A method for calculating a garbled circuit and related equipment

Abstract

This specification provides a method and related equipment for calculating obfuscated circuits. It is applied to a first computing device corresponding to the obfuscated circuit executor, which holds first input data corresponding to a first logic gate included in the obfuscated circuit. A second computing device corresponding to the obfuscated circuit generator holds expected first and second output data corresponding to the first logic gate. The first input data is 0 or 1. The method includes: obtaining a random number i and its corresponding random value r generated by running a randomized unintended transmission protocol. i The random number i is 0 or 1; obtain the intermediate calculation result calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data; if the value of the first input data is 0, based on the random value r i Calculate the obfuscation value corresponding to the first output data; if the first input data is 1, then based on the random value r... i The intermediate calculation result f is used to calculate the obfuscation value corresponding to the second output data.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of secure computing technology, and in particular to a method and related equipment for calculating obfuscated circuits. Background Technology

[0002] Obfuscated circuits are a type of cryptographic protocol that uses computer simulation of Application Specific Integrated Circuits (ASICs) to achieve secure multi-party computation. An obfuscated circuit typically includes multiple logic gates (such as AND, NOT, NOR, XOR, etc.). When executing each logic gate, one party involved in the obfuscated circuit computation (the obfuscated circuit generator) usually generates an obfuscated truth table corresponding to that logic gate and sends it to the other party (the obfuscated circuit executor). The obfuscated circuit executor then calculates the output of each logic gate based on the received obfuscated truth table and the obfuscated values ​​of the input data from both parties. Since an obfuscated truth table must be generated for each logic gate in the execution circuit, a significant amount of time is wasted, making the computational efficiency of obfuscated circuits extremely low. Summary of the Invention

[0003] In view of this, one or more embodiments of this specification provide a method for calculating obfuscated circuits and related equipment.

[0004] In a first aspect, this specification provides a method for calculating an obfuscated circuit, applied to a first computing device corresponding to an obfuscated circuit executor, the obfuscated circuit comprising a plurality of logic gates; the first computing device holds first input data corresponding to the first logic gates contained in the obfuscated circuit, the first input data being 1-bit data having a value of 0 or 1; a second computing device corresponding to an obfuscated circuit generator holds a plurality of expected output data corresponding to the first logic gates, wherein the plurality of expected output data includes first output data calculated when the first input data has a value of 0, and second output data calculated when the first input data has a value of 1;

[0005] The method includes:

[0006] From an array consisting of a random number i, a first random value, and a second random value obtained from the second computing device, a random value r is randomly selected that corresponds to the array index indicated by the random number i. i The random number i can be either 0 or 1.

[0007] Obtain the intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data;

[0008] When the value of the first input data is 0, based on the random value r i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate; or, when the value of the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0009] Secondly, this specification provides a method for calculating obfuscated circuits, applied to a second computing device corresponding to an obfuscated circuit generator. The obfuscated circuit includes a plurality of logic gates. A first computing device corresponding to an obfuscated circuit executor holds first input data corresponding to the first logic gates included in the obfuscated circuit. The first input data is 1-bit data with a value of 0 or 1. The second computing device holds a plurality of expected output data corresponding to the first logic gates. The plurality of expected output data includes first output data calculated when the first input data has a value of 0, and second output data calculated when the first input data has a value of 1.

[0010] The method includes:

[0011] Obtain a first random value and a second random value, and calculate an intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data, and the second output data;

[0012] The intermediate calculation result is sent to the first computing device, so that when the value of the first input data is 0, the first computing device calculates the result based on the random value r corresponding to the random number i. i Calculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0013] Wherein, the random number i takes the value of 0 or 1, and the random value r i It is a random value randomly selected from the array formed by the first random value and the second random value as array elements, corresponding to the array index indicated by the random number i.

[0014] Thirdly, this specification provides a scrambling circuit computing device applied to a first computing device corresponding to a scrambling circuit executor, the scrambling circuit comprising a plurality of logic gates; the first computing device holding first input data corresponding to the first logic gates contained in the scrambling circuit, the first input data being 1-bit data having a value of 0 or 1; a second computing device corresponding to a scrambling circuit generator holding a plurality of expected output data corresponding to the first logic gates, wherein the plurality of expected output data includes a first output data calculated when the first input data has a value of 0, and a second output data calculated when the first input data has a value of 1;

[0015] The device includes:

[0016] The first acquisition unit is used to acquire a random number i, and a random value r, which is randomly selected from an array consisting of a first random value and a second random value obtained from the second computing device as array elements, and which corresponds to the array index indicated by the random number i. i The random number i can be either 0 or 1.

[0017] The second acquisition unit is configured to acquire an intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data; and

[0018] The calculation unit is configured to, when the value of the first input data is 0, calculate based on the random value r. i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate; or, when the value of the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0019] Fourthly, this specification provides a scrambling circuit computing device applied to a second computing device corresponding to a scrambling circuit generator, the scrambling circuit comprising a plurality of logic gates; a first computing device corresponding to a scrambling circuit executor holds first input data corresponding to the first logic gates contained in the scrambling circuit, the first input data being 1-bit data having a value of 0 or 1; the second computing device holds a plurality of expected output data corresponding to the first logic gates; wherein the plurality of expected output data includes first output data calculated when the first input data has a value of 0, and second output data calculated when the first input data has a value of 1;

[0020] The device includes:

[0021] The acquisition unit is used to acquire a first random value and a second random value, and to calculate an intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data and the second output data;

[0022] The sending unit is configured to send the intermediate calculation result to the first computing device, so that when the value of the first input data is 0, the first computing device calculates the result based on the obtained random value r corresponding to the random number i. i Calculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0023] Wherein, the random number i takes the value of 0 or 1, and the random value r i It is a random value randomly selected from the array formed by the first random value and the second random value as array elements, corresponding to the array index indicated by the random number i.

[0024] Accordingly, this specification also provides a computing device, including: a memory and a processor; the memory stores a computer program / instructions executable by the processor; when the processor executes the computer program / instructions, it performs the obfuscated circuit calculation method described in the first or second aspect above.

[0025] Accordingly, this specification also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, performs the obfuscation circuit calculation method as described in the first or second aspect above.

[0026] Accordingly, this specification also provides a computer program product comprising a computer program / instructions, which, when executed by a processor, performs the obfuscated circuit calculation method as described in the first or second aspect above.

[0027] In summary, this application considers that in the calculation of some simple logic gates contained in the obfuscated circuit, the input data (e.g., a bit) held by the obfuscated circuit executor corresponding to the logic gate can only be 0 or 1. Therefore, the obfuscated circuit generator can first calculate the two possible output data (e.g., first output data and second output data) corresponding to the logic gate based on these two possible values ​​of 0 or 1. Furthermore, by running the unintentional transfer protocol, the obfuscated circuit executor can calculate the obfuscated value of the actual output data as the output of the logic gate based on the true value of the input data it holds, directly completing the calculation of a logic gate in the obfuscated circuit without having to generate an obfuscated truth table corresponding to that logic gate, saving a lot of time and improving the computational efficiency of the obfuscated circuit. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of a logic gate circuit provided in an exemplary embodiment;

[0029] Figure 2 This is a schematic diagram illustrating an unintentional transmission provided in an exemplary embodiment;

[0030] Figure 3 This is a schematic diagram of a system architecture provided in an exemplary embodiment;

[0031] Figure 4 This is a flowchart illustrating an exemplary embodiment of a method for calculating a garbled circuit.

[0032] Figure 5 This is a schematic diagram of the overall steps of a method for calculating a garbled circuit, provided in an exemplary embodiment.

[0033] Figure 6 This is a flowchart illustrating another method for calculating a garbled circuit, provided in an exemplary embodiment.

[0034] Figure 7 This is a schematic diagram of the structure of a garbled circuit computing device provided in an exemplary embodiment;

[0035] Figure 8 This is a schematic diagram of the structure of another obfuscated circuit computing device provided in an exemplary embodiment;

[0036] Figure 9 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Detailed Implementation

[0037] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0038] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0039] Furthermore, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0040] First, some terms used in this specification will be explained to facilitate understanding by those skilled in the art.

[0041] (1) Obfuscated circuits are a type of cryptographic protocol that uses computer simulation of integrated circuits (ASICs) to achieve secure multi-party computation. It should be understood that any given computational task can be designed with multiple logic gates (or arithmetic gates) according to operational logic, and these gates (e.g., AND gates, NOT gates, XOR gates, etc.) can be connected to form a gate circuit. Operations are then performed through this gate circuit to complete the given computational task. Obfuscated circuit algorithms, after representing the computational task as a gate circuit, encrypt each line of each logic gate. The encrypted gate circuit is called an obfuscated circuit. Thus, when both parties need to input their own data and then compute a result using the same function, the obfuscated circuit can ensure that the input data of each party is not known to the other party, thereby achieving secure multi-party computation. Further details are omitted here; please refer to the following: Figure 1 The description in the corresponding embodiment.

[0042] (2) The Oblivious Transfer (OT) protocol is a secure computation protocol executed by both parties. It allows one party (sender) to transmit one or more data items from a set of data to another party (receiver). During the transmission, the sender is unaware of which specific data items from this set have been transmitted (or in other words, the sender is unaware of which specific data items the receiver has obtained). Furthermore, the receiver, besides receiving the data items it selected, cannot know the other unselected data, thus achieving secure information transmission while maintaining the privacy of both parties. For example, the sender holds N secret input data items, and the receiver holds a secret choice p. The execution result of the Oblivious Transfer protocol is that the receiver receives the p-th input data item from the N input data items, while the sender's other input data remains confidential, and the sender cannot know the receiver's p, i.e., cannot know the specific data obtained by the receiver. For example, the aforementioned N secret input data items could be the identity information or credit ratings of N users, etc., which are not specifically limited in this specification.

[0043] Unintentional transmission protocols exist in various types, such as:

[0044] In 1-out-of-2OT (2 out-of-2 timeout) transmission, the sender holds two data sets, and the receiver can choose to retrieve one of them without the sender's knowledge of the choice.

[0045] In 1-out-of-n OT (One Out of N Data Points), the sender holds n data points, and the receiver can choose to receive one of them without the sender knowing the choice.

[0046] In the k-out-of-n OT (k-out-of-n OT) method, the sender holds n data items, and the receiver can obtain k of them without the sender knowing which ones were selected. k is an integer greater than 1 and less than n.

[0047] Random OT (Random Optical Transfer) is a secure computation protocol executed by both parties. Executing Random OT allows the sender to receive n random data items, and the receiver to receive a random choice and the corresponding random data. Random OT can be used as a tool to implement other secure computation protocols, etc., which will not be detailed here; please refer to the following for more information. Figure 2 The description in the corresponding embodiment.

[0048] For example, please refer to Figure 1 , Figure 1 This is a schematic diagram of a logic gate circuit provided in an exemplary embodiment. For example... Figure 1As shown, this gate circuit includes two AND gates, AND gate 1 and AND gate 2. a, b, and d are three input data points (or input wires), each representing one bit, meaning a, b, and d can all be either 0 or 1. AND gate 1 has input wires a and b, and its output wire c. AND gate 2 has input wires c and d, and its output wire s. It's easy to understand... Figure 1 The actual computation task performed by the gate circuit shown can be s = a AND b AND d, where AND represents AND computation.

[0049] It should be noted that obfuscated circuit algorithms are generally divided into an obfuscated truth table generation stage and an obfuscated circuit operation stage. One party participating in multi-party secure computation can act as the obfuscated circuit generator, generating an obfuscated truth table corresponding to the logic gates contained in the obfuscated circuit during the obfuscated truth table generation stage, i.e., generating the obfuscated circuit; the other party acts as the obfuscated circuit executor, performing operations based on the obfuscated truth table during the obfuscated circuit operation stage.

[0050] (1) Obfuscation of the truth table generation stage:

[0051] For example, with Figure 1 Taking AND gate 1 as an example, the obfuscating circuit executor can hold the input data 'a' of AND gate 1, the obfuscating circuit generator can hold the input data 'b' of AND gate 1, and the output data of AND gate 1 is 'c'. First, the obfuscating circuit generator can generate a truth table to express the operational logic of AND gate 1. The truth table of a logic gate indicates the corresponding value of the output data (e.g., 'c') when the two input data (e.g., 'a', 'b') take any value. For example, the truth table of AND gate 1 can be shown in Table 1 below.

[0052] Table 1

[0053]

[0054]

[0055] As shown in Table 1 above, the output data c is 1 only when the input data a and b of AND gate 1 are both 1. Otherwise, the output data c is 0.

[0056] Furthermore, in order to hide the true values ​​of each data point during the calculation process, the 0 and 1 values ​​of a, b, and c need to be replaced with random values, resulting in the replacement table shown in Table 2 below.

[0057] Table 2

[0058] a b c <![CDATA[A0]]> <![CDATA[B0]]> <![CDATA[C0]]> <![CDATA[A0]]> <![CDATA[B1]]> <![CDATA[C0]]> <![CDATA[A1]]> <![CDATA[B0]]> <![CDATA[C0]]> <![CDATA[A1]]> <![CDATA[B1]]> <![CDATA[C1]]>

[0059] As shown in Table 2 above, the obfuscation circuit generator can randomly generate six different random values, A0, A1, B0, B1, C0, and C1, to replace the corresponding 0 and 1 in Table 1 above. Among them, A0 is the random value corresponding to the value of a being 0 (i.e., the obfuscation value, or label), A1 is the random value corresponding to the value of a being 1, and B0, B1, C0, and C1 are similar, which will not be elaborated here.

[0060] Furthermore, the obfuscation circuit generator can use the obfuscation values ​​of the two input data in each row as a key to encrypt the obfuscation values ​​of the output data, resulting in the encryption table shown in Table 3 below.

[0061] Table 3

[0062] a b c <![CDATA[A0]]> <![CDATA[B0]]> <![CDATA[Enc A0，B0 (C0)]]> <![CDATA[A0]]> <![CDATA[B1]]> <![CDATA[Enc A0，B1 (C0)]]> <![CDATA[A1]]> <![CDATA[B0]]> <![CDATA[Enc A1，B0 (C0)]]> <![CDATA[A1]]> <![CDATA[B1]]> <![CDATA[Enc A1，B1 (C1)]]>

[0063] As shown in Table 3 above, C0 is encrypted using A0 and B0 (e.g., symmetric encryption), resulting in the ciphertext Enc. A0，B0 (C0) is encrypted using A0 and B1 to obtain the ciphertext Enc. A0，B1 (C0) is encrypted using A1 and B0 to obtain the ciphertext Enc. A1，B0 (C0) is encrypted using A1 and B1 to obtain the ciphertext Enc. A1，B1 (C1). Thus, given a scrambled value for input data a and a scrambled value for input data b, one row in Table 3 can be decrypted, thereby obtaining a scrambled value for output data c.

[0064] Furthermore, to make the content of each row in the encryption table independent of the row number, the obfuscation circuit generator can shuffle the order of the rows. For example, by swapping the order of the second and third rows, the final obfuscated truth table can be shown in Table 4 below.

[0065] Table 4

[0066] a b c <![CDATA[A0]]> <![CDATA[B0]]> <![CDATA[Enc A0，B0 (C0)]]> <![CDATA[A1]]> <![CDATA[B0]]> <![CDATA[Enc A1，B0 (C0)]]> <![CDATA[A0]]> <![CDATA[B1]]> <![CDATA[Enc A0，B1 (C0)]]> <![CDATA[A1]]> <![CDATA[B1]]> <![CDATA[Enc A1，B1 (C1)]]>

[0067] At this point, the obfuscated circuit generator has completed the generation of the obfuscated truth table for AND gate 1. The obfuscated truth table for AND gate 2 is generated in the same way. After generating the obfuscated truth tables for each logic gate, the obfuscated circuit generator can send the obfuscated truth tables to the obfuscated circuit executor to perform the obfuscated circuit operation.

[0068] (2) Confusion circuit operation stage:

[0069] The obfuscated circuit executor obtains the obfuscated truth table of AND gate 1 sent by the obfuscated circuit generator. In addition, the obfuscated circuit executor also needs to obtain the obfuscated value of input data a and the obfuscated value of input data b, so as to decrypt the obfuscated value of the corresponding output data c based on the above obfuscated truth table.

[0070] Since the obfuscation circuit generator holds the input data b, it can directly send the obfuscated value (B0) of input data b to the obfuscation circuit executor. However, for the input data a held by the obfuscation circuit executor, both parties need to execute an unintentional transmission protocol so that the obfuscation circuit executor can obtain the obfuscated value of input data a.

[0071] Specifically, the obfuscation circuit generator, acting as the sender of the OT protocol, first generates obfuscated values ​​corresponding to the two possible values ​​0 and 1, namely, obfuscated values ​​for 0 and 1, and uses these obfuscated values ​​as the two secret inputs of the OT protocol. The obfuscation circuit executor, acting as the receiver of the OT protocol, can use its input data 'a' as a secret option of the OT protocol to select the obfuscated value corresponding to the true value of 'a' from the two secret inputs. As mentioned above, when 'a' = 0, the execution result of the OT protocol is that the obfuscation circuit executor obtains the obfuscated value of 0, i.e., A0 in the table; when 'a' = 1, the execution result of the OT protocol is that the obfuscation circuit executor obtains the obfuscated value of 1, i.e., A1 in the table. Furthermore, the obfuscation circuit sender does not know which obfuscated value the obfuscation circuit executor has obtained.

[0072] After obtaining the obfuscated truth table and the obfuscated values ​​of the input data, the obfuscated circuit can use the obfuscated values ​​of 'a' and 'b' to attempt to decrypt each row in the obfuscated truth table of AND gate 1. Ultimately, it can only successfully decrypt one row, thus obtaining an obfuscated value for the output data 'c'. Furthermore, the obfuscated circuit can use the obfuscated values ​​of 'c' and 'd' to attempt to decrypt each row in the obfuscated truth table of AND gate 2. Ultimately, it can only successfully decrypt one row, thus obtaining an obfuscated value for the output data 's'.

[0073] In one illustrated embodiment, the obfuscated circuit executor can send the final output of the obfuscated circuit (i.e., the obfuscated value of s) to the obfuscated circuit generator. Correspondingly, the obfuscated circuit generator can translate the obfuscated value of s back to its true value based on translation rules corresponding to the obfuscation rules used when generating the obfuscated value, thereby obtaining the actual computation result of the obfuscated circuit. Furthermore, the obfuscated circuit generator can send this computation result to the obfuscated circuit executor. Thus, using an obfuscated circuit enables secure multi-party computation without disclosing data from either party.

[0074] In one illustrated embodiment, the obfuscation circuit also employs optimization methods such as free XOR and point permute. The construction of the obfuscation value differs after applying these optimization methods. The obfuscation circuit calculation method provided in this application can be a further improvement based on these two optimization methods.

[0075] In the obfuscation circuit, after applying free XOR, the obfuscated value of 0 and the obfuscated value of 1 for any line satisfy: obfuscated value of 1 = obfuscated value of 0 ⊕ Δ. Here, Δ is a random bit string generated by the obfuscation circuit generator, kept secret from the obfuscation circuit executor, and ⊕ is the bitwise XOR operation. After applying free XOR, the XOR gate in the circuit no longer needs an obfuscation truth table; the obfuscated value of the output data (1 bit) can be obtained directly by XORing the obfuscated values ​​of the two input data (1 bit), thus simplifying the calculation process of the obfuscation circuit and improving computational efficiency.

[0076] In this process, by applying both free XOR and point & permute in the obfuscation circuit, the lowest bit of the random bit string Δ is fixed at 1, while the other bits are random. Based on this, the obfuscation circuit executor can determine which row in the obfuscation truth table should be decrypted based on the lowest bit of the obfuscation value (the ciphertext order of each row in the obfuscation truth table is also arranged according to certain rules), thus avoiding the complex process of trying to decrypt row by row, etc., which will not be elaborated further here.

[0077] In one illustrated embodiment, in a free XOR-optimized obfuscation circuit, an unintentional transfer protocol can also be used to enable the obfuscated value of input data 'a' to be acquired by the obfuscated circuit executor. For an example, please refer to... Figure 2 , Figure 2 This is an exemplary embodiment illustrating an unintentional transmission. (As shown) Figure 2 As shown, the obfuscated circuit executor holds 1 bit of input data 'a', which can be used as a secret option for the OT protocol.

[0078] The offline stage, or preprocessing stage, such as Figure 2 As shown, the obfuscated circuit executor and the obfuscated circuit generator execute a random OT protocol. The result is that the obfuscated circuit generator (i.e., the OT protocol sender) obtains two random values, r0 and r1, while the obfuscated circuit executor (i.e., the OT protocol receiver) obtains a random number i and the corresponding random value r. i The random values ​​r0 and r1 can be 128 bits or 256 bits of data; this specification does not specify a particular limit. Typically, the lengths of the random values ​​r0 and r1 are the same as the length of the random bit string Δ. The random number i is 1 bit, meaning i can take the value 0 or 1. Correspondingly, the random value r...i The random value can be randomly selected from an array consisting of random values ​​r0 and r1 as array elements, corresponding to the array index indicated by the random number i. In one illustrated embodiment, the value of the random number i can be determined as the value of the array index, that is, the random number i is used as the array index. The array index is used to represent the array element at the corresponding position in the array. For example, an array index of 0 can represent the first array element, an array index of 1 can represent the second array element, and so on, which will not be elaborated further here. For example, if the random number i = 0, then the array index is 0, and correspondingly, the random value r obtained by the obfuscating circuit executor is... i Let r0 be the first random value in the array composed of random values ​​r0 and r1 as array elements; if the random number i = 1, then the array index is 1, and the corresponding random value r obtained by the aliasing circuit executor is r1. i Let r1 be the second random value in the array consisting of random values ​​r0 and r1.

[0079] During the online phase, such as Figure 2 As shown, the obfuscation circuit executor calculates the XOR result e of the random number i and the input data a, and sends the XOR result e to the obfuscation circuit generator. Correspondingly, the obfuscation circuit generator receives the XOR result e and randomly selects a random value r from the array composed of r0 and r1 that corresponds to the array index indicated by the XOR result e. e Furthermore, the scrambling circuit generator can be based on a random value r. e Calculate two obfuscation values ​​corresponding to the two possible values ​​of input data a, namely 0 and 1, such as... Figure 2 As shown, specifically, the confusion value of 0 is calculated: L0 = h(r e The obfuscation values ​​are: L1 = L0 ⊕ Δ, where L0 is A0 in the above obfuscation truth table, and L1 is A1 in the above obfuscation truth table. The h() function is a hash function, which is used to hash the input random value (e.g., r). e After some kind of operation, it outputs a random value of the same length as the random bit string Δ. For example, if r... e The length of the random bit string Δ is 256 bits, and the length of the random bit string Δ is 128 bits. Therefore, based on the hash function, we can calculate the hash value r. e The corresponding 128-bit hash value h(r) e ), and then use the hash value h(r) e The obfuscation value L0 is determined to be 0. It should be understood that if the length of the original input random value is the same as the length of the random bit string Δ (e.g., r...), then... eIf both the input and random bit string Δ have a length of 128 bits, then the hash function can also directly output the original random value without performing any calculations, i.e., h(r e ) = r e .

[0080] like Figure 2 As shown, the obfuscation circuit generator calculates f = h(r0)⊕h(r1)⊕Δ and sends the calculated f to the obfuscation circuit executor. Correspondingly, as... Figure 2 As shown, the obfuscating circuit executor receives f calculated by the obfuscating circuit generator and determines the value of its input data a. If a = 0, then based on the obtained random value r... i Calculate the confusion value of a: L a =h(r i It is not difficult to understand that the L calculated at this time... a That is, A0 as mentioned above; if a = 1, then based on the obtained random value r i Calculate the confusion value of a using f: L a =h(r i )⊕f, it is not difficult to understand that L calculated at this time a That is, A1 mentioned above.

[0081] As mentioned above, both parties utilize the random information obtained from running the random OT protocol to... Figure 2 The calculation method shown allows the obfuscation circuit generator to generate two obfuscated values, L0 and L1, corresponding to the two possible values ​​(0 and 1) of the input data a held by the obfuscation circuit executor. The obfuscation circuit executor, in turn, can obtain the obfuscated value L corresponding to the actual value of the input data a it holds. a .

[0082] Furthermore, after obtaining the obfuscated value of the input data, the obfuscating circuit execution unit can perform obfuscating circuit operations according to the above obfuscating truth table, and so on.

[0083] As mentioned above, an obfuscated circuit often includes multiple logic gates. When executing each logic gate, the obfuscated circuit generator typically needs to first generate an obfuscated truth table corresponding to that logic gate and send it to the obfuscated circuit executor. The obfuscated circuit executor then calculates the output of that logic gate based on the obfuscated truth table and the obfuscated values ​​of the input data from both sides. If an obfuscated truth table needs to be generated for each logic gate executed, it will waste a lot of time, making the computational efficiency of the obfuscated circuit extremely low.

[0084] Based on this, this specification provides a technical solution. Considering that the input data held by the obfuscated circuit executor can only be 0 or 1, the obfuscated circuit generator can first calculate the two possible output data of the current logic gate based on the two possible values ​​of 0 or 1. Then, by running the unintentional transmission protocol, the obfuscated circuit executor calculates the obfuscated value of the actual output data as the output of the logic gate based on the real value of the input data it holds.

[0085] In implementation, this application can be applied to a first computing device corresponding to the obfuscated circuit executor, the obfuscated circuit comprising a plurality of logic gates. The first computing device can hold first input data corresponding to the first logic gate of the obfuscated circuit, the first input data being 1-bit data with a value of 0 or 1. A second computing device corresponding to the obfuscated circuit generator can hold a plurality of expected output data corresponding to the first logic gate, wherein the plurality of expected output data can include first output data calculated when the first input data is 0, and second output data calculated when the first input data is 1. In one illustrated embodiment, the first and second computing devices can run a random accidental transfer protocol. The second computing device can obtain a first random value and a second random value generated by running the random accidental transfer protocol. The first computing device can obtain a random number i generated by running the random accidental transfer protocol, and a random value r randomly selected from an array composed of the first and second random values ​​as array elements, corresponding to the array index indicated by the random number i. i The random number i can take the value of 0 or 1. The first computing device can receive the intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data. Further, if the value of the first input data held by the first computing device is 0, the first computing device can calculate the intermediate calculation result corresponding to the output result of the first logic gate based on the obtained random value r. i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate. If the value of the first input data held by the first computing device is 1, then the first computing device can use the obtained random value r... i The obfuscation value corresponding to the second output data is calculated based on the intermediate calculation results, and the obfuscation value is used as the output result of the first logic gate.

[0086] In the above technical solution, considering that in the calculation of some simple logic gates contained in the obfuscated circuit, the input data (e.g., a bit) held by the obfuscated circuit executor corresponding to the logic gate can only be 0 or 1, the obfuscated circuit generator can first calculate the two possible output data (e.g., first output data and second output data) corresponding to the logic gate based on these two possible values ​​of 0 or 1. Furthermore, by running the unintentional transfer protocol, the obfuscated circuit executor can calculate the obfuscated value of the actual output data as the output of the logic gate based on the true value of the input data it holds, directly completing the calculation of a logic gate in the obfuscated circuit without the need to generate an obfuscated truth table corresponding to the logic gate, saving a lot of time and improving the computational efficiency of the obfuscated circuit.

[0087] Please see Figure 3 , Figure 3 This is a schematic diagram of a system architecture provided in an exemplary embodiment. One or more embodiments provided in this specification can be used... Figure 3 The specific implementation is carried out in the system architecture shown or a similar system architecture.

[0088] like Figure 3 As shown, the system includes a computing device 100 corresponding to the obfuscation circuit executor and a computing device 200 corresponding to the obfuscation circuit generator. In one illustrated embodiment, the computing device 100 and the computing device 200 may establish a communication connection in any possible manner, which is not specifically limited in this specification.

[0089] In one illustrated embodiment, the obfuscated circuit may include several logic gates, such as AND gates, NOT gates, NAND gates, NOR gates, XOR gates, etc. These logic gates can be connected in sequence and combined with each other to realize complete and complex logical operations, thereby completing the specified computational task.

[0090] In one illustrated embodiment, the computing device 100 corresponding to the executor of the obfuscating circuit may hold first input data corresponding to a first logic gate among a plurality of logic gates included in the obfuscating circuit. The first input data may be 1 bit, and its value may be 0 or 1. For example, the first logic gate may be an AND gate, NOT gate, NAND gate, NOR gate, or XOR gate, etc., and this specification does not specifically limit it.

[0091] In one illustrated embodiment, the computing device 200 corresponding to the scrambling circuit generator can hold second input data corresponding to the first logic gate. The second input data can be 1 bit. Accordingly, the first logic gate can be used to calculate the logical operation result of the first input data and the second input data, such as the XOR result, AND result, NOR result, etc. This specification does not specifically limit this.

[0092] In one illustrated embodiment, the first logic gate in this specification, besides the simple AND, NOT, and XOR gates described above, can also represent a computation function (e.g., an objective function) used to calculate the result of a function computation between the first input data and the second input data. This specification does not specifically limit the specific type of this computation function. Correspondingly, the second input data can also be data of arbitrary length, such as 2 bits, 8 bits, or 128 bits. Thus, the first logic gate can also be used to calculate the result of a function computation between a bit and data of arbitrary length, and so on. This specification does not specifically limit this. It should be understood that when the computation function is a function used to perform an XOR operation on two input bits, then the computation function is equivalent to an XOR gate; the same applies to AND and NOT gates, which will not be elaborated further here.

[0093] Understandably, although the first input data held by computing device 100 is kept confidential—that is, computing device 200 cannot know the actual value of the first input data—considering that the first input data has only two possible values, 0 or 1, computing device 200 can still calculate multiple expected output data corresponding to the first logic gate based on these two possible values. These multiple expected output data may include: first output data calculated by computing device 200 based on the value 0 and the second input data when the first input data is 0; and second output data calculated by computing device 200 based on the value 1 and the second input data when the first input data is 1.

[0094] In the offline phase before the formal commencement of the scrambled circuit calculation, computing devices 100 and 200 can run a random accidental transfer protocol. Computing device 200 can obtain a first random value (which can be denoted as r0) and a second random value (which can be denoted as r1) generated by running the random accidental transfer protocol. Computing device 100 can obtain a random number (which can be denoted as i) and its corresponding random value (which can be denoted as r) generated by running the random accidental transfer protocol. i The random number i can take the value 0 or 1, and the random value r i It can be a random value randomly selected from the array formed by the first random value r0 and the second random value r1 as array elements, corresponding to the array index indicated by the random number i. For details, please refer to the above. Figure 2 The descriptions in the corresponding embodiments will not be repeated here.

[0095] Furthermore, during the online phase of the confusing circuit calculation, the computing device 200 can calculate an intermediate calculation result (which can be denoted as f) corresponding to the output result of the first logic gate based on the first random value r0, the second random value r1, the first output data, and the second output data it holds, and send the intermediate calculation result f to the computing device 100. Accordingly, the computing device 100 can receive the intermediate calculation result f.

[0096] Furthermore, the computing device 100 can determine the value of the first input data it holds and calculate the obfuscation value of the actual output data corresponding to that value, thereby directly calculating the output result of the first logic gate.

[0097] In one illustrated embodiment, if the value of the first input data is 0, the corresponding actual output data should be the aforementioned first output data. Then, the computing device 100 can calculate based on the acquired random value r. i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate.

[0098] In one illustrated embodiment, if the value of the first input data is 1, the corresponding actual output data should be the aforementioned second output data. Then, the computing device 100 can calculate based on the acquired random value r. i The intermediate calculation result f is used to calculate the obfuscation value corresponding to the second output data mentioned above, and this obfuscation value is used as the output result of the first logic gate. See below for details. Figure 4 The description of the corresponding embodiments will not be elaborated here.

[0099] In one illustrated embodiment, computing device 100 and computing device 200 may be a laptop computer, desktop computer, server, server cluster consisting of multiple servers, or cloud computing service center with the above-described functions, etc., and this specification does not specifically limit them.

[0100] Thus, this application takes into account that in the calculation of some simple logic gates contained in the obfuscating circuit, the value of the input data (1 bit) corresponding to the logic gate held by the obfuscating circuit executor can only be 0 or 1. By pre-calculating the two possible expected output data corresponding to 0 or 1 and the unintentional transmission protocol, the obfuscated value of the actual output data can be directly calculated, and the calculation of a logic gate in the obfuscating circuit is directly completed. There is no need to generate an obfuscated truth table corresponding to the logic gate, saving a lot of time and greatly improving the calculation efficiency of the obfuscating circuit.

[0101] Please see Figure 4 , Figure 4 This is a schematic flowchart illustrating a method for calculating obfuscated circuits, provided in an exemplary embodiment. This method can be applied to... Figure 3 The system architecture shown can be specifically applied to Figure 3 The computing device 100 in the system architecture shown corresponds to the execution of the obfuscated circuit. For example... Figure 4 As shown, the method for calculating the confusion circuit may specifically include the following steps S401-S404.

[0102] Step S401: The first computing device obtains a random number i, and from the array formed by the first random value and the second random value obtained from the second computing device as array elements, a random value r is randomly selected that corresponds to the array index indicated by the random number i. i The first computing device holds first input data corresponding to the first logic gate included in the obfuscation circuit, the first input data being 1-bit data with a value of 0 or 1; the second computing device holds a plurality of expected output data corresponding to the first logic gate, wherein the plurality of expected output data includes first output data calculated when the value of the first input data is 0, and second output data calculated when the value of the first input data is 1.

[0103] First, as described above, the first computing device (e.g., the one mentioned above) that participates in the calculation of the obfuscated circuit and corresponds to the obfuscated circuit executor Figure 3 The computing device 100 shown can hold the first input data of the first logic gate contained in the obfuscated circuit, such as input data a; and the second computing device corresponding to the obfuscated circuit generator (e.g., the one described above) Figure 3 The computing device 200 shown can hold the second input data of the first logic gate, such as input data b.

[0104] The first input data is 1 bit, which can be either 0 or 1. The second input data can be data of any length, such as t bits, where t is an integer greater than or equal to 1.

[0105] In addition, the second computing device also holds two expected output results of the first logic gate corresponding to the two possible values ​​of 0 and 1 of the first input data, including: the first output data calculated by the second computing device when the first input data is 0 (which can be denoted as x[0]), and the second output data calculated by the second computing device when the first input data is 1 (which can be denoted as x[1]).

[0106] In one illustrated embodiment, the computing device 200 may also hold an objective function (which may be denoted as g) corresponding to the logic gate. Accordingly, the first logic gate may be used to take the first input data and the second input data as input data to the objective function g, and calculate the result of the objective function g. Taking the first input data as a and the second input data as b as an example, the result of the objective function g may be denoted as g(a, b).

[0107] In one of the illustrated embodiments, the objective function can be used to perform any possible computation, such as XOR computation, multiplication computation, etc., which are not specifically limited in this specification.

[0108] For example, considering that the first input data has only two possible values, 0 and 1, the second computing device can use the value 0 and the second input data b as input parameters of the objective function g to calculate the possible calculation result g(0, b) of the objective function g, that is, the first output data x[0]; the confusion circuit generator can also use the value 1 and the second input data b as input parameters of the objective function g to calculate another possible calculation result g(1, b) of the objective function g, that is, the second output data x[1].

[0109] For example, taking both a and b as 1 bit and the objective function g as a function that performs XOR calculation, the calculation result of the objective function g is g(a, b) = a⊕b. Accordingly, the first output data x[0] = g(0, b) = 0⊕b and the second output data x[1] = g(1, b) = 1⊕b.

[0110] Furthermore, as mentioned above Figure 3 As described in the corresponding embodiments, the first computing device and the second computing device can subsequently run the OT protocol in this application to enable the first computing device to obtain an obfuscated value of the actual output data corresponding to the true value of the first input data it holds, and so on.

[0111] It should be noted that, compared to the ordinary two-choice OT protocol, this application proposes a new type of OT protocol, which can be called a two-choice obfuscation value OT protocol. In one illustrated embodiment, since the execution result of the OT protocol in this application is that the first computing device obtains an obfuscated value of the actual output data corresponding to the true value of the first input data it holds, and the second computing device obtains obfuscated values ​​of the two expected output data, the new type of OT protocol provided by this application can also be called Yao Sharing OT (YSOT) protocol. The obfuscated values ​​held by each party can be used as a Yao secret sharing fragment of the actual output data. Only by combining the obfuscated values ​​held by each party can the true value of the actual output data be recovered.

[0112] In one of the illustrated implementations, please refer to Figure 5 , Figure 5 This is a schematic diagram illustrating the overall steps of a method for calculating a garbled circuit, as provided in an exemplary embodiment. Figure 5 As shown, Figure 5 Taking the first input data 'a' held by the executor of the obfuscated circuit as an example, the following will be combined with... Figure 5This application describes the YSOT protocol and the method for implementing obfuscated circuit calculation based on the YSOT protocol.

[0113] The entire process of the YSOT protocol can include offline and online phases.

[0114] like Figure 5 As shown, in the offline phase before the formal commencement of obfuscation circuit calculation, the first computing device corresponding to the obfuscation circuit executor and the second computing device corresponding to the obfuscation circuit generator can run a random accidental transfer protocol and obtain corresponding results. Specifically, the second computing device can obtain a first random value r0 and a second random value r1 generated by running the random accidental transfer protocol, and the first computing device can obtain a random number i and its corresponding random value r generated by running the random accidental transfer protocol. i In one illustrated embodiment, regarding r0, r1, i, r i The explanation can be found above. Figure 2 The descriptions in the corresponding embodiments will not be repeated here.

[0115] As mentioned above, the YSOT protocol proposed in this application still requires generating r0, r1, i, and r based on a random unintentional transmission protocol during the offline phase. i Therefore, it can be said that random unintentional transmission protocol is the foundation for building the YSOT protocol.

[0116] It should be noted that this specification does not specifically limit the particular implementation of the random accidental transmission protocol. Furthermore, in one illustrated embodiment, the aforementioned r0, r1, i, and r can also be generated by a trusted third-party random number server. i And send them to the corresponding first computing device and second computing device, or they can be generated by any other possible means. i ...etc., this instruction manual does not make specific limitations on this.

[0117] Step S402: Obtain the intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data.

[0118] like Figure 5As shown, in the online phase of the obfuscated circuit calculation, on the one hand, the first computing device can calculate the XOR result e of the random number i and the first input data a, i.e., e = i ⊕ a, and send the XOR result e to the second computing device. On the other hand, the second computing device can calculate the intermediate calculation result f corresponding to the output result of the first logic gate based on the first random value r0, the second random value r1, the first output data x[0], and the second output data x[1] it holds, and send the intermediate calculation result f to the first computing device. In one illustrated embodiment, the online phase of the obfuscated circuit calculation can be triggered in response to the execution instruction for the first logic gate, and this specification does not specifically limit this. For example, the first computing device can calculate the XOR result e in response to the execution instruction for the first logic gate and send the XOR result e to the second computing device. Correspondingly, the second computing device can calculate the intermediate calculation result f in response to the execution instruction for the first logic gate and send the intermediate calculation result f to the first computing device.

[0119] It should be noted that this specification does not impose any particular limitation on the order of execution of the above two operations. In one illustrated embodiment, in order to further improve computational efficiency, the operations performed by the first computing device and the second computing device can be performed simultaneously. That is, while the first computing device calculates the XOR result e and sends the XOR result e to the second computing device, the second computing device can calculate the intermediate calculation result f and send the intermediate calculation result f to the first computing device.

[0120] In one illustrated embodiment, when the second computing device calculates the intermediate calculation result f, it may specifically include: calculating the hash value h(r0) corresponding to the first random value r0 and the hash value h(r1) corresponding to the second random value r1 using a preset hash function. The hash function h() can be used to adjust the length of the input random value to a preset length, that is, the lengths of both hash values ​​h(r0) and h(r1) are preset lengths. The preset length can be the length of the random bit string Δ generated by the second computing device; in other words, the hash function h() can adjust the length of the input random value to the length of the random bit string Δ, as detailed above. Figure 2 The descriptions in the corresponding embodiments will not be repeated here.

[0121] Specifically, if Figure 5As shown, the second computing device can sequentially perform XOR calculations on the hash value h(r0) corresponding to the first random value r0, the hash value h(r1) corresponding to the second random value r1, the first multiplication result of the first output data x[0] and the random bit string Δ, and the second multiplication result of the second output data x[1] and the random bit string Δ, thereby calculating the intermediate calculation result f, i.e., f=h(r0)⊕h(r1)⊕x[0]Δ⊕x[1]Δ. Wherein, x[0]Δ is the first multiplication result of the first output data x[0] and the random bit string Δ, x[1]Δ is the second multiplication result of the second output data x[1] and the random bit string Δ, and ⊕ is the bitwise XOR calculation.

[0122] Furthermore, such as Figure 5 As shown, after receiving the XOR result e sent by the first computing device, the second computing device can also calculate the obfuscation value corresponding to the first output data x[0] and the obfuscation value corresponding to the second output data x[1] based on the XOR result e. The obfuscation values ​​corresponding to the first output data x[0] and the second output data x[1] can be used by the second computing device to construct an obfuscation truth table corresponding to the second logic gate contained in the obfuscation circuit. In one illustrated embodiment, the input line of the second logic gate can be connected to the output line of the first logic gate, and correspondingly, the obfuscation truth table can be used to perform logical calculations corresponding to the second logic gate using the output result of the first logic gate as input data. For example, please refer to... Figure 1 The first logic gate can be Figure 1 The AND gate 1 shown can be followed by the second logic gate. Figure 1 The output s of AND gate 2 and AND gate 1 (i.e. the first output data x[0] or the second output data x[1] mentioned above) can be further input into AND gate 2 as input data to perform the operation.

[0123] In one illustrated embodiment, when the second computing device calculates the obfuscation value corresponding to the first output data x[0] and the obfuscation value corresponding to the second output data x[1] based on the received XOR result e, it may specifically include:

[0124] First, such as Figure 5 As shown, the second computing device can randomly select a random value r from an array composed of a first random value r0 and a second random value r1 as array elements, which corresponds to the array index indicated by the received XOR result e. e It should be understood that the second computing device can only know the XOR result e calculated from the first input data a and the random number i, but cannot know the actual values ​​of the first input data a and the random number i, thus ensuring that the data held by the first computing device is not leaked.

[0125] Furthermore, the second computing device can calculate the hash function described above, along with the random value r. e The corresponding hash value h(r) e ), where the hash value h(r) e The length of ) is the same as the length of the random bit string Δ.

[0126] Furthermore, such as Figure 5 As shown, the second computing device can calculate the hash value h(r) e The XOR result of ) and x[0]Δ is denoted as L0, i.e., L0=h(r e )⊕x[0]Δ, and determine the XOR result L0 as the obfuscation value corresponding to the first output data x[0].

[0127] Furthermore, drawing upon the free XOR optimization method in the obfuscated circuit described in the above embodiments, such as... Figure 5 As shown, the second computing device can further calculate the XOR result L0 and the random bit string Δ, denoted as L1, i.e. L1=L0⊕Δ, and determine the XOR result L1 as the confusion value corresponding to the second output data x[1].

[0128] In one illustrated implementation, assuming the first logic gate is a logic gate that performs an XOR operation, and the second input data (e.g., b) is also 1 bit, with a value of 0 or 1, then the expected output data of the first logic gate has only two possible values: 0 or 1. For example, assuming the first output data x[0] has a value of 0 and the second output data x[1] has a value of 1, then the obfuscation value L0 corresponding to the first output data x[0] is the obfuscation value of 0 (or 0 label), and the obfuscation value L1 corresponding to the second output data x[1] is the obfuscation value of 1 (or 1 label).

[0129] Step S403, when the value of the first input data is 0, based on the random value r i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate.

[0130] Furthermore, after receiving the intermediate calculation result f sent by the second computing device, the first computing device can determine the value of the first input data a it holds, and calculate the confusion value of the actual output data corresponding to that value, thereby directly calculating the output result of the first logic gate.

[0131] In one illustrated embodiment, if the value of the first input data a is 0, the corresponding actual output data should be the aforementioned first output data x[0]. Then, the first computing device can base its calculation on the random value r generated by the random accidental protocol. iCalculate the obfuscation value corresponding to the first output data x[0] above, and use the obfuscation value as the output result of the first logic gate.

[0132] It should be noted that this manual does not explain how to base the random value r i The method for calculating the obfuscation value corresponding to the first output data x[0] is not specifically limited.

[0133] In one illustrated embodiment, the first computing device can generate a random value r i It is determined to be the obfuscated value corresponding to the first output data x[0].

[0134] In one illustrated embodiment, such as Figure 5 As shown, the first computing device can first calculate the hash value r based on the hash function. i The corresponding hash value h(r) i ), where the hash value h(r) i The length of ) is the same as the length of the random bit string Δ, and the hash value h(r) is... i The obfuscated value is determined to be the obfuscated value corresponding to the first output data x[0], and the obfuscated value is determined as the output result of the first logic gate.

[0135] In one illustrated embodiment, such as Figure 5 As shown, the output of the first logic gate can be denoted as L. x[a] , representing the obfuscation value of the actual output data corresponding to the true value of the first input data a. As mentioned above, when a = 0, L x[a] =h(r i ).

[0136] It should be understood that when a = 0, the XOR result e of the random number i and a depends on the value of the random number i. For example, when i = 0, the XOR result e = i ⊕ a = 0 ⊕ 0 = 0, while when i = 1, the XOR result e = i ⊕ a = 1 ⊕ 0 = 1. In other words, when a = 0, the XOR result e is consistent with the value of the random number i. Based on this, when a = 0, the first computing device can also be based on the random value r. e Calculate the obfuscation value corresponding to the first output data x[0], i.e. Figure 5 The L shown x[a] =h(r i )=h(r e ).

[0137] Step S404: When the value of the first input data is 1, based on the random value r... i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0138] In one illustrated embodiment, if the value of the first input data a is 1, the corresponding actual output data should be the aforementioned second output data x[1]. Then, the first computing device can base its calculation on the random value r generated by the random accidental protocol. i The received intermediate calculation result f is used to calculate the obfuscation value corresponding to the second output data x[1], and the obfuscation value is used as the output result of the first logic gate.

[0139] It should be noted that this manual does not explain how to base the random value r i The implementation method for calculating the obfuscation value corresponding to the first output data from the intermediate calculation result f is not specifically limited.

[0140] In one illustrated embodiment, such as Figure 5 As shown, the first computing device can first calculate the hash value r based on the hash function. i The corresponding hash value h(r) i ), where the hash value h(r) i The length of ) is the same as the length of the random bit string Δ. Then, the first computing device can calculate the hash value h(r). i The result of the XOR operation between the first logic gate and the intermediate calculation result f is determined as the obfuscated value corresponding to the second output data x[1], and the obfuscated value is used as the output result of the first logic gate.

[0141] In one illustrated embodiment, such as Figure 5 As shown, the output of the first logic gate can be denoted as L. x[a] , representing the obfuscation value of the actual output data corresponding to the true value of the first input data a. As mentioned above, when a = 1, L x[a] =h(r i )⊕f.

[0142] The calculations in this application will be explained below with several examples.

[0143] (1) Assume that the first logic gate is a logic gate that performs XOR calculation, and the first input data a = 0, the second input data b = 0, x[0] = 0, x[1] = 1, the first computing device obtains a random number i = 0 by running the random OT protocol, and the random value r i =r0.

[0144] The first computing device calculates: e = i ⊕ a = 0 ⊕ 0 = 0;

[0145] The second computing device calculates:

[0146] L0 = h(r) e )⊕x[0]Δ=h(r0)⊕0Δ=h(r0);

[0147] L1=L0⊕Δ=h(r0)⊕Δ;

[0148] f=h(r0)⊕h(r1)⊕x[0]Δ⊕x[1]Δ=h(r0)⊕h(r1)⊕0Δ⊕1Δ=h(r0)⊕h(r1)⊕Δ.

[0149] Since a = 0, the first computing device calculates L. x[a] =h(r i ) = h(r0).

[0150] (2) Assume that the first logic gate is a logic gate that performs XOR calculation, and the first input data a = 1, the second input data b = 0, x[0] = 0, x[1] = 1, the first computing device obtains a random number i = 0 by running the random OT protocol, and the random value r i =r0.

[0151] The first computing device calculates: e = i ⊕ a = 0 ⊕ 1 = 1;

[0152] The second computing device calculates:

[0153] L0 = h(r) e )⊕x[0]Δ=h(r1)⊕0Δ=h(r1);

[0154] L1=L0⊕Δ=h(r1⊕Δ;

[0155] f=h(r0)⊕h(r1)⊕x[0]Δ⊕x[1]Δ=h(r0)⊕h(r1)⊕0Δ⊕1Δ=h(r0)⊕h(r1)⊕Δ.

[0156] Since a = 1, the first computing device calculates L. x[a] =h(r i )⊕f=h(r0)⊕h(r0)⊕h(r1)⊕Δ=h(r1)⊕Δ.

[0157] (3) Assume that the first logic gate is a logic gate that performs XOR calculation, and the first input data a = 0, the second input data b = 0, x[0] = 0, x[1] = 1, the first computing device obtains a random number i = 1 by running the random OT protocol, and the random value r i =r1.

[0158] The first computing device calculates: e = i ⊕ a = 1 ⊕ 0 = 1;

[0159] The second computing device calculates:

[0160] L0 = h(r) e )⊕x[0]Δ=h(r1)⊕0Δ=h(r1);

[0161] L1=L0⊕Δ=h(r1⊕Δ;

[0162] f=h(r0)⊕h(r1)⊕x[0]Δ⊕x[1]Δ=h(r0)⊕h(r1)⊕0Δ⊕1Δ=h(r0)⊕h(r1)⊕Δ.

[0163] Since a = 0, the first computing device calculates L. x[a] =h(r i ) = h(r1).

[0164] In one illustrated embodiment, the entire calculation process of the YSOT protocol described in steps S401-S404 above can be denoted as YSOT(a, g(0, b), g(1, b)), where x[0] = g(0, b) and x[1] = g(1, b). The obfuscating circuit executor and the obfuscating circuit generator execute YSOT(a, g(0, b), g(1, b)), ultimately enabling the obfuscating circuit executor to directly obtain the obfuscated value of the actual output data that matches the true value of the input data a in the two expected output data (i.e., g(0, b) and g(1, b)) calculated by the obfuscating circuit generator based on the input data a it holds, that is, to obtain L x[a] .

[0165] In some possible implementations, x[0] and x[1] held by the aforementioned obfuscated circuit executor may simply be a set of data, rather than the expected output data for the logic gate; x[0] and x[1] can form an array as array elements. Thus, through the above... Figure 4 and Figure 5 The calculation process described in the corresponding embodiment can enable the obfuscating circuit executor to obtain the obfuscated value (i.e., label) corresponding to the data selected from the array composed of x[0] and x[1] according to the array index indicated by the first input data a held by itself, etc. This specification does not make specific limitations on this.

[0166] In some possible implementations, the first input data 'a' held by the obfuscated circuit executor and the second input data 'b' held by the obfuscated circuit generator can each be a Boolean fragment held by each party in the secret sharing, as described above. Figure 4 and Figure 5 The calculation process described in the corresponding embodiment can realize the conversion of the secretly shared Boolean fragments into the obfuscated values ​​of the obfuscated circuit, etc., but this specification does not specifically limit it.

[0167] In some possible implementations, there can be multiple sets of first input data a and second input data b, meaning that the obfuscation circuit executor and obfuscation circuit generator can perform multiple obfuscation circuit calculations. Correspondingly, there can also be multiple sets of x[0] and x[1]. For each set of x[0] and x[1], the above-described method can be used. Figure 4 and Figure 5 The calculation process described in the corresponding embodiment enables the obfuscating circuit executor to obtain the obfuscated value of the actual output data that matches the first input data a held in each group x[0] and x[1], etc., which is not specifically limited in this specification. For example, the original X[0] and X[1] can be 1 bit each, and can be further extended to X[0] and X[1] being t bits each (equivalent to having t groups of 1-bit X[0] and X[1]). In this case, the above X[0]Δ means that each bit of X[0] is multiplied by Δ, and the length of the multiplication result is t times the length of Δ. Similarly, X[1]Δ is the same. Correspondingly, the data length output by the above hash function h() is t times the length of Δ, etc., which is not specifically limited in this specification.

[0168] Please see Figure 6 , Figure 6 This is a schematic flowchart illustrating a method for calculating obfuscated circuits, provided in an exemplary embodiment. This method can be applied to... Figure 3 The system architecture shown can be specifically applied to Figure 3 The computing device 200 in the system architecture shown corresponds to the scrambling circuit generator. For example... Figure 6 As shown, the method for calculating the confusion circuit may specifically include the following steps S601-S602.

[0169] In step S601, the second computing device obtains the first random value and the second random value, and calculates the intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data and the second output data held by the second computing device corresponding to the first logic gate contained in the confusion circuit.

[0170] In one of the illustrated embodiments, the specific implementation of step S601 can be referred to the above. Figure 4 and Figure 5 The description of the corresponding embodiments will not be repeated here.

[0171] Step S602: The intermediate calculation result is sent to the first computing device, so that when the value of the first input data corresponding to the first logic gate held by the first computing device is 0, the first computing device calculates the result based on the random value r corresponding to the random number i. iCalculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0172] In one of the illustrated embodiments, the specific implementation of step S602 can be referred to the above. Figure 4 and Figure 5 The description of the corresponding embodiments will not be repeated here.

[0173] In summary, this application proposes a novel type of OT protocol, which can be called a "two-to-one obfuscation value OT protocol" or YSOT protocol. The difference between this and a conventional two-to-one OT protocol is that in a conventional two-to-one OT protocol, the receiver (i.e., the obfuscation circuit executor) can only obtain one of the two secret inputs from the sender (i.e., the obfuscation circuit generator), while in this application, the receiver (i.e., the obfuscation circuit executor) can directly obtain the obfuscation value of one of the two secret inputs from the sender (i.e., the obfuscation circuit generator).

[0174] Furthermore, the two secret inputs in the protocol of this application can also be the two expected output data of the logic gates calculated in advance. In this way, the calculation of a logic gate in the obfuscated circuit is directly completed through the YSOT protocol proposed in this application, without the need to generate an obfuscated truth table, saving a lot of time and greatly improving the computational efficiency of the obfuscated circuit.

[0175] Corresponding to the above method flow, embodiments of this specification also provide an obfuscation circuit computing device, applied to a first computing device corresponding to the obfuscation circuit executor. The obfuscation circuit includes a plurality of logic gates. The first computing device holds first input data corresponding to the first logic gates included in the obfuscation circuit, the first input data being 1-bit data with a value of 0 or 1. A second computing device corresponding to the obfuscation circuit generator holds a plurality of expected output data corresponding to the first logic gates, wherein the plurality of expected output data includes first output data calculated when the first input data is 0, and second output data calculated when the first input data is 1. Please refer to [link to relevant documentation]. Figure 7 , Figure 7 This is a schematic diagram of the structure of a garbled circuit computing device provided in an exemplary embodiment. For example... Figure 7 As shown, the device 70 includes:

[0176] The first acquisition unit 701 is used to acquire a random number i, and a random value r randomly selected from an array consisting of a first random value and a second random value obtained from the second computing device as array elements, which corresponds to the array index indicated by the random number i. i The random number i can be either 0 or 1.

[0177] The second acquisition unit 702 is configured to, in response to an execution instruction for the first logic gate, acquire an intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data; and,

[0178] Calculation unit 703 is used to calculate based on the random value r when the value of the first input data is 0. i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate; or, when the value of the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0179] In one illustrated embodiment, the second computing device further holds second input data corresponding to the first logic gate and an objective function, wherein the first logic gate is used to take the first input data and the second input data as input data to the objective function and calculate the result of the objective function.

[0180] In one illustrated embodiment, the first acquisition unit 701 is specifically used for:

[0181] Run a random accidental transmission protocol and obtain a random number i generated by running the random accidental transmission protocol, and a random value r randomly selected from an array consisting of a first random value and a second random value generated by running the random accidental transmission protocol on the second computing device, which are array elements, and the random value r corresponding to the array index indicated by the random number i. i .

[0182] In one illustrated embodiment, the computing unit 703 is specifically used for:

[0183] If the value of the first input data is 0, then the random value r is... i The value is determined to be the obfuscation value corresponding to the first output data.

[0184] In one illustrated embodiment, the computing unit 703 is specifically used for:

[0185] Based on a preset hash function, calculate the hash value r. i The corresponding hash value h(r) of the preset length i );

[0186] The hash value h(r) i The value is determined to be the obfuscation value corresponding to the first output data.

[0187] In one illustrated embodiment, the computing unit 703 is specifically used for:

[0188] If the value of the first input data is 1, then calculate the random value r. i The XOR result of the intermediate calculation results;

[0189] The XOR result is determined as the obfuscation value corresponding to the second output data.

[0190] In one illustrated embodiment, the computing unit 703 is specifically used for:

[0191] Based on a preset hash function, calculate the hash value r. i The corresponding hash value h(r) of the preset length i );

[0192] Calculate the hash value h(r) i The result of XORing the intermediate calculation results.

[0193] In one illustrated embodiment, the intermediate calculation result is the result obtained by the second computing device performing an XOR operation on the first random value, the second random value, the first output data, and the second output data in sequence.

[0194] In one illustrated embodiment, the intermediate calculation result is the result obtained by the second computing device sequentially performing an XOR operation on the hash value of a preset length corresponding to the first random value, the hash value of a preset length corresponding to the second random value, the first multiplication result of the first output data and the random bit string of a preset length, and the second multiplication result of the second output data and the random bit string.

[0195] In one illustrated embodiment, the device 70 further includes a transmitting unit 704, configured to:

[0196] The random number i is XORed with the first input data, and the result e is XORed with the second computing device. The second computing device calculates the obfuscation value corresponding to the first output data and the obfuscation value corresponding to the second output data based on the XOR result e.

[0197] The obfuscation value corresponding to the first output data and the obfuscation value corresponding to the second output data are used by the second computing device to construct an obfuscated truth table corresponding to the second logic gate contained in the obfuscated circuit; the obfuscated truth table is used to perform logical calculations corresponding to the second logic gate, with the output result of the first logic gate as the input data.

[0198] In one illustrated embodiment, the transmitting unit 704 is specifically used for:

[0199] The XOR result e is sent to the second computing device, so that the second computing device randomly selects a random value r from the array formed by the first random value and the second random value as array elements, which corresponds to the array index indicated by the XOR result e. e ;

[0200] Based on the preset hash function, calculate the hash value r. e The corresponding hash value h(r) of the preset length e );

[0201] Calculate the hash value h(r) e The product of the first multiplication and the first product are XORed to obtain the result L0, and the XOR result L0 is determined as the obfuscation value corresponding to the first output data; and,

[0202] Calculate the XOR result L0 and the XOR result L1 of the random bit string, and determine the XOR result L1 as the confusion value corresponding to the second output data.

[0203] Accordingly, embodiments of this specification also provide a scrambling circuit computing apparatus, applied to a second computing device corresponding to a scrambling circuit generator. The scrambling circuit includes a plurality of logic gates. A first computing device corresponding to a scrambling circuit executor holds first input data corresponding to the first logic gates included in the scrambling circuit. The first input data is a 1-bit data with a value of 0 or 1. The second computing device holds a plurality of expected output data corresponding to the first logic gates. The plurality of expected output data includes first output data calculated when the first input data is 0, and second output data calculated when the first input data is 1. Please refer to [link to previous document]. Figure 8 , Figure 8 This is a schematic diagram of the structure of a garbled circuit computing device provided in an exemplary embodiment. For example... Figure 8 As shown, the device 80 includes:

[0204] The acquisition unit 801 is used to acquire a first random value and a second random value, and calculate an intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data and the second output data;

[0205] Sending unit 802 is configured to send the intermediate calculation result to the first computing device, so that when the value of the first input data is 0, the first computing device calculates the result based on the obtained random value r corresponding to the random number i. i Calculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

[0206] Wherein, the random number i takes the value of 0 or 1, and the random value r i It is a random value randomly selected from the array formed by the first random value and the second random value as array elements, corresponding to the array index indicated by the random number i.

[0207] The specific implementation process of the functions and roles of each unit in the aforementioned devices 70 and 80 is detailed in the description of the above embodiments and will not be repeated here. It should be understood that the aforementioned devices 70 and 80 can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the CPU (Central Processing Unit) of the device loading the corresponding computer program instructions into memory for execution. From a hardware perspective, in addition to the CPU and memory, the device typically includes other hardware such as chips for wireless signal transmission and reception, and / or other hardware such as boards for implementing network communication functions.

[0208] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the units or modules can be selected to achieve the purpose of the solution described in this specification, depending on actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0209] The devices, units, and modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0210] Corresponding to the above method embodiments, embodiments of this specification also provide a computing device. Please refer to... Figure 9 , Figure 9 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Figure 9 The computing device shown can be a first computing device corresponding to the obfuscated circuit executor (e.g., Figure 3 The computing device 100 in the system architecture shown can be a second computing device (e.g., the one corresponding to the obfuscation circuit generator). Figure 3 The computing device 200 in the system architecture shown. Figure 9 As shown, the computing device includes a processor 1001 and a memory 1002, and may further include an input device 1004 (e.g., a keyboard) and an output device 1005 (e.g., a display). The processor 1001, memory 1002, input device 1004, and output device 1005 can be connected via a bus or other means. Figure 9 As shown, the memory 1002 includes a computer-readable storage medium 1003 that stores a computer program executable by the processor 1001. The processor 1001 may be a general-purpose CPU, a microprocessor, or an integrated circuit for controlling the execution of the above method embodiments. When the processor 1001 runs the stored computer program, it can execute various steps of the obfuscated circuit calculation method in the embodiments of this specification; please refer to the previous content for details, which will not be repeated here.

[0211] Corresponding to the above-described method embodiments, embodiments of this specification also provide a computer-readable storage medium storing computer programs that, when run by a processor, execute the various steps of the obfuscated circuit calculation method described in this specification. Please refer to the descriptions of the above embodiments for details, which will not be repeated here.

[0212] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

[0213] In a typical configuration, a terminal device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0214] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory. Memory is an example of computer-readable media.

[0215] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data.

[0216] Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0217] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0218] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program products implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A method for calculating a confused circuit, characterized in that, The obfuscation circuit is applied to a first computing device corresponding to an obfuscation circuit executor, the obfuscation circuit comprising a plurality of logic gates; the first computing device holds first input data corresponding to the first logic gates of the obfuscation circuit, the first input data being 1-bit data having a value of 0 or 1; a second computing device corresponding to an obfuscation circuit generator holds a plurality of expected output data corresponding to the first logic gates, wherein the plurality of expected output data includes a first output data calculated when the first input data has a value of 0, and a second output data calculated when the first input data has a value of 1; The method includes: From an array consisting of a random number i, a first random value, and a second random value obtained from the second computing device, a random value r is randomly selected that corresponds to the array index indicated by the random number i. i The random number i can be either 0 or 1. Obtain the intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data; When the value of the first input data is 0, based on the random value r i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate; or, when the value of the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

2. The method according to claim 1, characterized in that, The second computing device also holds second input data corresponding to the first logic gate and an objective function. The first logic gate is used to take the first input data and the second input data as input data of the objective function and calculate the result of the objective function.

3. The method according to claim 1, characterized in that, The random value r, which is randomly selected from the array formed by obtaining the random number i and the first and second random values ​​obtained from the second computing device as array elements, corresponds to the array index indicated by the random number i. i ,include: Run a random accidental transmission protocol and obtain a random number i generated by running the random accidental transmission protocol, and a random value r randomly selected from an array consisting of a first random value and a second random value generated by running the random accidental transmission protocol on the second computing device, which are array elements, and the random value r corresponding to the array index indicated by the random number i. i .

4. The method according to claim 1, characterized in that, When the value of the first input data is 0, based on the random value r i Calculating the obfuscation value corresponding to the first output data includes: When the value of the first input data is 0, the random value r is... i The value is determined to be the obfuscation value corresponding to the first output data.

5. The method according to claim 4, characterized in that, The random value r i The obfuscation values ​​identified as corresponding to the first output data include: Based on a preset hash function, calculate the hash value r. i The corresponding hash value h(r) of the preset length i ); The hash value h(r) i The value is determined to be the obfuscation value corresponding to the first output data.

6. The method according to claim 1, characterized in that, When the value of the first input data is 1, based on the random value r i Calculating the obfuscation value corresponding to the second output data based on the intermediate calculation results includes: If the value of the first input data is 1, then calculate the random value r. i The XOR result of the intermediate calculation results; The XOR result is determined as the obfuscation value corresponding to the second output data.

7. The method according to claim 6, characterized in that, The length of the intermediate calculation result is a preset length; the calculation of the random value r i The XOR result of the intermediate calculation result includes: Based on a preset hash function, calculate the hash value r. i The corresponding hash value h(r) of the preset length i ); Calculate the hash value h(r) i The result of XORing the intermediate calculation results.

8. The method according to claim 7, characterized in that, The intermediate calculation result is the result obtained by the second computing device performing an XOR operation on the first random value, the second random value, the first output data, and the second output data in sequence.

9. The method according to claim 8, characterized in that, The intermediate calculation result is the result obtained by the second computing device performing an XOR operation on the hash value of a preset length corresponding to the first random value, the hash value of a preset length corresponding to the second random value, the first multiplication result of the first output data and the random bit string of a preset length, and the second multiplication result of the second output data and the random bit string.

10. The method according to claim 9, characterized in that, The method further includes: The random number i is XORed with the first input data, and the result e is XORed with the second computing device, so that the second computing device calculates the obfuscation value corresponding to the first output data and the obfuscation value corresponding to the second output data based on the XOR result e. The obfuscation value corresponding to the first output data and the obfuscation value corresponding to the second output data are used by the second computing device to construct an obfuscated truth table corresponding to the second logic gate contained in the obfuscated circuit; the obfuscated truth table is used to perform logical calculations corresponding to the second logic gate, with the output result of the first logic gate as the input data.

11. The method according to claim 10, characterized in that, Sending the XOR result e to the second computing device, so that the second computing device calculates the obfuscation value corresponding to the first output data and the obfuscation value corresponding to the second output data based on the XOR result e, includes: The XOR result e is sent to the second computing device, so that the second computing device randomly selects a random value r from the array formed by the first random value and the second random value as array elements, which corresponds to the array index indicated by the XOR result e. e ; Based on the preset hash function, calculate the hash value r. e The corresponding hash value h(r) of the preset length e ); Calculate the hash value h(r) e The product of the first multiplication and the first product are XORed to obtain the result L0, and the XOR result L0 is determined as the obfuscation value corresponding to the first output data; and, Calculate the XOR result L0 and the XOR result L1 of the random bit string, and determine the XOR result L1 as the confusion value corresponding to the second output data.

12. A method for calculating a confused circuit, characterized in that, The system is applied to a second computing device corresponding to a generator of an obfuscation circuit, the obfuscation circuit comprising a plurality of logic gates; a first computing device corresponding to an executor of the obfuscation circuit holds first input data corresponding to the first logic gates contained in the obfuscation circuit, the first input data being 1-bit data having a value of 0 or 1; the second computing device holds a plurality of expected output data corresponding to the first logic gates; wherein, the plurality of expected output data includes first output data calculated when the first input data has a value of 0, and second output data calculated when the first input data has a value of 1; The method includes: Obtain a first random value and a second random value, and calculate an intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data, and the second output data; The intermediate calculation result is sent to the first computing device, so that when the value of the first input data is 0, the first computing device calculates the random value r corresponding to the random number i. i Calculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate. Wherein, the random number i takes the value of 0 or 1, and the random value r i It is a random value randomly selected from the array formed by the first random value and the second random value as array elements, corresponding to the array index indicated by the random number i.

13. A confused circuit computing device, characterized in that, The obfuscation circuit is applied to a first computing device corresponding to an obfuscation circuit executor, the obfuscation circuit comprising a plurality of logic gates; the first computing device holds first input data corresponding to the first logic gates of the obfuscation circuit, the first input data being 1-bit data having a value of 0 or 1; a second computing device corresponding to an obfuscation circuit generator holds a plurality of expected output data corresponding to the first logic gates, wherein the plurality of expected output data includes a first output data calculated when the first input data has a value of 0, and a second output data calculated when the first input data has a value of 1; The device includes: The first acquisition unit is used to acquire a random number i, and a random value r randomly selected from an array consisting of a first random value and a second random value obtained from the second computing device as array elements, which corresponds to the array index indicated by the random number i. i The random number i can be either 0 or 1. The second acquisition unit is configured to acquire an intermediate calculation result corresponding to the output result of the first logic gate, calculated by the second computing device based on the first random value, the second random value, the first output data, and the second output data; and The calculation unit is configured to, when the value of the first input data is 0, calculate based on the random value r. i Calculate the obfuscation value corresponding to the first output data, and use the obfuscation value as the output result of the first logic gate; or, when the value of the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate.

14. A confused circuit computing device, characterized in that, The system is applied to a second computing device corresponding to a generator of an obfuscation circuit, the obfuscation circuit comprising a plurality of logic gates; a first computing device corresponding to an executor of the obfuscation circuit holds first input data corresponding to the first logic gates contained in the obfuscation circuit, the first input data being 1-bit data having a value of 0 or 1; the second computing device holds a plurality of expected output data corresponding to the first logic gates; wherein, the plurality of expected output data includes first output data calculated when the first input data has a value of 0, and second output data calculated when the first input data has a value of 1; The device includes: The acquisition unit is used to acquire a first random value and a second random value, and to calculate an intermediate calculation result corresponding to the output result of the first logic gate based on the first random value, the second random value, the first output data and the second output data; The sending unit is configured to send the intermediate calculation result to the first computing device, so that when the value of the first input data is 0, the first computing device calculates the result based on the obtained random value r corresponding to the random number i. i Calculate the obfuscation value corresponding to the first output data and use the obfuscation value as the output result of the first logic gate; or, when the first input data is 1, calculate the obfuscation value based on the random value r. i The intermediate calculation results are used to calculate the obfuscation value corresponding to the second output data, and the obfuscation value is used as the output result of the first logic gate. Wherein, the random number i takes the value of 0 or 1, and the random value r i It is a random value randomly selected from the array formed by the first random value and the second random value as array elements, corresponding to the array index indicated by the random number i.

15. A computing device, characterized in that, include: Memory and processor; The memory stores computer programs that can be executed by the processor; When the processor runs the computer program, it performs the method as described in any one of claims 1 to 11, or performs the method as described in claim 12.

16. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 11, or implements the method as described in claim 12.

17. A computer program product, characterized in that, The computer program product includes a computer program / instruction that, when executed by a processor, implements the method as described in any one of claims 1 to 11, or implements the method as described in claim 12.

Images