Secret sharing and packaging method and device

Abstract

The embodiment of the invention provides a secret sharing and packaging method and device. And the plurality of participants respectively encode vectors formed by secret sharing of k pieces of data owned by the participants in a specified domain space to respectively obtain first domain elements owned by the participants, and the first domain elements have data structures meeting addition homomorphism. Then, the multiple participants perform secret sharing addition operation based on first domain elements owned by the multiple participants through first data interaction based on secure multi-party calculation, so that the multiple participants respectively obtain secret sharing of first sum values of the first domain elements owned by the multiple parties; the secret sharing of the first sum value is used as the secret sharing of a second domain element obtained by coding a vector formed by k data in a directional domain space.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer technology, and in particular, to a secret sharing packaging method and device. Background Art

[0002] Secure Multi-Party Computation (MPC) is a cryptographic technology that allows multiple parties to perform calculations and analyses together while maintaining the privacy of their respective data. The core idea is to use cryptographic techniques and algorithms to encrypt the data of each party for calculation, so as to ensure that each party can only obtain the data and calculation results it needs, but cannot obtain the original data of other parties. Many business scenarios involve data calculation and interaction between multiple parties who cooperate with each other, but none of them want to leak their own private data. At this time, secure multi-party computing based on secret sharing has become a widely deployed security solution. At present, reducing the computational overhead in secure multi-party computing is a problem that needs to be continuously solved. For example, in the traditional Boolean secret sharing scheme, 1 bit of data needs to be accompanied by at least 40 bits of verification code when calculating, which leads to huge computational and communication overhead.

[0003] Therefore, it is hoped that there will be an improved solution that can reduce the overhead in secure multi-party computing. Summary of the invention

[0004] One or more embodiments of this specification describe a secret sharing packaging method and device to reduce the overhead in secure multi-party computing. The specific technical solution is as follows.

[0005] In a first aspect, an embodiment provides a secret sharing packaging method, which is performed by multiple parties and includes:

[0006] Multiple participants respectively encode vectors formed by secret sharing of k data owned by them in a specified domain space, and respectively obtain first domain elements owned by them; the first domain elements have a data structure satisfying additive homomorphism;

[0007] Multiple participants interact with each other through first data based on secure multi-party computing, and perform secret sharing addition operations based on the first domain elements owned by each party, so that the multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each party; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0008] In one implementation, the secret sharing of k data of any participant is obtained in the following manner:

[0009] The i-th bit of the secret sharing of k data to be processed is determined as the secret sharing of the k data.

[0010] In one embodiment, the method further comprises:

[0011] The multiple participants perform a designated operation based on the secret sharing of the second domain element obtained by each of them through the second data interaction based on secure multi-party computing, so that the multiple participants respectively obtain the secret sharing operation result;

[0012] The result after decoding the secret sharing operation result is equal to: the result obtained by multiple participants respectively based on the corresponding operation based on the secret sharing of the i-th bit of the k to-be-processed data owned by each party.

[0013] In one embodiment, the first data interaction includes:

[0014] The multiple participants share the first domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the first domain elements owned by any one of the participants;

[0015] Multiple participants respectively sum up the secret shares of multiple first domain elements obtained by each party to obtain a secret share of a first sum value.

[0016] In one embodiment, the method further includes: multiple participants using k random numbers to perform consistency verification on the secret sharing of the first sum value and the k data.

[0017] In one embodiment, the consistency check includes:

[0018] Multiple participants respectively encode vectors composed of secret sharing of k random numbers owned by them in a specified domain space, and respectively obtain third domain elements owned by them; the third domain elements have a data structure that satisfies additive homomorphism;

[0019] The multiple participants perform a secret sharing addition operation on the third domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the second sum value of the third domain elements owned by each of the multiple parties;

[0020] The multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain a secret sharing of a first combination value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain a secret sharing of a second combination value;

[0021] Any one of the participants reconstructs the first combined value based on the secret sharing of the first combined value obtained by multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value obtained by multiple participants. When the result after decoding the first combined value is equal to the second combined value, it is determined that the consistency check has passed.

[0022] In one embodiment, the designated domain space is a space containing a plurality of m-bit binary domain elements, and the encoding includes an operation based on a multiplication-friendly encoding RMFE.

[0023] In a second aspect, the embodiment provides a secret sharing packaging method, which is executed by any one of a plurality of participants, and includes:

[0024] Encode a vector formed by secret sharing of k data owned by the user in a specified domain space to obtain a first domain element; the first domain element has a data structure that satisfies additive homomorphism;

[0025] By interacting with other participants based on secure multi-party computing of the first data, secret sharing addition operations are performed based on the first domain elements owned by each party, so that multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by multiple parties; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0026] In a third aspect, an embodiment provides a secret sharing packaging system, the system comprising a plurality of participants;

[0027] A plurality of participants are respectively used to encode a vector formed by sharing secrets of k data owned by each party in a specified domain space, and respectively obtain a first domain element owned by each party; the first domain element has a data structure satisfying additive homomorphism;

[0028] Multiple participants are used to interact with each other through first data based on secure multi-party computing, and perform secret sharing addition operations based on the first domain elements owned by each party, so that the multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each party; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0029] In a fourth aspect, the embodiment provides a secret sharing packaging device, which is deployed in any one of multiple participants, including:

[0030] An independent encoding module is configured to encode a vector formed by secret sharing of k data owned by the independent encoding module in a specified domain space to obtain a first domain element; the first domain element has a data structure that satisfies additive homomorphism;

[0031] The joint summation module is configured to perform secret sharing addition operations based on the first domain elements owned by each party through first data interaction based on secure multi-party computing with other participants, so that multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by multiple parties; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0032] In a fifth aspect, an embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the methods in the first aspect and the second aspect.

[0033] In a sixth aspect, an embodiment provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the first aspect and the second aspect is implemented.

[0034] In the method and device provided in the embodiments of this specification, by packaging the secret sharing of k data into the secret sharing of a domain element, it is achieved to convert multiple secret sharing into a more compact packaged data. Performing specified operations based on the packaged data can achieve the effect of processing k data simultaneously using one verification code, thereby improving the performance of secure multi-party computing and reducing overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0037] Figure 2 A schematic diagram of a secret sharing packaging method is provided for an embodiment;

[0038] Figure 3 A schematic diagram of the packaging process and the computing process provided by the embodiment;

[0039] Figure 4A schematic block diagram of a secret sharing packaging system provided in an embodiment;

[0040] Figure 5 A schematic block diagram of a secret sharing packaging device provided in an embodiment. DETAILED DESCRIPTION

[0041] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0042] Figure 1 The present invention is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. It includes multiple participants such as participant P0, participant P1 and participant P2. Each of the multiple participants encodes the vector corresponding to the secret sharing of k data owned by itself in a specified space to obtain a domain element, so that each participant obtains its own domain element. Then, the multiple participants perform secret sharing addition operations on the domain elements owned by each of them through data interaction based on MPC, and each participant obtains the secret sharing of the sum of all domain elements. Through this packaging / encoding technology, the secret sharing of k data is converted into the secret sharing of 1 domain element, and the secret sharing of the sum value is the secret sharing of the domain element after directly encoding the vector composed of k data. Among them, k data is the complete data obtained by reconstructing the secret sharing of k data owned by multiple participants. Reconstruction may include operations such as addition. The k data are private data, and reconstruction operations will not be performed in practical applications. The k data and reconstruction operations here are only used for theoretical analysis. Figure 1 The multiple participants shown are only an example. In practical applications, the number of multiple participants can be 2 or more.

[0043] Multiple participants can communicate with each other through the Internet and jointly execute the pre-negotiated software protocol MPC. The MPC in this specification may include algorithms such as homomorphic encryption, secret sharing, zero-knowledge proof, oblivious transmission and obfuscated circuits. Among them, secret sharing (Secret Sharing) is also called secret sharing, which can divide a confidential information into multiple random fragments, each fragment is stored and managed by a different participant, and the original secret can only be restored when a certain number of participants cooperate. Among them, you can use <x>to represent the secret sharing of x, <x>The subscript represents the party that owns the secret. Secret sharing is a basic algorithm in MPC. It provides a method for secure information exchange without leaking each other's input. This algorithm mechanism is the cornerstone for building more complex secure multi-party computing protocols. Other secure multi-party computing algorithms can be executed based on the secret sharing algorithm.

[0044] In business processing, multiple participants have secret shares of some data to be processed, and multiple participants perform operations based on these secret shares. In order to ensure the security of the operation and prevent the participants from not performing the corresponding operations as agreed, a verification code will be attached when performing operations on the secret shares of the data to be processed. For example, in a two-party Boolean secret sharing scenario, two participants P0 and P1 each have a secret share of sensitive data x. <x>0 and <x>1, x is either 0 or 1.

[0045] The two parties have two global L-bit keys a0 and a1, and the secret sharing of x will be accompanied by L-bit verification codes m0 and m1. <x>0 and m0, and party P1 has a1, <x>1 and m1, and satisfy the following relationship:

[0046] x= <x> 0+ <x>1

[0047] m0+m1=( <x> 0+ <x>1)(a0+a1)

[0048] In practical applications, in order to ensure sufficient security, the value of L needs to be at least 40. Based on this Boolean secret sharing scheme, any subsequent operation results need to maintain such an equation, that is, the L-bit verification code corresponding to the result needs to be calculated, resulting in L-bit overhead for 1-bit data operation, which increases the cost by L times.

[0049] In order to reduce the computational overhead in secure multi-party computing, the embodiments of this specification provide a secret sharing packaging method, which can package and encode the secret sharing of k data into the secret sharing of 1 domain element. Multiple participants perform specified operations based on the domain element, and attach a verification code. The obtained operation result is decoded to obtain the result obtained by directly performing the corresponding operation on the k data. However, directly performing the corresponding operation on the k data requires k such verification codes, which is a huge overhead. Therefore, the packaging technology of the embodiments of this specification can reduce the overhead in secure multi-party computing.

[0050] It should be noted that multiple participants perform data computing operations through their respective computing devices. The computing devices of multiple participants (i.e., participant devices) are connected through network communication. Each computing device can be implemented by any device, equipment, platform, device cluster, etc. with computing and processing capabilities.

[0051] Combine the following Figure 2 Specific embodiments are described in detail.

[0052] Figure 2 The present invention provides a flow chart of a secret sharing packaging method. The method is performed by multiple participants. For ease of understanding, the present invention takes participants P0 and P1 as examples for explanation. The present embodiment specifically includes the following steps.

[0053] In step S210, multiple participants respectively encode the vectors formed by the secret sharing of k data they each own in the specified domain space to obtain the first domain elements they each own.

[0054] The first domain element has a data structure that satisfies addition homomorphism.

[0055] The specified domain space can be a certain numerical domain space, which is a finite field. The specified domain space contains multiple elements. The specified domain space involves corresponding encoding and decoding processes. The encoding algorithm used in the specified domain space is an algorithm that can satisfy the additive homomorphic property. The first domain element and other domain elements (collectively referred to as domain elements) obtained after encoding in the specified domain space have a data structure that satisfies additive homomorphism, that is, the domain elements have additive homomorphism and can maintain addition operations.

[0056] Homomorphism is an important concept in mathematics and cryptography, which describes the ability of a structure to maintain its operational properties under a mapping (such as an encoding function). The property that domain elements can maintain addition operations can be expressed as follows: after encoding two vectors X and Y into elements M and N in a specified domain space, if carry-free addition Z = M + N is performed on M and N, and Z is decoded back into a vector C, then it can be guaranteed that C is equal to the result of bitwise addition of X and Y, that is, for any i-th bit, C[i] = X[i] + Y[i] (no carry). Among them, C[i], X[i] and Y[i] represent the data of the i-th bit in C, X and Y respectively. This encoding and decoding process can be used to embed elements from a small finite field into a larger finite field and maintain a certain degree of homomorphism.

[0057] In information theory, cryptography and communication systems, binary field is an important numerical field and algebraic operation field. The following takes binary field as an example to explain the specified field space. In the binary field space, the elements are m-bit binary numbers. This field space is usually called a binary finite field, also known as a Galois Field GF(2 m ). In this domain, the operations on elements are modulo 2, that is, the main operations are addition without carry and multiplication.

[0058] The following uses the multiplication-friendly encoding RMFE algorithm as an example to explain the encoding algorithm in the binary domain space. RMFE (Reverse Multiplication-Friendly Embedding) is an encoding and decoding technology used in cryptography and MPC. It allows multiple values ​​to be encoded as polynomials so that these polynomials can be multiplied without leaking the information of the original values. RMFE is an encoding method applied in the binary domain space. Its input is a k-bit vector (each element is 0 or 1), and the output is an m-bit binary domain element through the mapping of the encoding function.

[0059] In this scenario, k data are binary numbers, and the values ​​of k data can be 0 or 1 respectively. The vector formed by the secret sharing of k data is a k-bit vector, in which the elements are 0 or 1. The first domain elements obtained by multiple participants are m-bit binary domain elements. Among them, the space where the k-bit vector is located is a k-bit vector space, and k is usually set between 10 and 20. RMFE can convert elements between vector space and binary domain space. In addition, in order to increase security, m is usually set greater than k, that is, the number of bits in the binary domain space is greater than the dimension of the vector space. For example, the following settings can be used: k=12, m=48. It is also possible to set k and m to other values.

[0060] The domain elements obtained by the RMFE coding algorithm have both additive homomorphic properties (maintaining the properties of addition operations) and multiplicative homomorphic properties (maintaining the properties of multiplication operations). After two k-bit vectors X and Y are encoded into binary domain elements M and N respectively, if a carry-free addition Z=M+N is performed on M and N, and Z is decoded back to a vector C, then it can be guaranteed that C is equal to the result of the bitwise addition of X and Y, that is, for any i-th bit, C[i]=X[i]+Y[i] (no carry), which reflects the property that the binary domain elements maintain the addition operation. If a multiplication Z=MN is performed on M and N, and Z is decoded back to a vector C, then it can be guaranteed that C is equal to the result of the bitwise multiplication of X and Y, that is, for all i (1≤i≤k), C[i]=X[i]*Y[i], which reflects the property that the binary domain elements maintain the multiplication operation.

[0061] The following content uses E to represent the encoding algorithm (for example, the RMFE encoding algorithm) and uses D to represent the decoding algorithm (for example, the RMFE decoding algorithm).

[0062] In step S210, the secret sharing of k data owned by participant P0 can be expressed as <x1> 0, <x2>0,…, <x k >0. The vector formed by the secret sharing of k data by participant P0 can be expressed as

[0063] <x> 0＝( <x1> 0, <x2>0,…, <x k >0) (1)

[0064] The vector may be a k-bit vector, and the value of each element is 0 or 1.

[0065] The secret sharing of k data owned by participant P1 can be expressed as <x1> 1, <x2>1,…, <x k >1. The vector formed by the secret sharing of k data by participant P1 can be expressed as

[0066] <x> 1＝( <x1> 1, <x2>1,…, <x k >1) (2)

[0067] The vector may be a k-bit vector, and the value of each element is 0 or 1.

[0068] k data are complete data obtained by assuming that the secret sharing of k data owned by multiple participants is reconstructed. k data are private data. k data can be expressed as x1, x2, …, x k , the complete vector consisting of k data can be expressed as x=(x1,x2,…,x k ). And the following relationship exists:

[0069] x= <x> 0+ <x>1 (3)

[0070] Participant P0 has a k-bit vector <x>0, the obtained m-bit first field element y0 can be expressed as

[0071] y0=E( <x> 0)＝E(( <x1> 0, <x2>0,…, <x k >0)) (4)

[0072] Participant P1 has a k-bit vector <x>1 is encoded, and the first field element y1 of the dm bit can be expressed as

[0073] y1=E( <x> 1)＝E(( <x1> 1, <x2>1,…, <x k >1)) (5)

[0074] It is understandable that although the domain elements y0 and y1 obtained by both parties are called first domain elements, the values ​​of the two first domain elements are different. In addition, the first domain elements y0 and y1 are not secret sharing, but data obtained by encoding secret sharing, so they are not represented with angle brackets. The process of encoding k vectors into m-bit binary domain elements using RMFE can be implemented using existing technologies, which will not be repeated here.

[0075] In step S220, multiple participants (such as P0 and P1) perform secret sharing addition operations based on the first domain elements y0 and y1 owned by each party through the first data interaction based on MPC, so that multiple participants P0 and P1 respectively obtain the secret sharing of the first sum value y. The secret sharing of the first sum value y is used as the secret sharing of the second domain element E(x) obtained by encoding the vector composed of k data in the pointing domain space.

[0076] The first sum y is the sum of the first domain elements y0 and y1 owned by multiple participants, expressed as

[0077] y=y0+y1 (6)

[0078] Participant P0 gets the first secret share of value y <y>0, participant P1 gets the secret share of the first sum y <y>1.

[0079] In this embodiment, the first data interaction in step S220 can be implemented in a variety of ways in MPC, for example, a secret sharing addition algorithm can be used, based on the first domain elements y0 and y1 owned by each of the multiple participants, so that the multiple participants P0 and P1 respectively obtain the secret sharing of the first sum y. When executing step S220, it can specifically include the following steps 1 and 2.

[0080] Step 1: Multiple participants share the secret of the first domain element owned by each of them through the first data interaction based on MPC, so that the multiple participants can obtain the secret sharing of the first domain element owned by any participant.

[0081] For example, party P0 can split the first domain element y0 into secret shares <y0>0 and <y0>1, and share the secret <y0>1 is sent to participant P1. Participant P1 can split the first domain element y1 into secret sharing <y1>0 and <y1>1, and share the secret <y1>0 is sent to participant P0. In this way, participant P0 obtains the secret sharing of the first domain element <y0>0 and <y1>0, participant P1 obtains the secret sharing of the first domain element <y0>1 and <y1>1.

[0082] Among them, the following relationship exists:

[0083] y0= <y0> 0+ <y0> 1

[0084] y1＝ <y1> 0+ <y1>1 (7)

[0085] Step 2: Multiple participants respectively sum up the secret shares of multiple first domain elements obtained by each of them to obtain a secret share of a first sum value y.

[0086] Participant P0 shares the secret of the first domain element obtained <y0>0 and <y1>0 sum, the sum obtained <y0> 0+ <y1>0=<y0+y1> 0 is the secret sharing of the first and value y <y>0. This is because according to equation (6), we know that y=y0+y1.

[0087] Participant P1 shares the secret of the first domain element obtained <y0>1 and <y1>1Sum, the sum value obtained <y0> 1+ <y1>1=<y0+y1> 1 is the secret sharing of the first and value y <y>1.

[0088] The following theoretical sharing illustrates that the secret sharing of the first sum y can be used as the secret sharing of the second domain element E(x), that is, the following relationship is theoretically correct:

[0089] y=E(x) (8)

[0090] According to equations (4), (5) and (6), we know

[0091] y=y0+y1=E( <x> 0)+E( <x>1)

[0092] According to the properties of RMFE, the domain elements obtained after RMFE encoding have a data structure that satisfies addition homomorphism and can maintain addition operations, that is, the following relationship holds:

[0093] E( <x> 0)+E( <x> 1)＝E( <x> 0+ <x>1)

[0094] According to formula (3), we can know that:

[0095] E( <x> 0+ <x>1) = E(x)

[0096] Therefore, it can be concluded that y=E(x) holds.

[0097] This gives us a packaged form y of the k-bit vector x, and y has been shared in the form of a secret <y>Exists in P0 and P1. In the examples listed in the foregoing, a 1-bit data operation requires an L-bit verification code. Still taking this as an example, when y is an m-bit binary domain element, as long as m is greater than 40, then only an m-bit verification code is required in the secret sharing of y to meet the required security. Therefore, the embodiment achieves the effect of using an m-bit verification code to verify the initial k-bit vector x through packaging and conversion technology, reducing the overhead expansion factor from 40 to m / k, for example, k=12, m=48, that is, m / k=4. The overhead is effectively reduced. It can be understood that the packaging process in this embodiment also includes an encoding process. Therefore, when packaging is mentioned, it can also be understood as packaging and encoding operations.

[0098] It should be noted that the values ​​without angle brackets usually represent complete values, not secret sharing. In the embodiments of this specification, the relationship between complete values ​​is only used for theoretical analysis and will not be used for actual data processing. The corresponding secret sharing is used in actual data processing.

[0099] As mentioned above, the secret sharing of the first sum value y can be used as the secret sharing of the second domain element E(x), which is based on the premise that multiple participants have correctly executed the specified operations and protocols. However, in actual applications, the participants may have malicious operations. Therefore, based on y=E(x), the security of the steps executed by each party can be guaranteed through certain inspection steps.

[0100] In one embodiment, multiple participants can use k random numbers to perform consistency verification on the secret sharing of the first sum y and k data based on y=E(x). Multiple participants can perform verification based on MPC data interaction. The k random numbers are used to ensure that the privacy data of the first sum y and E(x) are not leaked.

[0101] Specifically, the consistency check process may include the following steps 3 to 6.

[0102] Step 3: Multiple participants share the secrets of their k random numbers. <r>The constructed vectors are encoded in the specified domain space to obtain the third domain elements owned by each party. The third domain elements have a data structure that satisfies additive homomorphism. Among them, multiple participants can obtain the secret sharing of k random numbers by calling the "random bit generation" process in the traditional Boolean secret sharing scheme. The values ​​of the k random numbers are 0 or 1.

[0103] The secret sharing of k random numbers owned by participant P0 is expressed as <r> 0， <r> 0＝( <r1> 0, <r2>0,…, <r k >0).

[0104] The secret sharing of k random numbers owned by participant P1 is expressed as <r> 1， <r> 1＝( <r1> 1, <r2>1,…, <r k >1).

[0105] Step 4: Multiple participants (such as P0 and P1) perform secret sharing addition operations on the third domain elements they each own through the first data interaction based on MPC, so that multiple participants obtain the second secret sharing of value q respectively. <q>.

[0106] The secret sharing of the second sum q is used as the secret sharing of the fourth domain element E(r) obtained by encoding the vector composed of k random numbers in the pointing domain space. The second sum q is the sum of the third domain elements owned by multiple participants.

[0107] Based on the above analysis, we can also obtain q=E(r).

[0108] In this embodiment, the specific implementation and description of steps 3 and 4 can refer to steps S210 and S220, where k random numbers are equivalent to k data, the third domain element is equivalent to the first domain element, and the second sum is equivalent to the first sum. The above equivalent relationship can be used for corresponding replacement, and the specific content will not be repeated.

[0109] Step 5: Any one of the multiple participants P0 and P1 performs the following operations: Secret sharing of the first sum y <y>and the secret sharing of the second sum q <q>Perform the first combination and obtain the secret sharing of the first combination value z <z>, secret sharing of k data <x>Secret sharing with k random numbers <r>Perform the first combination and obtain the secret sharing of the second combination value w <w>All participants perform this step.

[0110] The first combination may be a linear combination or a nonlinear combination. The linear combination may be an operation such as addition, and the nonlinear combination may be an operation such as multiplication.

[0111] Take the first combination as an example, which is a random linear combination. Secret sharing of the first combination value z <z>It can be obtained by the following formula:

[0112] <z> ＝ c <y> + <q>(9)

[0113] Here, c is a public random bit.

[0114] Secret sharing of the second combination value w <w>It can be obtained by the following formula:

[0115] <w> ＝c <x> + <r>

[0116] Step 6: Any participant P0 obtains the secret share of the first combination value z owned by participant P1 <z>, using the secret sharing of participant P0 itself <z>Reconstruct the first combination value z; obtain the secret share of the second combination value w owned by participant P1 <w>, using the secret sharing of participant P0 itself <w>The second combination value w is reconstructed. When the result D(z) after decoding the first combination value z is equal to the second combination value w, it is determined that the consistency check has passed. If they are not equal, it indicates that there is malicious operation among the participants.

[0117] Next, Figure 2 Step S210 in the embodiment is explained in detail.

[0118] In some application scenarios, the data to be processed may not be a 1-bit binary number, but an h-bit number. In this case, the above embodiment can be used to package the same bit data in the k h-bit data to be processed. Specifically, the secret sharing of k data of any participant is obtained in the following manner: the i-th bit of the secret sharing of k data to be processed is determined as the secret sharing of k data. i takes a value between 1 and h.

[0119] Among them, the i-th data of the k data to be processed is the k data, which is complete data.

[0120] Multiple participants perform designated operations based on the secret sharing of the second domain element E(x) obtained by each of them through the second data interaction based on MPC, so that multiple participants can obtain the secret sharing operation results respectively.

[0121] The result after decoding the secret sharing operation result is equal to: the result obtained by multiple participants respectively through corresponding operation based on the secret sharing of the i-th bit of k data to be processed.

[0122] Through the third data interaction based on MPC, multiple participants perform corresponding operations (which can be called original operations) based on the secret sharing of the i-th bit of k data to be processed, so that multiple participants can obtain corresponding results. The processing here is to perform original operations on the i-th bit of each data to be processed in combination with the attached verification code. When the data to be processed contains h bits and there are k data to be processed, k*h original operations are required.

[0123] By packing the i-th bit of k data to be processed, h packed second domain elements can be obtained. For each second domain element, h specified operations are performed in combination with the accompanying verification code, and the results are decoded. The same result can be obtained, but the operations are reduced from k*h times to h times, so the overhead can be significantly reduced.

[0124] The above primitive operations may include multiplication, addition, and logical operations. Logical operations include operations such as XOR and AND. When the primitive operations are multiplication and addition, the specified operations are also correspondingly multiplication and addition. When the primitive operation is XOR, the specified operation is addition. When the primitive operation is AND, the specified operation is multiplication.

[0125] Combine the following Figure 3 The example shown is used for illustration. Figure 3 A schematic diagram of a packing process and a computing process provided in an embodiment, wherein the data to be processed d1 and d2 are 32-bit numbers. Figure 3 The 32 horizontal boxes in the middle represent one data to be processed, and k data to be processed are listed vertically.

[0126] Taking the data to be processed d1 as an example, when packing, the first bit of the k data to be processed d1 can be formed into a vector, and the vector can be Figure 2 The method of the embodiment is packaged into a domain element E(d1), and multiple participants obtain the secret sharing of the domain element E(d1) respectively.<E(d1)> Similarly, the first bit of the k data to be processed d2 can be used to form a vector, and Figure 2 The method of the embodiment is packaged into a domain element E(d2), and multiple participants obtain the secret sharing of the domain element E(d2) respectively.<E(d2)> Multiple parties based on secret sharing<E(d1)> and secret sharing<E(d2)> , after multiple data interactions, the specified operation is performed and the result C is obtained.

[0127] If the packaging solution of this embodiment is not adopted, but the original operation is directly performed based on the secret sharing of the first bit of the data to be processed d1 owned by multiple participants and the secret sharing of the first bit of the data to be processed d2, the result c is obtained after multiple parties interact. Combined with the description of the above embodiment, it can be known that D(C) obtained by decoding the result C is equal to c.

[0128] When multiple participants perform various data interactions based on MPC (including the first data interaction and subsequent other data interactions), the functions and status of the participants are the same, the operations performed and the types of data obtained are the same, but the values ​​of the data themselves are different. For example, the secret sharing of the first sum y in participant P0 is different from the secret sharing in participant P1. It should be noted that although multiple secret sharing can reconstruct complete data, the complete data will not be reconstructed during the data processing process, but data processing is performed based on secret sharing.

[0129] In this specification, the word "first" in terms such as first domain element, first sum value and first data interaction, as well as the corresponding "second" (if any) in the text, are merely for the convenience of distinction and description and do not have any limiting meaning.

[0130] The foregoing describes certain embodiments of the present specification, and other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in an order different from that in the embodiments, and the desired results may still be achieved. In addition, the processes depicted in the accompanying drawings do not necessarily have to be performed in the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0131] Figure 4 Schematic block diagram of a secret sharing packaging system provided in an embodiment. The system 400 includes multiple participants such as participant 410, participant 420 and participant 430. The system 400 and Figure 2 The method embodiments shown correspond.

[0132] A plurality of participants are respectively used to encode a vector formed by sharing secrets of k data owned by each party in a specified domain space, and respectively obtain a first domain element owned by each party; the first domain element has a data structure satisfying additive homomorphism;

[0133] Multiple participants are used to interact with each other through first data based on secure multi-party computing, and perform secret sharing addition operations based on the first domain elements owned by each party, so that the multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each party; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0134] In one implementation, any participant is configured to obtain the secret sharing of the k data in the following manner: determining the i-th data of the secret sharing of the k data to be processed as the secret sharing of the k data.

[0135] In one embodiment, the multiple participants are further used to perform a designated operation based on the secret sharing of the second domain element obtained by each of them through the second data interaction based on secure multi-party computing, so that the multiple participants respectively obtain the secret sharing operation results. Wherein, the result after decoding the secret sharing operation result is equal to: the result obtained by the multiple participants respectively by performing a corresponding operation based on the secret sharing of the i-th bit of the k data to be processed owned by each of them.

[0136] In one implementation, the first data interaction includes:

[0137] The multiple participants share the first domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the first domain elements owned by any one of the participants;

[0138] Multiple participants respectively sum up the secret shares of multiple first domain elements obtained by each party to obtain a secret share of a first sum value.

[0139] In one implementation, the multiple participants are further configured to use k random numbers to perform consistency verification on the secret sharing of the first sum value and the k data.

[0140] In one embodiment, the consistency check includes:

[0141] Multiple participants respectively encode vectors composed of secret sharing of k random numbers owned by them in a specified domain space, and respectively obtain third domain elements owned by them; the third domain elements have a data structure that satisfies additive homomorphism;

[0142] The multiple participants perform a secret sharing addition operation on the third domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the second sum value of the third domain elements owned by each of the multiple parties;

[0143] The multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain a secret sharing of a first combination value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain a secret sharing of a second combination value;

[0144] Any one of the participants reconstructs the first combined value based on the secret sharing of the first combined value obtained by multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value obtained by multiple participants. When the result after decoding the first combined value is equal to the second combined value, it is determined that the consistency check has passed.

[0145] The above system embodiment corresponds to the method embodiment, and the specific description can refer to the description of the method embodiment part, which will not be repeated here. The system embodiment has the same technical effect as the corresponding method embodiment, and the specific description can refer to the corresponding method embodiment.

[0146] Figure 5 Schematic block diagram of a secret sharing packaging device provided in an embodiment. The device 500 and Figure 2 The method executed in any one of the participants in the method embodiment shown corresponds to the method executed in any one of the participants. The device 500 is deployed in any one of the multiple participants and includes the following modules.

[0147] The independent encoding module 510 is configured to encode a vector formed by secret sharing of k data owned by the independent encoding module in a specified domain space to obtain a first domain element; the first domain element has a data structure satisfying additive homomorphism;

[0148] The joint summation module 520 is configured to perform secret sharing addition operations based on the first domain elements owned by each party through first data interaction based on secure multi-party computing with other participants, so that multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by multiple parties; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0149] In one embodiment, it also includes a data acquisition module (not shown in the figure), which is configured to: obtain the secret sharing of the k data in the following manner: determine the i-th data of the secret sharing of the k data to be processed as the secret sharing of the k data.

[0150] In one embodiment, the apparatus 500 further includes: a data operation module (not shown in the figure), configured to perform a specified operation based on the secret sharing of the second domain element obtained by each party through a second data interaction based on secure multi-party computing with other parties, so that the multiple parties respectively obtain the secret sharing operation results;

[0151] The result after decoding the secret sharing operation result is equal to: the result obtained by multiple participants by performing corresponding operations based on the secret sharing of the i-th bit of the k to-be-processed data respectively owned by each party.

[0152] In one embodiment, the joint summation module 520 includes: a sharing submodule 521 and a summation submodule 522. The sharing submodule 521 is configured to perform secret sharing of the first domain elements owned by each party through first data interaction based on secure multi-party computing with other participants, so that multiple participants respectively obtain: the secret sharing of the first domain element owned by any participant. The summation submodule 522 is configured to sum the secret sharing of multiple first domain elements obtained by itself to obtain the secret sharing of the first sum value.

[0153] In one embodiment, the apparatus 500 further includes: a consistency verification module 530 configured to perform consistency verification on the secret sharing of the first sum value and the k data using k random numbers with other participants.

[0154] In one implementation, the consistency check module 530 includes: an encoding submodule, a summing submodule, a combining submodule, a reconstruction submodule, and a checking submodule (not shown in the figure).

[0155] The encoding submodule is configured to encode a vector composed of secret sharing of k random numbers owned by itself in a specified domain space to obtain a third domain element; the third domain element has a data structure that satisfies additive homomorphism;

[0156] The summing submodule is configured to perform a secret sharing addition operation on the third domain elements owned by each party through first data interaction based on secure multi-party computing with other parties, so that the multiple parties respectively obtain: a secret sharing of the second sum value of the third domain elements owned by each party;

[0157] a combining submodule configured to perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain a secret sharing of a first combined value; and perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain a secret sharing of a second combined value;

[0158] a reconstruction submodule, configured to reconstruct the first combination value based on the obtained secret sharing of the first combination value respectively owned by the multiple participants, and to reconstruct the second combination value based on the obtained secret sharing of the second combination value respectively owned by the multiple participants;

[0159] The check submodule is configured to determine that the consistency check passes when a result after decoding the first combined value is equal to the second combined value.

[0160] The above device embodiments correspond to the method embodiments. For specific descriptions, please refer to the description of the method embodiments, which will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For specific descriptions, please refer to the corresponding method embodiments.

[0161] The present specification also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute Figures 1 to 3 Any of the methods described above.

[0162] The embodiment of the present specification also provides a computing device, including a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, Figures 1 to 3 Any of the methods described above.

[0163] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the storage medium and computing device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0164] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of the present invention may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0165] The specific implementation methods described above further describe the purpose, technical solutions and beneficial effects of the embodiments of the present invention in detail. It should be understood that the above description is only a specific implementation method of the embodiments of the present invention and is not intended to limit the scope of protection of the present invention. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the scope of protection of the present invention.< / w> < / w> < / z> < / z> < / r> < / x> < / w> < / w> < / q> < / y> < / z> < / z> < / w> < / r> < / x> < / z> < / q> < / y> < / q> < / r1> < / r> < / r> < / r1> < / r> < / r> < / r> < / y> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / y> < / y0> < / y> < / y0> < / y1> < / y0> < / y0> < / y> < / y> < / x1> < / x> < / x> < / x1> < / x> < / x> < / x> < / x> < / x1> < / x> < / x1> < / x1> < / x> < / x1> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A secret sharing packaging method, performed by multiple parties, comprising: Multiple participants encode the vectors composed of the secret sharing of k data they each own in the specified domain space, and obtain the first domain elements they each own; The first domain elements have a data structure that satisfies addition homomorphism; Multiple participants interact with each other through first data based on secure multi-party computing, and perform secret sharing addition operations based on the first domain elements owned by each party, so that the multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each party; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

2. According to the method of claim 1, the secret sharing of k data of any participant is obtained by the following method: The i-th bit of the secret sharing of k data to be processed is determined as the secret sharing of the k data.

3. The method according to claim 2, further comprising: The multiple participants perform a designated operation based on the secret sharing of the second domain element obtained by each of them through the second data interaction based on secure multi-party computing, so that the multiple participants respectively obtain the secret sharing operation result; The result after decoding the secret sharing operation result is equal to: the result obtained by multiple participants respectively based on the corresponding operation based on the secret sharing of the i-th bit of the k to-be-processed data owned by each party.

4. The method according to claim 1, wherein the first data interaction comprises: The multiple participants share the first domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the first domain elements owned by any one of the participants; Multiple participants respectively sum up the secret shares of multiple first domain elements obtained by each party to obtain a secret share of a first sum value.

5. The method according to claim 1, further comprising: Multiple participants use k random numbers to perform consistency verification on the secret sharing of the first sum value and the k data.

6. The method according to claim 5, wherein the consistency check comprises: Multiple participants respectively encode vectors composed of secret sharing of k random numbers owned by them in a specified domain space, and respectively obtain third domain elements owned by them; the third domain elements have a data structure that satisfies additive homomorphism; The multiple participants perform a secret sharing addition operation on the third domain elements owned by each of them through the first data interaction based on secure multi-party computing, so that the multiple participants respectively obtain: the secret sharing of the second sum value of the third domain elements owned by each of the multiple parties; The multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain a secret sharing of a first combination value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain a secret sharing of a second combination value; Any one of the participants reconstructs the first combined value based on the secret sharing of the first combined value obtained by multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value obtained by multiple participants. When the result after decoding the first combined value is equal to the second combined value, it is determined that the consistency check has passed.

7. The method according to claim 1, wherein the specified domain space is a space containing multiple m-bit binary domain elements, and the encoding includes an operation based on a multiplication-friendly encoding RMFE.

8. A secret sharing packaging method, performed by any one of a plurality of participants, comprising: Encode the vector formed by the secret sharing of k data owned by itself in the specified domain space to obtain the first domain element; The first domain elements have a data structure that satisfies addition homomorphism; By interacting with other participants based on secure multi-party computing of the first data, secret sharing addition operations are performed based on the first domain elements owned by each party, so that multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by multiple parties; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

9. A secret sharing packaging system, the system comprising a plurality of participants; A plurality of participants are respectively used to encode a vector formed by sharing secrets of k data owned by each party in a specified domain space, and respectively obtain a first domain element owned by each party; the first domain element has a data structure satisfying additive homomorphism; Multiple participants are used to interact with each other through first data based on secure multi-party computing, and perform secret sharing addition operations based on the first domain elements owned by each party, so that the multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each party; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

10. A secret sharing packaging device, deployed in any one of a plurality of participants, comprising: An independent encoding module is configured to encode a vector formed by secret sharing of k data owned by itself in a specified domain space to obtain a first domain element; The first domain elements have a data structure that satisfies addition homomorphism; The joint summation module is configured to perform secret sharing addition operations based on the first domain elements owned by each party through first data interaction based on secure multi-party computing with other participants, so that multiple participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by multiple parties; the secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

11. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 8.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 8 is implemented.

Images