa of the first ciphertext data with the first ciphertext mantissa. The second ciphertext mantissas of the two ciphertext data are added to obtain a third ciphertext mantissa of the third ciphertext data, and a floating-point homomorphically encrypted data structure of the third ciphertext data contains the third ciphertext data. The suffix, the first index parameter and the gain parameter. The privacy operation method based on homomorphic encryption as described in claim 4, wherein the operation performed by the artificial intelligence model on the ciphertext data includes a multiplication operation, and the multiplication operation includes: converting the exponent parameter of the ciphertext data Multiply by a multiplier to obtain a new exponential parameter of the ciphertext data. The privacy operation method based on homomorphic encryption as described in request 4, wherein the operation performed by the artificial intelligence model on the ciphertext data includes: using functional bootstrapping of the artificial intelligence model on the ciphertext The mantissa removes noise and performs table lookup functions to implement nonlinear function operations. The privacy computing method based on homomorphic encryption as described in request item 4 further includes: after the training of the artificial intelligence model is completed, adjusting the content of the lookup table in the artificial intelligence model and the extraction (Extraction) of the function bootstrapping Encoder to avoid overflow during operation.