Anti-malicious opponent confidential two-party character string sorting scheme
Through ElGamal homomorphic encryption and discrete logarithmic zero-knowledge proof, a confidential two-party string sorting protocol under the malicious model was designed, which solved the problem of malicious participants tampering with data, and realized efficient string sorting, database query and DNA comparison applications.
Patent Information
- Application Number
- CN202510545042.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-28
- Publication Date
- 2025-08-01
AI Technical Summary
Under the malicious model, the existing technology lacks an effective two-party string sorting scheme, which cannot prevent malicious participants from tampering with or forging data, resulting in protocol failure and leaking intermediate results, especially in applications such as database matching and DNA comparison.
Using ElGamal homomorphic encryption and discrete logarithmic zero-knowledge proof methods, a confidential two-party string sorting protocol under a malicious model is designed to ensure the privacy and integrity of the data through encryption, decryption and randomization processes, and to use zero-knowledge proof to prevent fraud.
It realizes effective two-party string sorting under the malicious model, prevents malicious participants from cheating, improves execution efficiency, and has high efficiency under the semi-honest model, and has important application value for database query and DNA comparison.
Smart Images
Figure CN120415683A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computational science in secure multi-party computation, and in particular to the problem of sorting strings between two parties in computational science. Background Art
[0002] Secure multi-party computation (MPC) is a key research area in privacy computing, and its applications can be categorized into two scenarios: semi-honest and malicious. Protocol design approaches for semi-honest models are significantly easier than those for malicious models. This is because semi-honest models assume that all participants correctly execute the protocol and do not tamper with data or abort the protocol. While participants may attempt to infer intermediate results during the protocol, common cryptographic methods ensure that the final result remains unaffected. In recent years, significant progress has been made in various schemes for semi-honest models. Protocol design for malicious models is more challenging because participants may not correctly execute the protocol and may forge inputs, tamper with intermediate results, or abort the protocol. These actions can compromise the correctness and security of the protocol, making it particularly challenging to construct protocols for malicious models. In real-world scenarios, participants are likely to be malicious. Therefore, research on secure MPC protocols for malicious models is urgently needed to prevent malicious actions from causing protocol failures and leaking intermediate results.
[0003] Due to the difficulty of constructing confidentiality protocols under malicious models, currently, solutions for these protocols are very scarce. There has been some research on confidentiality protocols under malicious models, including data equality determination, maximum (minimum) value determination, and the millionaire's problem. There is currently almost no research on confidentiality sorting under malicious models. The few studies that have been conducted focus on the millionaire's problem or simple derivatives. The true confidentiality sorting problem is still under exploration, so research on confidentiality sorting under malicious models is urgently needed. Two-party string sorting is a fundamental problem in confidentiality sorting and is of great significance to the study of database matching and DNA comparison. However, no two-party string sorting solutions under malicious models have yet been developed.
[0004] To address these issues, this solution primarily uses ElGamal homomorphic encryption to construct a two-party string sorting protocol in a semi-honest model. Based on this, a confidential two-party string sorting protocol in a malicious model is designed using zero-knowledge proofs. The ElGamal algorithm ensures homomorphic multiplication while guaranteeing encryption; ciphertext re-randomization obfuscates ciphertext without affecting the plaintext; and discrete logarithm zero-knowledge proofs guarantee that the plaintext has not been tampered with, making them highly suitable for this solution. Summary of the Invention
[0005] To overcome the deficiencies of the above-mentioned prior art, the present invention proposes a secure two-party string sorting scheme under a malicious model. The technical solution of the present invention is as follows:
[0006] Input: String A = a1a2…a owned by Alice n , and string B = b1b2…b owned by Bob m .
[0007] Output: The result F(A, B) after sorting by Alice and Bob
[0008] Preparation stage: Alice and Bob negotiate and determine the public parameters p and g. Alice generates a private key sk, calculates the public key h, publishes (p, g, h), and agrees on the string interaction length as l.
[0009] Specific steps:
[0010] (1) Alice constructs a vector according to each character information in her own string and fills in the corresponding number of 2s to obtain the corresponding vector V as shown in formula (1).
[0011]
[0012] Then, the obtained W is encrypted using the public key h as shown in formula (2), and then the calculated W is sent to Bob.
[0013]
[0014] (2) Bob calculates C according to formula (3) based on the W sent by Alice, where C is a proof vector for verifying whether Alice forges W. Bob sends the calculated C to Alice.
[0015]
[0016] (3) After receiving C, Alice decrypts it, proves that the decryption result is correct in the way of zero-knowledge proof of discrete logarithm, and randomly shuffles the result of C within the row. The randomly shuffled result is represented by R, and R is sent to Bob.
[0017] (4) Bob verifies whether each row in the decryption result R meets the following conditions: only the three results 0, 2, and 4 appear in the result, and 2 appears at most once. If other results appear, it means that Alice attempts to deceive, and Bob terminates the protocol; otherwise, Bob continues to execute the protocol.
[0018] (5) Bob calculates Y based on the received W according to the character information of his own string, and re-randomizes the ciphertext in Y during the calculation process. This step is the same as formula (4). After calculating Y, it is randomly shuffled into T, and then T is sent to Alice.
[0019]
[0020] (6) After Alice receives T, she decrypts T and verifies the decryption result. If the result shows other results than 0, 1, and multiples of 2, it means that Bob is trying to deceive, and Alice terminates the protocol; otherwise, Alice continues to execute the protocol.
[0021] (7) After Alice obtains the decryption result, she analyzes the result in T to obtain F(A, B). The specific analysis is as follows:
[0022] If 2 appears in D(T), output F(A, B) = 0; string A is sorted before string B in lexicographical order;
[0023] If n 1s appear in D(T), output F(A, B) = 1; string A is the same as string B;
[0024] If 0 appears in D(T), output F(A, B) = 2; string A is sorted after string B in lexicographical order;
[0025] Then send F(A, B) to Bob, and prove that the decryption result is correct by means of zero-knowledge proof of discrete logarithm.
[0026] (8) After Bob confirms that the result sent by Alice is correct, he obtains the final result F(A, B).
[0027] The advantages and beneficial effects of the present invention are as follows:
[0028] Compared with the prior art, the innovation points and beneficial effects of the present invention are in the following three aspects:
[0029] (1) The proposed scheme can solve the problem of secure two-party string sorting under the malicious model and can effectively prevent the malicious behavior of malicious participants.
[0030] (2) The proposed method can also solve the problem of secure two-party string sorting in the semi-honest model, and the execution efficiency is improved compared with other similar protocols.
[0031] (3) The proposed secure two-party string sorting protocol under the malicious model is of great significance for database query operations, DNA comparison, etc. Brief Description of the Drawings
[0032] Figure 1 This is the schematic model diagram of the solution idea of the present invention. Specific implementation manners
[0033] Next, the technical solutions in the embodiments of the present invention will be clearly and detailedly described in conjunction with the accompanying drawings in the embodiments of the present invention. First, the two-party string sorting solution under the semi-honest model will be introduced. The specific steps are as follows:
[0034] Input: The string A = a1a2…a owned by Alice n , and the string B = b1b2…b owned by Bob m .
[0035] Output: The result F(A, B) after sorting by Alice and Bob.
[0036] Preparation stage: Alice and Bob negotiate and determine the public parameters p and g. Alice generates the private key sk, calculates the public key h, and publishes (p, g, h).
[0037] The specific steps are as follows:
[0038] (1) Alice encodes the private string A = a1a2…a n according to formula (5) to obtain the matrix V'. To ensure that after Bob receives the matrix V', he cannot obtain the length of Alice's string from the length of V', Alice fills the number of rows of the V' vector to l rows. The specific filling rule is: when n < l, add l - n rows to the end of the vector V', and fill all the newly added rows with 2 to obtain the vector V' as shown in formula (6).
[0039]
[0040] (2) Alice encrypts each element in the matrix using the public key. The encryption process is to obtain the encryption result as shown in formula (7).
[0041]
[0042] The calculated result can be represented by W = E(V), and W is sent to Bob.
[0043] (3) After Bob receives W, he extracts the corresponding data from W according to the position of each character in his string B in the alphabet U, and then calculates formula (8).
[0044]
[0045] Among them, (b i )ord Indicates the position of the character in the alphabet U; Ran(C) represents re-randomizing the ciphertext.
[0046] (4) Bob constructs the vector Y' = (y1, y2, …, y m , …, y m ) according to the calculated y1, y2, …, y
[0047] Y = (y1, y2, …, y m , …, y l ) (9)
[0048] After obtaining the result, randomly shuffle the elements in Y, denote the shuffled result as T, and send T to Alice.
[0049] (5) After receiving T, Alice decrypts it with the private key to get D(t), and there are the following three cases:
[0050] If 2 appears in D(T), output F(A, B) = 0; string A is sorted before string B in lexicographical order.
[0051] If n 1s appear in D(T), output F(A, B) = 1; string A is the same as string B.
[0052] If 0 appears in D(T), output F(A, B) = 2; string A is sorted after string B in lexicographical order.
[0053] (6) Alice sends F(A, B) to Bob, and Bob gets the final result. After introducing the secure two-party string sorting scheme in the semi-honest model, according to the analysis, when designing the secure two-party string sorting scheme in the malicious model, only the case where Alice may exhibit malicious behavior needs to be considered. The malicious behavior of Bob can be classified into the case of providing false input and will not leak more information than the ideal protocol, so it can be not considered. And there are mainly two ways to detect Alice's malicious behavior:
[0054] (1) Forging a vector that does not conform to the specified form. In this case, the property of ElGamal homomorphic encryption can be utilized. Calculate the value of v i ×v i-1 for each row of the vector V, and ensure that v i ×v i-1The value can only take three values: 0, 2, and 4, and 2 appears only once. The correctness of the protocol is proven using zero - knowledge proof.
[0055] (2) After decryption, tell Bob a wrong result. Prove that the decryption result is correct in the way of zero - knowledge proof.
[0056] Based on the above analysis, a two - party string sorting scheme under a malicious model is constructed. The specific steps are as follows:
[0057] Input: The string A = a1a2…a owned by Alice n , and the string B = b1b2…b owned by Bob m .
[0058] Output: The result F(A, B) after sorting by Alice and Bob.
[0059] Preparation stage: Alice and Bob negotiate the public parameters p and g. Alice generates the private key sk, calculates the public key h, publishes (p, g, h), and agrees on the string interaction length l.
[0060] Specific steps:
[0061] (1) Alice constructs a vector according to each character information in her own string and fills in the corresponding number of 2s to obtain the corresponding vector V as shown in formula (10).
[0062]
[0063] Then encrypts it using the public key h to get W as shown in formula (11), and then sends the calculated W to Bob.
[0064]
[0065] (2) Bob calculates C according to the W sent by Alice according to formula (12), where C is the proof vector to verify whether Alice forges W. Bob sends the calculated C to Alice.
[0066]
[0067] (3) After receiving C, Alice decrypts it, proves that the decryption result is correct in the way of zero - knowledge proof of discrete logarithm, and randomly shuffles the result of C within the line. The randomly shuffled result is represented by R, and R is sent to Bob.
[0068] (4) Bob verifies whether each row in the decryption result R meets the following conditions: only the three results 0, 2, and 4 appear in the result, and 2 appears at most once. If other results appear, it means that Alice is trying to deceive, and Bob terminates the protocol; otherwise, Bob continues to execute the protocol.
[0069] (5) Bob calculates Y based on the received W and the character information of his own string, and re-randomizes the ciphertext in Y during the calculation process. This step is the same as formula (13). After calculating Y, it is randomly shuffled into T, and then T is sent to Alice.
[0070]
[0071] (6) After receiving T, Alice decrypts T and verifies the decryption result. If results other than 0, 1, and multiples of 2 appear, it means that Bob is trying to deceive, and Alice terminates the protocol; otherwise, Alice continues to execute the protocol.
[0072] (7) After Alice obtains the decryption result, she analyzes the result in T to obtain F(A, B). The specific analysis is as follows:
[0073] If 2 appears in D(T), output F(A, B) = 0; string A is sorted before string B in lexicographical order;
[0074] If n 1s appear in D(T), output F(A, B) = 1; string A is the same as string B;
[0075] If 0 appears in D(T), output F(A, B) = 2; string A is sorted after string B in lexicographical order;
[0076] Then send F(A, B) to Bob and prove that the decryption result is correct by means of zero-knowledge proof of discrete logarithm.
[0077] (8) After Bob confirms that the result sent by Alice is correct, he obtains the final result F(A, B).
[0078] The above embodiments should be understood as only for illustrating the present invention and not for limiting the protection scope of the present invention. After reading the content recorded in the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.
Claims
1. A secure two-party string sorting scheme against malicious adversaries, characterized in that, It can detect in time when a participant performs malicious behavior, force the participant to execute the protocol under the semi - honest model, and solve the two - party string sorting problem. There are mainly two - party string sorting schemes under the semi - honest model and secure two - party string sorting schemes under the malicious model.
2. The secure two-party string sorting scheme under the semi-honest model according to claim 1, characterized in that It transforms the one - to - one comparison between characters in string sorting into a calculation problem between vector matrices, can effectively solve the two - party string sorting problem, and then uses the ElGamal algorithm to achieve secure two - party string sorting, enabling participants to only know the sorting result without knowing the string information of other participants. The idea of the scheme is as follows: The alphabet U = {u1, u2,..., u k}, (u1 < u2 <... < u k ), all characters in A and B can be found in the alphabet U. Considering that the lengths of the strings are different, it is first necessary to agree that the lengths of the two strings are l, (l >= n, m). Alice constructs an l×k-dimensional vector V. The vector V carries the information of each character in A and sends V to Bob. After receiving V, Bob calculates relevant data based on the character data of B, thereby obtaining a vector T containing sorting information, and sends T to Alice. After Alice decrypts it, the final result F(A, B) is output, thereby obtaining the sorting result of the two.
3. The secure two-party string sorting scheme under the malicious model according to claim 1, characterized in that, Based on the secure two - party string sorting scheme in the semi - honest model, by using effective calculation methods and zero - knowledge proof methods of discrete logarithms, it can effectively resist the malicious behavior of participants forging midway to solve the two - party string sorting problem under the malicious model, and can be extended and applied to the solution of the millionaire problem under the malicious model.
4. The zero-knowledge proof method of discrete logarithm according to claim 3, characterized in that It can effectively solve the problem of Alice or Bob cheating, and can prove that the carried plaintext information has not been tampered with.