WO2021197037A1

WO2021197037A1 - Method and apparatus for jointly performing data processing by two parties

Info

Publication number: WO2021197037A1
Application number: PCT/CN2021/080753
Authority: WO
Inventors: 陈超超; 王力; 周俊
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2020-04-01
Filing date: 2021-03-15
Publication date: 2021-10-07
Also published as: CN111162896A; CN111162896B

Abstract

The embodiments of the present specification provide a data privacy protection based method and apparatus for jointly performing data processing by two parties, wherein each of the two parties maintains an original matrix formed by private data. The method comprises that: one party, of which the matrix dimension is smaller, of the two parties carries out homomorphic encryption on its own matrix, and sends the encrypted matrix to the other party; the other party uses its own original matrix to carry out homomorphic summation operation on the encrypted matrix to obtain an encrypted comprehensive matrix, the encrypted comprehensive matrix being equivalent to a matrix obtained by encrypting a multiplication matrix; and then, the two parties carry out secret sharing under homomorphic encryption on the encrypted comprehensive matrix, and finally each obtains a matrix fragment, the sum of the fragments being the multiplication matrix, thereby realizing a secure matrix operation of the two parties.

Description

Method and device for joint data processing by both parties

Technical field

One or more embodiments of this specification relate to the field of data security, and in particular, to methods and devices for joint data processing by both parties.

Background technique

In the context of big data, it is often necessary to comprehensively process the business data of different data parties. For example, in a business classification analysis scenario based on machine learning, the electronic payment platform owns the merchant’s transaction flow data, the e-commerce platform stores the merchant’s sales data, the banking institution owns the merchant’s lending data, and the model party owns the modeling parameter data. . In the process of joint processing of multi-party data, the protection and security of data privacy have become issues worthy of attention. For example, in a multi-party computing scenario, Party A holds the user sample characteristic data to be processed, and Party B holds the data processing model. When processing sample feature data through this data processing model, if Party A sends the sample data directly to Party B, it will cause the feature value of the user sample to be exposed, leaking user privacy; if Party B provides the data processing model to The use by Party A will cause the model parameters of the data processing model to be exposed.

Therefore, it is hoped to provide an improved solution to protect the security of the private data of all parties in the process of joint data processing by multiple parties.

Summary of the invention

One or more embodiments of this specification describe methods and devices for joint data processing by both parties, so that secure matrix multiplication operations can be performed without revealing the privacy of the data of both parties, and collaborative data processing can be realized.

According to a first aspect, there is provided a method for two parties that protect data privacy to jointly perform data processing. The two parties include a first party and a second party, and the first party has first private data recorded as a first original matrix. The second party has second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the method executed by the first party includes:

Receiving a second encryption matrix from the second party, where the second encryption matrix is obtained by encrypting the second original matrix by using a homomorphic encryption algorithm using a second public key corresponding to the second party;

Perform homomorphic summation between the rows and columns of the plaintext elements in the first original matrix and the ciphertext elements in the second encrypted matrix to obtain the encrypted comprehensive matrix, so that the encrypted comprehensive matrix corresponds to the The second public key is a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix by using the homomorphic encryption algorithm;

Randomly generating a first sharing matrix, and encrypting it by using the second public key and the homomorphic encryption algorithm to obtain a first secret sharing matrix;

Calculate the difference matrix between the encrypted synthesis matrix and the first secret sharing matrix, and send the difference matrix to the second party, so that the second party decrypts the difference matrix to obtain a second sharing matrix , The sum of the second sharing matrix and the first sharing matrix is the product matrix.

According to an embodiment, the first party and the second party are the model owner and the data owner, respectively, and the first private data and the second private data are the model parameter data of the machine learning model and the feature data of the business object, respectively.

Further, in different embodiments, the machine learning model may be a logistic regression model or a linear regression model; the business object may include one of the following: users, commodities, and events.

In an embodiment, the above-mentioned product matrix is an original matrix multiplied by a second original matrix; in this case, the homomorphic sum operation between rows and columns includes: using the plaintext elements of each row in the first original matrix, Perform a homomorphic summation operation on the ciphertext elements of each column of the second encryption matrix to obtain the encryption synthesis matrix.

In another embodiment, the above-mentioned product matrix is the second original matrix multiplied by the first original matrix; in this case, the homomorphic sum operation between rows and columns includes: using the plaintext of each column in the first original matrix Element, performing a homomorphic addition operation on the ciphertext elements of each row of the second encryption matrix to obtain the encryption synthesis matrix.

According to one embodiment, the homomorphic encryption algorithm adopts the Paillier algorithm; for n plaintext elements from one row or one column in the first original matrix, and n ciphertext elements included in the second encryption matrix, the corresponding homomorphic summation The operation includes: using the i-th plaintext element to perform the power operation on the i-th ciphertext element to obtain n power operation results; based on the multiplication of the n power operation results, the n plaintext elements and the corresponding The homomorphic sum result of n ciphertext elements is used as an element in the encryption synthesis matrix.

In an embodiment, after sending the above-mentioned difference matrix, it is further executed: sending the first sharing matrix to the second party, and/or; receiving the second sharing matrix from the second party.

In another embodiment, after sending the above-mentioned difference matrix, the first sharing matrix is sent to a third party different from the first party and the second party.

According to a second aspect, there is provided a method for two parties that protect data privacy to jointly perform data processing. The two parties include a first party and a second party, and the first party has first private data recorded as a first original matrix. The second party has second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the method executed by the second party includes:

Encrypt the second original matrix by using a homomorphic encryption algorithm using the second public key possessed by the second party to obtain a second encryption matrix;

Sending the second encryption matrix to the first party;

Receive a difference matrix from the first party, the difference matrix being the difference between the encrypted synthesis matrix and the first secret sharing matrix, wherein the encrypted synthesis matrix corresponds to using the second public key and using the The homomorphic encryption algorithm encrypts a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix, and the first secret sharing matrix is the first party randomly generated by the first party using the second public key pair 1. Share the matrix obtained by matrix encryption;

Use the second private key corresponding to the second public key to decrypt the difference matrix to obtain a second sharing matrix, so that the sum of the second sharing matrix and the first sharing matrix is the product matrix.

According to a third aspect, there is provided a device for joint data processing by two parties that protect data privacy. The two parties include a first party and a second party, and the first party has first privacy data recorded as a first original matrix. The second party has second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the deployment of the device in the first party includes:

The receiving unit is configured to receive a second encryption matrix from the second party, where the second encryption matrix encrypts the second original matrix using a homomorphic encryption algorithm by using a second public key corresponding to the second party And get

The homomorphic operation unit is configured to perform a homomorphic sum operation between rows and columns of the plaintext elements in the first original matrix and the ciphertext elements in the second encrypted matrix to obtain an encrypted comprehensive matrix, so that the encrypted The comprehensive matrix corresponds to a matrix obtained by using the second public key and using the homomorphic encryption algorithm to encrypt the product matrix of the first original matrix and the second original matrix;

The sharing matrix generating unit is configured to randomly generate a first sharing matrix, and encrypt it by using the second public key and the homomorphic encryption algorithm to obtain a first secret sharing matrix;

The sending unit is configured to calculate the difference matrix between the encryption synthesis matrix and the first secret sharing matrix, and send the difference matrix to the second party, so that the second party decrypts the difference matrix A second sharing matrix is obtained, and the sum of the second sharing matrix and the first sharing matrix is the product matrix.

According to a fourth aspect, there is provided an apparatus for joint data processing by two parties that protect data privacy. The two parties include a first party and a second party, and the first party has first private data recorded as a first original matrix. The second party has second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than that of the first original matrix; the deployment of the device in the second party includes:

An encryption unit configured to use a second public key possessed by the second party to encrypt the second original matrix using a homomorphic encryption algorithm to obtain a second encryption matrix;

A sending unit, configured to send the second encryption matrix to the first party;

The receiving unit is configured to receive a difference matrix from the first party, the difference matrix being the difference between an encrypted synthesis matrix and a first secret sharing matrix, wherein the encrypted synthesis matrix corresponds to using the second The public key is a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix using the homomorphic encryption algorithm, and the first secret sharing matrix is the first party using the second public key The matrix obtained by encrypting the randomly generated first shared matrix;

The decryption unit is configured to use a second private key corresponding to the second public key to decrypt the difference matrix to obtain a second sharing matrix, such that the second sharing matrix is between the second sharing matrix and the first sharing matrix And is the product matrix.

According to a fifth aspect, there is provided a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

According to a sixth aspect, there is provided a computing device, including a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the first aspect or the first aspect is implemented. Two-sided approach.

According to the method and device provided in the embodiments of this specification, the one of the two parties with the smaller matrix dimension homomorphically encrypts its matrix, and sends the encrypted matrix to the other party. The other party uses its own original matrix to perform a homomorphic operation on the encrypted matrix to obtain an encrypted comprehensive matrix. The encrypted synthesis matrix is equivalent to the matrix after the multiplication matrix is encrypted. Then, the two parties perform secret sharing under homomorphic encryption for the encrypted synthesis matrix, and finally each obtain a matrix fragment, so that the sum of the fragments is a multiplication matrix. In the above process, both parties will not leak the plaintext of their original matrix, thus achieving a safe matrix multiplication operation. In addition, the above process only requires a matrix with a small communication dimension, and the communication volume and calculation volume are relatively small, so the secure private data calculation is efficiently guaranteed.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present invention more clearly, the following will briefly introduce the drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. A person of ordinary skill in the art can obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

Figure 2 shows a schematic diagram of two parties performing matrix multiplication;

FIG. 3 shows a schematic diagram of a process in which two parties jointly perform data processing in an embodiment;

Fig. 4 shows a schematic block diagram of a data processing device deployed in a first party according to an embodiment;

Fig. 5 shows a schematic block diagram of a data processing device deployed in a second party according to an embodiment.

Detailed ways

The following describes the solutions provided in this specification with reference to the accompanying drawings.

As mentioned earlier, in the process of multi-party joint data processing, data privacy security has become an issue of concern. In a variety of specific data processing operations, the matrix multiplication operation between data matrices is a common operation in multi-party joint processing, and it is also a difficult point in privacy data protection. For example, when one party holds a feature matrix composed of feature data of certain business objects, and the other party holds a parameter matrix for processing these feature data, in this case, in order to perform joint business processing, the above feature matrix and parameter matrix Perform safe matrix operations. For this reason, the processing method provided in the embodiment of this specification is mainly designed for a scenario where two parties holding private data perform a security matrix multiplication operation.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. In this implementation scenario, participants A and B are schematically shown. Each participant can be embodied as a device, platform, server or device cluster with computing and processing capabilities. Among them, participant A has a matrix X composed of party A's private data, and participant B has a matrix Y composed of party B's private data. Both parties hope to perform a secure matrix multiplication operation, that is, party A does not reveal the plaintext of its matrix X. Participant B does not disclose the plaintext of its matrix Y, but finally calculates the result of matrix multiplication X*Y.

In one embodiment, the participants A and B are the model owner and the data owner, respectively. Correspondingly, the private data in the matrix X and the matrix Y are the model parameter data of the machine learning model and the feature data of the business object, respectively.

More specifically, business objects may include users, products, events, etc. to be analyzed. When the business object is a user, the corresponding feature data can include user attribute feature data, such as age, gender, registration duration, occupation, purchase record, loan record, etc.; when the business object is a commodity, the corresponding feature data can be Including, product attribute feature data, such as product category, shelf time, number of reviews, etc.; when the business object is an event, the corresponding feature data can include related event features, such as the time, place, and participation of the event The trajectory of participants, the amount of (transaction) events, channels, etc. In addition, in other examples, the business object may also be a picture, audio, text, etc. to be analyzed, respectively corresponding to it. The characteristic data may include picture pixel characteristics, audio frequency spectrum characteristics, text encoding characteristics, and so on.

The machine learning model owned by the other party may be a model used to perform business processing on the above-mentioned business objects. For example, when the business object is a user, the business processing can include business processing based on user classification, such as user group division, user service customization, etc.; when the business object is an event, the business processing can include an incident security assessment. In the case of other business objects, business processing may also include business processing based on audio recognition, business processing based on text analysis, and so on.

According to the needs of business processing, the above-mentioned machine learning model can be a classification model or a regression model, and the model involves a linear combination of model parameters and feature data. Therefore, the model parameter matrix X and the feature data matrix Y need to be multiplied. Typically, the model may be a linear regression model, and its core algorithm is the above-mentioned linear combination operation. Alternatively, the model may also be a logistic regression model, which further imposes a nonlinear function operation on the basis of the above linear combination operation. Or, the model can also be other models that require linear combination operations.

In other embodiments, participant A and participant B in FIG. 1 may also be peers that jointly perform model joint training, each having a part of model parameters and feature data. Alternatively, participant A and participant B may also be other private data holders, and in order to perform certain data processing, a secure matrix multiplication operation is required.

In the above various scenarios, for the purpose of privacy data protection, participant A cannot leak its original matrix X, and participant B cannot leak its original matrix Y. Both parties hope to jointly calculate the matrix multiplication result X*Y.

To this end, according to the embodiment of the present specification, the party with the smaller matrix dimension of the two parties is assumed to be participant B, and its matrix Y is homomorphically encrypted, and the encrypted matrix [Y] is sent to the other party A. The other party A uses its own matrix X to perform a homomorphic operation on the encrypted matrix [Y] to obtain the encrypted comprehensive matrix [Z]. This encrypted synthesis matrix is equivalent to a matrix obtained by encrypting the multiplication matrix X*Y. Then, the two parties conduct a secret sharing under homomorphic encryption for the encrypted synthesis matrix [Z], and finally participant A and participant B each get a matrix segment Z ₁ and Z ₂ , making the sum of Z ₁ and Z ₂ a multiplication matrix X*Y.

In the above process, both parties will not leak the plaintext of their original matrix, but can obtain the final multiplication matrix by combining their matrix slices together. In addition, the above process only requires a matrix with a small communication dimension, and the communication volume and calculation volume are relatively small, so the secure private data calculation is efficiently guaranteed.

The specific implementation process of the above scheme is described below.

Figure 2 shows a schematic diagram of matrix multiplication performed by both parties. Continuing the example in Figure 1, Figure 2 shows participant A and participant B. Participant A maintains a private data matrix X, which is an m*n-dimensional matrix; participant B maintains a private data matrix Y, which The matrix is an n*k-dimensional matrix. Both parties hope to safely calculate the X*Y multiplication matrix (m*k dimension).

In one case, the matrix Y is a matrix with a smaller dimension, that is, k<m, which corresponds to the scene (A) in FIG. 2. In another case, the matrix X is a matrix with a smaller dimension, that is, m<k, which corresponds to the scene (B) in FIG. 2.

First, the situation of scene (A) will be described. For simplicity and clarity of description, we call the party with the larger dimension of the matrix as the first party, and the party with the smaller dimension of the matrix as the second party. In the case of scenario (A), the first party is the participant. A, the second party is participant B.

Fig. 3 shows a schematic diagram of a process in which both parties jointly perform data processing in an embodiment. This schematic diagram shows the process of safe matrix multiplication by both parties in the case of the above scenario (A).

In order to perform a secure matrix multiplication, first, in step 301, the second party uses its own public key and uses a homomorphic encryption algorithm to encrypt the second original matrix it owns to obtain a second encryption matrix.

In the example of FIG. 3, the second party is participant B. Participant B can choose the homomorphic encryption algorithm E, and generate the public key PK-b and the private key SK-b under the encryption algorithm. Then, using its public key PK-b, homomorphic encryption algorithm E is used to perform homomorphic encryption on the second original matrix, namely matrix Y, to obtain the second encryption matrix [Y] _b .

In this article, use [] to represent encryption, and the subscript represents the public key identification used in encryption. It can be understood that the second encryption matrix [Y] _b contains ciphertext elements at various positions, and each ciphertext element is obtained by performing the above-mentioned homomorphic encryption on the original elements at the corresponding positions of the original matrix Y.

Next, in step 302, the second party B sends the second encryption matrix [Y] _b to the first party A. Since the matrix has been encrypted, the communication in this step will not reveal the private data of participant B.

Then, in step 303, the first party A performs a homomorphic summation between the rows and columns of the plaintext elements in the first original matrix X and the ciphertext elements in the second encrypted matrix [Y] _{b to obtain the encryption} Comprehensive matrix [Z] _b . In the case of wishing to calculate the product matrix of X*Y, the above-mentioned homomorphic addition operation between rows and columns is: using the plaintext elements of each row in the original matrix X, and the ciphertext of each column of the _{second encrypted matrix [Y] b} The elements are subjected to a homomorphic addition operation to obtain the above-mentioned encrypted synthesis matrix.

The above-mentioned homomorphic addition operation is a homomorphic operation operation between the plaintext and the ciphertext corresponding to the aforementioned homomorphic encryption algorithm E. Its function can make the homomorphism between the rows and columns of the _{plaintext matrix X and the ciphertext matrix [Y] b} The encrypted synthesis matrix [Z] _b obtained by the addition operation corresponds to the matrix obtained by using the same public key PK-b to encrypt the product matrix X*Y using the homomorphic encryption algorithm E, that is, [Z] _b =[ X*Y] _b . This is determined by the "homomorphism" of the homomorphic encryption algorithm. The process is described in detail below.

It needs to be understood that a homomorphic encryption algorithm is an encryption function that performs operations on plaintext and then encrypts it, and performs corresponding operations on ciphertext after encryption, and the result is equivalent. For example, using the same public key PK to encrypt v ₁ and v _{2 to} obtain E _PK (v ₁ ) and E _PK (v ₂ ), if it satisfies:

Then it is considered that the encryption algorithm satisfies the additive homomorphism, where

Add operation for the corresponding homomorphism.

For example, Paillier's algorithm is a commonly used encryption algorithm that satisfies additive homomorphism. Paillier algorithm satisfies: E _PK (v ₁ +v ₂ )=E _PK (v ₁ )·E _PK (v ₂ ), then the multiplication of ciphertext E _PK (v ₁ )·E _PK (v ₂ ) corresponds to the same State addition operation.

Easy to verify, the Paillier encryption algorithm also satisfies:

The above formula (2) can be used as the basis of the homomorphic sum operation between plaintext and ciphertext under Paillier's algorithm.

For example, assuming that the original matrix X contains n plaintext elements in a certain row (x ₁ , x ₂ ,..., x _n ), the encryption matrix [Y] _b contains n ciphertext elements in a certain column (c ₁ , c _2,. .., c _n ), where any ciphertext c _i _{is obtained by encrypting the corresponding element y i} in the original matrix Y, that is, c _i =E _PK-b (y _i ). Then, the homomorphic sum operation between the plaintext elements and the ciphertext elements can be implemented as follows:

That is, the i-th plaintext element x _{i is used} to power the i-th ciphertext element c _i to obtain the result of the n power operation; based on the multiplication of the results of the n power operation, the homomorphic addition result z is obtained as Encrypt an element in the synthesis matrix.

Combined with the above formula (2), it can be seen that the above formula (3) can be written as:

z=E _PK-b (x ₁ *y ₁ +x ₂ *y ₂ +…+x _n *y _n ) (4)

In this way, using the plaintext element in the jth row of the original matrix X and the ciphertext element _{in the kth column of the encrypted matrix [Y] b} to perform the above homomorphic summation, the result can be used as the jth row in the encrypted synthesis matrix. _{The element z jk in} the k-th column, and as shown in formula (4), the element z _{jk is} actually equal to the encrypted value of the corresponding element in the product matrix X*Y of the original matrix X and the original matrix Y.

_{Therefore, the encrypted synthesis matrix [Z] b} obtained by the homomorphic summation between the rows and columns of the plaintext matrix X and the ciphertext matrix [Y] _b corresponds to, using the same public key PK-b, using the homomorphic encryption algorithm E to The matrix obtained by encrypting the product matrix X*Y, that is, [Z] _b =[X*Y] _b .

The description of the homomorphic addition operation combined with the Paillier algorithm is described above. It can be understood that a variety of homomorphic encryption algorithms already exist, and all encryption algorithms with additive homomorphic properties can be used in this solution. For example, some other algorithms based on elliptic curve encryption similar to Paillier also satisfy additive homomorphism. In addition, the Gentry algorithm, as a quasi-fully homomorphic encryption algorithm, satisfies both additive homomorphism and multiplication homomorphism. Correspondingly, different homomorphic encryption algorithms have different forms of homomorphic addition operations. For example, if there is a homomorphic encryption algorithm whose homomorphic addition operation corresponds to conventional addition, the above-mentioned homomorphic addition operation of plaintext elements and ciphertext elements may correspond to a linear combination of plaintext elements and ciphertext elements.

In this way, in the above step 303, the first party A calculates the encrypted synthesis matrix [Z] _b . Next, for the encrypted synthesis matrix, the first party A performs secret sharing under homomorphic encryption, so that both parties obtain secure matrix fragments.

To perform secret sharing, in step 304, the first party A randomly generates a first sharing matrix, denoted as <Z> ₁ . Then, the first party A uses the public key PK-b of the second party B and the aforementioned homomorphic encryption algorithm E to encrypt the first sharing matrix to obtain the first secret sharing matrix [<Z> ₁ ] _b .

Next, in step 305, the first party A calculates _{the difference matrix between the encrypted synthesis matrix [Z] b} and the first secret sharing matrix [<Z> ₁ ] _b , and the difference matrix is denoted as [<Z> ₂ ] _b , and:

[<Z> ₂ ] _b = [Z] _b -[<Z> ₁ ] _b (5)

Among them, when calculating the difference matrix, the subtraction operation between the two ciphertext matrices is a homomorphic subtraction operation corresponding to the homomorphic addition operation.

Then in step 306, the first party A _{sends the difference matrix [<Z> 2} ] _b to the second party B.

In step 307, after receiving the above-mentioned difference matrix, the second party B uses its private key SK-b to decrypt the difference matrix to obtain a second sharing matrix <Z> ₂ .

According to the description in conjunction with step 303, the encrypted synthesis matrix [Z] _b corresponds to the matrix obtained by encrypting the product matrix X*Y using the public key PK-b using the homomorphic encryption algorithm E, that is, [Z] _b = [X *Y] _b , and according to step 304, the first secret sharing matrix is a matrix encrypted with the public key PK-b and the algorithm E to the first sharing matrix. Combining the above formula (5), it can be seen that when using the private key SK-b corresponding to the public key PK-b to _{decrypt the difference matrix [<Z> 2} ] _b , the second shared matrix <Z> _{2 obtained} satisfies :

<Z> ₂ ＝X*Y-<Z> ₁ (6)

In other words, the first party gets the first sharing matrix <Z> ₁ , the second party gets the second sharing matrix <Z> ₂ , and the sum of the first sharing matrix and the second sharing matrix is equal to the expected product matrix X* Y.

In one embodiment, after the above step 307, optionally, the first party A sends its first sharing matrix <Z> ₁ to the second party B, so the second party B adds the two sharing matrices And <Z> ₁ +<Z> _{2 to} get the result of the product matrix. The first sharing matrix <Z> ₁ is a matrix randomly generated by the first party A, so party A's private data will not be leaked. Or, the second party B sends its second sharing matrix <Z> ₂ to the first party A, and the first party A obtains the result of the product matrix by adding the two sharing matrices. The second sharing matrix <Z> ₂ will not reveal party B's private data. Of course, the above two can also be executed at the same time, so both sides get the result of the product matrix.

In another embodiment, the first party A sends its first sharing matrix <Z> ₁ to a third party different from the first party and the second party, and the second party B sends its second sharing matrix <Z> ₂ It is also sent to the third party, and the third party adds the first sharing matrix and the second sharing matrix to obtain the product matrix. The third party can notify the first party A and/or the second party B of the product matrix, or perform subsequent operations based on the product matrix.

The above description is directed to the scenario (A) in FIG. 2, that is, the case where the original matrix Y has a smaller dimension. If it is the case of scenario (B), that is, the original matrix X in party A has a smaller dimension, then party A can be used as the second party, and party B can be the first party. In this way, the second party is still the matrix dimension For the smaller one, calculate similarly with reference to the method shown in FIG. 3.

Specifically, in the case of scenario (B), the first party is participant B, and the first original matrix is Y; the second party is participant A, and the second original matrix is X. First, the second party (party A) still uses its public key (PK-a) to encrypt the second original matrix X to obtain the second encryption matrix [X] _a , and then send the second encryption matrix to the first Party (Party B). The first party B performs a homomorphic sum operation between the rows and columns of the plaintext elements in the first original matrix Y and the ciphertext elements in the second encrypted matrix [X] _a. The difference here with the example in Figure 2 is that since the product matrix to be calculated is X*Y, the first party B uses the plaintext elements of each column in the first original matrix Y, and each row in the second encrypted matrix [X] _a For the ciphertext elements of, perform homomorphic summation to obtain the encrypted synthesis matrix [Z] _a . Then, the first party B secretly shares the encrypted comprehensive matrix [Z] _a to generate the first sharing matrix <Z> ₁ and the difference matrix [<Z> ₂ ] _a , where the difference matrix [<Z> ₂ ] _a =[Z] _a -[<Z> ₁ ] _a . Then, the second party uses its private key SK-a to decrypt the difference matrix to obtain the second sharing matrix <Z> _2. Similarly, <Z> ₁ +<Z> ₂ =X*Y. In this way, the safe matrix multiplication operation of both parties is realized when the original matrix X dimension of party A is smaller.

Looking back at the above process, it can be seen that the first party and the second party did not transmit any plaintext information of the original matrix, so their private data will not be leaked. In the end, both parties obtain a matrix fragment of the product matrix. The sum of the slices is the product matrix, which realizes the safe matrix multiplication operation. In addition, the communication volume in the calculation process only contains the encryption matrix of the matrix with a smaller dimension. Compared with some existing secure matrix multiplications, the communication volume is greatly reduced and the calculation efficiency is higher.

According to another embodiment, there is provided a device for two parties to jointly perform data processing, wherein the two parties include a first party and a second party, the first party has first private data recorded as a first original matrix, and the first party The two parties have the second private data recorded as the second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the above-mentioned device is deployed in the first party, and the first party can use any equipment with computing and processing capabilities , Platform or equipment cluster. Fig. 4 shows a schematic block diagram of a data processing apparatus deployed in a first party according to an embodiment. As shown in FIG. 4, the processing device 400 includes:

The receiving unit 41 is configured to receive a second encryption matrix from the second party, where the second encryption matrix uses a second public key corresponding to the second party to perform a homomorphic encryption algorithm on the second original matrix. Obtained by encryption;

The homomorphic operation unit 42 is configured to perform a homomorphic sum operation between rows and columns of the plaintext elements in the first original matrix and the ciphertext elements in the second encrypted matrix to obtain an encrypted comprehensive matrix, so that the The encrypted synthesis matrix corresponds to a matrix obtained by using the second public key and using the homomorphic encryption algorithm to encrypt the product matrix of the first original matrix and the second original matrix;

The sharing matrix generating unit 43 is configured to randomly generate a first sharing matrix, and encrypt it by using the second public key and the homomorphic encryption algorithm to obtain a first secret sharing matrix;

The sending unit 44 is configured to calculate the difference matrix between the encryption synthesis matrix and the first secret sharing matrix, and send the difference matrix to the second party, so that the second party has the difference matrix The second sharing matrix is obtained by decryption, and the sum of the second sharing matrix and the first sharing matrix is the product matrix.

In one embodiment, the above-mentioned first party and the second party are the model owner and the data owner, respectively, and the first private data and the second private data are model parameter data of the machine learning model and feature data of the business object, respectively .

Further, in different embodiments, the above-mentioned machine learning model includes a logistic regression model or a linear regression model; the business object may include one of the following: users, commodities, and events.

In an embodiment, the product matrix is the first original matrix multiplied by the second original matrix; the homomorphic operation unit 42 is configured to: use the plaintext elements in each row of the first original matrix to perform The ciphertext elements of each column of the second encryption matrix are subjected to a homomorphic addition operation to obtain the encryption synthesis matrix.

In another embodiment, the product matrix is the second original matrix multiplied by the first original matrix; the homomorphic operation unit 42 is configured to: use the plaintext elements of each column in the first original matrix to The ciphertext elements of each row of the second encryption matrix are subjected to a homomorphic addition operation to obtain the encryption synthesis matrix.

According to an embodiment, the first original matrix includes n plaintext elements from one row or one column, the second encryption matrix includes corresponding n ciphertext elements; the homomorphic encryption algorithm is Paillier's algorithm, and the same The state operation unit 42 is configured as:

Use the i-th plaintext element to perform power operation on the i-th ciphertext element to obtain n power operation results;

Based on the continuous multiplication of the n power operation results, a homomorphic sum result of the n plaintext elements and the corresponding n ciphertext elements is obtained as an element in the encryption synthesis matrix.

According to an embodiment, the device 400 further includes a transceiving unit (not shown) configured to: send the first sharing matrix to the second party, and/or; receive the received data from the second party The second sharing matrix.

According to another embodiment, the transceiver unit is configured to send the first sharing matrix to a third party different from the first party and the second party.

According to another embodiment, there is provided a device for two parties to jointly perform data processing, wherein the two parties include a first party and a second party, the first party has first private data recorded as a first original matrix, and the first party has first privacy data recorded as a first original matrix. The two parties have the second privacy data recorded as the second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the above-mentioned device is deployed in the second party, and the second party can use any equipment with computing and processing capabilities , Platform or equipment cluster. Fig. 5 shows a schematic block diagram of a data processing device deployed in a second party according to an embodiment. As shown in FIG. 5, the processing device 500 includes:

The encryption unit 51 is configured to use a second public key possessed by the second party to encrypt the second original matrix by using a homomorphic encryption algorithm to obtain a second encryption matrix;

The sending unit 52 is configured to send the second encryption matrix to the first party;

The receiving unit 53 is configured to receive a difference matrix from the first party, the difference matrix being the difference between the encrypted synthesis matrix and the first secret sharing matrix, wherein the encrypted synthesis matrix corresponds to using the first Two public keys, a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix using the homomorphic encryption algorithm, the first secret sharing matrix is the first party using the second public key The matrix obtained by encrypting the first shared matrix randomly generated by the key;

The decryption unit 54 is configured to use a second private key corresponding to the second public key to decrypt the difference matrix to obtain a second sharing matrix, such that the second sharing matrix and the first sharing matrix The sum is the product matrix.

In one embodiment, the above-mentioned apparatus 500 further includes a transceiving unit (not shown) configured to: send the second sharing matrix to the first party, and/or; receive the second sharing matrix from the first party The first sharing matrix.

According to another embodiment, the transceiver unit is configured to send the second sharing matrix to a third party different from the first party and the second party.

Through the above device 400 and device 500, both parties can jointly perform data processing involving matrix multiplication while protecting the security of private data.

According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method described in conjunction with FIG. 3.

According to an embodiment of still another aspect, there is also provided a computing device, including a memory and a processor, the memory is stored with executable code, and when the processor executes the executable code, it implements the method described in conjunction with FIG. 3 method.

Those skilled in the art should be aware that, in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium.

The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific embodiments of the present invention, and are not intended to limit the scope of the present invention. The protection scope, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims

A method for two parties that protect data privacy to jointly perform data processing. The two parties include a first party and a second party. The first party has first privacy data recorded as a first original matrix, and the second party has The second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the method is executed by the first party, and includes:

Receiving a second encryption matrix from the second party, where the second encryption matrix is obtained by encrypting the second original matrix by using a homomorphic encryption algorithm using a second public key corresponding to the second party;

Perform homomorphic summation between the rows and columns of the plaintext elements in the first original matrix and the ciphertext elements in the second encrypted matrix to obtain the encrypted comprehensive matrix, so that the encrypted comprehensive matrix corresponds to the The second public key is a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix by using the homomorphic encryption algorithm;

Randomly generating a first sharing matrix, and encrypting it by using the second public key and the homomorphic encryption algorithm to obtain a first secret sharing matrix;

Calculate the difference matrix between the encrypted synthesis matrix and the first secret sharing matrix, and send the difference matrix to the second party, so that the second party decrypts the difference matrix to obtain a second sharing matrix , The sum of the second sharing matrix and the first sharing matrix is the product matrix.
The method according to claim 1, wherein the first party and the second party are the model owner and the data owner, respectively, and the first private data and the second private data are model parameter data of the machine learning model, respectively And the characteristic data of the business object.
The method according to claim 2, wherein the machine learning model includes a logistic regression model or a linear regression model; and the business object includes one of the following: users, commodities, and events.
The method according to claim 1, wherein the product matrix is the first original matrix multiplied by the second original matrix; the homomorphic sum operation between rows and columns includes: using the first original matrix For the plaintext elements of each row, homomorphic addition operations are performed on the ciphertext elements of each column of the second encryption matrix to obtain the encryption synthesis matrix.
The method according to claim 1, wherein the product matrix is the second original matrix multiplied by the first original matrix; the homomorphic sum operation between rows and columns includes: using the first original matrix For the plaintext elements of each column, homomorphic addition operations are performed on the ciphertext elements of each row of the second encryption matrix to obtain the encryption synthesis matrix.
The method according to claim 1, wherein the first original matrix includes n plaintext elements from one row or one column, and the second encryption matrix includes corresponding n ciphertext elements; and the homomorphic encryption algorithm is In Paillier algorithm, the homomorphic addition operation includes:

Use the i-th plaintext element to perform power operation on the i-th ciphertext element to obtain n power operation results;

Based on the continuous multiplication of the n power operation results, a homomorphic sum result of the n plaintext elements and the corresponding n ciphertext elements is obtained as an element in the encryption synthesis matrix.
The method according to claim 1, further comprising:

Sending the first sharing matrix to the second party, and/or;

Receiving the second sharing matrix from the second party.
The method according to claim 1, further comprising:

The first sharing matrix is sent to a third party different from the first party and the second party.
A method for two parties that protect data privacy to jointly perform data processing. The two parties include a first party and a second party. The first party has first privacy data recorded as a first original matrix, and the second party has The second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the method is executed by the second party, and includes:

Encrypt the second original matrix by using a homomorphic encryption algorithm using the second public key possessed by the second party to obtain a second encryption matrix;

Sending the second encryption matrix to the first party;

Receive a difference matrix from the first party, the difference matrix being the difference between the encrypted synthesis matrix and the first secret sharing matrix, wherein the encrypted synthesis matrix corresponds to using the second public key and using the The homomorphic encryption algorithm encrypts a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix, and the first secret sharing matrix is that the first party uses the second public key and the homomorphic The matrix obtained by encrypting the randomly generated first shared matrix by the encryption algorithm;

Use the second private key corresponding to the second public key to decrypt the difference matrix to obtain a second sharing matrix, so that the sum of the second sharing matrix and the first sharing matrix is the product matrix.
The method according to claim 9, further comprising:

Sending the second sharing matrix to the first party, and/or;

Receiving the first sharing matrix from the first party.
A device for joint data processing by two parties that protect data privacy. The two parties include a first party and a second party. The first party has first privacy data recorded as a first original matrix, and the second party has The second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the deployment of the device in the first party includes:

The receiving unit is configured to receive a second encryption matrix from the second party, where the second encryption matrix encrypts the second original matrix using a homomorphic encryption algorithm by using a second public key corresponding to the second party And get

The homomorphic operation unit is configured to perform a homomorphic sum operation between rows and columns of the plaintext elements in the first original matrix and the ciphertext elements in the second encrypted matrix to obtain an encrypted comprehensive matrix, so that the encrypted The comprehensive matrix corresponds to a matrix obtained by using the second public key and using the homomorphic encryption algorithm to encrypt the product matrix of the first original matrix and the second original matrix;

The sharing matrix generating unit is configured to randomly generate a first sharing matrix, and encrypt it by using the second public key and the homomorphic encryption algorithm to obtain a first secret sharing matrix;

The sending unit is configured to calculate the difference matrix between the encryption synthesis matrix and the first secret sharing matrix, and send the difference matrix to the second party, so that the second party decrypts the difference matrix A second sharing matrix is obtained, and the sum of the second sharing matrix and the first sharing matrix is the product matrix.
The apparatus according to claim 11, wherein the first party and the second party are model owners and data owners, respectively, and the first private data and the second private data are model parameter data of a machine learning model, respectively And the characteristic data of the business object.
The device according to claim 12, wherein the machine learning model includes a logistic regression model or a linear regression model; and the business object includes one of the following: users, commodities, and events.
11. The device according to claim 11, wherein the product matrix is the first original matrix multiplied by the second original matrix; the homomorphic operation unit is configured to use the plaintext of each row in the first original matrix Element, performing a homomorphic addition operation on the ciphertext elements of each column of the second encryption matrix to obtain the encryption synthesis matrix.
The device according to claim 11, wherein the product matrix is the second original matrix multiplied by the first original matrix; the homomorphic operation unit is configured to use the plaintext of each column in the first original matrix Element, performing a homomorphic addition operation on the ciphertext elements of each row of the second encryption matrix to obtain the encryption synthesis matrix.
The apparatus according to claim 11, wherein the first original matrix includes n plaintext elements from one row or one column, and the second encryption matrix includes corresponding n ciphertext elements; and the homomorphic encryption algorithm is In the Paillier algorithm, the homomorphic operation unit is configured as:

Use the i-th plaintext element to perform power operation on the i-th ciphertext element to obtain n power operation results;

Based on the continuous multiplication of the n power operation results, a homomorphic sum result of the n plaintext elements and the corresponding n ciphertext elements is obtained as an element in the encryption synthesis matrix.
The device according to claim 11, further comprising a transceiving unit configured to:

Sending the first sharing matrix to the second party, and/or;

Receiving the second sharing matrix from the second party.
The device according to claim 11, further comprising a transceiving unit configured to:

The first sharing matrix is sent to a third party different from the first party and the second party.
A device for joint data processing by two parties that protect data privacy. The two parties include a first party and a second party. The first party has first privacy data recorded as a first original matrix, and the second party has The second privacy data recorded as a second original matrix, the dimension of the second original matrix is smaller than the first original matrix; the deployment of the device in the second party includes:

An encryption unit configured to use a second public key possessed by the second party to encrypt the second original matrix using a homomorphic encryption algorithm to obtain a second encryption matrix;

A sending unit, configured to send the second encryption matrix to the first party;

The receiving unit is configured to receive a difference matrix from the first party, the difference matrix being the difference between an encrypted synthesis matrix and a first secret sharing matrix, wherein the encrypted synthesis matrix corresponds to the use of the second The public key is a matrix obtained by encrypting the product matrix of the first original matrix and the second original matrix using the homomorphic encryption algorithm, and the first secret sharing matrix is the first party using the second public key A matrix obtained by encrypting a randomly generated first shared matrix with the homomorphic encryption algorithm;

The decryption unit is configured to use a second private key corresponding to the second public key to decrypt the difference matrix to obtain a second sharing matrix, such that the second sharing matrix is between the second sharing matrix and the first sharing matrix And is the product matrix.
The device according to claim 19, further comprising a transceiving unit configured to:

Sending the second sharing matrix to the first party, and/or;

Receiving the first sharing matrix from the first party.
A computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1-10.
A computing device, comprising a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the method described in any one of claims 1-10 is implemented. method.