Secure multi-party computing method and system based on secret sharing

Abstract

The invention discloses a secure multi-party computing method and system based on secret sharing, and relates to the technical field of information security, and the method comprises the steps: obtaining original computing data, and dividing the original computing data into a plurality of data fragments; homomorphic encryption and symmetric encryption are respectively and sequentially carried out based on all the data fragments to obtain a plurality of layered encryption fragments; generating a random mask value and correspondingly binding the random mask value with the layered encryption fragment to obtain a final encryption fragment; based on all the final encryption fragments, distributing the final encryption fragments to each computing node for security computing, and correspondingly obtaining an intermediate result and a corresponding zero-knowledge proof; performing verification based on all zero-knowledge proof, and aggregating corresponding intermediate results based on verification results to generate an encryption calculation result; and decrypting based on the encrypted calculation result to obtain a plaintext calculation result. And the calculation efficiency is improved on the basis of ensuring the safety of the calculation data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a secure multi-party computing method and system based on secret sharing. Background Art

[0002] Currently, secret sharing disassembles real data into multiple meaningless numbers and distributes these numbers to multiple participating parties. Each participating party only gets a part of the original data, and a single participating party cannot restore the original data. Only when their respective data are put together can the real data be restored. In the field of multi-party secure computing (MPC), hierarchical encryption and anti-collusion mechanisms are the core technologies to ensure data privacy.

[0003] However, traditional solutions (such as Shamir secret sharing) achieve privacy protection by splitting data into multiple shards and distributing them to different participating parties, combined with encryption algorithms. However, the existing technologies have the following key problems: insufficient detection and defense against collusion attacks, single-layer encryption is vulnerable to key leakage threats, and complex verification processes (such as multiple interactions and parameter pre-generation) lead to a sharp increase in computing latency and communication overhead. As a result, the existing methods have problems of low computing efficiency and low data security.

[0004] Therefore, how to improve the computing efficiency on the basis of ensuring the security of computing data is an urgent problem for those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a secure multi-party computing method and system based on secret sharing, which improves the computing efficiency on the basis of ensuring the security of computing data.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A secure multi-party computing method based on secret sharing, comprising:

[0008] Obtaining original computing data and dividing it into multiple data shards;

[0009] Performing homomorphic encryption and symmetric encryption on all the data shards in sequence to obtain multiple hierarchically encrypted shards;

[0010] Generating a random mask value and binding it to the hierarchically encrypted shard correspondingly to obtain a final encrypted shard;

[0011] Distributing all the final encrypted shards to each computing node for secure computing, correspondingly obtaining intermediate results and corresponding zero-knowledge proofs;

[0012] Verify based on all the zero-knowledge proofs, and aggregate the corresponding intermediate results based on the verification results to generate an encrypted calculation result;

[0013] Decrypt the encrypted calculation result to obtain a plaintext calculation result.

[0014] Preferably, set a dynamic threshold value t;

[0015] The number n of the data shards is greater than or equal to the dynamic threshold value t to ensure that a single data shard cannot restore the original calculation data;

[0016] The dynamic threshold value t is dynamically adjusted according to the network state:

[0017] When the network packet loss rate exceeds the threshold, reduce the dynamic threshold value t to tolerate more node failures;

[0018] When the risk of collusion attack is detected, increase the dynamic threshold value t to enhance security.

[0019] Preferably, the method for obtaining the hierarchical encrypted shards is as follows:

[0020] Generate a public master key and a private master key based on the homomorphic encryption algorithm;

[0021] Perform homomorphic encryption on the data shards based on the public master key to obtain initial encrypted shards;

[0022] Generate a temporary session key and send it to each of the computing nodes;

[0023] Perform symmetric encryption on the initial encrypted shards based on the temporary session key to obtain the hierarchical encrypted shards.

[0024] Preferably, generating a random mask value specifically includes:

[0025] Generate a plurality of the random mask values based on a secure pseudorandom number generator;

[0026] All the random mask values satisfy

[0027] where a represents the number of random mask values, and M i represents the i-th random mask value;

[0028] The number of the random mask values is the same as the number of the data shards.

[0029] Preferably, obtaining the intermediate result and the corresponding zero-knowledge proof specifically includes:

[0030] The computing node decrypts the allocated final encrypted shard based on the temporary session key to obtain the corresponding initial encrypted shard and the random mask value;

[0031] The computing node performs a homomorphic operation on the initial encrypted shard based on a secure multi-party computing protocol to obtain a calculation result;

[0032] The intermediate result is jointly composed of the calculation result and the corresponding random mask value;

[0033] Perform a hash calculation on the hierarchical encrypted shard to obtain a shard hash value;

[0034] Generate the corresponding zero-knowledge proof based on the shard hash value, the calculation result, the random mask value, and the temporary session key.

[0035] Preferably, generating the corresponding zero-knowledge proof based on the shard hash value, the calculation result, the random mask value, and the temporary session key specifically includes:

[0036] Perform a hash calculation on the shard hash value and the calculation result to obtain a shard result binding hash value;

[0037] Set a large prime number and a generator;

[0038] Generate a mask linear commitment value based on the large prime number, the generator, and the random mask value;

[0039] Generate a challenge value based on the shard result binding hash value and the large prime number;

[0040] Generate a response value based on the challenge value, the temporary session key, the large prime number, and the random mask value;

[0041] Generate the zero-knowledge proof based on the response value, the shard result binding hash value, and the mask linear commitment value.

[0042] Preferably, verifying based on all the zero-knowledge proofs specifically includes:

[0043] Perform a global mask constraint check, a single proof validity verification, and a shard consistency verification on all the zero-knowledge proofs respectively;

[0044] When all the verifications pass, it indicates that the zero-knowledge proof verification passes; otherwise, it indicates that the zero-knowledge proof verification fails.

[0045] Preferably, aggregating the corresponding intermediate results based on the verification result to generate an encrypted calculation result specifically includes:

[0046] Judge whether all of the zero-knowledge proofs pass the verification based on the verification results;

[0047] If so, aggregate the intermediate results corresponding to all of the zero-knowledge proofs to obtain the encrypted calculation result;

[0048] Otherwise, trigger a disciplinary mechanism for the computing nodes corresponding to the zero-knowledge proofs that fail to pass the verification, and at the same time judge whether the remaining number of valid shards is greater than or equal to the current dynamic threshold value t;

[0049] If so, start a redundant shard recovery mechanism, extract t valid shards from the backup shard library based on the original secret sharing protocol, re-encrypt and distribute them to trusted computing nodes, and repeat the above calculation and verification process until the encrypted calculation result is obtained;

[0050] Otherwise, determine that the task fails, generate an error code and terminate the process, and re-execute the above process of dividing, encrypting, and distributing the original calculation data to other computing nodes for calculation and verification.

[0051] Preferably, it further includes:

[0052] When the number of zero-knowledge proofs that fail to pass the verification is greater than the threshold, it is determined that there is a systematic attack or network failure, and a security rollback mechanism is executed:

[0053] Discard all current intermediate results, adjust the dynamic threshold value, and redistribute the final encrypted shards, and repeat the above calculation and verification process;

[0054] At the same time, record all the zero-knowledge proofs that fail to pass the verification and the corresponding computing nodes in the tamper-proof log.

[0055] A secure multi-party computing system based on secret sharing, including: a data division module, a data encryption module, a data binding module, a distribution and calculation module, a verification and output module, and a result output module;

[0056] The data division module is used to obtain the original calculation data and divide it into multiple data shards;

[0057] The data encryption module is used to perform homomorphic encryption and symmetric encryption on all of the data shards in sequence to obtain multiple hierarchical encrypted shards;

[0058] The data binding module is used to generate a random mask value and bind it to the hierarchical encrypted shards correspondingly to obtain the final encrypted shards;

[0059] The distribution and calculation module is used to distribute all of the final encrypted shards to each computing node for secure calculation, and correspondingly obtain intermediate results and corresponding zero-knowledge proofs;

[0060] The verification output module is used to verify based on all the zero-knowledge proofs, and aggregate the corresponding intermediate results based on the verification results to generate an encrypted calculation result;

[0061] The result output module is used to decrypt the encrypted calculation result to obtain a plaintext calculation result.

[0062] As can be seen from the above technical solutions, compared with the prior art, the present invention discloses a secure multi-party computing method and system based on secret sharing, which has the following beneficial effects:

[0063] 1. By splitting the original data into multiple shards and combining a hierarchical encryption mechanism of homomorphic encryption and symmetric encryption, the present invention ensures that the data is always in an encrypted state during transmission and calculation. Even if a single shard or node is attacked, the original data cannot be restored, significantly reducing the risk of data leakage.

[0064] 2. By binding random mask values, the present invention further confuses the plaintext features of the data shards, preventing attackers from inferring data information through statistical analysis or side-channel attacks, and enhancing the anti-reverse engineering ability of the data.

[0065] 3. The present invention distributes the encrypted shards to multiple computing nodes for parallel processing, which not only realizes multi-party collaborative computing but also avoids the risk of centralized data storage, meeting the requirements of privacy protection regulations (such as GDPR); by generating and verifying zero-knowledge proofs of intermediate results, the correctness and legality of the calculation process are ensured, and specific calculation details do not need to be exposed, which not only guarantees the credibility of the calculation results but also maintains the privacy of the participating parties.

[0066] 4. After the data is sharded, it can be processed in parallel by multiple nodes, accelerating the calculation process and improving the overall efficiency. By combining homomorphic encryption and symmetric encryption, the present invention balances the computational complexity and security, and may reduce the high overhead of pure homomorphic encryption, making it suitable for large-scale data scenarios.

[0067] 5. Through technologies such as data sharding, hierarchical encryption, random masking, and zero-knowledge proof verification, the present invention constructs a secure, efficient, and verifiable multi-party computing framework, effectively balancing privacy protection and computing efficiency, providing reliable technical support for multi-party collaboration scenarios; through strict encryption and verification mechanisms, it meets the regulatory requirements of various industries for data privacy and security, and can be applied to multi-party computing scenarios requiring privacy protection, such as financial transactions, medical data collaboration, and joint statistical analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained according to the provided drawings.

[0069] Figure 1 Flowchart of a secure multi-party computation method based on secret sharing provided by the present invention.

[0070] Figure 2 Flowchart of the method for generating intermediate results and corresponding zero-knowledge proofs provided by the present invention.

[0071] Figure 3 Flowchart of the method for generating corresponding zero-knowledge proofs based on shard hash values, calculation results, random mask values, and temporary session keys provided by the present invention.

[0072] Figure 4 Schematic diagram of the structure of a secure multi-party computation system based on secret sharing provided by the present invention. Detailed implementation manners

[0073] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0074] Embodiment 1

[0075] As Figure 1 shown, the embodiment of the present invention discloses a secure multi-party computation method based on secret sharing, including:

[0076] Obtain the original calculation data and divide it into multiple data shards;

[0077] Based on all the data shards, perform homomorphic encryption and symmetric encryption in sequence to obtain multiple hierarchical encrypted shards;

[0078] Generate random mask values and bind them to the hierarchical encrypted shards correspondingly to obtain the final encrypted shards;

[0079] Distribute all the final encrypted shards to each computing node for secure computation, and correspondingly obtain intermediate results and corresponding zero-knowledge proofs;

[0080] Verify all the zero-knowledge proofs, and based on the verification results, aggregate the corresponding intermediate results to generate an encrypted calculation result;

[0081] Decrypt the ciphertext calculation result to obtain the plaintext calculation result.

[0082] Embodiment 2

[0083] An embodiment of the present invention discloses a secure multi-party computing method based on secret sharing, including:

[0084] Obtain the original calculation data and divide it into multiple data shards.

[0085] Preferably, in this embodiment, the original calculation data is the original data D to be calculated, and the original calculation data is split into n data shards based on the Shamir threshold secret sharing protocol: S1, S2, S3,..., S n .

[0086] Preferably, set a dynamic threshold value t;

[0087] The number n of data shards is greater than or equal to the dynamic threshold value t to ensure that a single data shard cannot restore the original calculation data;

[0088] The dynamic threshold value t is dynamically adjusted according to the network state:

[0089] When the network packet loss rate exceeds the threshold, reduce the dynamic threshold value t to tolerate more node failures;

[0090] When the risk of collusion attack is detected, increase the dynamic threshold value t to enhance security.

[0091] Preferably, based on the dynamic adjustment of the dynamic threshold value t of the present invention, in a high-risk scenario (such as detecting a collusion attack): by increasing the dynamic threshold value t, it is ensured that even if an attacker controls some nodes, they cannot obtain enough shards, thereby effectively resisting the collusion attack. When the number of malicious nodes does not exceed the new threshold value, the original data still cannot be restored, protecting the security of sensitive information; in a low-risk scenario (such as normal network state): reduce the dynamic threshold value t, reduce the dependence on node reliability, and even if some nodes fail or shards are lost, the data can still be quickly restored through the remaining shards, avoiding service interruption. Dynamically adjust the generation and distribution strategies of shards according to real-time requirements, avoiding resource waste caused by maintaining a high threshold when the security threat is low. A single shard can never restore the original data, and even if some shards are intercepted or leaked, the original data remains secure. Through the dynamic threshold adjustment mechanism, the Shamir threshold secret sharing protocol can achieve a dynamic balance among security, availability, and resource efficiency according to environmental changes. This adaptive ability makes it applicable to dynamic network environments (such as blockchain, distributed storage, cloud computing, etc.), significantly improving the robustness, security, and flexibility of the system.

[0092] Perform homomorphic encryption and symmetric encryption on all data shards in sequence to obtain multiple hierarchical encrypted shards.

[0093] Preferably, the method for obtaining hierarchical encrypted shards is as follows:

[0094] Generate a master public key and a master private key based on the homomorphic encryption algorithm;

[0095] Perform homomorphic encryption on the data shards based on the master public key to obtain initial encrypted shards;

[0096] Generate a temporary session key and send it to each computing node;

[0097] Perform symmetric encryption on the initial encrypted shards based on the temporary session key to obtain hierarchical encrypted shards.

[0098] Preferably, in this embodiment, a master public key PK and a master private key SK are generated based on the homomorphic encryption algorithm, and the data shard S i is homomorphically encrypted based on the master public key PK to obtain an initial encrypted shard E(S i ):

[0099] E(S i ) = Enc PK (S i ), where Enc PK represents the encryption operation using the master public key PK.

[0100] Preferably, AES-GCM symmetric encryption is performed on the initial encrypted shard E(S i ) based on the temporary session key Ks to obtain a hierarchical encrypted shard C i : C i = Enc Ks (E(S i )), where Enc Ks represents the encryption operation using the temporary session key Ks.

[0101] Preferably, the present invention adopts a two-layer encryption mechanism: using the master public key to perform homomorphic encryption on the data shards to ensure that calculations can be performed on the encrypted data and avoid exposure of the original plaintext; performing secondary encryption on the initial encrypted shards through the temporary session key to further isolate the access rights of the data shards. Even if an attacker obtains the encrypted shards, they still need to break through two layers of encryption to access the data.

[0102] Preferably, homomorphic encryption: allows direct calculations (such as addition and multiplication) on encrypted data, but has a high computational overhead and is suitable for key calculation steps; symmetric encryption: has a fast encryption / decryption speed and is suitable for quickly encrypting and transmitting a large amount of data; combining computationally intensive tasks (such as homomorphic operations) with efficient encryption to balance performance and security.

[0103] Preferably, the hierarchical design adopted in the present invention not only reduces the risk of long-term keys, but also enhances fine-grained control through temporary session keys, and is applicable to privacy-sensitive distributed computing scenarios (such as medical data collaboration, blockchain smart contracts, cloud computing, etc.). This multi-layer encryption mechanism provides in-depth defense for data security while taking into account the performance requirements of practical applications.

[0104] Generate a random mask value and bind it to the hierarchical encryption shard correspondingly to obtain the final encrypted shard.

[0105] Preferably, generating a random mask value specifically includes:

[0106] Generate multiple random mask values based on a secure pseudo-random number generator;

[0107] All random mask values satisfy

[0108] where a represents the number of random mask values, and M i represents the i-th random mask value;

[0109] The number of random mask values is the same as the number of data shards, that is, a = n.

[0110] Preferably, generate a random number seed R, and generate multiple random mask values M1, M2, M3,..., M a .

[0111] Preferably, based on the random mask value M i and the hierarchical encryption shard C i correspondingly bind to obtain the final encrypted shard C' i : C' i = C i + M i .

[0112] Preferably, by adding random mask values, the present invention enhances data security. Even if an attacker obtains some encrypted shards (such as k / n shards), since each shard is bound to an independent random mask value Mi, the attacker cannot directly decrypt or recover the original data. The integrity of the data depends on the combination of the mask values and shards of all shards, thus significantly improving the anti-attack ability of the system; the introduction of random mask values increases the confusion of shards, making the sharded data exhibit random characteristics during storage or transmission, and it is difficult for the attacker to infer the original data by analyzing the statistical characteristics or patterns of the shards; since the mask values of each shard are independent and unpredictable, the attacker needs to break through multiple shard storage nodes and obtain the corresponding mask values simultaneously to recover the data, significantly improving the robustness of the system; even if the content of the original data shards is the same (such as duplicate data blocks), after binding different random mask values, each shard presents different random data patterns during storage, avoiding collision attacks caused by data duplication; each generated mask value sequence is different (based on different seeds R), and even if the data remains unchanged, the shards generated during re-encryption will be completely different, further preventing analysis attacks.

[0113] Preferably, the present invention generates random mask values consistent with the number of shards and ensures their unpredictability based on a secure pseudo-random number generator. This method achieves a balance of security, fault tolerance, and efficiency in data encryption and sharded storage. Its core advantage is that it disperses the confidentiality of the data into multiple independent protection layers, so that the attacker must break through multiple layers of protection (such as shard acquisition, mask value acquisition, seed cracking) simultaneously to threaten data security, thus significantly improving the overall security of the system.

[0114] Based on all the final encrypted shards are distributed to each computing node for secure computing, and the corresponding intermediate results and corresponding zero-knowledge proofs are obtained.

[0115] Preferably, as Figure 2 shown, the corresponding intermediate results and corresponding zero-knowledge proofs are obtained, specifically including:

[0116] The computing node decrypts the allocated final encrypted shard based on the temporary session key to obtain the corresponding initial encrypted shard and random mask value;

[0117] The computing node performs a homomorphic operation on the initial encrypted shard based on the secure multi-party computing protocol to obtain the computing result;

[0118] Based on the computing result and the corresponding random mask value, they jointly form the intermediate result;

[0119] Based on the hierarchical encrypted shard, a hash calculation is performed to obtain the shard hash value;

[0120] Generate corresponding zero - knowledge proofs based on the shard hash value, calculation result, random mask value, and temporary session key.

[0121] Preferably, the computing node decrypts the allocated final encrypted shard C' based on the temporary session key Ks i to obtain the corresponding initial encrypted shard E(S i ) and the random mask value M i ;

[0122] The computing node performs a homomorphic operation on the initial encrypted shard E(S i ) based on the secure multi - party computing protocol to obtain the calculation result R i : R i = Compute(E(S i ))), where Compute represents executing the pre - agreed calculation logic through the secure multi - party computing (MPC) protocol.

[0123] Preferably, based on the calculation result R i and the corresponding random mask value M i together form the intermediate result O i : O i = Ri + M i .

[0124] Preferably, perform a hash calculation on the hierarchical encrypted shard C i to obtain the shard hash value H i : H i = Hash(C i ), where Hash represents the hash calculation.

[0125] Preferably, as Figure 3 shown, generate corresponding zero - knowledge proofs based on the shard hash value, calculation result, random mask value, and temporary session key, specifically including:

[0126] Perform a hash calculation on the shard hash value and the calculation result to obtain the shard result binding hash value;

[0127] Set a large prime number and a generator;

[0128] Generate a masked linear commitment value based on the large prime number, generator, and random mask value;

[0129] Generate a challenge value based on the shard result binding hash value and the large prime number;

[0130] Generate a response value based on the challenge value, temporary session key, large prime number, and random mask value;

[0131] Generate a zero - knowledge proof based on the response value, shard result binding hash value, and masked linear commitment value.

[0132] Preferably, based on the shard hash value H i and the calculation result R i perform a hash calculation to obtain the shard result binding hash value B i : B i = Hash(H i / / R i ), where / / represents the parallel operation.

[0133] Preferably, based on the large prime number p, the generator g, and the random mask value M i generate the masked linear commitment value A i : A i = g Mi mod p, where mod represents the modulo operation, and mod p means taking the remainder of g Mi divided by p, that is, calculating the remainder of g Mi divided by p. No matter how large the value of g Mi is, through the modulo operation, its result can be limited to the range of 0 to p - 1.

[0134] Preferably, based on the shard result binding hash value B i and the large prime number p, generate the challenge value V i :

[0135] V i = LSB 32 (B i ) mod p, where LSB 32 (B i ) means taking the last 32 bits of B i as the challenge to avoid additional hash calculations.

[0136] Preferably, based on the challenge value V i , the temporary session key Ks, the large prime number p, and the random mask value M i generate the response value L i : L i = M i + V i × Ks mod p.

[0137] Based on the response value L i , the shard result binding hash value B i and the masked linear commitment value A i generate the zero - knowledge proof Q i : Q i = (A i , B i , L i ).

[0138] Preferably, generating a single proof only requires 1 hash + 2 modular exponentiation operations, which takes less time and improves efficiency; B iBind the shard hash value H simultaneously i and the calculation result R i , tampering with any part will result in verification failure. Based on the temporary session key Ks as the secret factor of the response value, it prevents cross-task proof forgery; fully reuses the encryption layer parameters of the temporary session key Ks and the shard hash value H i , and at the same time, through the Fiat-Shamir challenge value V i directly binds the hash value B from the shard result i generated, eliminating the overhead of random number generation. Through parameter reuse, hash binding compression, and linear algebra optimization, it realizes the minimalist generation and efficient verification of zero-knowledge proofs, while ensuring a deep association with the hierarchical encryption mechanism and anti-collusion constraints.

[0139] Verify based on all zero-knowledge proofs, and based on the verification results, aggregate the corresponding intermediate results to generate the encrypted calculation result.

[0140] Preferably, verify based on all zero-knowledge proofs, specifically including:[[]]

[0141] Conduct global mask constraint checking, single-proof validity verification, and shard consistency verification respectively based on all zero-knowledge proofs;

[0142] When all verifications pass, it indicates that the zero-knowledge proof verification passes; otherwise, it indicates that the zero-knowledge proof verification fails.

[0143] Preferably, global mask constraint checking: where Π represents the product operation, and ≡ represents the congruence relation modulo p. In the global mask constraint checking, it is required that the product result of all A i , and g 0 are all congruent to 1 modulo p to verify the legality of the mask; through modular operations and product aggregation, it ensures the overall legality of the data in the multi-party participation protocol.

[0144] Preferably, single-proof validity verification: Verify the validity of a single zero-knowledge proof Q i , ensure that the participant has not tampered with its commitment, and through the congruence relation modulo p, ensure that the calculation is completed within a finite field to prevent numerical overflow; utilize the discrete logarithm problem and the congruence relation to prevent the deception behavior of a single participant.

[0145] Preferably, shard consistency verification: Hash(H i / / R i ) = B i , verify the consistency of the shard hash value H i and the calculation result R i to prevent data tampering. The shard hash value Hi With the calculation result R i After splicing and hashing again, generate a shard result binding hash value B i , ensuring the non-forgeability of the sharded data; through the hash chain and splicing operations, ensure the local and global consistency of the sharded data.

[0146] Preferably, based on the verification result, aggregate the corresponding intermediate results to generate an encrypted calculation result, specifically including:

[0147] Based on the verification result, determine whether all zero-knowledge proofs are verified successfully;

[0148] If so, aggregate the intermediate results corresponding to all zero-knowledge proofs to obtain the encrypted calculation result;

[0149] Otherwise, trigger a disciplinary mechanism for the computing nodes corresponding to the zero-knowledge proofs that fail the verification, and at the same time determine whether the remaining number of valid shards is greater than or equal to the current dynamic threshold t;

[0150] If so, start the redundant shard recovery mechanism, extract t valid shards from the backup shard library based on the original secret sharing protocol, re-encrypt and distribute them to the trusted computing nodes, and repeat the above calculation and verification process until the encrypted calculation result is obtained;

[0151] Otherwise, determine that the task fails, generate an error code and terminate the process, and re-execute the above process of dividing, encrypting, and distributing the original calculation data to other computing nodes for calculation and verification.

[0152] Preferably, ensure the correctness of the intermediate results of the computing nodes through zero-knowledge proofs (ZKP), without exposing the original data or calculation details at the same time, protecting the privacy of the participants; the data and intermediate results are always in an encrypted state, and only the result is decrypted in the final aggregation stage, effectively preventing data leakage or tampering; when there are insufficient valid shards, quickly extract shards from the backup library and redistribute them, avoiding task interruption caused by node failures, ensuring the continuity of the calculation process, even if some nodes fail or act maliciously, the system can still recover the calculation through the redundancy mechanism and finally output a trusted result, reducing the task failure rate; if the task fails, the system automatically re-divides, encrypts, and distributes the data, reducing manual intervention, improving the system availability, through the shard recovery and redistribution mechanism, the system can dynamically select new trusted nodes, optimize the node resource allocation, and avoid long-term dependence on unreliable nodes.

[0153] Preferably, the disciplinary mechanism is:

[0154] Based on the zero-knowledge proofs that fail the verification, determine the corresponding computing nodes and mark them as abnormal nodes;

[0155] Deduct the corresponding integrity value based on the abnormal node. When the integrity value is lower than the set value, add it to the blacklist and it cannot participate in the computing task.

[0156] Preferably, the present invention triggers disciplinary actions (such as financial penalties, reputation deductions, or node elimination) for nodes that fail verification, maintains the honesty of the network, and reduces the motivation to act maliciously.

[0157] Preferably, the present invention pre-stores a backup shard library and quickly replaces it when some computing nodes fail, ensuring task continuity (different from the traditional solution of directly terminating the task). At the same time, the dynamic threshold value t is automatically adjusted according to the network state to balance security and availability.

[0158] Preferably, it further includes:

[0159] When the number of zero-knowledge proofs that fail verification is greater than the threshold, it is determined that there is a systematic attack or network failure, and a security rollback mechanism is executed:

[0160] Discard all current intermediate results, adjust the dynamic threshold value, and redistribute the final encrypted shards, repeating the above calculation and verification process;

[0161] At the same time, record all zero-knowledge proofs that fail verification and the corresponding computing nodes in the tamper-proof log.

[0162] Preferably, by implementing the security rollback mechanism, the system can quickly take action when detecting a possible systematic attack or serious network failure. This helps prevent the further spread of potential security threats and protects the overall security and data integrity of the system; redistributing the final encrypted shards and repeating the calculation and verification process can effectively handle verification failures caused by accidental errors (such as transmission errors), enhancing the system's ability to handle abnormal situations, thereby improving the robustness and stability of the system; recording all zero-knowledge proofs that fail verification and the corresponding computing nodes in the tamper-proof log not only provides valuable data support for subsequent analysis, but also ensures that any abnormal behavior can be traced, increasing the transparency of the system and the ability to track the responsibility for potential malicious behavior.

[0163] Decrypt the encrypted calculation result to obtain the plaintext calculation result.

[0164] Preferably, when aggregating all intermediate results O i During the process, since the aggregation result automatically eliminates the influence of the mask, the encrypted calculation result R a is:

[0165] Preferably, decrypt the encrypted calculation result R a based on the master private key SK to obtain the plaintext calculation result Dr.

[0166] Example 3

[0167] As Figure 4 shown, a secure multi-party computing system based on secret sharing includes: a data partitioning module, a data encryption module, a data binding module, a distribution computing module, a verification output module, and a result output module;

[0168] The data partitioning module is used to obtain the original computing data and partition it into multiple data shards;

[0169] The data encryption module is used to perform homomorphic encryption and symmetric encryption on all data shards in sequence to obtain multiple hierarchically encrypted shards;

[0170] The data binding module is used to generate random mask values and bind them to the hierarchically encrypted shards correspondingly to obtain the final encrypted shards;

[0171] The distribution computing module is used to distribute all the final encrypted shards to each computing node for secure computing, and correspondingly obtain intermediate results and corresponding zero-knowledge proofs;

[0172] The verification output module is used to verify based on all the zero-knowledge proofs, and aggregate the corresponding intermediate results based on the verification results to generate an encrypted computing result;

[0173] The result output module is used to decrypt the encrypted computing result to obtain the plaintext computing result.

[0174] Preferably, the functional implementation processes of the modules in this embodiment correspond one by one to the above method content, and will not be elaborated here one by one.

[0175] Example 4

[0176] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete mutual communication through the communication bus;

[0177] The memory is used to store computer programs;

[0178] When the processor is used to execute the programs stored on the memory, it can implement a secure multi-party computing method based on secret sharing as described in Example 1 or 2.

[0179] The electronic device may include: a processor, a communications interface, a memory, and a communication bus. Among them, the processor, the communications interface, and the memory complete communication with each other through the communication bus. The processor may call the logical instructions in the memory to execute a secure multi-party computation method based on secret sharing in Embodiment 1 or 2.

[0180] In addition, when the logical instructions in the above-mentioned memory are implemented in the form of software functional units and sold or used as an independent product, they may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in various embodiments of the present invention. The foregoing storage medium includes: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc that can store program codes.

[0181] As can be seen from the above technical solutions, the present invention discloses a secure multi-party computation method and system based on secret sharing, having the following beneficial effects:

[0182] 1. By splitting the original data into multiple shards and combining a hierarchical encryption mechanism of homomorphic encryption and symmetric encryption, the present invention ensures that the data is always in an encrypted state during transmission and computation. Even if a single shard or node is attacked, the original data cannot be restored, significantly reducing the risk of data leakage.

[0183] 2. By binding random mask values, the present invention further obfuscates the plaintext features of the data shards, preventing attackers from inferring data information through statistical analysis or side-channel attacks, and enhancing the anti-reverse engineering ability of the data.

[0184] 3. The present invention distributes the encrypted shards to multiple computing nodes for parallel processing, which not only realizes multi-party collaborative computation but also avoids the risk of centralized data storage, meeting the requirements of privacy protection regulations (such as GDPR); by generating and verifying zero-knowledge proofs of intermediate results, the correctness and legality of the computation process are ensured, without exposing specific computation details, which not only guarantees the credibility of the computation results but also maintains the privacy of the participating parties.

[0185] 4. After the data of the present invention is fragmented, it can be processed in parallel by multiple nodes, accelerating the calculation process and improving the overall efficiency. By combining homomorphic encryption and symmetric encryption, the calculation complexity and security are balanced, and the high overhead of pure homomorphic encryption may be reduced, making it suitable for large-scale data scenarios.

[0186] 5. Through technologies such as data fragmentation, hierarchical encryption, random masking, and zero-knowledge proof verification, the present invention constructs a secure, efficient, and verifiable multi-party computing framework, effectively balancing privacy protection and computing efficiency, and providing reliable technical support for multi-party collaboration scenarios; through strict encryption and verification mechanisms, it meets the regulatory requirements of various industries for data privacy and security, and can be applied to multi-party computing scenarios that require privacy protection, such as financial transactions, medical data collaboration, and joint statistical analysis.

[0187] In this specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and reference can be made to the description in the method part for related parts.

[0188] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure multi-party computing method based on secret sharing, characterized in that, Including: Obtain the original calculation data and divide it into multiple data shards; Based on all the data shards, perform homomorphic encryption and symmetric encryption in sequence respectively to obtain multiple hierarchical encrypted shards; Generate random mask values and bind them to the corresponding hierarchical encrypted shards to obtain the final encrypted shards; Distribute all the final encrypted shards to each computing node for secure computing, and correspondingly obtain intermediate results and corresponding zero-knowledge proofs; Verify based on all the zero-knowledge proofs, and based on the verification results, aggregate the corresponding intermediate results to generate an encrypted calculation result; Decrypt the encrypted calculation result to obtain the plaintext calculation result.

2. The secure multi-party computing method based on secret sharing according to claim 1, wherein Set a dynamic threshold value t; The number n of the data shards is greater than or equal to the dynamic threshold value t to ensure that a single data shard cannot restore the original calculation data; The dynamic threshold value t is dynamically adjusted according to the network state: When the network packet loss rate exceeds the threshold, reduce the dynamic threshold value t to tolerate more node failures; When the risk of collusion attack is detected, increase the dynamic threshold value t to enhance security.

3. A secure multi-party computing method based on secret sharing according to claim 2, characterized in that, The method for obtaining the hierarchical encrypted shards is: Generate a public master key and a private master key based on the homomorphic encryption algorithm; Perform homomorphic encryption on the data shards based on the public master key to obtain initial encrypted shards; Generate a temporary session key and send it to each computing node; Perform symmetric encryption on the initial encrypted shards based on the temporary session key to obtain the hierarchical encrypted shards.

4. A secure multi-party computation method based on secret sharing according to claim 2, characterized in that, Generate random mask values, specifically including: Generate multiple random mask values based on a secure pseudorandom number generator; All of the said random mask values satisfy where a represents the number of random mask values, and M i represents the i-th random mask value; The number of the random mask values is the same as the number of the data shards.

5. A secure multi-party computation method based on secret sharing according to claim 3, characterized in that Correspondingly obtain intermediate results and corresponding zero-knowledge proofs, specifically including: The computing node decrypts the allocated final encrypted shards based on the temporary session key to obtain the corresponding initial encrypted shards and the random mask values; The computing node performs homomorphic operations on the initial encrypted shards based on the secure multi-party computing protocol to obtain a calculation result; The calculation result and the corresponding random mask values together form the intermediate result; Perform a hash calculation on the hierarchical encrypted shards to obtain a shard hash value; Generate the corresponding zero-knowledge proof based on the shard hash value, the calculation result, the random mask value, and the temporary session key.

6. A secure multi-party computation method based on secret sharing according to claim 5, characterized in that, Generate the corresponding zero-knowledge proof based on the shard hash value, the calculation result, the random mask value, and the temporary session key, specifically including: Perform a hash calculation on the shard hash value and the calculation result to obtain a shard result binding hash value; Set a large prime number and a generator; Generate a mask linear commitment value based on the large prime number, the generator, and the random mask value; Generate a challenge value based on the shard result binding hash value and the large prime number; Generate a response value based on the challenge value, the temporary session key, the large prime number, and the random mask value; Generate the zero-knowledge proof based on the response value, the shard result binding hash value, and the mask linear commitment value.

7. A secure multi-party computing method based on secret sharing according to claim 6, characterized in that, Verify based on all the zero-knowledge proofs, specifically including: Perform global mask constraint checking, single-proof validity verification, and shard consistency verification respectively based on all the zero-knowledge proofs; When all verifications pass, it indicates that the zero-knowledge proof verification passes; otherwise, it indicates that the zero-knowledge proof verification fails.

8. A secure multi-party computation method based on secret sharing according to claim 7, characterized in that, Based on the verification results, aggregate the corresponding intermediate results to generate an encrypted calculation result, specifically including: Judge whether all the zero-knowledge proofs pass the verification based on the verification results; If so, aggregate the intermediate results corresponding to all the zero-knowledge proofs to obtain the encrypted calculation result; Otherwise, trigger a disciplinary mechanism for the computing nodes corresponding to the zero-knowledge proofs that fail the verification, and at the same time judge whether the number of remaining valid shards is greater than or equal to the current dynamic threshold t; If so, start the redundant shard recovery mechanism, extract t valid shards from the backup shard library based on the original secret sharing protocol, re-encrypt and distribute them to the trusted computing nodes, and repeat the above calculation verification process until the encrypted calculation result is obtained; Otherwise, determine that the task fails, generate an error code and terminate the process, and re-execute the above process of dividing, encrypting, and distributing the original calculation data to other computing nodes for calculation verification.

9. A secure multi-party computation method based on secret sharing according to claim 7, characterized in that It also includes: When the number of zero-knowledge proofs that fail the verification is greater than the threshold, determine that there is a systematic attack or network failure, and execute the security rollback mechanism: Discard all current intermediate results, adjust the dynamic threshold, and redistribute the final encrypted shards, and repeat the above calculation verification process; At the same time, record all the zero-knowledge proofs that fail the verification and the corresponding computing nodes in the tamper-proof log.

10. A secure multi-party computing system based on secret sharing, which is applied to a secure multi-party computing method based on secret sharing as described in any one of claims 1-9, characterized in that, It includes: A data division module, a data encryption module, a data binding module, a distribution calculation module, a verification output module, and a result output module; The data division module is used to obtain the original calculation data and divide it into multiple data shards; The data encryption module is used to perform homomorphic encryption and symmetric encryption on all the data shards in sequence to obtain multiple hierarchically encrypted shards; The data binding module is used to generate a random mask value and bind it to the hierarchically encrypted shards correspondingly to obtain the final encrypted shards; The distribution calculation module is used to distribute all the final encrypted shards to each computing node for secure calculation, and correspondingly obtain intermediate results and corresponding zero-knowledge proofs; The verification output module is used to verify based on all the zero-knowledge proofs, and aggregate the corresponding intermediate results based on the verification results to generate an encrypted calculation result; The result output module is used to decrypt the encrypted calculation result to obtain the plaintext calculation result.

Images