Federated Matrix Factorization with Privacy Guarantee