Secure data sharing computing method and system based on semi-honest MASCOT protocol

Abstract

The present invention provides a secure data sharing calculation method and system based on a semi-honest MASCOT protocol, the method comprising: when a new participant joins the request in the preprocessing stage, the predetermined participant extracts the obtained shards and the corresponding key values; for each shard under each extracted key value, the predetermined participant randomly selects a value in a finite field to generate a shard under the corresponding key value of the new participant, and sends the generated shards and the corresponding key value to the new participant; based on the sent shards, the predetermined participant updates the value of the shard corresponding to itself under each key value; the predetermined participant extracts the obtained multi-group shards and the corresponding key values; for each multi-group shard under each extracted key value, the predetermined participant randomly selects multiple values ​​in a finite field to generate a multi-group shard of the new participant, and sends the generated multi-group shards to the new participant; the predetermined participant updates the multi-group shard corresponding to itself under each key value based on the sent multi-group shards.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a secure data sharing calculation method and system based on a semi-honest MASCOT protocol. Background Art

[0002] Secure Multi-Party Computation (MPC) technology can realize the joint calculation of the output value of a function by multiple parties through their own secret inputs without the existence of a trusted third party and under the premise of protecting data privacy. N , each holding a secret input x1,x2,…,x N , we want to jointly compute the public function f(x1,x2,...,x N ), while ensuring that your secret input x i The result of the function is not known to other participants, and the correctness of the function result is guaranteed. MPC technology has very important applications in cloud, big data, artificial intelligence and other fields. At present, the research on MPC protocol shows that its security and performance have met the preliminary requirements of industrial productization. The SPDZ series of protocols is one of the famous MPC protocols for arithmetic circuits, including SPDZ, MASCOT, SPDZ2k, etc.

[0003] The SPDZ protocol is et al. proposed an efficient secure multi-party computation protocol at the 2012 American Cryptography Conference. It is divided into a preprocessing phase and an online phase. The preprocessing phase is independent of the function value to be calculated and the secret input values ​​of each party, and is used to generate the information required for the online phase; the online phase is used to calculate the function, and its operation process is very efficient. Since the preprocessing phase of the SPDZ protocol is based on partial homomorphic encryption technology, this phase consumes a lot of time. In order to reduce the time complexity of this phase, Keller et al. proposed the MASCOT protocol. The protocol still uses the online phase of the original SPDZ protocol, but redesigns its preprocessing process using oblivious transfer technology to speed up the execution of the preprocessing phase. According to the ability to resist the adversary, the MASCOT protocol can be divided into a semi-honest version and a malicious version. Among them, "semi-honest" refers to the ability of the adversary in the secure multi-party computation security model. An adversary with semi-honest capabilities, although it has broken into the participating party, will abide by the behavior specified in the protocol, that is, the participating party that has been broken into by the semi-honest adversary will honestly execute the protocol, but in the process, it will try to obtain as much information as possible.

[0004] Although the semi-honest version of the MASCOT protocol proposed by Keller et al. can efficiently implement the function of secure multi-party computation, the protocol is not complete. This is because in actual application environments, new participants will join the calculation during the execution of the protocol, and some original participants will need to exit the calculation process due to special circumstances. The MASCOT protocol does not take these two actual application environments into account. Therefore, during its operation, new participants cannot join, and the exit of the original participants will cause the protocol to run incorrectly. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a secure data sharing calculation method and system based on the semi-honest MASCOT protocol to eliminate or improve one or more defects in the prior art.

[0006] The technical solution of the present invention is as follows:

[0007] According to one aspect of the present invention, a secure data sharing calculation method based on the semi-honest MASCOT protocol is provided, the method comprising the following steps:

[0008] When a new participant joining request carrying identification information of the new participant is received during the preprocessing phase, the predetermined participant of the secure multi-party computation extracts all obtained data shards and corresponding key values;

[0009] For each data slice under each key value extracted, the predetermined participant randomly selects a value in a finite field to generate a data slice under the corresponding key value of the new participant, and sends the generated data slice and the corresponding key value to the new participant;

[0010] Based on the data shards sent to the new participant, the intended participant updates the value of the data shard corresponding to itself under each key value;

[0011] After receiving a joining request from a new participant in the preprocessing phase, the predetermined participant extracts the obtained multi-component fragments and corresponding key values;

[0012] For each multi-group fragment under each extracted key value, the predetermined participant randomly selects a plurality of values ​​in a finite field to generate a multi-group fragment under the corresponding key value of the new participant, and sends the generated multi-group fragment and the corresponding key value to the new participant;

[0013] The predetermined participant updates the multi-group fragment corresponding to itself under each key value based on the multi-group fragment sent to the new participant.

[0014] Optionally, the method also includes: in the case of receiving a participant exit request carrying participant identification information in the preprocessing stage, the predetermined participant receives all the obtained data slices and corresponding key values ​​sent by the participant to be exited; based on the data slices sent by the participant to be exited, the predetermined participant updates the value of the corresponding data slice under each key value; after receiving the exit request of the participant to be exited in the preprocessing stage, the predetermined participant receives all the obtained multi-group slices and corresponding key values ​​sent by the participant to be exited; the predetermined participant updates the value of its own multi-group slice under each key value based on the multi-group slices and corresponding key values ​​sent by the participant to be exited.

[0015] Optionally, the step of the predetermined participant updating the corresponding multi-group shard under each key value based on the multi-group shard sent to the new participant includes: the predetermined participant updates the corresponding data shard x under each key value (m) Update the value of x (m)- x (s) , where m represents the identifier of the predetermined participant, s represents the identifier of the new participant, and x (s) The step of updating the value of its own multi-group slice under each key value based on the multi-group slice and the corresponding key value sent by the participant to be withdrawn comprises: the predetermined participant updates the value of its own multi-group slice under each key value z (m) The value of is updated to z (m) +z (t) , where z represents an element of the multi-group slice, m represents the identifier of the predetermined participant, t represents the identifier of the participant to be withdrawn, and z (t) A fragment of the multi-group sent by the exiting party to the intended party.

[0016] Optionally, the predetermined participant is the participant with the smallest key value among all current participants.

[0017] Optionally, the method also includes: when a joining request from a prospective participant carrying at least identification information of a new participant is received during the calculation phase, the predetermined participant of the secure multi-party computation extracts all obtained data shards and corresponding key values; for each data shard under each extracted key value, the predetermined participant randomly selects a value in a finite field to generate a data shard under the corresponding key value of the new participant, and sends the generated data shard and corresponding key value to the new participant; based on the data shard sent to the new participant, the predetermined participant updates the value of its corresponding data shard under each key value; initiated by the new participant and under the responsibility of the predetermined participant, the triple shard is converted into a triple shard with one more shard; and the new participant randomly generates a mask shard for transmitting the data shard, and distributes it to all other participants.

[0018] Optionally, the method also includes: when an exit request from the participant to be exited carrying the identification information of the participant to be exited is received during the calculation phase, the predetermined participant receives all the obtained data slices and corresponding key values ​​sent by the participant to be exited; based on the data slices and corresponding key values ​​received from the participant to be exited, the predetermined participant updates the value of the corresponding slice under each key value; the participant to be exited sends the random number used when distributing data to the predetermined participant; the participant to be exit sends all the triplet slices it owns to the predetermined participant.

[0019] According to another aspect of the present invention, the present invention also provides a secure data sharing calculation method based on the semi-honest MASCOT protocol, the method comprising the following steps:

[0020] In the case where a withdrawal request from a participant to be withdrawn carrying identification information of the participant to be withdrawn is received in the preprocessing stage: the predetermined participant receives all acquired data fragments and corresponding key values ​​sent by the participant to be withdrawn; and the predetermined participant updates the value of the corresponding multi-group fragment under each key value based on the multi-group fragment and corresponding key value sent by the participant to be withdrawn;

[0021] In the case where an exit request from a participant to be exited carrying the identification information of the participant to be exited is received during the calculation phase: the predetermined participant receives all obtained data slices and corresponding key values ​​sent by the participant to be exited; and the predetermined participant updates the value of the corresponding data slice under each key value based on the data slices and corresponding key values ​​received from the participant to be exited.

[0022] Optionally, the step of the predetermined participant updating the value of its own multi-group fragment under each key value based on the multi-group fragment and the corresponding key value sent by the participant to be withdrawn includes: the predetermined participant updates the value of its own multi-group fragment under each key value z (m)The value of is updated to z (m) +z (t) , where z represents an element of the multi-group slice, m represents the identifier of the predetermined participant, t represents the identifier of the participant to be withdrawn, and z (t) A fragment of the multi-group sent by the exiting party to the intended party.

[0023] On the other hand, the present invention also provides a secure data sharing computing system based on the semi-honest MASCOT protocol, the device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, when the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0024] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the method described above are implemented.

[0025] The secure data sharing computing method and system based on the semi-honest MASCOT protocol provided by the present invention can realize the function of adding new participants and / or withdrawing original participants when the MASCOT protocol is running, which is closer to actual needs.

[0026] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically pointed out in the written description, claims, and drawings.

[0027] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. The components in the drawings are not drawn to scale, but are only for illustrating the principles of the present invention. In order to facilitate the illustration and description of some parts of the present invention, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present invention. In the drawings:

[0029] Figure 1 The figure is a flow chart of a method for adding participants in the preprocessing phase of the semi-honest MASCOT protocol in one embodiment of the present invention.

[0030] Figure 2The figure is a flowchart of a method for exiting a participant in the preprocessing phase of the semi-honest MASCOT protocol in one embodiment of the present invention.

[0031] Figure 3 The figure is a flow chart of a method for adding participants in the online phase based on the semi-honest MASCOT protocol in one embodiment of the present invention.

[0032] Figure 4 The figure is a flowchart of a participant exit method in the online phase based on the semi-honest MASCOT protocol in one embodiment of the present invention.

[0033] Figure 5 This is an overall framework diagram for implementing the addition and reduction of participants based on the semi-honest MASCOT protocol according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0035] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0036] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0037] Before introducing the secure multi-party computing protocol based on the semi-honest MASCOT protocol proposed in this invention, we first introduce basic symbols. i represents the i-th participant. At the beginning of the protocol, the N participants in the protocol are denoted as P1, P2, ..., P N The operations included in the protocol are all based on finite fields. In the following description, finite fields are uniformly recorded as The lowercase letter x represents a finite field. The bold lowercase letter x represents a finite field. A vector on . Let g be a finite field Generator of , introducing vector Defining functions is a "bit-decomposition" function that takes the input Mapped into a k-bit bit vector x B =g -1(x)∈{0,1} k , so that this vector can be mapped into the original input value x by taking the form of inner product with vector g, that is <g,g -1 (x)>=x. Introducing the symbol [x] to represent a vector And satisfy

[0038] Since the secure multi-party computing protocol proposed in this invention is based on the original MASCOT protocol, and the MASCOT protocol modifies the preprocessing phase of the SPDZ protocol, the following briefly introduces the semi-honest version of the SPDZ protocol. The SPDZ protocol is divided into a preprocessing phase and an online phase during execution. The preprocessing phase is mainly used to generate the information required for the online phase, and the online phase is used to calculate the function value to be calculated. During the online phase, in order to achieve the purpose of secure multi-party computing, all participants should not know every data in the function calculation process. The true value of each participant only has a random slice of the data, that is, for each data P i What you have is data sharding And satisfy In the embodiment of the present invention, the symbol [x] is used to represent that each participant owns a shard of x. In order to realize the online phase, the preprocessing phase needs to complete the following two tasks: (1) each participant P i A value needs to be randomly selected Then, this value is randomly divided into pieces and distributed to each participant, including oneself, to obtain [x]; (2) Generate enough triples ([a], [b], [c]) to satisfy c = a·b, where The participant P i What we actually have is a triple (a (i) , b (i) , c (i) ).

[0039] In the embodiment of the present invention, in the preprocessing stage, not only the tasks required for the online stage are completed, but also the actual application situations where new participants join or some of the original participants withdraw are handled. In the MASCOT protocol of the present invention, the preprocessing stage includes two sub-protocols II. [·] and Π Triple , where protocol Π [·] It is used to generate a shard [x] from a value x on a finite field and distribute it to each participant, and its true value can be revealed through the participation of all participants; Protocol Π TripleIt can be used to generate a triplet ([a], [b], [c]) that satisfies the condition c=a·b. In the case where the MPC protocol supports more tuples (such as quadruple or quintuple, etc.) including more than 4 elements in the future, the protocol II in the embodiment of the present invention Triple It can also be used to generate tuples with more than three elements.

[0040] The following describes the protocol UI in the embodiment of the present invention. [·] and Π Triple .

[0041] I. Protocol II[·]

[0042] (I) Distribution process: Participant P i Each input value x is distributed to other participants in the form of shards

[0043] The agreement starts from the participants P i Get the input (Input, id, x, N, P i ), from other participants P j (j≠i) gets the input (Input, id, N, P i ), where x represents data and id represents the identity number (ID number) corresponding to the shard to be generated.

[0044] Then, perform the following process:

[0045] (1) Participant P i Randomly select N-1 finite fields Assign the value in to x (1) , x (2) , …, x (N-1) ;

[0046] (2) Participant P i calculate

[0047] (3)Participant P i Split x (j) The value is sent to P j ;

[0048] (4) All participants store the resulting shards under the key value id.

[0049] Example: Assume that there are five parties, P1, P2, P3, P4, and P5, participating in the operation, that is, N = 5. At this time, the process of P1 distributing the input value x1 to other participants is as follows:

[0050] The protocol receives input (Input, 1, x1, 5, P1) from P1 and j (j≠1) gets the input (Input, 1, 5, P1), and then executes the following process;

[0051] (1) Participant P1 randomly selects 4 finite fields Assign the value in

[0052] (2) Calculation by Party P1

[0053] (3) Participant P1 will shard The value is sent to P j ;

[0054] (4) All participants store the obtained shards under their key id. That is, P1 has P2 has P3 has P4 has P5 has

[0055] Similarly, other participants P2~P4 can generate and send x to all participants including themselves. l (l=2, 3, 4, 5) fragments.

[0056] (II) Reveal process: All participants jointly reveal the corresponding value under the id

[0057] The protocol gets input (Open, id, N) from all parties and then performs the following process:

[0058] Each participant extracts the shard stored under the key id and then broadcasts their shard to other participants;

[0059] Each participant calculates And output the value.

[0060] Example: Assume that there are five parties, P1, P2, P3, P4, and P5, participating in the operation, that is, N = 5. At this time, all parties want to reveal the corresponding value under id, the process is as follows:

[0061] The protocol receives the same input (Open, 1, 5) from P1, P2, P3, P4, and P5, and then performs the following process:

[0062] (1) All participants extract the shard stored under key 1, that is, P1 extracts x (1) , P2 extracts x (2) , P3 extracts x (3) , P4 extracts x (4) , P5 extracts x (5) ;

[0063] (2) All participants broadcast their own shards to other participants. At this time, each participant owns all shards of x.

[0064] (3) Each participant calculates And output.

[0065] (III) Addition of new participants: New participant P s To join the agreement, you need to obtain the shards of the values ​​distributed by the original participants.

[0066] In the present embodiment, the protocol UI [·] Improvements have been made to add the ability for new participants to join the protocol. If a new participant wants to join the operation in the preprocessing stage, Figure 1 As shown, the multi-party secure operation proposed based on the improved protocol includes the following steps:

[0067] Step S110, when a new participant joins the preprocessing phase, the predetermined participant of the secure multi-party computation extracts all the obtained data shards and corresponding key values.

[0068] The joining request may be a broadcast message input by the new participant and carrying a joining instruction and an identifier of the new participant.

[0069] Here, the predetermined participant may be a pre-agreed parameter party, such as P1 or other participants, and the predetermined participant is used to allocate shards to the new participant based on the data shards it has obtained.

[0070] In one embodiment of the present invention, the participants used to allocate shards to new participants can also be agreed upon in a predetermined priority order. For example, according to the key value of the participant, when the participant P1 with the highest priority has withdrawn, the participant P2 with the second highest priority can be selected as the predetermined participant.

[0071] Step S120, for each shard under each extracted key value, the predetermined participant randomly selects a value in the finite field to generate a data shard under the corresponding key value of the new participant, and sends the generated data shard and the corresponding key value to the new participant.

[0072] Through this step, the new participant obtains the shard of data used for secure multi-party computing so as to participate in secure multi-party computing.

[0073] Step S130, based on the data slices sent to the new participant, the predetermined participant updates the value of the data slice corresponding to each key value.

[0074] For example, the scheduled participants will divide their own corresponding data into x shards under each key value. (m) Update the value of x (m) -x(s) , where m represents the identifier of the predetermined participant, s represents the identifier of the new participant, and x (s) The data shard sent by the intended participant to the new participant.

[0075] More specifically, protocol II [·] From the new participant P s (S>N, for example, it can be N+1) to get the input (Add, P s ), and then perform the following procedure:

[0076] (1) Participant P1 extracts all the obtained data shards and the corresponding key values ​​(id, x (1) ).

[0077] (2) For each (id, x (1) ), participant P1 randomly selects a finite domain The value x in (s) And (id, x (s) ) to P s , and then update the corresponding value under the key value id to x (1) -x (s) A more detailed example is given below.

[0078] Example:

[0079] Assume that initially only P1, P2, P3, P4, and P5 participate in the operation, and a new participant P6 wants to join. At this point, P1 has completed the distribution of data x1, P2 has completed the distribution of data x2, P3 has completed the distribution of data x3, and P4 and P5 have not yet distributed. For P1, P2, P3, P4, and P5, each party has a shard of x1, x2, and x3, that is:

[0080] Participant P1 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0081] Participant P2 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0082] Participant P3 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0083] Participant P4 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0084] Participant P5 has The fragment values ​​are stored under id=1, 2, and 3 respectively.

[0085] After the new participant P6 joins, it needs to obtain a shard of x1, x2, and x3. At this time, participant P1 is responsible for generating a shard of x1, x2, and x3 for participant P6. The specific process is as follows:

[0086] (1) Participant P1 extracts the shard with key id = 1 Then randomly choose a finite field The value in and will Send it to P6, and then update the shard value under key id=1

[0087] (2) Participant P1 extracts the shard with key id = 2 Then randomly choose a finite field The value in and will Send it to P6, and then update the shard value under key id=2

[0088] (3) Participant P1 extracts the shard with key id = 3 Then randomly choose a finite field The value in and will Send it to P6, and then update the shard value under key id=3

[0089] After participating, when participants P4 and P5 distribute input values, they can directly generate shards of input values ​​for all 6 participants and distribute them to each participant.

[0090] (IV) Participant withdrawal: Original participant P t (t≤N) Exit the agreement and send the shards it owns to the intended participants

[0091] The multi-party secure computing method of the embodiment of the present invention also includes a process in which a participant exits during the pre-processing phase, such as Figure 2 As shown, the process includes the following steps:

[0092] Step S210: When receiving a withdrawal request from the original participant in the preprocessing phase, the predetermined participant receives all the obtained fragments and corresponding key values ​​sent by the participant to be withdrawn.

[0093] The exit request may be a broadcast message input by the participant to be exited and carrying an exit instruction and a participant identification. The predetermined participant is, for example, P1, but is not limited thereto.

[0094] Step S230: Based on the slices sent by the participant to be withdrawn, the scheduled participant updates the value of the slice corresponding to each key value.

[0095] For example, the scheduled participants will divide their own data into x shards under each key value (m) Update the value of x (m) +x (t) , where m represents the identifier of the scheduled participant, t represents the identifier of the participant to be withdrawn, and x (t) The shards sent by the participant to be withdrawn to the scheduled participant.

[0096] More specifically, the protocol starts from the original party P t Get input (Quit, P t ), and then perform the following procedure:

[0097] (1) Participant P t All the obtained fragments and the corresponding key values ​​(id, x (t) ) is sent to P1;

[0098] (2) For each id, participant P1 updates the value of the corresponding shard to x (1) +x (t) .

[0099] Example:

[0100] Assume that initially only P1, P2, P3, P4, and P5 participate in the operation, and participant P2 wants to withdraw. At this time, P1 has completed the distribution of input value x1, P2 has completed the distribution of input value x2, P3 has completed the distribution of input value x3, and P4 and P5 have not yet distributed. For the five parties P1, P2, P3, P4, and P5, each party has a shard of x1, x2, and x3, that is:

[0101] P1 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0102] P2 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0103] P3 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0104] P4 has Store the shard values ​​under id=1, 2, and 3 respectively;

[0105] P5 has The fragment values ​​are stored under id=1, 2, and 3 respectively.

[0106] If participant P2 wants to exit, it needs to send all the shards it owns to the intended participant P1. The specific process is as follows:

[0107] (1) Participant P2 extracts the shard with key value id=1 Then Send it to P1, and then P1 updates the shard value under key id=1

[0108] (2) Participant P2 extracts the shard with key id = 2 Then Send it to P1, and then P1 updates the shard value under key id = 2

[0109] (3) Participant P2 extracts the shard with key id = 3 Then Send it to P1, and then P1 updates the shard value under key id = 3

[0110] Therefore, in the preprocessing stage, whether the original participants withdraw or new participants join, compared with the existing semi-honest version of the MASCOT protocol, the protocol Π [·] The actual needs of adding new participants and withdrawing existing participants during runtime are closer to the real environment.

[0111] 2.Π Triple protocol

[0112] Π Triple The protocol uses the random oblivious transfer protocol (ROT) during execution. The oblivious transfer (hereinafter referred to as OT) protocol is the basis of other cryptographic protocols, especially in secure two-party (multi-party) computing protocols. The most common OT protocol is the two-choice OT protocol, that is, the sender inputs two messages M0 and M1, and the receiver inputs a selection bit c. After the protocol is executed, the receiver gets the message M0. c But for M 1-c The sender knows nothing, and the receiver will not know whether M0 or M1 is obtained by the receiver. If the number of messages sent by the sender increases to n, then the protocol is an n-choose-one OT protocol. The random OT protocol is similar to the OT protocol but also different. Taking the two-choose-one random OT protocol as an example, at the beginning of the protocol execution, the sender does not have the message, but the receiver still inputs a selection bit c. After the execution, the sender obtains two messages M0 and M1 randomly generated by the protocol, while the receiver only obtains one of the messages M. c , for M 1-c In the embodiment of the present invention, the symbol It represents a k-times random OT protocol, in which the length of the message transmitted is k bits.

[0113] (I) TripleTriple generation of the protocol: All parties jointly generate a set of triplets

[0114] Π Triple The protocol's triplet generation process is as follows:

[0115] (1) Each participant P i Randomly select finite fields The two values ​​in are assigned to a (i) , b (i) ;

[0116] (2) For every pair of ordered parties (P i , P j ), use random OT to perform the following operations:

[0117] (2.1) Participant P i (equivalent to the sender in the random OT protocol) and P j (equivalent to the receiver in the random OT protocol) call Where P i enter As the selection bits of the random OT protocol, since there are k selection bits in total, the random OT protocol is performed k times;

[0118] (2.2) For each h∈{1, 2, …, k} (h represents the number of executions of the random OT protocol), P j We get a finite field The two values ​​in and P i get This value satisfies hour when hour

[0119] (2.3) For each h∈{1, 2, …, k}, P j calculate Then send it to P i ;

[0120] For each h∈{1, 2, ..., k}, P i calculate Then there is

[0121] (2.4) Record

[0122] (2.5)P i calculate P j calculate Note that there is

[0123] (3) Each participant P i calculate

[0124] (4) Each participant P i Store under the key id (a (i) , b (i) , c (i) ), note that now we have the equation ∑ i c (i) =(∑ i a (i) )·(∑ i b (i) ) holds, that is, a set of triples ([a], [b], [c]) is generated, where ∑ i a (i) =a,∑ i b (i) =b,∑ i c (i) =c.

[0125] Since the triple generation process is an existing process, it will not be explained and illustrated in detail here, but the present invention is not limited to the triple generation process generated as above, and is also applicable to the present invention when the triple or multi-tuple generation process is changed.

[0126] (II) Addition of new participants: New participant P s To join the protocol, the generated triples need to be processed into triples with one more shard and distributed to the new participant P s .

[0127] like Figure 1 As shown, after receiving a joining request from a new participant in the preprocessing stage, the multi-party secure computation in the embodiment of the present invention includes the following steps:

[0128] Step S140: The predetermined participant extracts the obtained multi-group fragments and corresponding key values.

[0129] Scheduled Participant P i For example, it may be P1, and of course, it may also be other participants.

[0130] Step S150: For each multi-group fragment under each extracted key value, the predetermined participant randomly selects multiple values ​​in the finite field to generate a multi-group fragment under the corresponding key value of the new participant, and sends the generated multi-group fragment and the corresponding key value to the new participant.

[0131] Step S160: The predetermined participant updates its corresponding multi-group fragment under each key value based on the multi-group fragment sent to the new participant.

[0132] More specifically, when the intended participant is P1, the protocol starts with the new participant P s Get input (Add, P s ) and then perform the following process:

[0133] (1) Participant P1 extracts all the obtained triples and their corresponding key values ​​(id, a (1) , b (1) , c (1) );

[0134] (2) For each (id, a (1) , b (1) , c (1) ), participant P1 randomly selects three finite fields Assign the value in to a (s) , b (s) , c (s) , and (id, a (s) , b (s) , c (s) ) to P s , and then update the corresponding triplet fragment under the key value id to (a (1) -a (s) , b (1) -b (s) , c (1) -c (s) ).

[0135] Example:

[0136] Assume that initially only P1, P2, P3, P4, and P5 participate in the operation, and a new participant P6 wants to join.

[0137] Participant P1 has 5 sets of triplet shards, which store shard values ​​under id=1, 2, 3, 4, 5 respectively:

[0138] The fragment value stored under id=1

[0139] The fragment value stored under id=2

[0140] The fragment value stored under id=3

[0141] The fragment value stored under id=4

[0142] The fragment value stored under id=5

[0143] After the new participant P6 joins, it needs to get a slice of the triple. At this time, participant P1 is responsible for generating a slice of the triple for participant P6. The specific process is as follows:

[0144] (1) Participant P1 extracts the triplet fragment under key id=1 Then randomly choose a finite field The three values ​​in and will Send it to P6, and then update the triplet fragment value under key id=1 to

[0145] (2) Participant P1 extracts the triplet fragment under key id = 2 Then randomly choose a finite field The three values ​​in and will Send it to P6, and then update the triplet fragment value under key id = 2

[0146] For the triplet fragment under the key value id=3, 4, 5, participant P1 performs the same operation, which will not be repeated here.

[0147] As a result, the new participant P6 has the corresponding 5 sets of triplet shards, and can participate in the calculation like other participants.

[0148] (III) Participant withdrawal: Original participant P t To exit the protocol, the ternary shards owned by the user must be sent to P1.

[0149] Refer to Figure 2 After receiving the exit request of the original participant in the preprocessing stage, the multi-party secure computing of the embodiment of the present invention further includes the following steps:

[0150] Step S230: the scheduled participant receives all obtained multi-group fragments and corresponding key values ​​sent by the participant to be withdrawn.

[0151] The predetermined participant is, for example, P1.

[0152] Step S240: the predetermined participant updates the value of its own multi-group fragment under each key value based on the multi-group fragment and the corresponding key value sent by the participant to be withdrawn.

[0153] More specifically, the protocol starts from the original party P t Get input (Quit, P t ) and then perform the following process:

[0154] (1) Original participant P tSlice all the obtained triples and the corresponding key values ​​(id, a (t) , b (t) , c (t) ) is sent to participant P1;

[0155] (2) For each id, P1 updates the value of the corresponding triplet fragment to (a (1) +a (t) , b (1) +b (t) , c (1) +c (t) ).

[0156] If z is used to represent each element of a multi-tuple slice, such as [a], [b], [c], then the updated value of the corresponding triple slice can be represented as z (m) +z (t) .

[0157] This process is the opposite of the joining process of participants, so I will not go into details here.

[0158] As can be seen from the above, in the embodiment of the present invention, protocol II [·] and Π Triple Both have the functions of "adding participants" and "withdrawing participants". Based on the "adding participants" and "withdrawing participants" processes in the preprocessing stage as described above, the problem that new participants cannot join the existing semi-honest version of the MASCOT protocol during its operation, and the withdrawal of the original participants will cause the protocol to run incorrectly can be solved.

[0159] In addition, in the embodiment of the present invention, a mechanism for participants to join and exit the online phase is also proposed, that is, in the protocol UI, Online The "Participant Addition" and / or "Participant Exit" functions have been added. Online The introduction is used to illustrate the method for participants to join and exit in the online stage of the present invention.

[0160] 3. Protocol II Online

[0161] Π Online The protocol is used in the online phase, with N participants P1, P2, ..., P N Together we complete the public function f(x1, x2, ..., x n ) calculation.

[0162] (I) Existing Process

[0163] Protocol Online There is an initialization step, namely: each participant P i Calling the protocol Π in the preprocessing stage TripleGenerate multiple sets of triplets ([a], [b], [c]), where each participant only has one set of triplet fragments of the corresponding triplets; each participant randomly selects its own mask value r i , and using the protocol Π in the preprocessing stage [·] Distribute it to other parties.

[0164] When adding or deleting participants at this stage, the "Participant Addition" or "Participant Exit" function of the corresponding protocol is called to meet the actual application requirements of adding or deleting participants.

[0165] The Π Online The process of protocol execution calculation is as follows:

[0166] (1) Input: Each participant P i Use the mask value r that you randomly select and distribute i Enter the secret into x i To share, you need to perform the following process:

[0167] Participant P i Calculate ε = x i -r i , and then broadcast the value of ε to all other participants;

[0168] All participants P j Using the known r i Shard Calculate x as follows i The shard of x owned by P1 i Shard for Other participants P j (j≠1) Owned shards and same.

[0169] (4) Addition calculation:

[0170] To calculate the sum of two elements x and y, each participant only needs to calculate locally. i Find the corresponding shard x (i) and (i) , then calculate z (i) =x (i) +y (i) , and store the shard value of the intermediate state.

[0171] (5) Multiplication calculation:

[0172] To calculate the product of two elements x and y, the following process is performed:

[0173] Each participant P iFind the corresponding shard x (i) and (i) , and find a triplet slice with the same key value (a (i) , b (i) , c (i) );

[0174] Each participant P i Calculate ε (i) =x (i) -a (i) , ρ (i) =y (i) -b (i) ;

[0175] All parties call the protocol Π [·] The "reveal" function obtains the values ​​of ε and ρ;

[0176] Each participant P i Calculate z (i) =c (i) +ε·b (i) +ρ·a (i) +ε·ρ, and store the shard value of the intermediate state.

[0177] (6) Output calculation results

[0178] To output the final result z, all participants call the protocol The "reveal" function can use the slice value to get the value of z.

[0179] (II) Increase in the number of participants

[0180] In the embodiment of the present invention, when a participant requests to join the calculation in the online calculation stage, such as Figure 3 As shown, the corresponding multi-party security operation includes the following steps:

[0181] Step S310: The predetermined participant extracts all obtained intermediate value fragments and corresponding key values.

[0182] The predetermined participant is, for example, P1.

[0183] Step S320: For each shard under each extracted key value, the predetermined participant randomly selects a value in the finite field to generate a shard under the corresponding key value of the new participant, and sends the generated shard and the corresponding key value to the new participant.

[0184] Step S330, based on the shards sent to the new participant, the predetermined participant updates the value of the shard corresponding to itself under each key value.

[0185] Step S340, initiated by the new participant and under the responsibility of the predetermined participant, converts the triplet fragment into a triplet fragment with one more fragment.

[0186] Therefore, the new participant can use the existing computing process to perform online computing. For example, in step S350, the new participant randomly generates a mask slice for transmitting data slices and distributes it to all other participants. The new participant can then use the mask slice to distribute its own secret input and perform further computing.

[0187] More specifically, if the protocol starts with the new participant P s Get input (Add, P s ) (Participant Join Request), and then perform the following process:

[0188] (1) In step S310, participant P1 extracts all obtained intermediate value fragments and corresponding key values ​​(id, x (1) ).

[0189] (2) In steps S320 to S330, for each (id, x (1) ), participant P1 randomly selects a finite domain The value x in (s) And (id, x (s) ) to P s , and then update the corresponding value under the key value id to x (1) -x (s) .

[0190] (3) In step S340, the new participant P s Calling Protocol Π Triple The "Participant Addition" function converts all triplet shards into triplet shards with one more shard.

[0191] (4) In step S350, the new participant P s Randomly generate finite fields A value r s , then call the protocol Use the Distribute function to distribute it.

[0192] Therefore, the participant P s Calling Protocol Π Online The "input" function can be used to s Distribute your own secret input x s , so that further calculations can be performed.

[0193] Example:

[0194] Assume that initially only P1, P2, P3, P4, and P5 participate in the operation, and a new participant P6 wants to join. At this point, the preprocessing phase has been completed and the online phase is in progress. This means that each participant has multiple sets of shards of triplets and shards of intermediate calculation values ​​(including shards of secret input values ​​of other participants, which will not be discussed below). The addition of a new participant requires the completion of three main tasks: (1) Obtain shards of all intermediate calculation values ​​through interaction with P1; (2) Obtain a shard of all triplets through interaction with P1; (3) Distribute its own secret input x6. Assume that the shards of intermediate values ​​owned by P1 are and The shards of the triples owned are and The specific process is as follows:

[0195] (1) For id=1, 2, 3, participant P1 randomly selects a finite domain The value in and and will and Send it to P6, and then update its own values ​​under key id=1, 2, 3 respectively and

[0196] (2) For id=4, 5, 6, 7, party P1 calls protocol Π Triple The "Participant Addition" function converts all triplet shards into triplet shards with one more shard and sends the corresponding shards to P6;

[0197] (3) The new participant P6 randomly generates a finite field A value r6 is entered, and then the protocol is called The "distribute" function distributes it;

[0198] (4) Participant P6 calls protocol Π Online The "input" function can use r6 to distribute its own secret input x6, so that further calculations can be performed.

[0199] (III) Withdrawal of Participants:

[0200] In the embodiment of the present invention, when an original participant requests to exit the operation during the online phase (or the computing phase), Figure 4 As shown, the corresponding multi-party security operation includes the following steps:

[0201] Step S410, when receiving a withdrawal request from the original participant in the online stage, the predetermined participant receives all the obtained fragments and corresponding key values ​​sent by the participant to be withdrawn.

[0202] This exit request can enable the original participant P t The input message carries the exit identifier and the identifier of the party to be exited (Quit), such as the input (Quit, P t )information.

[0203] Step S420: based on the received shards and corresponding key values, the scheduled participant P m Update the value of the corresponding shard under each key value;

[0204] Step S430, the participant to be withdrawn sends the random number used when distributing data to the predetermined participant;

[0205] Step S440: the participant to be withdrawn sends all the triplet fragments it has to the intended participant.

[0206] For example, in the original participant P to be withdrawn t To the intended participant P m All received fragments x sent (t) and the corresponding key value, the predetermined participant P m Each key value has its corresponding shard x (m) Update the value of x (m) +x (t) .

[0207] More specifically, the protocol starts from the original party P t Get input (Quit, P t ), and then perform the following procedure:

[0208] (1) Original participant P t Slice all the intermediate values ​​obtained and the corresponding key values ​​(id, x (t) ) is sent to P1;

[0209] (2) For each id, P1 updates the value of the corresponding shard to x (1) +x (t) ;

[0210] (3) Original participant P t The random number r used when distributing secret input t Send to P1;

[0211] (4) Original participant P t Calling Protocol Π Triple The "Party Exit" function sends all triplet shards to P1.

[0212] Example:

[0213] Suppose that initially there are five parties P1, P2, P3, P4, and P5 participating in the operation. Participant P2 wants to withdraw, and the intended participant is P1. At this point, the preprocessing stage has been completed, and the online stage is in progress. This means that each participant has multiple sets of shards of triplets, and has shards of intermediate calculation values ​​(including shards of secret input values ​​of other participants, which will not be discussed below). The withdrawal of the original participant requires the completion of three main tasks: (1) Through interaction with P1, send the shards of all intermediate calculation values ​​to P1; (2) Through interaction with P1, send a shard of all triplets to P1; (3) Send r2 used to distribute its own secret input x2 to P1. Suppose the shards of the intermediate values ​​owned by P2 are and The shards of the triples owned are and The specific process is as follows:

[0214] (1) For id=1, 2, 3, participant P2 will and Sent to P6, participant P1 updates its corresponding values ​​under key id=1, 2, 3 respectively and

[0215] (2) For id=4, 5, 6, 7, participant P2 calls protocol Π Triple The "Participant Exit" function sends all triplet fragments to P1;

[0216] (3) Participant P2 sends r2 to P1.

[0217] like Figure 5 As shown, the embodiment of the present invention is to protocol II [·] , Π Triple and Online Both have been improved, and the functions of adding and withdrawing participants have been added, so that participants can be added and withdrawn regardless of the preprocessing stage or the online stage.

[0218] Compared with the existing semi-honest version of the MASCOT protocol, the above-described embodiment of the present invention can handle the actual needs of adding new participants and withdrawing original participants when the protocol is running, thereby solving the problem that new participants cannot join during the operation of the existing semi-honest version of the MASCOT protocol, and the withdrawal of original participants will cause the protocol to run incorrectly. In addition, the embodiment of the present invention is closer to the real environment.

[0219] Correspondingly, the present invention also provides a system for adding and exiting participants based on the semi-honest MASCOT protocol, the system comprising a processor and a memory, the memory being used to store computer instructions, the processor being used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0220] In terms of protocol security, if no participants are added or deleted, the security of this protocol is consistent with that of the semi-honest version of the MASCOT protocol. When participants are added or deleted, the security is slightly reduced because the information of the added participants and the original participants who have withdrawn will be controlled or obtained by participant P1. In terms of protocol execution efficiency, if no participants are added or deleted, the execution efficiency of this protocol is consistent with that of the semi-honest version of the MASCOT protocol. When participants are added or deleted, the execution efficiency is slightly reduced because additional operations need to be performed. However, it should be noted that this protocol can implement functions that the semi-honest version of the MASCOT protocol cannot implement, and can handle real-world applications that the semi-honest version of the MASCOT protocol cannot handle. Therefore, the slightly reduced security and execution efficiency are completely negligible compared to the completeness of the functions and the closer to the actual application environment.

[0221] The present disclosure also relates to a storage medium, on which computer program code may be stored, and when the program code is executed, various embodiments of the method of the present invention may be implemented. The storage medium may be a tangible storage medium, such as an optical disk, a USB flash drive, a floppy disk, a hard disk, etc.

[0222] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0223] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium or transmitted on a transmission medium or a communication link via a data signal carried in a carrier. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, and the like. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0224] It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in a different order from the embodiments, or several steps can be performed simultaneously.

[0225] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0226] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A secure data sharing computing method based on the semi-honest MASCOT protocol, characterized in that: The method comprises the following steps: When a new participant joining request carrying identification information of the new participant is received during the preprocessing phase, the predetermined participant of the secure multi-party computation extracts all obtained data shards and corresponding key values; For each data slice under each key value extracted, the predetermined participant randomly selects a value in a finite field to generate a data slice under the corresponding key value of the new participant, and sends the generated data slice and the corresponding key value to the new participant; Based on the data shards sent to the new participant, the intended participant updates the value of the data shard corresponding to itself under each key value; After receiving a joining request from a new participant in the preprocessing phase, the predetermined participant extracts the obtained multi-component fragments and corresponding key values; For each multi-group fragment under each extracted key value, the predetermined participant randomly selects a plurality of values ​​in a finite field to generate a multi-group fragment under the corresponding key value of the new participant, and sends the generated multi-group fragment and the corresponding key value to the new participant; The predetermined participant updates the corresponding multi-group fragment under each key value based on the multi-group fragment sent to the new participant; The step of the predetermined participant updating the value of the data slice corresponding to itself under each key value based on the data slice sent to the new participant includes: The predetermined participant divides the corresponding data slice x under each key value (m) Update the value of x (m) -x (s) , where m represents the identifier of the predetermined participant, s represents the identifier of the new participant, and x (s) The data shard sent by the intended participant to the new participant.

2. The method according to claim 1, characterized in that: The method further comprises: In the case of receiving a participant exit request carrying the participant identification information during the pre-processing phase, the predetermined participant receives all acquired data fragments and corresponding key values ​​sent by the participant to be exited; Based on the data shards sent by the participant to be withdrawn, the scheduled participant updates the value of the corresponding data shard under each key value; After receiving the exit request of the participant to be exited in the preprocessing stage, the predetermined participant receives all the obtained multi-group fragments and corresponding key values ​​sent by the participant to be exited; The predetermined participant updates the value of its own multi-group fragment under each key value based on the multi-group fragment and the corresponding key value sent by the participant to be withdrawn.

3. The method according to claim 2, characterized in that The step of the predetermined participant updating the value of its own multi-group fragment under each key value based on the multi-group fragment and the corresponding key value sent by the participant to be withdrawn includes: The predetermined participant slices its own multi-components under each key value z (m) The value of is updated to z (m) +z (t) , where z represents an element of the multi-group slice, m represents the identifier of the predetermined participant, t represents the identifier of the participant to be withdrawn, and z (t) A fragment of the multi-group sent by the exiting party to the intended party.

4. The method according to claim 1 or 2, characterized in that: The predetermined participant is the participant with the smallest key value among all current participants.

5. The method according to claim 1 or 2, characterized in that: The method further comprises: In case a joining request from a prospective participant carrying at least identification information of a new participant is received during the computation phase, the intended participant of the secure multi-party computation extracts all obtained data shards and corresponding key values; For each data slice under each key value extracted, the predetermined participant randomly selects a value in a finite field to generate a data slice under the corresponding key value of the new participant, and sends the generated data slice and the corresponding key value to the new participant; Based on the data slices sent to the new participant, the predetermined participant updates the value of the data slice corresponding to itself under each key value; The new participant converts the triplet shard into a triplet shard with one more shard; and The new participant randomly generates a mask shard for transmitting data shards and distributes it to all other participants.

6. The method according to claim 1 or 2, characterized in that: The method further comprises: In the case of receiving a withdrawal request from a participant to be withdrawn carrying identification information of the participant to be withdrawn during the calculation phase, the predetermined participant receives all acquired data fragments and corresponding key values ​​sent by the participant to be withdrawn; Based on the data shards and corresponding key values ​​received from the participant to be withdrawn, the predetermined participant updates the value of the corresponding shard under each key value; The participant to be withdrawn sends the random number used when distributing data to the intended participant; The participant to be withdrawn sends all the triplet fragments it has to the intended participant.

7. A secure data sharing computing method based on the semi-honest MASCOT protocol, characterized in that: The method comprises the following steps: In the case where a withdrawal request from a participant to be withdrawn carrying identification information of the participant to be withdrawn is received in the preprocessing stage: the predetermined participant receives all acquired data slices and corresponding key values ​​sent by the participant to be withdrawn; and the predetermined participant updates the value of the corresponding data slice under each key value based on the multi-group slice and corresponding key value sent by the participant to be withdrawn; In the case where a withdrawal request from a participant to be withdrawn carrying identification information of the participant to be withdrawn is received during the calculation phase: the predetermined participant receives all acquired data slices and corresponding key values ​​sent by the participant to be withdrawn; and the predetermined participant updates the value of the corresponding multi-group slice under each key value based on the data slices and corresponding key values ​​received from the participant to be withdrawn; The step of the predetermined participant updating the value of its own multi-group fragment under each key value based on the multi-group fragment and the corresponding key value sent by the participant to be withdrawn includes: The predetermined participant slices its own multi-components under each key value z (m) The value of is updated to z (m) +z (t) , where z represents an element of the multi-group slice, m represents the identifier of the predetermined participant, t represents the identifier of the participant to be withdrawn, and z (t) A fragment of the multi-group sent by the exiting party to the intended party.

8. A secure data sharing computing system based on the semi-honest MASCOT protocol, the system comprising a processor and a memory, characterized in that: The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of any one of the methods described in claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images