WO2020220754A1 - 一种用于加密模型的安全性评估的方法和设备 - Google Patents

一种用于加密模型的安全性评估的方法和设备 Download PDF

Info

Publication number
WO2020220754A1
WO2020220754A1 PCT/CN2020/071605 CN2020071605W WO2020220754A1 WO 2020220754 A1 WO2020220754 A1 WO 2020220754A1 CN 2020071605 W CN2020071605 W CN 2020071605W WO 2020220754 A1 WO2020220754 A1 WO 2020220754A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
data
security
ciphertext
plaintext
Prior art date
Application number
PCT/CN2020/071605
Other languages
English (en)
French (fr)
Inventor
阮方圆
Original Assignee
创新先进技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 创新先进技术有限公司 filed Critical 创新先进技术有限公司
Priority to US16/836,725 priority Critical patent/US11228423B2/en
Publication of WO2020220754A1 publication Critical patent/WO2020220754A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds

Definitions

  • the present disclosure relates to the field of encryption model security, in particular, to an encryption model security deployment evaluation scheme.
  • a widely used data model is the machine learning model.
  • the machine learning model can acquire new knowledge or skills by simulating or realizing human learning behavior, reorganize the existing knowledge structure, and continuously improve its performance .
  • It is the core of artificial intelligence, the key technology of artificial intelligence in computers, and its applications are in all fields of artificial intelligence. It mainly uses data induction and synthesis rather than deduction.
  • the data model can be divided into unencrypted data model (plaintext data model) and encrypted data model (ciphertext data model).
  • plaintext data model unencrypted data model
  • ciphertext data model encrypted data model
  • the plaintext data model can directly determine the security, but it cannot protect the privacy of the data demander.
  • the ciphertext data model can protect the privacy of the demander, it makes it difficult for the data source to be deployed to directly evaluate the security of the model. Therefore, there is a need to improve the model security deployment scheme in order to be able to provide a more secure and robust model security deployment assessment mechanism.
  • the present disclosure relates to a security deployment evaluation scheme of an encryption model.
  • the scheme utilizes homomorphic encryption technology to realize the security evaluation of the encryption model. Therefore, there is no risk of leaking the plaintext of model parameters.
  • a data requester device for security evaluation of an encryption model
  • the data requester device being configured to send data to be homomorphically encrypted to the data source device
  • a deployment request for the model to be deployed on the data source device where the deployment request includes the ciphertext model parameters that are homomorphically encrypted based on the plaintext parameters of the data model and the public key used for the homomorphic encryption
  • the security evaluator device receives the first ciphertext security evaluation indicator; and uses the private key corresponding to the public key to decrypt the received first ciphertext security evaluation indicator to generate a plaintext security evaluation indicator and evaluate the plaintext security
  • the indicator is forwarded to the security assessor device.
  • a data source device for security evaluation of an encryption model
  • the data source device being configured to: receive data to be homomorphically encrypted from a data requesting device A deployment request for the model to be deployed on the data source device, the deployment request including the homomorphic encrypted ciphertext model parameters and the public key used for the homomorphic encryption; the homomorphic encrypted cipher
  • the document model parameters and the public key are forwarded to the security assessor device; and the model security assessment report is received from the security assessor device, and the model security assessment report is used to approve whether to deploy the data provided by the data requester device Data model with homomorphic encryption.
  • the data source device as described in the second aspect is further configured to: forward the homomorphically encrypted ciphertext model parameters and the public key to the security evaluator Before the device, the sequence of the ciphertext model parameters that are homomorphically encrypted is shuffled.
  • a security evaluator device for security evaluation of an encryption model, the security evaluator device being configured to: receive a data requester forwarded from a data source device The homomorphic encrypted ciphertext model parameters and public key provided by the device; the first ciphertext security evaluation index is obtained by calculation using the homomorphic encrypted ciphertext model parameters and the first ciphertext security evaluation index is sent To the data requester device; receive the plaintext security assessment index from the data requester device; use the public key provided by the data requester device to encrypt the received plaintext security assessment index to generate the first Two ciphertext security assessment indicators; comparing the first ciphertext security assessment indicators with the second ciphertext security assessment indicators to determine their consistency, and generating a corresponding model security assessment report based on the consistency; and The model safety assessment report is sent to the data source device.
  • a method for evaluating the security of an encryption model includes: sending a data requester device to a data source device to deploy a homomorphic encrypted data model in all locations.
  • the deployment request on the data source device where the deployment request includes the ciphertext model parameters that are homomorphically encrypted based on the plaintext parameters of the data model and the public key used for the homomorphic encryption; the data source
  • the device forwards the homomorphically encrypted ciphertext model parameters and the public key to the security evaluator device;
  • the security evaluator device uses the received homomorphically encrypted ciphertext model parameters to calculate Obtain the first ciphertext security evaluation index, and send the first ciphertext security evaluation index to the data requester device;
  • the data requester device uses the private key corresponding to the public key to decrypt the received
  • the first ciphertext security assessment index is used to generate a plaintext security assessment index, and the plaintext security assessment index is forwarded to the security assessor device; the security assessor device uses
  • the method as described in the fifth aspect further includes: before the data demander device sends the deployment request to the data source device, the data from each source has been used as the model feature To train the data model, and obtain an encrypted data model by performing homomorphic encryption on the model parameters.
  • the method according to the fifth aspect further includes: when multiple evaluations occur, comparing results of a plurality of the first ciphertext security evaluation index and the second ciphertext security evaluation index Comprehensive consideration is carried out to generate a comprehensive model safety assessment report.
  • the method as described in the fifth aspect can also be executed after the data source device deploys the homomorphic encrypted data model for evaluating the data provided by the data requester. Is there a risk of inferring the detailed data value of the data source in the result of the plaintext model of.
  • the method as described in the fifth aspect further includes: in the decryption step, before sending the plaintext security assessment index to the security assessor, the data requester may pass Compare the decrypted variance Var with the Var calculated from the plaintext for review to avoid leaking model parameters
  • the method according to the fifth aspect further includes: providing a random number along with the public key to ensure that the same public key encrypts the same data under the same random number condition.
  • a data requester device for security evaluation of an encryption model
  • the data requester device being configured to: send to the data source device the homomorphic encrypted A deployment request for the data model to be deployed on the data source device, the deployment request including the ciphertext model parameter homomorphically encrypted based on the plaintext parameter of the data model and the public key used for the homomorphic encryption; Receiving a first ciphertext security evaluation index from the data source device; and using a private key corresponding to the public key to decrypt the received first ciphertext security evaluation index to generate a plaintext security evaluation index and to combine the plaintext The security evaluation index is forwarded to the data source device.
  • a data source device for evaluating the security of an encryption model, the data source device being configured to: receive a homomorphic encrypted data from a data requesting device A deployment request for deploying a data model on the data source device, the deployment request including the homomorphic encrypted ciphertext model parameters and the public key used for the homomorphic encryption; using the homomorphic encrypted
  • the ciphertext model parameters are calculated to obtain the first ciphertext security evaluation index, and the first ciphertext security evaluation index is sent to the data requester device; the plaintext security evaluation index is received from the data requester device;
  • the public key provided by the demand-side device encrypts the received plaintext security assessment index to generate a second ciphertext security assessment index; compares the first ciphertext security assessment index with the second ciphertext security assessment Indicators to determine their consistency, and generate a corresponding model security assessment report based on the consistency; and approve whether to deploy the homomorphic encrypted data model provided by the data request
  • a method for evaluating the security of an encryption model includes: a data requester device sends a data source device to deploy a homomorphic encrypted data model on The deployment request on the data source device, the deployment request including the ciphertext model parameters that are homomorphically encrypted based on the plaintext parameters of the data model and the public key used for the homomorphic encryption; the data source The third party device uses the received homomorphic encrypted ciphertext model parameters to obtain a first ciphertext security evaluation index through calculation, and sends the first ciphertext security evaluation index to the data requester device; the data The demand-side device uses the private key corresponding to the public key to decrypt the received first ciphertext security evaluation index to generate a plaintext security evaluation index, and forwards the plaintext security evaluation index to the data source device The data source device uses the public key provided by the data requester device to encrypt the received plaintext security assessment index to generate a second ciphertext security assessment index, and compare the first
  • the method according to the thirteenth aspect further includes: before the data demander device sends the deployment request to the data source device, the data from each source has been used as Model features are used to train the data model, and the encrypted data model is obtained by homomorphic encryption of the model parameters.
  • the method as described in the thirteenth aspect further includes: when multiple evaluations occur, by evaluating a plurality of the first ciphertext security evaluation index and the second ciphertext security evaluation index The comparison results are comprehensively considered to generate a comprehensive model safety assessment report.
  • the method as described in the thirteenth aspect can also be executed after the data source device deploys the homomorphic encrypted data model for evaluating the data demander Does the provided plaintext model result risk inferring the detailed data value of the data source.
  • the method according to the thirteenth aspect includes: providing a random number along with the public key to ensure that the same public key encrypts the same data under the same random number condition.
  • Fig. 1 shows an exemplary operating computing environment of the present disclosure.
  • Fig. 2 is an encryption model security deployment evaluation scheme according to an embodiment of the present disclosure.
  • Fig. 3 is a flowchart of an encryption model security deployment evaluation method according to an embodiment of the present disclosure.
  • Fig. 4 shows another exemplary operating computing environment of the present disclosure.
  • Fig. 5 is an encryption model security deployment evaluation scheme according to another embodiment of the present disclosure.
  • Fig. 6 is a flowchart of an encryption model security deployment evaluation method according to another embodiment of the present disclosure.
  • a trusted evaluator is provided as a third-party evaluation agency to approve the requirements. Whether the deployed encrypted data model is secure, it can obtain the plaintext model parameters from the data requester, and then, after calculating the model security evaluation index based on the plaintext model parameters, it outputs the model parameter security evaluation report to the data source. The data source judges the security of the model based on the security assessment report and decides whether to deploy it locally.
  • this traditional evaluation scheme has a big flaw, that is, its scheme is based on the assumption that the trusted evaluator is a completely trustworthy third party, but in the real world, even if it is not deliberately done by a third party, But there are always various intruders trying to use various loopholes or backdoors to break through the security barriers of trusted third parties to steal various valuable data. Since the data requester transmits the model parameters in plaintext to the trusted evaluator to calculate the model security evaluation index, once the trusted evaluator is compromised (for example, a Trojan horse program), the plaintext model parameters are very useful It may be secretly transmitted to the intruder by the Trojan horse program, causing the plaintext of the model of the data demander to be exposed to the intruder without being noticed.
  • Homomorphic Encryption is a kind of encryption method with special natural properties. It is a cryptographic technique based on the computational complexity theory of mathematical problems. The homomorphic encrypted data is processed to obtain an output, and the output is decrypted. The result is the same as the output obtained by processing the unencrypted original data in the same method.
  • homomorphic encryption can also achieve multiple calculation functions between ciphertexts, that is, calculating first and then decrypting is equivalent to first decrypting and then calculating.
  • homomorphic encryption refers to such an encryption function: performing addition and multiplication operations on the plaintext and then encrypting it, and performing the corresponding operations on the ciphertext after encryption, and the result is equivalent. It is the special natural attribute of homomorphic encryption that makes it possible to completely resolve the contradiction between security and privacy when deploying data models.
  • An encryption function with homomorphic properties means that two plaintexts a and b satisfy Encryption function, where En is encryption operation, Dec is decryption operation, ⁇ , Corresponding to operations on the plaintext and ciphertext domains respectively.
  • En encryption operation
  • Dec decryption operation
  • ⁇ Corresponding to operations on the plaintext and ciphertext domains respectively.
  • ⁇ represents multiplication
  • ⁇ multiplicative homomorphic encryption.
  • Fully homomorphic encryption refers to an encryption function that satisfies the properties of additive homomorphism and multiplication homomorphism at the same time, and can perform any number of addition and multiplication operations.
  • homomorphic encryption algorithms include additive homomorphic Paillier algorithm, multiplicative homomorphic Elgamal algorithm, and LWE-based fully homomorphic algorithm.
  • homomorphic encryption algorithm is given below.
  • m is plaintext
  • c is ciphertext
  • SK is the encryption key
  • E(,) is the encryption function
  • D(,) is the decryption function.
  • the properties of the additive homomorphic encryption algorithm it can realize the following additive homomorphic operations, and can also use multiple addition homomorphic operations to realize multiplication homomorphic operations.
  • Multiplicative homomorphic encryption algorithm properties the following multiplicative homomorphic operations can be realized:
  • HMul(c1,c2) E(PK,m1 ⁇ m2).
  • FIG. 1 an exemplary operating computing environment of an embodiment of the present disclosure is shown in FIG. 1.
  • the data requester device 110 (referred to as the “data requester 110")
  • the security evaluator device 120 (referred to as the “security evaluator 120")
  • the data source device is included. 130 (referred to as “data source 130") these three parties.
  • the data requester, security assessor, and data source can be composed of secure computing nodes, such as personal computers, servers, clients, mobile devices (such as mobile phones, personal digital assistants, tablets, etc.), and various computing devices. Between the parties, data communication is carried out through the network.
  • the network includes various types of wired and wireless networks, including but not limited to the Internet, local area network, WIFI, WLAN, cellular communication networks (GPRS, CDMA, 2G/ 3G/4G/5G cellular network), satellite communication network, etc.
  • the data demander, the security assessor, and the data source can transmit various data to each other for processing.
  • GPRS global positioning reference
  • CDMA Code Division Multiple Access
  • 2G/ 3G/4G/5G cellular network satellite communication network
  • satellite communication network etc.
  • the encryption model security deployment evaluation solution in an embodiment of the present disclosure as shown in FIG. 2, data exchange between these three parties is involved.
  • the solution may only involve both the data demander 110 and the data source 130, and the solution is described in detail in FIGS. 4 and 5.
  • FIG. 2 there is shown an overall scheme of model security deployment assessment implemented among the three parties: the data demander 110, the security assessor 120, and the data source 130.
  • the data requester 110 sends to the data source 130 a deployment request for the data model (for example, a trained machine learning model) to be deployed on the data source 130 after homomorphic encryption.
  • the deployment request includes
  • the plaintext parameters of the data model are homomorphically encrypted by the ciphertext model parameters and the public key used for encryption.
  • the data requester 110 Before initiating the deployment request, the data requester 110 has used data from various sources as model features to train a data model, and homomorphically encrypts the model parameters of the data model with a public key to obtain an encrypted data model ( Ciphertext model).
  • Ciphertext model an encrypted data model
  • a linear regression model is used as an example of a machine learning model for description, but it should be understood that the data model is not limited to linear regression models, but can be applied to various types of data models
  • the model result is other ciphertext models that predict probability values, such as logistic regression, regression decision tree and other data models.
  • the original data model is also called “plaintext model”
  • the data model after homomorphic encryption is also called "ciphertext model”.
  • the data source 130 After receiving the request from the data requester 110 that contains the homomorphically encrypted ciphertext model parameters and the public key, the data source 130 will shuffle the order of the homomorphically encrypted ciphertext model parameters, and then will be destroyed
  • the out-of-order homomorphic encrypted ciphertext model parameters are transmitted to the security evaluator 120 together with the public key, or the homomorphic encrypted ciphertext model parameters and the public key are directly transmitted to the security evaluator 120 together.
  • the homomorphic encrypted ciphertext model parameters are used to calculate the first ciphertext security evaluation index (in this embodiment Take variance calculation as an example), and transmit the first ciphertext security evaluation index to the data requester 110.
  • the data requester 110 uses the private key corresponding to the public key to decrypt the received first ciphertext security assessment index to generate a plaintext security assessment index, and then transmits the plaintext security assessment index back to the security assessor 120.
  • the security assessor 120 uses the public key previously provided by the data requester 110 to encrypt the received plaintext security assessment indicator to generate a second ciphertext security assessment indicator, and compares the second ciphertext security assessment indicator with the first ciphertext security assessment indicator. Document safety assessment indicators are compared to determine their consistency. Then, the security assessor 120 generates a corresponding model security assessment report according to the consistency and returns it to the data source 130 for its reference.
  • a model security evaluation report indicating that the ciphertext model is safe can be provided;
  • a model security assessment report that the ciphertext model is insecure for example, the data requester 110 may falsify during the decryption process
  • the data source 130 approves the model deployment request according to the model security assessment report, that is, if the model security assessment report indicates that the ciphertext model is secure, the deployment site is approved.
  • the ciphertext model is described, otherwise the ciphertext model is refused to be deployed, and a prompt of refusal to deploy may be returned to the data requester 110. After approval, the encrypted ciphertext model is deployed on the data source 130. At this point, the program is over.
  • the security evaluator can only get the ciphertext model parameters in the ciphertext form, so there is no risk of leaking the model parameter plaintext from them; at the same time, the data requester is sending the first ciphertext
  • the security assessor first verifies the two security assessment indicators before and after the data requester’s decryption.
  • Model security assessment report and then return the report to the data source, thereby preventing the data requester from falsifying in the decryption process (if the data requester provides encrypted ciphertext indicators, according to the characteristics of homomorphic encryption technology, the security assessment The comparison between the first and second ciphertext security evaluation indicators by the party office cannot be consistent). It can be seen that the encryption model security deployment evaluation solution of the present disclosure solves various deficiencies in traditional model security deployment solutions, and provides a more secure and robust model security deployment evaluation mechanism with improved performance.
  • FIG. 3 shows a flowchart of a model security deployment assessment method using homomorphic encryption according to an embodiment of the present disclosure.
  • the flow chart corresponds to the evaluation scheme shown in FIG. 2.
  • the flowchart also involves the data flow between the data requester 110, the security assessor 120, and the data source 130.
  • the data requester 110 generates an encryption key (public key PK) and a decryption key (private key SK) for homomorphic encryption, and homomorphically encrypts the model parameters to generate an encrypted data model.
  • the source 130 sends a deployment request to deploy the homomorphically encrypted data model on the data source 130, and the deployment request includes the ciphertext model parameters based on the plaintext parameters of the data model that are homomorphically encrypted And the public key PK used in the homomorphic encryption.
  • the specific model encryption process is as follows:
  • Algorithm input k+1 model parameters a_0, a_1,..., a_k.
  • Algorithm output k+1 encryption model parameters c_0, c_1,..., c_k.
  • step 320 after receiving the deployment request, the data source 130 will homomorphically encrypted ciphertext model parameters (ie c_0, c_1,..., c_k, the order of which can be disrupted) and the public key ( That is, PK) is transmitted to the security evaluator 120 together.
  • ciphertext model parameters ie c_0, c_1,..., c_k, the order of which can be disrupted
  • PK public key
  • the security evaluator 120 obtains the homomorphic encrypted ciphertext model parameters and public key, and then uses the homomorphic encrypted ciphertext model parameters to obtain the first ciphertext security evaluation index through calculation , And transmit the first ciphertext security evaluation index to the data requester 110.
  • "security evaluation index” refers to a statistical index such as variance (var) or range calculated by using encryption model parameters based on homomorphic properties. Using the statistical indicators can prevent the occurrence of a situation in which the parameters of a certain feature in the model are far greater than the parameters of other features. This parameter, which is much larger than other characteristic parameters, is likely to be a "malicious" parameter used to reverse the corresponding original value. Therefore, through variance calculation, possible "malicious" parameters can be completely ineffective.
  • the variance calculation is performed on the homomorphic encrypted ciphertext model parameters as an example of calculating the security evaluation index, and the algorithm is as follows:
  • the ciphertext (sample) variance index is:
  • Var_E HAdd(HSM(HAdd(HMul(c_0,c_0),HMul(c_1,c_1),...,HMul(c_k,c_k)),1/k),HSM(HMul(HAdd(c_0,c_1,...,c_k ),HAdd(c_0,c_1,...,c_k)),-1/(k*(k+1))).
  • HAdd() means additive homomorphic operation
  • HSM() means multiplication homomorphic operation
  • HMul() means multiplicative homomorphic operation.
  • step 350 the security evaluator 120 uses the public key PK provided by the data requester 110 to encrypt the received plaintext security evaluation index to generate a second ciphertext security evaluation index:
  • Var_E2 E(PK,Var).
  • Var represents the variance
  • E(,) is the encryption function
  • D(,) is the decryption function
  • SK is the private key
  • PK is the public key.
  • step 360 the security evaluator 120 compares the first ciphertext security evaluation index (generated in step 330) with the second ciphertext security evaluation index to determine their consistency, that is, compares Var_E with Var_E2.
  • the security evaluator 120 compares the first ciphertext security evaluation index (generated in step 330) with the second ciphertext security evaluation index to determine their consistency, that is, compares Var_E with Var_E2.
  • the security evaluator 120 compares the first ciphertext security evaluation index (generated in step 330) with the second ciphertext security evaluation index to determine their consistency, that is, compares Var_E with Var_E2.
  • the security assessor 120 In step 370, the security assessor 120 generates a corresponding model security assessment report based on the consistency and returns it to the data source 130 for its reference.
  • a model security evaluation report indicating that the data model is safe can be provided;
  • a model security assessment report indicating that the data model is insecure for example, the data requester 110 may falsify during the decryption process
  • step 380 the data source 130 approves the model deployment request based on the received model security assessment report, that is, if the model security assessment report indicates that the encrypted ciphertext model is secure, the ciphertext model is approved to be deployed Otherwise, the deployment of the ciphertext model is rejected, and a prompt of rejecting deployment may be returned to the data requester 110. After the deployment is approved, the encrypted ciphertext model is deployed on the data source 130.
  • homomorphic encryption and decryption algorithms involved in the present disclosure utilize some parameters, functions, and calculations in common homomorphic encryption and decryption algorithms. These parameters, functions, and calculations are all basic common sense of homomorphic encryption, so they will not be described here.
  • the above example algorithm is provided for illustrative purposes only, and it is not intended to limit the homomorphic encryption, decryption, and calculation of the present disclosure to the above algorithm. In fact, technicians can choose any other suitable homomorphic encryption and decryption and calculation algorithms according to actual needs.
  • the variance may be compared with a set threshold, and if the variance exceeds the threshold, it is determined as It is not safe because the model parameters may be fake parameters used to attack the model.
  • a comprehensive security level assessment report is provided, that is, in the process of generating the report, there may be multiple assessments, and then multiple first security assessment indicators and second ciphertexts are provided at the same time Security assessment indicators, after comprehensive consideration (for example, scoring) of the comparison results of these first ciphertext security assessment indicators and the second ciphertext security assessment indicators, a more accurate comprehensive security level assessment report can be obtained.
  • the data source 130 may require the data requester 110 to send deployment requests multiple times at different times, and send the encryption model parameters and public keys in each deployment request to the security evaluator 120.
  • the security evaluator 120 also calculates the encryption model parameters each time to generate the first security evaluation indicator, and sends the first security evaluation indicator to the data requester 110, and receives the plaintext decrypted by the data requester 110.
  • the public key is used to encrypt the plaintext security evaluation indicator to generate a corresponding second ciphertext security evaluation indicator and compare it with the corresponding first security evaluation indicator. Subsequently, the results of each comparison are combined to generate a comprehensive security level assessment report.
  • the synthesis may include giving an unsafe assessment when one of the multiple comparison results exceeds the threshold, or weighted average of all the results to obtain a total safety score to be added to the report to be fed back to the data source 130, and many more.
  • step 340 the data requester 110 decrypts the ciphertext parameters in the received ciphertext model security evaluation index to generate the plaintext security evaluation index, in the step of sending the plaintext security evaluation index to Before the security evaluator 120, the data requester can conduct an audit by comparing the decrypted variance Var with the Var calculated based on the plaintext to determine whether someone has modified an encrypted model parameter and faked it into Var_E for the data requester 110 Decrypt. Through the audit, such counterfeiting can be found to avoid leakage of model parameters.
  • the model security evaluation solution can also be used in the evaluation of the model results after the encrypted data model is deployed to the data source, to evaluate whether the plaintext model results provided by the data requester 110 are reversed.
  • the risk of the detailed data value of the data source A large amount of valuable data is stored on the data source. Therefore, if the plaintext model results provided by the data model provided by the data requester 110 can easily calculate the detailed data value input by the data source, then the data requester 110 may The specific model parameters are set for reverse estimation. Therefore, the model security evaluation scheme of the present disclosure can be used to audit the deployed encrypted data model to determine whether there is a reverse push risk. Since the process is similar, it will not be described in detail here.
  • model security deployment assessment mechanism among the three parties: the data demander, the security assessment party, and the data source.
  • a model security deployment evaluation mechanism that uses homomorphic encryption to be more secure and robust is also provided.
  • FIG. 4 shows an exemplary operating environment for model security deployment assessment implemented between the data requester 110 and the data source 130 without the need for a security assessor.
  • the data requester 110 and the data source 130 communicate directly with each other through the network without the participation of the security assessment party.
  • FIG. 5 shows an encryption model security deployment evaluation scheme according to another embodiment of the present disclosure.
  • the data requester 110 sends to the data source 130 a deployment request for the data model (for example, a trained machine learning model) to be deployed on the data source 130 after homomorphic encryption.
  • the deployment request includes The plaintext parameters of the data model are homomorphically encrypted by the ciphertext model parameters and the public key used for encryption.
  • the data source 130 uses the homomorphically encrypted ciphertext model parameters to obtain the first ciphertext security assessment by calculation And send the first ciphertext security evaluation index to the data requester 110.
  • the data requester 110 uses the private key corresponding to the public key to decrypt the received ciphertext model security evaluation index to generate a plaintext security evaluation index, and then transmits the plaintext security evaluation index back to the data source 130.
  • the data source 130 uses the public key previously provided by the data requester 110 to encrypt the received plaintext security assessment indicator to generate a second ciphertext security assessment indicator, and compares the second ciphertext security assessment indicator with the first ciphertext security assessment indicator. Document safety assessment indicators are compared to determine their consistency. Then, the data source 130 generates a corresponding model security assessment report according to the consistency.
  • a model security evaluation report indicating that the data model is safe can be provided;
  • a model security assessment report indicating that the data model is insecure for example, the data requester 110 may falsify during the decryption process
  • the data source 130 approves the model deployment request according to the model security assessment report, that is, if the model security assessment report indicates that the encrypted ciphertext model is secure, then approve the deployment of the ciphertext model, otherwise refuse to deploy the ciphertext model.
  • the model may return to the data requester 110 a prompt to refuse deployment.
  • the encrypted ciphertext model is deployed on the data source 130. At this point, the program is over.
  • the generation of the model safety assessment report facilitates archiving it for future use, that is, if the model safety assessment report shows that the data model from the data requester 110 is unsafe, it will be received in the future After a subsequent deployment request from the same data requester 110, you can directly consult the stored model security assessment report associated with the data requester 110 to directly reject the subsequent deployment request from the data requester 110 to save resources .
  • the step of generating the security assessment report may also be skipped, and the model deployment request may be approved directly based on the comparison result of the first ciphertext security assessment index and the second ciphertext security assessment index. That is, if the comparison result of the first ciphertext security evaluation index and the second ciphertext security evaluation index is consistent, the deployment of the ciphertext model is approved, otherwise, if the comparison results are inconsistent, the deployment of the ciphertext model is rejected.
  • the data source 130 can only get the model parameters in ciphertext form, so there is no risk of leaking the plaintext of the model parameters; at the same time, the data requester 110 is decrypting the first ciphertext security evaluation index. After that, the data source 130 encrypts the plaintext security evaluation index by using the public key to generate a second ciphertext security evaluation index, and verifies the two security evaluation indicators before and after the data requester decrypts the security evaluation index to generate the model security. Evaluation report, thereby preventing the data demander from falsifying in the decryption process (if the falsified index is provided, according to the characteristics of homomorphic encryption technology, the two ciphertext security evaluation indexes cannot be the same). It can be seen that the encryption model security deployment evaluation solution of the present disclosure solves various deficiencies in traditional model security deployment solutions, and provides a more secure and robust model security deployment evaluation mechanism with improved performance.
  • FIG. 6 shows the flow of the model security deployment assessment method using homomorphic encryption according to the other embodiment of the present disclosure.
  • the flowchart relates to the flow of data between the data requester 110 and the data source 130. The contents, definitions and descriptions similar to those in Fig. 3 will not be detailed.
  • the data requester 110 generates an encryption key (public key PK) and a decryption key (private key SK) for homomorphic encryption, and homomorphically encrypts the model parameters to generate an encrypted data model.
  • the source 130 sends a deployment request to deploy the homomorphically encrypted data model on the data source 130, and the deployment request includes the ciphertext model parameters based on the plaintext parameters of the data model that are homomorphically encrypted And the public key PK used for encryption.
  • the specific encryption process is as follows:
  • Algorithm input k+1 model parameters a_0, a_1,..., a_k.
  • Algorithm output k+1 encryption model parameters c_0, c_1,..., c_k.
  • the data source 130 uses the homomorphic encrypted ciphertext model parameters to obtain the first ciphertext security evaluation index through calculation, and then calculates the first ciphertext security evaluation index.
  • the security evaluation index is transmitted to the data requester 110.
  • the calculation index may be, for example, using encrypted model parameters to calculate statistical indicators such as range and variance type according to homomorphic properties, so as to prevent the parameter of a certain feature in the model from being much larger than the parameters of other features. This parameter, which is much larger than other characteristic parameters, is likely to be a "malicious" parameter used to reverse the corresponding original value.
  • the algorithm is as follows:
  • the ciphertext (sample) variance index is:
  • Var_E HAdd(HSM(HAdd(HMul(c_0,c_0),HMul(c_1,c_1),...,HMul(c_k,c_k)),1/k),HSM(HMul(HAdd(c_0,c_1,...,c_k ),HAdd(c_0,c_1,...,c_k)),-1/(k*(k+1))).
  • step 650 the data source 130 compares the first ciphertext security evaluation index (generated in step 620) with the second ciphertext security evaluation index to determine their consistency, that is, compares Var_E with Var_E2.
  • the data requester 110 intends to maliciously extract the detailed data of the data source by falsifying model parameters
  • the falsification performed during decryption will inevitably lead to changes in the plaintext parameters of the plaintext security evaluation index, which in turn leads to changes based on the plaintext parameters.
  • the generated Var_E2 is inconsistent with the previously calculated Var_E. This inconsistency reveals that the data requester 110 fraudulently performed the decryption.
  • the data source 130 generates a corresponding model security assessment report based on the consistency.
  • a model security evaluation report indicating that the data model is safe can be provided;
  • a model security assessment report indicating that the data model is insecure for example, the data requester 110 may falsify during the decryption process
  • the data source 130 approves the model deployment request according to the model security assessment report, that is, if the model security assessment report indicates that the encrypted ciphertext model is secure, then approve the deployment of the ciphertext model, Otherwise, the deployment of the ciphertext model is rejected and a prompt of rejection of deployment may be returned to the data requester 110. After approval, the encrypted ciphertext model is deployed on the data source 130.
  • a comprehensive security level assessment report is provided, that is, in the process of generating the report, there may be multiple assessments, and then multiple first security assessment indicators and second ciphertexts are provided at the same time Security assessment indicators, through comprehensive consideration of the multiple comparison results of these first ciphertext security assessment indicators and the second ciphertext security assessment indicators (such as weighted summation, filtering the maximum and minimum differences, etc.), you can get more Accurate and comprehensive safety level assessment report.
  • the data source 130 may require the data requester 110 to send deployment requests multiple times at different times, and each time the deployment request is received, the encryption model parameters are calculated to generate the first security evaluation index to be sent to The data requester 110, and after receiving the plaintext security evaluation index decrypted by the data requester 110, uses the public key to encrypt the plaintext security evaluation index to generate a corresponding second ciphertext security evaluation index and compare it with the corresponding first ciphertext security evaluation index. A safety assessment index for comparison. Subsequently, the data source 130 synthesizes the results of each comparison and then generates a comprehensive security level assessment report. The synthesis may include giving an unsafe assessment when one of the multiple comparison results exceeds the threshold, or weighted average of all the results to obtain a total safety score to add to the report to feedback safety, and so on.
  • step 340 the data requester 110 decrypts the ciphertext parameters in the received ciphertext model security evaluation index to generate the plaintext security evaluation index, in the step of sending the plaintext security evaluation index to Before the security evaluator 120, the data demander can conduct an audit by comparing the decrypted variance Var with the Var calculated based on the plaintext to determine whether someone has modified an encryption score model parameter and then faked it to Var_E for the data demander 110 decrypted. Through the audit, such counterfeiting can be found to avoid leakage of model parameters.
  • a random number will be provided along with the public key to ensure that the same public key encrypts the same data under the same random number condition. Therefore, in the above-mentioned steps involving public keys, the processing of random numbers is actually included.
  • the "random number" is a common security method for asymmetric encryption.
  • the data source can replace the security evaluator to complete the generation and comparison of the first and second key security indicators and the generation of the model security evaluation report.
  • various potential safety hazards caused by the existence of the evaluator are further avoided, and the safety evaluation report is more credible. Therefore, it can also solve various deficiencies in traditional model security deployment solutions, and provide a more secure and robust model security deployment evaluation mechanism with improved performance.

Abstract

本公开提供了一种用于加密模型的安全性评估方案，所述方案包括：数据需求方设备向数据源方设备发送部署请求；数据源方设备将部署请求中的密文模型参数以及公钥转发给安全性评估方设备；安全性评估方设备利用密文模型参数通过计算得到第一密文安全评估指标并将其发送给数据需求方设备；数据需求方设备利用私钥解密第一密文安全评估指标以生成明文安全评估指标并将其转发给安全性评估方设备；安全性评估方设备利用公钥对明文安全评估指标进行加密以生成第二密文安全评估指标，比较第一密文安全评估指标与第二密文安全评估指标以确定它们的一致性来生成相应的模型安全评估报告，数据源方设备根据模型安全评估报告审批是否部署加密的数据模型。

Description

一种用于加密模型的安全性评估的方法和设备 技术领域
本公开涉及加密模型安全性领域，具体而言，涉及一种加密模型安全部署评估方案。
背景技术
随着互联网技术的不断发展和云计算概念的诞生，越来越多的公司和用户倾向于通过互联网来进行数据通信。由此，许多公司在自己的平台上建立起各种数据模型来处理来自各种源的各种类型的数据，所述处理包括：接收、计算、更新、存储、发送等各种数据操作。例如，一种被广泛使用的数据模型是机器学习模型，机器学习模型可通过模拟或实现人类的学习行为，来获取新的知识或技能，重新组织已有的知识结构，进而不断改善自身的性能。它是人工智能的核心，是计算机具有人工智能的关键技术，其应用遍及人工智能的各个领域。它主要使用数据的归纳、综合而不是演绎。数据模型可以分为未加密数据模型(明文数据模型)和加密数据模型(密文数据模型)。在部署数据模型时，需要评估模型的安全性。明文数据模型可以直接判断安全性，却不能保护数据需求方的隐私，而密文数据模型虽然能保护需求方的隐私，却使得要部署的数据源方难以直接评估模型的安全性。因此，存在对模型安全部署方案进行改进的需求，以便能够提供一种更加安全稳健的模型安全部署评估机制。
发明内容
本公开涉及一种加密模型安全部署评估方案，所述方案利用了同态加密技术实现对加密模型的安全性评估，因此，不存在泄露模型参数明文的风险。
根据本公开的第一方面，提供了一种用于加密模型的安全性评估的数据需求方设备，所述数据需求方设备被配置为：向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；从安全性评估方设备接收第一密文安全评估指标；以及利用与所述公钥相对应的私钥解密接收到的第一密文安全评估指标以生成明文安全评估指标并将所述明文安全评估指标转发给所述安全性评估方设备。
根据本公开的第二方面，提供了一种用于加密模型的安全性评估的数据源方设备， 所述数据源方设备被配置为：从数据需求方设备接收要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了被同态加密的密文模型参数以及所述同态加密所使用的公钥；将所述被同态加密的密文模型参数以及所述公钥转发给安全性评估方设备；以及从所述安全性评估方设备接收模型安全评估报告，并根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
根据本公开的第三方面，如第二方面所述的数据源方设备还被配置为：在将所述被同态加密的密文模型参数以及所述公钥转发给所述安全性评估方设备之前，打乱所述被同态加密的密文模型参数的顺序。
根据本公开的第四方面，提供了一种用于加密模型的安全性评估的安全性评估方设备，所述安全性评估方设备被配置为：接收从数据源方设备转发的由数据需求方设备提供的被同态加密的密文模型参数以及公钥；利用所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标并将所述第一密文安全评估指标发送给所述数据需求方设备；从所述数据需求方设备接收明文安全评估指标；利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标；比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告；以及将所述模型安全评估报告发送给所述数据源方设备。
根据本公开的第五方面，提供了一种用于加密模型的安全性评估的方法，所述方法包括：数据需求方设备向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；所述数据源方设备将所述被同态加密的密文模型参数以及所述公钥转发给安全性评估方设备；所述安全性评估方设备利用接收到的所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标，并将所述第一密文安全评估指标发送给所述数据需求方设备；所述数据需求方设备利用与所述公钥相对应的私钥解密接收到的所述第一密文安全评估指标以生成明文安全评估指标，并将所述明文安全评估指标转发给所述安全性评估方设备；所述安全性评估方设备利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标，比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告，再将所述模型安全评估报告发送给所述数据源方设备；以及所述数据源方设备根据接收到的所述模 型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
根据本公开的第六方面，如第五方面所述的方法还包括：在所述数据需求方设备向所述数据源方设备发送所述部署请求之前，已经利用来自各个源的数据作为模型特征来训练所述数据模型，并通过对所述模型参数进行同态加密得到加密数据模型。
根据本公开的第七方面，如第五方面所述的方法还包括：当发生多次评估时，通过对多个所述第一密文安全评估指标和第二密文安全评估指标的比较结果进行综合考虑来生成综合的模型安全评估报告。
根据本公开的第八方面，如第五方面所述的方法也可以在所述数据源方设备部署了所述经同态加密的数据模型之后被执行以用于评估所述数据需求方所提供的明文模型结果有没有反推所述数据源方的明细数据值的风险。
根据本公开的第九方面，如第五方面所述的方法还包括：在所述解密步骤中，在将所述明文安全评估指标发送给所述安全评估方之前，所述数据需求方可以通过将所述解密出的方差Var与根据明文算出的Var比较来进行审核以避免泄露模型参数
根据本公开的第十方面，如第五方面所述的方法还包括：随同所述公钥还提供了一个随机数以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。
根据本公开的第十一方面，提供了一种用于加密模型的安全性评估的数据需求方设备，所述数据需求方设备被配置为：向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；从所述数据源方设备接收第一密文安全评估指标；以及利用与所述公钥相对应的私钥解密接收到的第一密文安全评估指标以生成明文安全评估指标并将所述明文安全评估指标转发给所述数据源方设备。
根据本公开的第十二方面，提供了一种用于加密模型的安全性评估的数据源方设备，所述数据源方设备被配置为：从数据需求方设备接收要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了被同态加密的密文模型参数以及所述同态加密所使用的公钥；利用所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标并将所述第一密文安全评估指标发送给数据需求方设备；从所述数据需求方设备接收明文安全评估指标；利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标；比较所述第一密文安 全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告；以及根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
根据本公开的第十三方面，提供了一种用于加密模型的安全性评估的方法，所述方法包括：数据需求方设备向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；所述数据源方设备利用接收到的所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标并将所述第一密文安全评估指标发送给所述数据需求方设备；所述数据需求方设备利用与所述公钥相对应的私钥解密接收到的所述第一密文安全评估指标以生成明文安全评估指标，并将所述明文安全评估指标转发给所述数据源方设备；所述数据源方设备利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标，比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告；以及根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
根据本公开的第十四方面，如第十三方面所述的方法还包括：在所述数据需求方设备向所述数据源方设备发送所述部署请求之前，已经利用来自各个源的数据作为模型特征来训练所述数据模型，并通过对所述模型参数进行同态加密得到加密数据模型。
根据本公开的第十五方面，如第十三方面所述的方法还包括：当发生多次评估时，通过对多个所述第一密文安全评估指标和第二密文安全评估指标的比较结果进行综合考虑来生成综合的模型安全评估报告。
根据本公开的第十六方面，如第十三方面所述的方法也可以在所述数据源方设备部署了所述经同态加密的数据模型之后被执行以用于评估所述数据需求方所提供的明文模型结果有没有反推所述数据源方的明细数据值的风险。
根据本公开的第十七方面，如第十三方面所述的方法包括：随同所述公钥还提供了一个随机数以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。
提供本概述以便以简化的形式介绍以下在详细描述中进一步描述的一些概念。本概述并不旨在标识所要求保护主题的关键特征或必要特征，也不旨在用于限制所要求保护主题的范围。
附图说明
为了描述可获得本公开的上述和其它优点和特征的方式，将通过参考附图中示出的本公开的具体实施例来呈现以上简要描述的本公开的更具体描述。可以理解，这些附图只描绘了本公开的各典型实施例，并且因此不被认为是对其范围的限制，将通过使用附图并利用附加特征和细节来描述和解释本公开，在附图中：
图1示出了本公开的一个示例性运行计算环境。
图2是根据本公开的一个实施例的加密模型安全部署评估方案。
图3根据本公开的一个实施例的加密模型安全部署评估方法的流程图。
图4示出了本公开的另一个示例性运行计算环境。
图5是根据本公开的另一个实施例的加密模型安全部署评估方案。
图6根据本公开的另一个实施例的加密模型安全部署评估方法的流程图。
具体实施方式
首先，为了解决在部署数据模型时的安全性和隐私之间的矛盾，在传统模型安全部署方案中，在部署加密数据模型之前，提供了可信评估方作为第三方评估机构来审批所述要部署的加密数据模型是否安全，它可以从数据需求方获取明文模型参数，然后，在基于该明文模型参数计算出模型安全性评估指标后，就向数据源方输出模型参数安全性评估报告。数据源方根据该安全性评估报告来判断模型安全性并决定是否将其部署在本地。
但是，这种传统的评估方案存在很大的缺陷，即其方案是建立在假定可信评估方是完全可以信任的第三方的基础上，但在现实世界中，即使并非第三方刻意为之，但总是有各种入侵者试图利用各种漏洞或后门攻破可信第三方的安全壁垒来盗取各种有价值的数据。由于数据需求方将模型参数以明文方式传送给可信评估方以计算模型安全性评估指标，因此，一旦可信评估方被攻破(例如被植入木马程序)，则所述明文模型参数很有可能被木马程序偷偷地传送给入侵者，从而导致数据需求方的模型明文在无人察觉的情况下被暴露给入侵者。
或者，在另一种情况下，假如评估方实际上和数据源方形成共谋，以将数据需求方的模型参数明文泄露给数据源方(这种泄露对于正常状态下的可信评估方来说是绝对禁 止的，但不能排除可信评估方中的内部工作人员的私下共谋行为的存在可能性)，则数据需求方的加密模型明文也会暴露给数据源方。无论是上述哪种情况，都将使得数据需求方的模型安全性受到严重的威胁。所以，传统模型安全部署方案并不能很好地解决模型安全部署的问题。
而另一方面，随着互联网的发展和云计算概念的诞生，以及人们在密文搜索、电子投票、移动代码和多方计算等方面的需求日益增加，同态加密(Homomorphic Encryption)变得更加重要。同态加密是一类具有特殊自然属性的加密方法，它是一种基于数学难题的计算复杂性理论的密码学技术。对经过同态加密的数据进行处理得到一个输出，将这一输出进行解密，其结果与用同一方法处理未加密的原始数据得到的输出结果是一样的。与一般加密算法相比，同态加密除了能实现基本的加密操作之外，还能实现密文间的多种计算功能，即先计算后解密可等价于先解密后计算。本质上，同态加密是指这样一种加密函数：对明文进行环上的加法和乘法运算再加密，与加密后对密文进行相应的运算，结果是等价的。正是同态加密这种特殊自然属性，使得要彻底解决部署数据模型时的安全性和隐私之间的矛盾变得可能。
在具体介绍本公开的方案之前，首先对同态加密的具体算法加以说明，以帮助技术人员清楚认识到同态算法的所述特殊自然属性。
具有同态性质的加密函数是指两个明文a、b满足
Figure PCTCN2020071605-appb-000001
的加密函数，其中En是加密运算，Dec是解密运算，⊙、
Figure PCTCN2020071605-appb-000002
分别对应明文和密文域上的运算。当
Figure PCTCN2020071605-appb-000003
代表加法时，称该加密为加同态加密：当⊙代表乘法时，称该加密为乘同态加密。而全同态加密是指同时满足加同态和乘同态性质，可以进行任意多次加和乘运算的加密函数。用数学公式来表达，即Dec(f(En(m1)，En(m2)，…，En(mk)))＝f(m1，m2，…，mk)，或写成：f(En(m1)，En(m2)，…，En(mk))＝En(f(m1，m2，…，mk))，如果f是任意函数，称为全同态加密。
为了便于理解，下面对最常用的同态加密算法加以说明。最常用的同态加密算法有加法同态Paillier算法、乘法同态Elgamal算法、基于LWE的全同态算法。下面给出同态加密算法的定义。
令加密运算为c＝E(PK,m)，解密运算为m＝D(SK,d)。其中，m为明文，c为密文，SK为加密密钥，E(,)为加密函数,D(,)为解密函数。
加法同态加密算法性质：可实现如下的加法同态运算，还可以利用多次加法同态运 算实现数乘同态运算。
加法同态运算：HAdd(c1,c2)
给定明文m1和m2的密文c1和c2，即c1＝E(PK,m1)，c2＝E(PK,m2)。对c1和c2计算可得到m1+m2的密文，即有下式成立：
HAdd(c1,c2)＝E(PK,m1+m2)
数乘同态运算：HSM(c1,m2)
给定明文m1的密文c1和明文m2，对c1执行m2次HAdd(,)运算可以得到m1×m2的密文。例如，当m2＝3时，有下式成立：
HSM(c1,m2)＝HAdd(c1,HAdd(c1,HAdd(c1,c1)))＝E(PK,m1×m2)
乘法同态加密算法性质：可实现如下的乘法同态运算：
乘法同态运算：HMul(c1,c2)
给定明文m1和m2的密文c1和c2，即c1＝E(PK,m1)，c2＝E(PK,m2)。对c1和c2计算可得到m1×m2的密文，即有下式成立：
HMul(c1,c2)＝E(PK,m1×m2)。
由此可见，在上式中，对明文进行环上的加法和乘法运算再加密，与加密后对密文进行相应的运算，其结果都是等价的。利用这个特殊自然属性，有助于解决部署数据模型时的安全性和隐私之间的矛盾。上述算法公式都是同态加密领域的基本知识，在此不再进一步详细描述。
在了解了同态加密的基本算法和含义之后，为使本公开的目的、技术方案及优点更加清楚明白，以下参照附图并例举实施例，对本公开作进一步详细说明。
首先，在图1中示出了本公开的一个实施例的一个示例性运行计算环境。在图1所示的计算环境中，包含了数据需求方设备110(简称为“数据需求方110”)、安全性评估方设备120(简称为“安全性评估方120”)以及数据源方设备130(简称为“数据源方130”)这三方。所述数据需求方、安全性评估方以及数据源方可以由安全计算节点，例如个人计算机、服务器、客户端、移动设备(例如手机、个人数字助理、平板等)以及各种计算设备等构成。在所述各方之间，通过网络进行数据通信，所述网络包括各种类型的有线和无线网络，包括但不局限于互联网、局域网、WIFI、WLAN、蜂窝通信网络(GPRS、CDMA、2G/3G/4G/5G蜂窝网络)、卫星通信网络等等。通过所述数据通信 网络，数据需求方、安全性评估方以及数据源方可以相互传送各种数据以供处理。在如图2所示的本公开的一个实施例中的加密模型安全部署评估方案中，就涉及在这三方之间的数据交换。而在另一个实施例中，所述方案可以仅仅涉及数据需求方110和数据源方130这两者，该方案在图4和5中有详细描述。
在描述了图1的本公开的一个实施例的示例性运行计算环境之后，接着，结合所述运行计算环境来描述一种利用同态加密来更加安全稳健的模型安全部署评估机制。如图2所示，示出了一种在数据需求方110、安全性评估方120以及数据源方130这三方之间实现的模型安全部署评估的整体方案。首先，数据需求方110向数据源方130发送要将数据模型(例如训练好的机器学习模型)经过同态加密后部署在数据源方130上的部署请求，在所述部署请求中包含了基于所述数据模型的明文参数被同态加密的密文模型参数以及加密所使用的公钥。在发起所述部署请求之前，数据需求方110已经利用来自各个源的数据作为模型特征来训练出数据模型，并用公钥对所述数据模型的模型参数进行同态加密后得到了加密数据模型(密文模型)。注意，在各实施例中，是以线性回归模型作为机器学习模型的一个示例来进行描述，但应该理解所述数据模型并不局限于线性回归模型，而是可以应用于各种类型的数据模型，例如模型结果为预测概率值的其他密文模型，如逻辑回归、回归决策树等数据模型。在本公开的上下文中，原始的数据模型也被称为“明文模型”，而经同态加密后的数据模型也被称为“密文模型”。在接收到来自数据需求方110的包含经同态加密的密文模型参数和公钥的请求之后，数据源方130将经同态加密的密文模型参数的顺序打乱，随后，将被打乱顺序的经同态加密的密文模型参数与所述公钥一起传送给安全性评估方120或直接将经同态加密的密文模型参数和公钥一起传送给安全性评估方120。所述安全性评估方120在获取经同态加密的密文模型参数和公钥后，利用该经同态加密的密文模型参数通过计算得到第一密文安全评估指标(在本实施例中以方差计算为例)，并将该第一密文安全评估指标传送给数据需求方110。数据需求方110利用与所述公钥相对应的私钥解密接收到的第一密文安全评估指标以生成明文安全评估指标，接着将明文安全评估指标回传给安全评估方120。安全评估方120利用先前由数据需求方110提供的公钥对接收到的明文安全评估指标进行加密以生成第二密文安全评估指标，并将所述第二密文安全评估指标与第一密文安全评估指标进行比较以确定它们的一致性。接着，安全评估方120根据所述一致性生成相应的模型安全评估报告并将其返回给数据源方130以供其参考。其中，当第一密文安全评估指标与第二密文安全评估指标一致时，可以提供所述密文模型是安全的模型安全评估报告，反之，当第一密文安全评估指标与第二密文安全评估指标不一致时，可以提供所述 密文模型是不安全(例如数据需求方110可能在解密过程中造假)的模型安全评估报告。在接收到来自安全评估方120的模型安全评估报告之后，数据源方130根据模型安全评估报告审批所述模型部署请求，即如果模型安全评估报告指示所述密文模型是安全的则批准部署所述密文模型，否则拒绝部署该密文模型并可向数据需求方110返回拒绝部署的提示。当审批批准后，在数据源方130上部署所述经加密的密文模型。至此，所述方案结束。
在本公开的所述方案中，安全评估方只能拿到密文形式下的密文模型参数，因此，没有从其泄露出模型参数明文的风险；同时，数据需求方在将第一密文安全评估指标解密成明文安全评估指标之后，不是直接将明文安全评估指标发送给数据源方，而是先由安全评估方对数据需求方解密之前和之后的两份安全评估指标进行校验后生成模型安全评估报告，再将该报告返回给数据源方，从而防止了数据需求方在解密过程中造假(如果数据需求方提供的是加密密文指标则根据同态加密技术的特点，在安全评估方处对第一和第二这两份密文安全评估指标的比较就不可能一致)。由此可见，本公开的加密模型安全部署评估方案解决了传统模型安全部署方案中所存在的各种缺陷，提供了具有改进性能的更加安全稳健的模型安全部署评估机制。
在了解了本公开的加密模型安全部署评估方案的概况之后，在图3中示出了根据本公开的一个实施例的利用同态加密的模型安全部署评估方法的流程图。所述流程图与图2所示的评估方案相对应。该流程图同样涉及在数据需求方110、安全性评估方120以及数据源方130这三者之间的数据流动。
首先，在步骤310，数据需求方110生成同态加密的加密密钥(公钥PK)和解密密钥(私钥SK)，对模型参数进行同态加密以生成加密数据模型，随后，向数据源方130发送要将经过同态加密后的数据模型部署在数据源方130上的部署请求，在所述部署请求中包含了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥PK。具体的模型加密过程如下：
算法输入：k+1个模型参数a_0,a_1,…,a_k。
算法过程：c_0＝E(PK,a_0),c_1＝E(PK,a_1),…,c_k＝E(PK,a_k)。
算法输出：k+1个加密模型参数c_0,c_1,…,c_k。
其中，应该理解上述算法示例仅仅是出于说明目的的简单加密过程的演示。实际上，根据非对称加密技术的特点，出于安全性考虑，采用非对称加密时，随同所述公钥还会 提供一个随机数给数据评估方，以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。“随机数”是非对称加密的常用安全手段，与本公开本身的关系不大，因此，不再在此深入展开。
随后，在步骤320，在接收到所述部署请求之后，数据源方130将经同态加密的密文模型参数(即c_0,c_1,…,c_k，其顺序可以被打乱)和公钥(即PK)一起传送给安全性评估方120。
接着，在步骤330，所述安全性评估方120在获取经同态加密的密文模型参数和公钥后，利用该经同态加密的密文模型参数通过计算得到第一密文安全评估指标，并将该第一密文安全评估指标传送给数据需求方110。在本公开中，“安全性评估指标”是指根据同态性质利用加密模型参数计算出的方差(var)或极差之类的统计指标。使用所述统计指标可以防止出现模型中某个特征的参数远大于其他特征的参数的情况。这种远大于其他特征的参数的参数很可能是用于反推其对应的原始值的“恶意”参数。因此，通过方差计算，可以使得可能的“恶意”参数彻底失去作用。在本实施例中通过对经同态加密的密文模型参数执行方差计算来作为计算安全性评估指标的一个示例，其算法如下：
算法输入：k+1个加密模型参数c_0,c_1,…,c_k。
算法过程：密文(样本)方差指标为：
Var_E＝HAdd(HSM(HAdd(HMul(c_0,c_0),HMul(c_1,c_1),…,HMul(c_k,c_k)),1/k),HSM(HMul(HAdd(c_0,c_1,…,c_k),HAdd(c_0,c_1,…,c_k)),-1/(k*(k+1)))。
其中，如前所述，HAdd()表示加法同态运算，HSM()表示数乘同态运算，而HMul()表示乘法同态运算。
在步骤340，数据需求方110利用与所述公钥相对应的私钥SK解密接收到的第一密文模型安全评估指标中的密文参数以生成明文安全评估指标(Var＝D(SK,Var_E)并将该明文安全评估指标发给安全性评估方120。
在步骤350，安全评估方120利用由数据需求方110提供的公钥PK对接收到的明文安全评估指标进行加密以生成第二密文安全评估指标：
Var_E2＝E(PK,Var)。
其中，如前所述，Var表示方差，E(,)为加密函数,D(,)为解密函数，SK为私钥，而PK为公钥。
在步骤360，安全评估方120将(步骤330生成的)所述第一密文安全评估指标与第二密文安全评估指标进行比较以确定它们的一致性，即将Var_E与Var_E2进行比较。其中，如果数据需求方110是意图通过造假模型参数来恶意套取数据源方的明细数据，则在数据需求方110用私钥SK解密时造假的模型参数必然导致所生成的明文安全评估指标的明文参数发生变化，进而导致在安全评估方120处基于所述明文参数加密生成的Var_E2与Var_E不一致。这种不一致性，揭示了数据需求方110在步骤340解密时进行了造假。
在步骤370，安全评估方120基于所述一致性生成相应的模型安全评估报告并将其返回给数据源方130以供其参考。其中，当第一密文安全评估指标与第二密文安全评估指标一致时，可以提供所述数据模型是安全的模型安全评估报告，反之，当第一密文安全评估指标与第二密文安全评估指标不一致时，可以提供所述数据模型是不安全(例如数据需求方110可能在解密过程中造假)的模型安全评估报告。
最后，在步骤380，数据源方130根据接收到的模型安全评估报告，审批所述模型部署请求，即如果模型安全评估报告指示所述加密密文模型是安全的则批准部署所述密文模型，否则拒绝部署所述密文模型并可向数据需求方110返回拒绝部署的提示。当批准部署后，在数据源方130上部署所述加密的密文模型。
至此，所述评估方法的整个流程结束。需要理解的是，本公开所涉及的同态加密和解密算法利用了常用的同态加密解密算法中的一些参数、函数和算式。这些参数、函数和算式都是同态加密的基本常识，因此，不再在此过多描述。上述示例算法仅仅是为了说明性目的提供的，并不是要把本公开的同态加密、解密以及计算局限于上述算法。实际上，技术人员可以根据实际需要选择其他任何合适的同态加密和解密和计算算法。
在一个改进实施例中，在步骤330中基于经同态加密的密文模型参数生成方差Var_E之后，还可以将该方差与设定的一个阈值进行比较，如果所述方差超过该阈值则判定为不安全，因为所述模型参数可能是用来攻击模型的造假参数。
在一个改进的实施例中，提供了一种综合的安全等级评估报告，即在该报告的生成过程中，可以存在多次评估，进而同时提供了多个第一安全评估指标和第二密文安全评估指标，通过对这些第一密文安全评估指标和第二密文安全评估指标的比较结果进行综合考虑(例如评分)之后，就能获得更加准确的综合的安全等级评估报告。具体而言，数据源方130可以要求数据需求方110在不同的时间多次发送部署请求，并将每次部署请求中的加密模型参数和公钥发送给安全评估方120。同样，安全评估方120也在每次 对加密模型参数进行计算生成第一安全评估指标后将该第一安全评估指标发送给数据需求方110，并在接收到经数据需求方110解密后的明文安全评估指标后使用公钥对所述明文安全评估指标进行加密以生成相应的第二密文安全评估指标并与相应的第一安全评估指标进行比较。随后，综合每次比较后的结果再生成综合的安全等级评估报告。所述综合可以包括当多次比较结果中有一次结果超过阈值就给出不安全的评估，或者对所有结果进行加权平均后获得一个总的安全评分分数加入报告中以反馈给数据源方130，等等。在另一个改进的实施例中，在步骤340的数据需求方110解密接收到的密文模型安全评估指标中的密文参数以生成明文安全评估指标的步骤中，在将明文安全评估指标发送给安全评估方120之前，数据需求方可以通过将所述解密出的方差Var与根据明文算出的Var比较来进行审核，以确定是否有人将一个加密的模型参数变型后假冒成Var_E让数据需求方110解密。通过所述审核，可以发现这种假冒行为以避免泄露模型参数。
在其它实施例中，所述模型安全性评估方案还可以用于在加密数据模型被部署到数据源方之后的模型结果评估中，以评估数据需求方110所提供的明文模型结果有没有反推数据源方的明细数据值的风险。在数据源方存储有大量有价值的数据，因此，如果数据需求方110所提供的数据模型所提供的明文模型结果可以轻易推算出数据源方输入的明细数据值，则说明数据需求方110可能设定了特定的模型参数来进行反推。因此，可以使用本公开的模型安全性评估方案对已部署的加密数据模型进行审计以确定是否存在反推风险。由于其过程类似，不再在此详细陈述。
另外，如前所述，在非对称加密过程中，随同所述公钥还会提供一个随机数，以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。因此，在上述涉及公钥的步骤中，实际上还包含了随机数的处理。但所述“随机数”是非对称加密的常用安全手段
上面主要描述的是在数据需求方、安全性评估方以及数据源方这三方之间的模型安全部署评估机制。而根据本公开的另一个实施例，也提供了一种利用同态加密来更加安全稳健的模型安全部署评估机制。如图4所示，示出了一种在无需安全性评估方的情况下，在数据需求方110以及数据源方130这两方之间实现的模型安全部署评估的示例性运行环境。在该示例性运行环境中，数据需求方110以及数据源方130通过网络直接双向通信，而不需要安全性评估方的参与。
而在图5中示出了根据本公开的另一个实施例的加密模型安全部署评估方案。
首先，数据需求方110向数据源方130发送要将数据模型(例如训练好的机器学习 模型)经过同态加密后部署在数据源方130上的部署请求，在所述部署请求中包含了基于所述数据模型的明文参数被同态加密的密文模型参数以及加密所使用的公钥。在接收到来自数据需求方110的包含经同态加密的密文模型参数和公钥的请求之后，数据源方130利用该经同态加密的密文模型参数通过计算得到第一密文安全评估指标，并将该第一密文安全评估指标传送给数据需求方110。数据需求方110利用与所述公钥相对应的私钥解密接收到的密文模型安全评估指标以生成明文安全评估指标，接着将明文安全评估指标回传给数据源方130。数据源方130利用先前由数据需求方110提供的公钥对接收到的明文安全评估指标进行加密以生成第二密文安全评估指标，并将所述第二密文安全评估指标与第一密文安全评估指标进行比较以确定它们的一致性。接着，数据源方130根据所述一致性生成相应的模型安全评估报告。其中，当第一密文安全评估指标与第二密文安全评估指标一致时，可以提供所述数据模型是安全的模型安全评估报告，反之，当第一密文安全评估指标与第二密文安全评估指标不一致时，可以提供所述数据模型是不安全(例如数据需求方110可能在解密过程中造假)的模型安全评估报告。然后，数据源方130根据模型安全评估报告审批所述模型部署请求，即如果模型安全评估报告指示所述加密密文模型是安全的则批准部署所述密文模型，否则拒绝部署所述密文模型并可向数据需求方110返回拒绝部署的提示。当审批批准后，在数据源方130上部署所述加密的密文模型。至此，所述方案结束。
所述模型安全评估报告的生成方便了对其进行存档以备将来使用，也即如果所述模型安全评估报告显示来自所述数据需求方110的数据模型是不安全的，则在今后再收到来自同一数据需求方110的后续部署请求后，可以直接查阅所存储的先前生成的与该数据需求方110相关联的模型安全评估报告来直接拒绝来自该数据需求方110的后续部署请求以节省资源。
因此，在一个实施例中，也可以跳过所述安全评估报告生成的步骤，而直接根据第一密文安全评估指标与第二密文安全评估指标的比较结果来审批所述模型部署请求，即如果第一密文安全评估指标与第二密文安全评估指标的比较结果为一致，则批准部署所述密文模型，反之，如果比较结果不一致，则拒绝部署所述密文模型。
在本公开的所述方案中，数据源方130只能拿到密文形式下的模型参数，因此，没有泄露模型参数明文的风险；同时数据需求方110在对第一密文安全评估指标解密之后，由数据源方130通过利用公钥对明文安全评估指标进行加密以生成第二密文安全评估指标并对数据需求方解密前和后的这两份安全评估指标进行校验后生成模型安全评估报 告，从而防止了数据需求方在解密过程中造假(如果提供的是造假指标则根据同态加密技术的特点，这两份密文安全评估指标不可能一致)。由此可见，本公开的加密模型安全部署评估方案解决了传统模型安全部署方案中所存在的各种缺陷，提供了具有改进性能的更加安全稳健的模型安全部署评估机制。
在了解了本公开的另一个实施例的加密模型安全部署评估方案的概况之后，在图6中示出了根据本公开的该另一个实施例的利用同态加密的模型安全部署评估方法的流程图。所述流程图涉及在数据需求方110以及数据源方130这两者之间的数据流动。其中与图3相类似的内容、定义和描述不再详述。
首先，在步骤610，数据需求方110生成同态加密的加密密钥(公钥PK)和解密密钥(私钥SK)，对模型参数进行同态加密以生成加密数据模型，随后，向数据源方130发送要将经过同态加密后的数据模型部署在数据源方130上的部署请求，在所述部署请求中包含了基于所述数据模型的明文参数被同态加密的密文模型参数以及加密所使用的公钥PK。具体的加密过程如下：
算法输入：k+1个模型参数a_0,a_1,…,a_k。
算法过程：c_0＝E(PK,a_0),c_1＝E(PK,a_1),…,c_k＝E(PK,a_k)。
算法输出：k+1个加密模型参数c_0,c_1,…,c_k。
随后，在步骤620，所述数据源方130在接收到所述部署请求之后，利用该经同态加密的密文模型参数通过计算得到第一密文安全评估指标，并将该第一密文安全评估指标传送给数据需求方110。所述计算指标可以是例如根据同态性质利用加密模型参数计算极差、方差类型之类的统计指标，以防止模型中某个特征的参数远大于其他特征的参数。这种远大于其他特征的参数的参数很可能是用于反推其对应的原始值的“恶意”参数。以方差为例，其算法如下：
算法输入：k+1个加密模型参数c_0,c_1,…,c_k。
算法过程：密文(样本)方差指标为：
Var_E＝HAdd(HSM(HAdd(HMul(c_0,c_0),HMul(c_1,c_1),…,HMul(c_k,c_k)),1/k),HSM(HMul(HAdd(c_0,c_1,…,c_k),HAdd(c_0,c_1,…,c_k)),-1/(k*(k+1)))。
在步骤630，数据需求方110利用与所述公钥相对应的私钥SK解密接收到的第一密文模型安全评估指标中的密文参数以生成明文安全评估指标(Var＝D(SK,Var_E)并将该明文安全评估指标返回给数据源方130。
在步骤640，所述数据源方130利用由数据需求方110提供的公钥PK对接收到的明文安全评估指标进行加密以生成第二密文安全评估指标Var_E2＝E(PK,Var)。
在步骤650，数据源方130将(在步骤620生成的)所述第一密文安全评估指标与第二密文安全评估指标进行比较以确定它们的一致性，即将Var_E与Var_E2进行比较。其中，如果数据需求方110是意图通过造假模型参数来恶意套取数据源方的明细数据，则在解密时进行的造假必然导致明文安全评估指标的明文参数发生变化，进而导致基于所述明文参数生成的Var_E2与先前计算的Var_E不一致。这种不一致性，揭示了数据需求方110在解密时进行了造假。
在步骤660，数据源方130基于所述一致性生成相应的模型安全评估报告。其中，当第一密文安全评估指标与第二密文安全评估指标一致时，可以提供所述数据模型是安全的模型安全评估报告，反之，当第一密文安全评估指标与第二密文安全评估指标不一致时，可以提供所述数据模型是不安全(例如数据需求方110可能在解密过程中造假)的模型安全评估报告。
最后，在步骤670，数据源方130根据所述模型安全评估报告，审批所述模型部署请求，即如果模型安全评估报告指示所述加密密文模型是安全的则批准部署所述密文模型，否则拒绝部署所述密文模型并可向数据需求方110返回拒绝部署的提示。当审批批准后，在数据源方130上部署所述加密的密文模型。
在一个改进的实施例中，提供了一种综合的安全等级评估报告，即在该报告的生成过程中，可以存在多次评估，进而同时提供了多个第一安全评估指标和第二密文安全评估指标，通过对这些第一密文安全评估指标和第二密文安全评估指标的多次比较结果进行综合考虑(例如进行加权求和，过滤最大和最小差异等等)，就能获得更加准确的综合的安全等级评估报告。具体而言，数据源方130可以要求数据需求方110在不同的时间多次发送部署请求，并在每次接收到部署请求时，都对加密模型参数进行计算生成第一安全评估指标以发送给数据需求方110，并在接收到经数据需求方110解密后的明文安全评估指标后使用公钥对所述明文安全评估指标进行加密以生成相应的第二密文安全评估指标并与相应的第一安全评估指标进行比较。随后，数据源方130综合每次比较后的结果再生成综合的安全等级评估报告。所述综合可以包括当多次比较结果中有一次结果超过阈值就给出不安全的评估，或者对所有结果进行加权平均后获得一个总的安全评分分数加入报告中以反馈安全性，等等。
在另一个改进的实施例中，在步骤340的数据需求方110解密接收到的密文模型安 全评估指标中的密文参数以生成明文安全评估指标的步骤中，在将明文安全评估指标发送给安全评估方120之前，数据需求方可以通过将所述解密出的方差Var与根据明文算出的Var比较来进行审核，以确定是否是否有人将一个加密得分模型参数变型后假冒成Var_E让数据需求方110解密。通过所述审核，可以发现这种假冒行为以避免泄露模型参数。
另外，如前所述，在非对称加密过程中，随同所述公钥还会提供一个随机数，以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。因此，在上述涉及公钥的步骤中，实际上还包含了随机数的处理。但所述“随机数”是非对称加密的常用安全手段。
在上述另一个实施例中，数据源方可以取代安全评估方来完成第一和第二密钥安全指标的生成、比较以及模型安全评估报告的生成。这样，进一步避免了评估方的存在可能带来的各种安全性隐患，使得所述安全评估报告更加可信。因此，其也能解决传统模型安全部署方案中所存在的各种缺陷，并提供具有改进性能的更加安全稳健的模型安全部署评估机制。
虽然以上描述了不同的实施例，但应当理解的是它们只是作为示例而非限制。(诸)相关领域的技术人员将领会，在不偏离如所附权利要求书所定义的本公开的精神和范围的情况下，可以在形式和细节方面进行各种修改。因此，此处所公开的本公开的宽度和范围不应被上述所公开的示例性实施例所限制，而应当仅根据所附权利要求书及其等同替换来定义。

Claims (17)

  1. 一种用于加密模型的安全性评估的数据需求方设备，其特征在于，所述数据需求方设备被配置为：
    向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    从安全性评估方设备接收第一密文安全评估指标；以及
    利用与所述公钥相对应的私钥解密接收到的所述第一密文安全评估指标以生成明文安全评估指标并将所述明文安全评估指标转发给所述安全性评估方设备。
  2. 一种用于加密模型的安全性评估的数据源方设备，其特征在于，所述数据源方设备被配置为：
    从数据需求方设备接收要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    将所述被同态加密的密文模型参数以及所述公钥转发给安全性评估方设备；以及
    从所述安全性评估方设备接收模型安全评估报告，并根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的所述经同态加密的数据模型。
  3. 如权利要求2所述的所述数据源方设备，其特征在于，所述数据源方设备还被配置为：
    在将所述被同态加密的密文模型参数以及所述公钥转发给所述安全性评估方设备之前，打乱所述被同态加密的密文模型参数的顺序。
  4. 一种用于加密模型的安全性评估的安全性评估方设备，其特征在于，所述安全性评估方设备被配置为：
    接收从数据源方设备转发的由数据需求方设备提供的被同态加密的密文模型参数以及公钥；
    利用所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标并将所述第一密文安全评估指标发送给所述数据需求方设备；
    从所述数据需求方设备接收明文安全评估指标；
    利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标；
    比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致 性，并基于所述一致性生成相应的模型安全评估报告；以及
    将所述模型安全评估报告发送给所述数据源方设备。
  5. 一种用于加密模型的安全性评估的方法，其特征在于，所述方法包括：
    数据需求方设备向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    所述数据源方设备将所述被同态加密的密文模型参数以及所述公钥转发给安全性评估方设备；
    所述安全性评估方设备利用接收到的所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标，并将所述第一密文安全评估指标发送给所述数据需求方设备；
    所述数据需求方设备利用与所述公钥相对应的私钥解密接收到的所述第一密文安全评估指标以生成明文安全评估指标，并将所述明文安全评估指标转发给所述安全性评估方设备；
    所述安全性评估方设备利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标，比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告，再将所述模型安全评估报告发送给所述数据源方设备；以及
    所述数据源方设备根据接收到的所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
  6. 如权利要求5所述的方法，其特征在于，所述方法还包括：
    在所述数据需求方设备向所述数据源方设备发送所述部署请求之前，已经利用来自各个源的数据作为模型特征来训练所述数据模型，并通过对所述模型参数进行同态加密得到加密数据模型。
  7. 如权利要求5所述的方法，其特征在于，所述方法还包括：
    当发生多次评估时，通过对多个所述第一密文安全评估指标和第二密文安全评估指标的比较结果进行综合考虑来生成综合的模型安全评估报告。
  8. 如权利要求5所述的方法，其特征在于，所述方法也可以在所述数据源方设备部署了所述经同态加密的数据模型之后被执行以用于评估数据需求方所提供的明文模型结果有没有反推所述数据源方的明细数据值的风险。
  9. 如权利要求5所述的方法，其特征在于，在所述解密步骤中，在将所述明文安全 评估指标发送给所述安全评估方之前，所述数据需求方可以通过将所述解密出的方差Var与根据明文算出的Var比较来进行审核以避免泄露模型参数。
  10. 如权利要求5所述的方法，其特征在于，随同所述公钥还提供了一个随机数以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。
  11. 一种用于加密模型的安全性评估的数据需求方设备，其特征在于，所述数据需求方设备被配置为：
    向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    从所述数据源方设备接收第一密文安全评估指标；以及
    利用与所述公钥相对应的私钥解密接收到的第一密文安全评估指标以生成明文安全评估指标并将所述明文安全评估指标转发给所述数据源方设备。
  12. 一种用于加密模型的安全性评估的数据源方设备，其特征在于，所述数据源方设备被配置为：
    从数据需求方设备接收要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    利用所述被同态加密的密文模型参数通过计算得到第一密文安全评估指标并将所述第一密文安全评估指标发送给数据需求方设备；
    从所述数据需求方设备接收明文安全评估指标；
    利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标；
    比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告；以及
    根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
  13. 一种用于加密模型的安全性评估的方法，其特征在于，所述方法包括：
    数据需求方设备向数据源方设备发送要将经同态加密的数据模型部署在所述数据源方设备上的部署请求，所述部署请求包括了基于所述数据模型的明文参数被同态加密的密文模型参数以及所述同态加密所使用的公钥；
    所述数据源方设备利用接收到的所述被同态加密的密文模型参数通过计算得到第 一密文安全评估指标并将所述第一密文安全评估指标发送给所述数据需求方设备；
    所述数据需求方设备利用与所述公钥相对应的私钥解密接收到的所述第一密文安全评估指标以生成明文安全评估指标，并将所述明文安全评估指标转发给所述数据源方设备；
    所述数据源方设备利用由所述数据需求方设备提供的所述公钥对接收到的所述明文安全评估指标进行加密以生成第二密文安全评估指标，比较所述第一密文安全评估指标与所述第二密文安全评估指标以确定它们的一致性，并基于所述一致性生成相应的模型安全评估报告；以及根据所述模型安全评估报告审批是否部署所述数据需求方设备提供的经同态加密的数据模型。
  14. 如权利要求13所述的方法，其特征在于，所述方法还包括：
    在所述数据需求方设备向所述数据源方设备发送所述部署请求之前，已经利用来自各个源的数据作为模型特征来训练所述数据模型，并通过对所述模型参数进行同态加密得到加密数据模型。
  15. 如权利要求13所述的方法，其特征在于，所述方法还包括：
    当发生多次评估时，通过对多个所述第一密文安全评估指标和第二密文安全评估指标的比较结果进行综合考虑来生成综合的模型安全评估报告。
  16. 如权利要求13所述的方法，其特征在于，所述方法也可以在所述数据源方设备部署了所述经同态加密的数据模型之后被执行以用于评估数据需求方所提供的明文模型结果有没有反推所述数据源方的明细数据值的风险。
  17. 如权利要求13所述的方法，其特征在于，随同所述公钥还提供了一个随机数以保证在相同随机数条件下相同公钥对同一个数据加密结果一致。
PCT/CN2020/071605 2019-04-30 2020-01-12 一种用于加密模型的安全性评估的方法和设备 WO2020220754A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/836,725 US11228423B2 (en) 2020-01-12 2020-03-31 Method and device for security assessment of encryption models

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910365011.2 2019-04-30
CN201910365011.2A CN110113203B (zh) 2019-04-30 2019-04-30 一种用于加密模型的安全性评估的方法和设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/836,725 Continuation US11228423B2 (en) 2020-01-12 2020-03-31 Method and device for security assessment of encryption models

Publications (1)

Publication Number Publication Date
WO2020220754A1 true WO2020220754A1 (zh) 2020-11-05

Family

ID=67487956

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/071605 WO2020220754A1 (zh) 2019-04-30 2020-01-12 一种用于加密模型的安全性评估的方法和设备

Country Status (2)

Country Link
CN (1) CN110113203B (zh)
WO (1) WO2020220754A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205155A (zh) * 2021-12-07 2022-03-18 四川启睿克科技有限公司 一种基于安全多方计算的供应商风险评估系统及方法

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110113203B (zh) * 2019-04-30 2021-10-22 创新先进技术有限公司 一种用于加密模型的安全性评估的方法和设备
CN110620671B (zh) * 2019-08-30 2024-04-09 厦门一通灵信息科技有限公司 加密算法测评方法、介质、设备及装置
CN111242453B (zh) * 2020-01-07 2023-10-24 通链(北京)科技有限公司 基于区块链的财务评估方法及评估系统
US11228423B2 (en) 2020-01-12 2022-01-18 Advanced New Technologies Co., Ltd. Method and device for security assessment of encryption models
US11496287B2 (en) 2020-08-18 2022-11-08 Seagate Technology Llc Privacy preserving fully homomorphic encryption with circuit verification
CN111970694B (zh) * 2020-08-27 2022-09-30 中国科学技术大学 一种对密码设备实现实时侧信道泄露评估的方法与设备
US11575501B2 (en) 2020-09-24 2023-02-07 Seagate Technology Llc Preserving aggregation using homomorphic encryption and trusted execution environment, secure against malicious aggregator
CN114124343B (zh) * 2020-11-16 2023-11-14 神州融安数字科技(北京)有限公司 保护隐私的风险评分信息查询方法、装置、系统及设备
CN112491862B (zh) * 2020-11-23 2022-08-02 中国联合网络通信集团有限公司 分布式加密方法和装置
CN114257402B (zh) * 2021-11-12 2024-04-09 中国南方电网有限责任公司 加密算法确定方法、装置、计算机设备和存储介质
CN115801449B (zh) * 2023-01-09 2023-05-26 深圳市迪博企业风险管理技术有限公司 风险评估数据的隐私保护方法、系统和可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070140479A1 (en) * 2005-12-19 2007-06-21 Microsoft Corporation Privacy-preserving data aggregation using homomorphic encryption
CN106910057A (zh) * 2016-06-23 2017-06-30 阿里巴巴集团控股有限公司 移动终端及移动终端侧的安全认证方法和装置
CN109033854A (zh) * 2018-07-17 2018-12-18 阿里巴巴集团控股有限公司 基于模型的预测方法和装置
CN109190876A (zh) * 2018-07-16 2019-01-11 阿里巴巴集团控股有限公司 一种业务产品的安全接入方法和装置
CN110113203A (zh) * 2019-04-30 2019-08-09 阿里巴巴集团控股有限公司 一种用于加密模型的安全性评估的方法和设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9252942B2 (en) * 2012-04-17 2016-02-02 Futurewei Technologies, Inc. Method and system for secure multiparty cloud computation
CN102750510A (zh) * 2012-06-19 2012-10-24 袁开国 基于pki和hash的可信二维码方案
CN107104987A (zh) * 2017-06-30 2017-08-29 山东开创云软件有限公司 一种数据安全传输方法
US10805281B2 (en) * 2017-09-25 2020-10-13 Palo Alto Research Center Incorporated System and method for secure two-party evaluation of utility of sharing data
CN108898475B (zh) * 2018-05-08 2021-04-06 众安信息技术服务有限公司 基于属性加密的联盟区块链实现信贷方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070140479A1 (en) * 2005-12-19 2007-06-21 Microsoft Corporation Privacy-preserving data aggregation using homomorphic encryption
CN106910057A (zh) * 2016-06-23 2017-06-30 阿里巴巴集团控股有限公司 移动终端及移动终端侧的安全认证方法和装置
CN109190876A (zh) * 2018-07-16 2019-01-11 阿里巴巴集团控股有限公司 一种业务产品的安全接入方法和装置
CN109033854A (zh) * 2018-07-17 2018-12-18 阿里巴巴集团控股有限公司 基于模型的预测方法和装置
CN110113203A (zh) * 2019-04-30 2019-08-09 阿里巴巴集团控股有限公司 一种用于加密模型的安全性评估的方法和设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205155A (zh) * 2021-12-07 2022-03-18 四川启睿克科技有限公司 一种基于安全多方计算的供应商风险评估系统及方法
CN114205155B (zh) * 2021-12-07 2023-09-15 四川启睿克科技有限公司 一种基于安全多方计算的供应商风险评估系统及方法

Also Published As

Publication number Publication date
CN110113203B (zh) 2021-10-22
CN110113203A (zh) 2019-08-09

Similar Documents

Publication Publication Date Title
WO2020220754A1 (zh) 一种用于加密模型的安全性评估的方法和设备
US11228423B2 (en) Method and device for security assessment of encryption models
US10630478B1 (en) Sender optimal, breach-resilient, and post-quantum secure cryptographic methods and systems for digital auditing
CN110719159A (zh) 抗恶意敌手的多方隐私集合交集方法
CN102263638B (zh) 认证设备、认证方法和签名生成设备
CN110011810A (zh) 基于可链接环签名和多重签名的区块链匿名签名方法
CN110086599B (zh) 基于同态变色龙哈希函数的哈希计算方法及签密方法
CN110163008B (zh) 一种部署的加密模型的安全性审计的方法和系统
Wright et al. Crypto crumple zones: Enabling limited access without mass surveillance
CN104092686A (zh) 基于svm分类器的隐私保护和数据安全访问的方法
Wazid et al. SCS-WoT: Secure communication scheme for web of things deployment
Wan et al. Towards privacy-preserving and verifiable federated matrix factorization
Sivasundari et al. RETRACTED ARTICLE: Hybrid aggregated signcryption scheme using multi-constraints differential evolution algorithm for security
Tyagi et al. Federated learning: Applications, Security hazards and Defense measures
KR101217491B1 (ko) 공개키 기반의 키워드 검색 방법
CN116614216A (zh) 一种基于格和零知识证明的区块链数据隐私保护方法
CN111475690B (zh) 字符串的匹配方法和装置、数据检测方法、服务器
Carpent et al. Private set projections & variants
Du et al. Peba: Enhancing user privacy and coverage of safe browsing services
Hu et al. Security and privacy protocols for perceptual image hashing
Liang et al. Auditable federated learning with byzantine robustness
An et al. Examchain: A privacy-preserving onscreen marking system based on consortium blockchain
Joseph et al. Design a hybrid optimization and homomorphic encryption for securing data in a cloud environment
Armour et al. Subverting Deniability
Dayong et al. Research on Blockchain: Privacy Protection of Cryptography Blockchain-Based Applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20798294

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20798294

Country of ref document: EP

Kind code of ref document: A1