Secure computing network device and method

Abstract

The present disclosure relates to techniques for secure computing. One aspect includes a network device including a non-transitory memory containing instructions; and one or more processors in communication with the non-transitory memory. The one or more processors execute instructions to receive and process routing requests in a network; send an indication to the network that the network device is capable of performing secure computing; perform secure computing based on input received from an input device through the network; ensure that the result of the secure computing is credible as a correct result of the secure computing; and provide the credible result of the secure computing to a result device connected to the network.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application No. 62 / 810,730, filed on February 26, 2019, entitled “SECURE COMPUTING NETWORK APPARATUS AND METHOD,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to secure computing network devices and methods. Background Art

[0004] Secure computation (also known as privacy-preserving computation) is a subfield of cryptography whose goal is to create methods for computing results for some input while keeping the input private. An example of secure computation is a zero-knowledge proof (also known as a zero-knowledge protocol). A zero-knowledge proof is a method for one party (the prover) to prove to another party (the verifier) ​​that the prover knows a value "x" without conveying any information other than the fact that the prover knows the value of "x". So, a zero-knowledge proof allows the prover to prove that they know the value of "x" without revealing the value of "x" to the verifier. Summary of the invention

[0005] According to one aspect of the present disclosure, a network device is provided, comprising a non-transitory memory containing instructions; and one or more processors in communication with the non-transitory memory. The one or more processors execute instructions to receive and process routing requests in a network. The one or more processors execute instructions to send an indication of the type of secure computation that the network device can perform to the network. The one or more processors execute instructions to perform the type of secure computation based on input received from an input device via the network. The one or more processors execute instructions to ensure that the result of the secure computation is trusted as the correct result of the secure computation. The one or more processors execute instructions to provide the trusted result of the secure computation to a result device connected to the network.

[0006] Optionally, in any of the foregoing aspects, in order to ensure that the result of the secure computation is credible, one or more processors execute instructions to generate a credible result by the network device acting as a peer with other network devices in the network that perform secure computation.

[0007] Optionally, in any of the foregoing aspects, in order to provide a trusted result of the secure computation to the result device, one or more processors execute instructions to record the trusted result in a blockchain ledger.

[0008] Optionally, in any of the foregoing aspects, in order to ensure that the results of the secure computation are credible, one or more processors execute instructions to notarize the results of the secure computation from multiple network devices to produce a credible result.

[0009] Optionally, in any of the foregoing aspects, in order to ensure that the results of the secure computing are trustworthy, one or more processors execute instructions in a trusted execution environment (TEE).

[0010] Optionally, in any of the foregoing aspects, in order to send an indication to the network of the type of secure computing that the network device can perform, one or more processors execute instructions to: receive a query via the network as to whether the network device is capable of performing that type of secure computing; and respond to the query to indicate that the network device is capable of performing that type of secure computing.

[0011] Optionally, in any of the foregoing aspects, in order to send an indication to the network of the type of secure computations that the network device is capable of performing, the one or more processors execute instructions to add information to a header of a data packet when processing a routing request.

[0012] Optionally, in any of the preceding aspects, the input from the input device comprises a zero-knowledge proof.

[0013] Optionally, in any of the foregoing aspects, in order to perform secure computing, one or more processors execute instructions to verify the correctness of the zero-knowledge proof based on a verification protocol.

[0014] Optionally, in any of the foregoing aspects, in order to provide a trusted result of a secure computation to a result device, one or more processors execute instructions to: in response to a correct zero-knowledge proof, return a true result to the result device; in response to an incorrect zero-knowledge proof, return a false result to the result device.

[0015] Optionally, in any of the preceding aspects, to process routing requests in a network, one or more processors execute instructions to route data packets according to an open system interconnection (OSI) layer 3 protocol.

[0016] Optionally, in any of the preceding aspects, to process routing requests in a network, one or more processors execute instructions to transmit frames according to an Open Systems Interconnection (OSI) layer 2 protocol.

[0017] Optionally, in any of the foregoing aspects, input received from the input device over the network is encrypted. One or more processors execute instructions to perform secure computations without decrypting the input. This allows the input device to keep information confidential.

[0018] Optionally, in any of the aforementioned aspects, the network device further includes a secure computing accelerator configured to perform secure computing.

[0019] According to another aspect of the present disclosure, a computer-implemented method for secure computing is provided. The method includes a network device receiving and processing a routing request in a network; the network device sending an indication of a type of secure computing that the network device can perform to the network; the network device performing the type of secure computing based on input received from an input device via the network; the network device ensuring that a result of the secure computing is credible as a correct result of the secure computing; and providing the credible result of the secure computing from the network device to a result device connected to the network.

[0020] According to another aspect of the present disclosure, a non-transitory computer-readable medium for secure computing is provided, storing computer instructions that, when executed by one or more processors, cause the one or more processors to: receive and process routing requests in a network through a network device; send an indication to the network of the type of secure computing that the network device is capable of performing; perform the type of secure computing based on input received from an input device through the network; ensure that a result of the secure computing is trustworthy as a correct result of the secure computing; and provide the trusted result of the secure computing to a result device connected to the network.

[0021] This summary is provided to introduce a selection of concepts that are further described in the following detailed description in a simplified form. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. The claimed subject matter is not limited to implementations that solve any or all of the disadvantages mentioned in the background technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The various aspects of the present disclosure are illustrated by way of example and not limitation in the accompanying figures, in which like reference numerals refer to elements thereof.

[0023] Figure 1 A communication system is shown in which embodiments may be practiced.

[0024] Figure 2 An embodiment of a network node according to an embodiment of the present disclosure is shown.

[0025] Figure 3 A high-level block diagram of a computing system is shown.

[0026] Figure 4 A high-level block diagram of a computing system that may be used in one embodiment of a network node is shown.

[0027] Figure 5 An example user device is shown.

[0028] Figure 6 is a flow diagram of one embodiment of a secure computation process performed by a network node.

[0029] Figure 7 is a flow chart of one embodiment of a process for secure computing.

[0030] Figure 8 An embodiment of a process in which a single network node performs secure computations is shown.

[0031] Fig. 9 An embodiment of a process in which multiple network nodes perform secure computations is shown.

[0032] Fig.10 An embodiment of a process in which the results of a secure computation are recorded in a blockchain ledger is shown.

[0033] Fig.11 Embodiments of a communication system in which a single network node verifies a zero-knowledge proof are described.

[0034] Fig.12 Describes the Fig.11 Flowchart of one embodiment of a process used in the communication system 1100.

[0035] Fig.13 Embodiments of a communication system are depicted in which multiple network nodes verify a zero-knowledge proof and in which a notary node exists to notarize the result.

[0036] Fig.14 Describes the Fig.13 Flowchart of one embodiment of a process used in the communication system 1300.

[0037] Fig.15 An embodiment of a communication system is depicted in which a plurality of network nodes act as peers in a blockchain network, verifying zero-knowledge proofs.

[0038] Fig.16 Describes the Fig.15 Flow diagram of one embodiment of a process used in the communication system 1500. DETAILED DESCRIPTION

[0039] The present disclosure will now be described with reference to the accompanying drawings, which generally relates to secure computing network devices, systems and methods.A network device (also referred to herein as a "network node") may include, but is not limited to, a router or a switch.

[0040] Secure computing (also known as privacy-preserving computing) is a subfield of cryptography whose goal is to create methods for computing results for certain inputs while keeping the inputs private. One type of secure computing is zero-knowledge proofs (also known as zero-knowledge protocols). In one embodiment, a network node acts as a "verifier" by verifying that the zero-knowledge proof generated by the input node is correct. Zero-knowledge protocols meet three requirements: integrity, soundness, and zero-knowledge. In this case, integrity means that if the input is true, the zero-knowledge proof always returns "true". Soundness means that it is impossible to trick the zero-knowledge proof into returning "true" if the input is false. Zero-knowledge means that if the statement is true, the verifier will not know what the statement actually is.

[0041] Another type of secure computation is secure multi-party computation (MPC). The MPC protocol allows n "players" to compute a function of their data while keeping their data private. In one embodiment, the network nodes compute a function of the data without the input nodes revealing their data. For example, two entities with confidential patient data can conduct a joint study on the patient data without revealing the confidential patient information. Therefore, in one embodiment, the network nodes perform secure MPC.

[0042] Embodiments are not limited to the type of secure computation being zero-knowledge proof or secure multi-party computation, and other types of privacy-preserving computation may be implemented.

[0043] In one embodiment, one or more parties (referred to herein as "input nodes") encrypt information that they wish to keep confidential before sending the encrypted information to one or more network nodes. In one embodiment, one or more network nodes perform secure computations without decrypting the encrypted information. Thus, one or more network nodes can determine the results of the secure computations while maintaining the privacy of the information of one or more parties.

[0044] A significant challenge in implementing secure computations such as zero-knowledge proofs or MPC is that it may require relatively large amounts of computer memory and / or computation time, which makes it difficult to provide practical implementations. Embodiments in which secure computations are performed by network nodes shift the burden of performing secure computations from electronic devices that do not have the computational power and / or the ability to perform secure computations that would be too burdensome.

[0045] Another major challenge in implementing secure computing is to prevent dishonest entities from attempting to produce erroneous results of secure computing. As defined herein, secure computing has a correct result. However, dishonest entities may attempt to impose erroneous results. In one embodiment, one or more network nodes performing secure computing provide a mechanism to ensure that the result of the secure computing can be trusted as the correct result. Here, "trusted result" means that the result of the secure computing can be considered to be the correct result. Examples of mechanisms to ensure that the result of the secure computing can be trusted as the correct result include, but are not limited to, multiple network nodes acting as peer nodes to generate trusted results, notarizing the results of secure computing from multiple network devices to produce trusted results, and / or performing secure computing in a trusted execution environment (TEE).

[0046] Additionally, routing traffic can be reduced by selecting network nodes that perform secure computations.

[0047] It should be understood that the current embodiments of the present disclosure can be implemented in many different forms, and the scope of the claims should not be interpreted as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure thorough and complete, and will fully convey the embodiment concepts of the present invention to those skilled in the art. In fact, the present disclosure is intended to cover the substitution, modification and equivalence of these embodiments, which are included in the scope and spirit of the present disclosure as defined by the appended claims. In addition, in the following detailed description of the current embodiments of the present disclosure, many specific details are set forth in order to provide a thorough understanding. However, it will be clear to those of ordinary skill in the art that the current embodiments of the present disclosure can be practiced without these specific details.

[0048] Figure 1A communication system 100 is shown in which an embodiment can be practiced. The communication system 100 includes one or more input nodes 102 (also referred to as "input devices"), one or more result nodes (also referred to as "result devices") 104, and multiple network nodes (also referred to as "input devices") 106. The network nodes 110 reside in one or more networks 110. The network nodes 106 may be routers, switches, etc. At least one of the network nodes 106 is configured to perform a secure computation. In one embodiment, the secure computation has one or more inputs and at least one result. The input node 102 is a node that provides input to the secure computation. When there are two or more inputs, one or more input nodes 102 may provide different inputs to the secure computation. The result node 104 is a node that receives the result of the secure computation. Therefore, the terms "input node" and "result node" refer to the roles played by each node in the secure computation. A node may be an input node for one secure computation and a result node for another secure computation. For the same secure computation, when there are multiple input nodes for the secure computation, a node may be both an input node and a result node.

[0049] Input node 102 or result node 104 can be user equipment (UE), including but not limited to wireless transmission / reception unit (UE), mobile station, fixed or mobile subscription unit, pager, cellular phone, personal digital assistant (PDA), smart phone, notebook computer, computer, touch pad, wireless sensor, wearable device or consumer electronic device. Input node 102 or result node 104 can be a network server. Input node 102 can also be referred to as input device in this article, which is understood to be an electronic device such as UE or network server. Result node 104 can also be referred to as result device in this article, which is understood to be an electronic device such as UE or network server.

[0050] The network node 106 is used to receive and process routing requests in the network 110. The network node 106 may include, for example, a router or a switch. In one embodiment, the network node 106 routes data packets between two nodes (e.g., between two input nodes 102, between an input node and a result node 104, between two result nodes 104) according to an open system interconnection (OSI) network layer (or layer 3) protocol. In one embodiment, the network node 106 transmits frames between two nodes according to an open system interconnection (OSI) link layer (or layer 2) protocol. The network node 106 is not limited to these examples for receiving and processing routing requests in the network 110. For example, in a multi-protocol label switching (MPLS) embodiment, an MPLS header may be added between a network layer header (i.e., a layer 3 header) and a link layer header (i.e., a layer 2 header) of an open system interconnection model (OSI model). Because MPLS typically operates at a layer that is generally considered to be between the traditional definitions of OSI Layer 2 (Data Link Layer) and Layer 3 (Network Layer), MPLS is often referred to as a Layer 2.5 protocol.

[0051] In one embodiment, at least one of the network nodes 106 is used to perform a type of secure computation. Secure computation may also be referred to herein as "privacy-preserving computation". One type of secure computation is zero-knowledge proof (also referred to as zero-knowledge protocol). Zero-knowledge protocols are known to those of ordinary skill in the art. It is not required that all network nodes 106 are capable of performing secure computation. In one embodiment, the input node 102 or the result node 104 sends a request (or query) to the network 110 to find one or more network nodes 106 that can perform that type of secure computation. The sender of the query (e.g., the input node 102 or the result node 104) selects one or more of the network nodes 106 to perform the secure computation. Note that there may be multiple types of zero-knowledge proofs. For example, there may be many different protocols for calculating and verifying zero-knowledge proofs. Therefore, the sender of the query can look for one or more network nodes 106 that can perform a specific type of zero-knowledge protocol.

[0052] Zero-knowledge proofs can be thought of as secure two-party computations, where a verifier (e.g., network node 106) verifies the validity of a statement made by a prover (e.g., input node 102). This concept can be extended to secure multi-party computation (MPC). The MPC protocol allows n "players" to compute functions of their inputs while keeping their inputs private. An example of secure multi-party computation is called a secure summation protocol, which allows multiple parties to compute functions of their respective data without revealing the data to each other. For example, party A has data x1, party B has data x2, and party C has data x2. Each party can be a different input node 102. Network node 106 computes a function of the data, while input node 102 does not reveal their data. For example, two entities with confidential patient data can conduct a joint study of the patient data without revealing confidential patient information. Therefore, in one embodiment, network node 106 performs secure multi-party computation. Techniques for secure multi-party computation are known to those of ordinary skill in the art.

[0053] As described above, the security computation may have one or more inputs from corresponding to one or more input nodes 102. In one embodiment, each input node having inputs for the security computation sends its inputs to each selected network node 106. After the one or more selected network nodes 106 perform the security computation, the result of the security computation is provided to the result node 104. In one embodiment, the network node 106 is used to ensure that the result of the security computation is credible. In other words, the network node 106 is used to ensure that the result of the security computation is the correct result. Further details of how the network node 106 ensures that the result is credible are described here.

[0054] The following secure computation example will be used for illustrative purposes. Input node 102 may be a laptop computer and result node 104 may be a network server. The user of the laptop computer may be making a purchase on an e-commerce server that includes a network server. One of network nodes 106 may perform a secure computation associated with the purchase. An example of a secure computation is for network node 106 to verify that the user of the laptop computer has sufficient monetary funds to make the purchase. The transaction may involve blockchain technology; however, the use of blockchain technology is not required.

[0055] Network node 106 can perform any type of secure computation. Secure computation allows input node 102 (or multiple nodes) to keep certain input information confidential while still allowing result node 104 to be certain about the input information. For example, input node 102 can keep the total amount of money a user has in an account confidential while still assuring result node 104 that the user has enough funds to make a purchase. In one embodiment, input node 102 keeps its information private by encrypting it before sending it to network node 106. In one embodiment, network node 106 is able to generate results for secure computations without decrypting the information.

[0056] In some cases, the secure computation involves more than one input node 102. An example of this is sometimes called the "millionaire's problem." In one version of the millionaire's problem, two or more people want to determine who has more wealth without revealing their exact wealth to anyone. More generally, this can be viewed as a problem of comparing two numbers to determine which is larger without revealing the actual value of either number. This problem has many practical applications. A practical example is if a buyer only wants to pay a certain amount of money, and a seller wants to sell for a certain minimum amount, but neither wants to reveal their respective amounts. One or more network nodes 106 perform secure computations for these or other problems, keeping certain inputs from input nodes 102 confidential. For example, a network node 106 can determine which of two people has more wealth without either person revealing their wealth to the network node 106.

[0057] In one embodiment, a single network node 106 performs secure computations. In one embodiment, the network node 106 has a trusted execution environment (TEE). In one embodiment, secure computations are performed in the TEE. In one embodiment, the TEE is a secure area of ​​the main processor. In one embodiment, the TEE ensures that the code and data loaded inside are protected in terms of confidentiality and integrity. Examples of TEEs include, but are not limited to, AMD platform security processors (PSP), ARM Technology, Intel Trusted Execution Technology and Secure Trusted Execution Environment. Network node 106 may send the result to result node 104. Thus, in this manner, network node 106 may provide the result to result node 104. Furthermore, due to the use of, for example, TEE, result node 104 may trust that the result is the correct result. Note that security mechanisms other than TEE may be used in conjunction with network node 106.

[0058] In one embodiment, two or more network nodes 106 perform the same security calculation. Each network node 106 can provide the result of its security calculation to one of the nodes, which can act as a "notarization node". The notarization node can compare the results to determine the final result. For example, in one embodiment, if all results match, the result can be considered a final result. If the results do not match, the results can be discarded, or in one embodiment, most of the results can be considered final results. In one embodiment, the notarization node is one of the network nodes 106. In one embodiment, the notarization node can be a node that is not a network node 106, in which case two or more network nodes 106 send their respective results to the notarization node for notarization. In one embodiment, the notarization node can be a result node 104, in which case two or more network nodes 106 send their respective results to the result node 104 for notarization. In addition, due to the consensus mechanism provided by the notarization node, for example, the result node 104 can believe that the result is the correct result.

[0059] In one embodiment, two or more network nodes 106 act as peer nodes (or more simply "peers") to ensure that the results of the secure computation are trusted as correct results. Each node can perform secure computations. Network nodes 106 can act as peers and compare their results. For example, two or more network nodes 106 act as peers in a blockchain network. The blockchain network consists of peer nodes, each of which can hold a copy of the ledger. Therefore, in one embodiment, network nodes 106 hold a copy of the blockchain ledger. In one embodiment, the results of the secure computation are recorded in the blockchain ledger. In one embodiment, result node 104 obtains the results from the blockchain ledger. Therefore, in this way, one or more network nodes 106 can provide the results to result node 104. In addition, result node 104 can believe that the result is correct, for example, a consensus mechanism provided by network nodes 106 acting as peers.

[0060] Although Figure 1 An example of a communication system is shown, but the Figure 1 For example, the communication system 100 may include any number of input nodes 102, network nodes 106, result nodes 104, or other components in any suitable configuration.

[0061] Figure 2An embodiment of a network node (e.g., a router) according to an embodiment of the present disclosure is shown. The network node 106 may include multiple input / output ports 210 / 230 and / or receivers (receivers, Rx) 212 and transmitters (transmitters, Tx) 232 for receiving and sending data from other nodes, a processor 220, including a memory 222, to process data and determine the node to send data. Although illustrated as a single processor, the processor 220 is not limited thereto and may include multiple processors. The processor 220 may be implemented as one or more central processing unit (CPU) chips, cores (e.g., multi-core processors), field programmable gate arrays (field-programmable gate arrays, FPGAs), application specific integrated circuits (application specific integrated circuits, ASICs) and / or digital signal processors (digital signal processors, DSPs), and / or may be part of one or more ASICs. The processor 220 may be used to implement any of the schemes described herein using any one of the steps or combinations of steps described in the embodiments. In some embodiments, the processor 220 is used to perform secure computing. In addition, the processor 220 may be implemented using hardware, software, or both.

[0062] The memory 222 (or memory) may include a cache 224 and a long-term memory 226, and may be configured to store routing tables, forwarding tables, or other tables or information disclosed herein. Although illustrated as a single memory, the memory 222 may be implemented as a combination of a read only memory (ROM), a random access memory (RAM), or a secondary memory (e.g., one or more disk drives or tape drives for non-volatile storage of data). In one embodiment, the memory 222 contains instructions that can be executed on the processor 220 to perform secure computing.

[0063] Figure 3 A high-level block diagram of a computing system 300 is shown. The computing system 300 may be used to implement an input node 102, a result node 104, or a network node 106. A particular device may utilize all of the components shown, or only a subset of the components, and the level of integration may vary from device to device. In addition, a device may include multiple instances of a component, such as multiple processing units, processors, memories, transmitters, receivers, etc.

[0064] The computing system 300 may include one or more input / output devices, such as a network interface, a storage interface, etc. The computing system 300 may include a central processing unit (CPU) 310, a memory 320, a mass storage device 330, and an I / O interface 360 ​​connected to a bus 370. The bus may be one or more of a plurality of bus architecture types, including a storage bus or storage controller, a peripheral bus, etc.

[0065] CPU 310 may include any type of electronic data processor. CPU 310 may be used to implement any scheme described herein using any one of the steps or combinations of steps described in the embodiments. Memory 320 may include any type of system memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), combinations thereof, etc. In one embodiment, memory 320 may include ROM for use at startup, and DRAM for program and data storage used when executing a program.

[0066] In an embodiment, memory 320 is non-transitory. Memory 320 is a non-transitory computer-readable medium that stores computer instructions that, when executed by CPU 310, cause one or more processors to perform various functions described herein. In an embodiment, memory 320 includes software modules that can be executed on CPU 310.

[0067] The mass storage device 330 may include any type of storage device for storing data, programs, and other information and making the data, programs, and other information accessible via the bus. The mass storage device 330 may include, for example, one or more of a solid-state drive, a hard disk drive, a magnetic disk drive, an optical disk drive, and the like.

[0068] The computing system 300 also includes one or more network interfaces 350, which may include wired links, such as Ethernet cables, etc., and / or wireless links to access nodes or one or more networks 110. The network interfaces 350 allow the computing system 300 to communicate with remote units via the network 110. For example, the network interface 350 may provide wireless communication via one or more transmitters / transmit antennas and one or more receivers / receive antennas. In one embodiment, the computing system 300 is coupled to a local area network or a wide area network for data processing and communication with remote devices, such as other processing units, the Internet, remote storage facilities, etc. Herein, the term "network interface" will be understood to include ports.

[0069] Figure 3 The components depicted in the computing system of are those typically found in computing systems suitable for the techniques described herein, and are intended to represent a broad class of such computer components known in the art. Many different bus configurations, network platforms, and operating systems may be used.

[0070] Figure 4 A high-level block diagram of a computing system 400 that may be used in one embodiment of a network node 106 is shown. The computing system 400 has some of the same elements as the computing system 300, which will not be described in detail. For example, the computing system 400 has a CPU 410 connected to a bus 470, a mass storage 440, a network interface 450, and an I / O interface 460.

[0071] Memory 440 stores various modules. Routing module 440A is used to receive and process routing requests in a network, such as network 110. In one embodiment, routing module 440A is used to route packets according to an open system interconnection (OSI) layer 3 protocol. In one embodiment, routing module 440A is used to transmit frames according to an open system interconnection (OSI) layer 2 protocol.

[0072] The capability qualifier module 440B is used to inform other nodes (usually not another network node 106) that the network device 106 is capable of performing a specific type (or multiple types) of secure computation. The type of secure computation may indicate the type of zero-knowledge proof, the type of MPC, or some other privacy-preserving computation. In one embodiment, the capability qualifier module 440B is used to add information to a data packet header indicating that the network device 106 is capable of performing a specific type of secure computation. The data packet header may be used for one or more data packets routed by the network device 106. In one embodiment, the capability qualification module 440B is used to receive a query via the network to inquire whether the network device 106 is capable of performing a specific type of secure computation. In one embodiment, the capability qualification module 440E is used to respond to the query to indicate that the network device is capable of performing a specific type of secure computation.

[0073] Secure computation module 440C is used to perform secure computation. As described above, secure computation (also known as privacy-preserving computation) is a subfield of cryptography whose goal is to create methods for computing the results of certain input(s) while maintaining the privacy of the inputs. In one embodiment, secure computation includes zero-knowledge proofs (also known as zero-knowledge protocols). In one embodiment, secure computation includes secure MPC.

[0074] The trust providing module 440D is used to perform operations to ensure that the result of the secure computation is a correct result (e.g., a trusted result). In one embodiment, the trust providing module 440D is used to communicate with other network devices 106 that perform the same secure computation. For example, this can allow the network device 106 to act as a peer point for other network devices that perform secure computations in the network. In one embodiment, the network device 106 is used to act as a peer node in a blockchain network. By acting as a peer node in a blockchain network when performing secure computations, the network device 106 helps ensure that the result of the secure computation is trusted to be correct.

[0075] The result providing module 440D is used to provide the result of the secure computation to the result device 104 connected to the network 110. In one embodiment, the result is sent from the network device 106 to the result device 104. In one embodiment, the network device 106 records the result in the blockchain ledger. In one embodiment, the blockchain ledger is stored on the network device 106. For example, the blockchain ledger can be stored in the memory 440 or the mass storage 440. In one embodiment, the result device 104 obtains the result from the blockchain ledger.

[0076] In some embodiments, secure computing may require a large amount of computing power. In one embodiment, secure computing accelerator 480 is used to accelerate secure computing. Secure computing accelerator 480 may include hardware (e.g., a processor and possible additional memory). In one embodiment, secure computing accelerator 480 includes a hardware accelerator. In one embodiment, the hardware accelerator is used to perform secure computing. Therefore, in one embodiment, secure computing accelerator 480 is specially designed to perform secure computing. Therefore, in one embodiment, secure computing accelerator 480 can perform secure computing faster than a general-purpose processor. Secure computing accelerator 480 is not necessary. Therefore, in one embodiment, secure computing is performed on CPU 410.

[0077] Figure 5 An example user device is shown. User device 500 may be used to implement input node 102 or result node 104. User equipment (UE) may be, for example, a mobile phone, but in further examples may be other devices, such as a desktop computer, a laptop computer, a tablet, a handheld computing device, an automotive computing device, and / or other computing devices. As shown, UE 500 includes at least one processor 504. Processor 504 implements various processing operations of UE 500. For example, processor 504 may perform signal encoding, data processing, power control, input / output processing, or enable UE 500 to communicate with system 100 ( Figure 1) or any other functions operated in the processor 504. The processor 504 may include any suitable processing or computing device for performing one or more operations. For example, the processor 504 may include a microprocessor, a microcontroller, a digital signal processor, a field programmable gate array, or an application specific integrated circuit.

[0078] UE 500 also includes at least one transceiver 502. Transceiver 502 is used to modulate data or other content for transmission through at least one antenna 510. Transceiver 502 is also used to demodulate data or other content received by at least one antenna 510. Each transceiver 502 may include any suitable structure for generating signals for wireless transmission, and / or processing wireless received signals. Each antenna 510 includes any suitable structure for transmitting and / or receiving wireless signals. It is understood that one or more transceivers 502 can be used in UE 500, and one or more antennas 510 can be used in UE 500. Although shown as a single functional unit, transceiver 502 can also be implemented using at least one transmitter and at least one independent receiver.

[0079] UE 500 also includes one or more input / output devices 508. Input / output devices 508 facilitate interaction with a user. Each input / output device 508 includes any suitable structure for providing information to a user or receiving information from a user, such as a speaker, microphone, keypad, keyboard, display, or touch screen.

[0080] In addition, the UE 500 includes at least one memory 506. The memory 506 stores instructions and data used, generated or collected by the UE 500. For example, the memory 506 can store software or firmware instructions executed by the processor 504, and data for reducing or eliminating interference in incoming signals. Each memory 506 includes any suitable volatile and / or non-volatile memory and retrieval device. Any suitable type of memory can be used, such as a random access memory (RAM), a read-only memory (ROM), a hard disk, an optical disk, a subscriber identity module (SIM) card, a memory stick, a secure digital (SD) memory card, etc.

[0081] Figure 66 is a flow chart of one embodiment of a process 600 for secure computing. In one embodiment, the process 600 is performed by the network node 106. Step 602 includes receiving and processing a routing request in the network 110. In one embodiment, step 602 includes routing packets according to an open systems interconnection (OSI) layer 3 protocol. In one embodiment, step 602 includes transmitting frames according to an open systems interconnection (OSI) layer 2 protocol. In one embodiment, step 602 includes receiving and processing a routing request according to an MPLS protocol.

[0082] Step 604 includes sending an indication of the type of secure computation that the network device 106 is capable of performing to the network 110. In one embodiment, step 604 includes the network device 106 adding information to a header of a data packet indicating the type of secure computation that the network device 106 is capable of performing. For example, when processing a data packet in step 602, the network device 106 may add information to a header of one or more data packets. The data packet may be a data packet that is transmitted between the input node 102 and the result node 104; however, this is not required. Therefore, in one embodiment, the network device 106 is one of the network devices 106 that processes data packets that are transmitted between the input node 102 and the result node 104.

[0083] Other techniques may be used for a network node 106 to indicate the type of secure computation it is capable of performing. In one embodiment, a network device 106 responds to a query from, for example, an input node 102 or a result node 104 regarding the capabilities of the network node 106. For example, a network device 106 may receive a query regarding the type of secure computation that the network device 106 is capable of performing. In one embodiment, the request is received from a node that is about to provide input to a secure computation (or input node 102). In one embodiment, the request is received from a node that is about to receive the result of a secure computation (or result node 104).

[0084] Step 606 includes the network node 106 performing the type of security computation based on input from the input node 102. In one embodiment, before step 606, the network node 106 may receive input for the security computation from each of the one or more input nodes 102. In one embodiment, the network node 106 performs the security computation based on input from a single input node 102. In one embodiment, the network node 106 performs the security computation based on separate input from each of two or more input nodes 102. In one embodiment, the network node 106 is one of two or more network nodes 106 performing the same security computation. In one embodiment, the security computation includes a zero-knowledge proof. In this case, the input node 102 may provide proof and verification to the network node 106. The network node 106 may verify the correctness of the zero-knowledge proof based on a verification key.

[0085] Step 608 includes the network node 106 ensuring that the result of the secure computation is trusted to be correct. The network node 106 can ensure that the result is trusted to be correct in a variety of ways. In one embodiment, the network node 106 acts as a peer with other network devices performing secure computations in the network 110 to ensure that the result is trusted to be correct. In one embodiment, the network node 106 acts as a peer in the blockchain network to ensure that the result is trusted to be correct. In one embodiment, the network node 106 notarizes the result of the secure computation from a group of network devices. In one embodiment, the network node 106 performs secure computations in a TEE to ensure that the result is trusted to be correct.

[0086] Step 610 includes network node 106 providing the result of the secure computation to result node 104. Step 610 includes providing the result directly from network node 106 to result node 104, or indirectly from network node 106 to result node 104. Result node 104. In one embodiment, network node 106 provides the result directly to result node 104. In one embodiment, network node 106 provides the result directly to notary node, which provides final result to result node 104. In one embodiment, network node 106 adds the result to blockchain ledger to provide the result indirectly to result node 104. That is, result node 104 obtains the result from blockchain ledger to obtain the result indirectly from network node 106.

[0087] Figure 7 is a flow chart of one embodiment of a process 700 for secure computation. The process 700 may be performed in the communication system 100, but is not limited thereto. In the process 700, there may be one or more input nodes 102, one or more result nodes 104, and one or more network nodes 106 that may perform secure computation.

[0088] Step 702 includes a node communicating an intention to perform a secure computation. In one embodiment, the result node 104 sends a request to the input node 102 to perform a zero-knowledge proof. The request passes through the network 110 and may be processed by one or more network nodes 106 capable of performing secure computations. However, it is possible that none of the network nodes 106 processing the request are capable of performing secure computations.

[0089] Steps 704 and 705 describe different options for knowing which one or more network nodes 106 are capable of performing secure computations. One or both steps may be performed.

[0090] Step 704 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 702. However, the request may be sent to the network node 106 that did not process the request of step 702. One or more network nodes 106 may respond to the request of step 704, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0091] Step 705 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, the one or more received data packets are associated with the communication between the nodes in step 702. For example, the result node 104 or input node 102 may examine the header of a data packet it received from another node in step 702. However, the one or more data packets need not be associated with the communication between the nodes in step 702.

[0092] Step 706 includes selecting one or more network nodes 106 capable of performing the secure computation. In one embodiment, the selection is based on the network nodes 106 that responded to the request of step 704. In one embodiment, the selection is based on inspecting the header of the data packet in step 705. In one embodiment, a single network node 106 is selected. In one embodiment, multiple network nodes 106 are selected. In one embodiment, the selection is made by the result node 104. In one embodiment, the selection is made by the input node 102.

[0093] In one embodiment, the selection in step 706 is based on the distance from the input node 102 to the network node 106. In one embodiment, the selection in step 706 is based on the distance from the result node 104 to the network node 106. For example, the network node 106 with the shortest distance may be selected in either case. The selection in step 706 is based on the route between the input node 102 and the result node 104. For example, the network node 106 may be selected to achieve the shortest route between the input node 102 and the result node 104.

[0094] In one embodiment, the selection in step 706 is based on the capabilities of the network node 106. For example, there may be different algorithms for performing secure computations. The selection may be made based on which algorithm the network node 106 is capable of executing. The selection in step 706 may be based on more than one factor. For example, the selection may be based on distance (e.g., distance to the network node 106, routing distance between the input node 102 and the result node 104, etc.) and capabilities (e.g., secure computation algorithms that the network node 106 is capable of executing). In one embodiment, the network node 106 is selected based on a matrix of factors.

[0095] Step 708 includes one or more input nodes 102 preparing input for secure computation. In one embodiment, step 708 includes each input node 102 encrypting information that is desired to be kept secret. In one embodiment, input node 102 prepares a zero-knowledge proof. Further details of input node 102 preparing a zero-knowledge proof are provided in conjunction with Fig.12 1200 (e.g., see step 1208) discussed in the process 1200 in step 708. The input in step 708 is not limited to being a zero-knowledge proof. Step 708 can include each node of the MPC preparing their own input. For example, process 700 can be used to allow multiple parties to bid without revealing the actual bid, such as by encrypting the bid.

[0096] Step 710 includes one or more input nodes 102 sending their respective inputs to each of the one or more selected network nodes 106 .

[0097] Step 712 includes each of the one or more selected network nodes 106 performing a secure computation. In one embodiment, each network node 106 verifies the zero-knowledge proof. In one embodiment, each network node 106 performs MPC.

[0098] Step 714 includes ensuring that the result of the secure computation is trusted to be correct. In one embodiment, trust is ensured by a security mechanism on the network node 106. For example, the network node 106 can perform the secure computation in a TEE. In one embodiment, trust is ensured by sending the result of the secure computation to a notary node by multiple network nodes 106, and the notary node notarizes the result. "Notarizing the result" means that the notary compares the results from multiple network nodes 106 to verify that the result can be trusted to be correct. In one embodiment, if all results are the same, the result is credible. In one embodiment, trust is ensured by multiple network nodes 106 acting as peers in the blockchain network, and the results are recorded in the blockchain ledger.

[0099] Step 716 includes one or more result nodes 104 obtaining the result. In one embodiment, the result node 104 obtains the result directly from the network node 106 that performs the secure computation. In one embodiment, the result node 104 obtains the result indirectly from a notary node that notarizes the result. In one embodiment, the result node 104 obtains the result from a blockchain ledger that records the result.

[0100] Figure 8 , 9 10 and 11 describe three different embodiments of secure computing. These are three different embodiments of process 700. Figure 8 An embodiment is described in which a single network node 106 performs secure computations. Fig. 9 An embodiment is described in which a plurality of network nodes 106 perform secure computations. Fig.10 An embodiment is described in which the results of a secure computation are recorded in a blockchain ledger.

[0101] Reference now Figure 8 , depicts a flow chart of one embodiment of a process 800 for secure computation using a single network node 106. The process 800 may be performed in the communication system 100, but is not limited thereto. In the process 800, there may be one or more input nodes 102, and one or more result nodes 104.

[0102] Step 802 includes a node communicating an intent to perform a secure computation. In one embodiment, result node 104 sends a request to input node 102 to perform a zero-knowledge proof.

[0103] Step 804 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 802. However, the request may be sent to the network node 106 that did not process the request of step 802. One or more network nodes 106 may respond to the request of step 804, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0104] Step 805 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, the one or more received data packets are associated with communications between the nodes in step 802. However, the one or more data packets need not be associated with communications between the nodes in step 802.

[0105] Step 806 includes selecting a network node 106 to perform the security computation. In one embodiment, the selection is based on the network node 106 that responded to the request of step 804. In one embodiment, the selection is based on inspecting the header of the data packet in step 805. For example, result node 104 or input node 102 may inspect the header of the data packet it received from another node in step 802.

[0106] Step 808 includes one or more input nodes 102 preparing inputs to the secure computation. In one embodiment, input nodes 102 prepare a zero-knowledge proof. Step 808 may include each node of the MPC preparing their respective inputs.

[0107] Step 810 includes one or more input nodes 102 sending their respective inputs to the selected network node 106. Step 812 includes the selected network node 106 performing a secure computation. In one embodiment, the network node 106 performs the secure computation in the TEE, which is an embodiment of step 714 (ensuring that the result is trustworthy). Other trust mechanisms may be used at the network node 106 to ensure that the result is trustworthy.

[0108] Step 814 includes the selected network node 106 providing the results to the results node 104. In one embodiment, the selected network node 106 sends the results to the results node 104 directly.

[0109] Reference now Fig. 9 , depicts a flow chart of one embodiment of a process 900 for secure computation using a plurality of network nodes 106. The process 900 may be performed in the communication system 100, but is not limited thereto. In the process 900, there may be one or more input nodes 102 and one or more result nodes 104.

[0110] Step 902 includes a node communicating an intent to perform a secure computation. In one embodiment, result node 104 sends a request to input node 102 to perform a zero-knowledge proof.

[0111] Step 904 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 902. However, the request may be sent to the network node 106 that did not process the request of step 902. One or more network nodes 106 may respond to the request of step 904, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0112] Step 905 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, the one or more received data packets are associated with the communication between the nodes in step 802. For example, the result node 104 or input node 102 may examine the header of the data packet it received from another node in step 902. However, in step 902, the one or more data packets need not be associated with the communication between the nodes.

[0113] Step 906 includes selecting a plurality of network nodes 106 that are capable of performing the secure computation. Process 800 may be performed in the event that only one network node 106 responds that it is capable of performing the secure computation.

[0114] Step 908 includes one or more input nodes 102 preparing inputs. In one embodiment, the input nodes 102 prepare zero-knowledge proofs. Step 808 may include each node of the MPC preparing their respective inputs. Step 908 also includes one or more input nodes 102 sending their respective inputs to each selected network node 106. Step 910 includes each selected network node 106 performing the secure computation. Step 912 includes the selected network nodes 106 providing their respective results to the notary node. The notary node may be a result node, but is not required.

[0115] Step 914 includes the notary node notarizing the result. In one embodiment, the results from each network node 106 should match for the result to be valid. If the result is valid (step 916), the notary node sends the valid result to one of the multiple result nodes 104 in step 918. If the result is invalid, the notary node discards the result (step 920). Note that the notary node can optionally be a result node. Steps 914-920 are an embodiment of step 714 (ensuring that the result is credible).

[0116] In one embodiment, the notary nodes perform a "majority rule" algorithm, where the notary nodes select the most common result as the final result. For example, if each network node provides a true TRUE or false FALSE result, the notary node determines whether there are more TRUE or FALSE results. In one embodiment, an odd number of network nodes is used to prevent ties. In another embodiment, an even number of network nodes is allowed, and the results are discarded in the event of a tie.

[0117] Reference now Fig.10, depicts a flow chart of one embodiment of a process 1000 for secure computation using multiple network nodes 106 and a blockchain. The process 1000 may be performed in a communication system 100, but is not limited thereto. In the process 1000, there may be one or more input nodes 102 and one or more result nodes 104.

[0118] Step 1002 includes a node communicating an intent to perform a secure computation. In one embodiment, result node 104 sends a request to input node 102 to perform a zero-knowledge proof.

[0119] Step 1004 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 1002. However, the request may be sent to the network node 106 that did not process the request of step 1002. One or more network nodes 106 may respond to the request of step 1004, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0120] Step 1005 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, the one or more received data packets are associated with the communication between the nodes in step 802. For example, the result node 104 or input node 102 may examine the header of the data packet it received from another node in step 1002. However, the communication between the nodes in step 1002 does not need to be associated with one or more data packets.

[0121] Step 1006 includes selecting a plurality of network nodes 106 that are capable of performing the secure computation. Process 800 may be performed in the event that only one network node 106 responds that it is capable of performing the secure computation.

[0122] Step 1008 includes one or more input nodes 102 preparing inputs. In one embodiment, input nodes 102 prepare zero-knowledge proofs. Step 1008 may include each node of the MPC preparing their respective inputs. Step 1008 also includes one or more input nodes 102 sending their respective inputs to each selected network node 106. Step 1010 includes each selected network node 106 performing a secure computation.

[0123] Step 1012 includes the selected network nodes 106 acting as peers in the blockchain network to verify the result. Step 1014 includes at least one of the selected network nodes 106 recording the verification result in the blockchain ledger. The blockchain ledger may be stored on one or more peers. In one embodiment, all blockchain peers store a copy of the blockchain ledger. Steps 1012 and 1014 are an embodiment of step 714 (ensuring the result is authentic).

[0124] Step 1016 includes the result node 104 obtaining the result from the blockchain ledger.

[0125] In some embodiments, the secure computation performed by network node 106 is a zero-knowledge proof. In one embodiment, the zero-knowledge proof is a non-interactive zero-knowledge proof. Figure 11-16 Details of an embodiment are shown in which the secure computation performed by the network node 106 is a zero-knowledge proof. Fig.11 An embodiment of a communication system 1100 is depicted in which a single network node 106 verifies a zero-knowledge proof. Fig.12 A flow chart of one embodiment of a process 1200 that may be used in the communication system 1100 is depicted. Fig.13 An embodiment of a communication system 1300 is depicted in which a plurality of network nodes 106 verify a zero-knowledge proof and in which a notary node is present to notarize the result. Fig.14 A flow chart of one embodiment of a process 1400 that may be used in the communication system 1300 is depicted. Fig.15 An embodiment of a communication system 1500 is depicted in which a plurality of network nodes 106 acting as peers in a blockchain network verify a zero-knowledge proof. Fig.16 A flow chart of one embodiment of a process 1600 that may be used in the communication system 1500 is described.

[0126] Reference now Fig.11 , depicts a communication system 1100 in which an embodiment may be practiced. The communication system 1100 includes an input node 102, a result node 104, and a number of network nodes 106 in a network 1110. Six network nodes 106a-106f are explicitly depicted. There may be other network nodes 106 that are not depicted in a portion of the network 1110a. The depicted network nodes 106a-106f are considered to reside in one or more networks. In the communication system 1100, network node 106e has been selected to verify a zero-knowledge proof. Typically, the input node 102 performs a zero-knowledge proof (Prf) and sends the proof to a verifier network node 106e. The verifier network node 106e verifies the proof and sends the result of the proof to the result node 104.

[0127] In one embodiment, a zero-knowledge proof includes a mathematical algorithm ("P" or "proof algorithm"). In one embodiment, the proof algorithm inputs a proof key ("pk"), a random input ("x"), and a private statement ("w"). The private statement is something that the prover (e.g., the person operating the input node 102) wishes to keep secret. In one embodiment, the proof key and random input are publicly available information. In one embodiment, the proof is used to encrypt the private statement ("w").

[0128] The verifier network node 106e performs verification of the proof. To do this, in one embodiment, the verifier network node 106e executes a mathematical algorithm ("V" or "verification algorithm"). In one embodiment, the verification algorithm (V) inputs a random input ("x"), a verification key ("vk"), and a proof (prf). In one embodiment, the verification key is publicly available. In one embodiment, the verification algorithm (V) outputs a binary value (e.g., TRUE, FALSE). The verifier network node 106e sends the result (e.g., TRUE, FALSE) to the result node 104.

[0129] In one embodiment, the zero-knowledge proof is based on zero-knowledge succinct non-interactive augments of knowledge (zk-SNARKs). zk-SNARKs is a non-interactive zero-knowledge proof. Non-interactive means that the proof itself can be used by the verifier without any further interaction from the prover. The zk-SNARK protocol can be based on three algorithms (G, P, V). The generator (G) algorithm can be used to generate a proof key (pk) and a verification key (pv). The inputs to the generator (G) algorithm are the parameter lambda and the program. The parameter lambda is kept secret. The proof key (pk) and the verification key (vk) can each be distributed publicly. In one embodiment, the network node 106e acts as a generation node to generate the proof key (pk) and the verification key (pv). However, the generator node can be some other node. The generator node does not need to be the network node 106. The zk-SNARK protocol is an example of a protocol for zero-knowledge proof. Other protocols for zero-knowledge proof can be used. In one embodiment, the network node 106 notifies (e.g., see Figure 6 Step 604) The type of protocol that the network node 106 is able to execute for zero-knowledge proofs.

[0130] Reference now Fig.12, depicts a flow chart of one embodiment of a process 1200 for verifying a zero-knowledge proof. The process 1200 may be used in the communication system 1100. Step 1202 includes the result node 104 sending a zero-knowledge proof request to the input node 102. The request refers to a request to perform a zero-knowledge proof on the input node 102. The request may be initiated in response to a user of the input node 102 wanting to prove a piece of information to an entity that controls the result node 104 without the user revealing the piece of information.

[0131] Step 1204 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 1202. However, the request may be sent to the network node 106 that did not process the request of step 1202. One or more network nodes 106 may respond to the request of step 1204, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0132] Step 1205 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, in step 1202, the one or more received data packets are associated with communications between nodes. However, in step 1202, the one or more data packets need not be associated with communications between nodes.

[0133] Step 1206 includes selecting a validator network node 106. The selection may be based on the location of the network node 106. For example, a network node 106 that is close to an input node 102 and / or a result node 104 may be selected.

[0134] Step 1208 includes input node 102 generating a zero-knowledge proof. In one embodiment, the zero-knowledge proof has as input a proof key "pk" and a statement "w". In one embodiment, the proof key ("pk") is publicly available. Statement "w" is something that an entity (e.g., a user) at input node 102 wants to prove but keep secret. In one embodiment, the zero-knowledge proof has as input a proof key "pk", a random parameter "x", and a statement "w". In one embodiment, the random parameter "x" is publicly available.

[0135] Step 1210 includes the input node 102 sending the zero-knowledge proof to the selected verifier network node 106e. The input node 102 may also send the verification key “vk” to the selected verifier network node 106e. Since the verification key “vk” may be publicly available, the input node 102 is not required to send the verification key “vk” to the selected verifier network node 106e. The input node 102 may also send the random parameter “x” to the selected verifier network node 106e. Since the random parameter “x” may be publicly available, the input node 102 is not required to send the random parameter “x” to the selected verifier network node 106e.

[0136] Step 1212 includes the selected verifier network node 106e verifying the zero-knowledge proof. In one embodiment, the selected verifier network node 106e executes a verifier algorithm that inputs the zero-knowledge proof, the verification key "vk", and the random parameter "x". In one embodiment, the verifier algorithm outputs a binary value (e.g., TRUE, FALSE).

[0137] Step 1214 includes a decision as to whether the zero-knowledge proof is correct. In one embodiment, this decision is made based on whether the verifier algorithm outputs TRUE or FALSE.

[0138] In the event that the zero-knowledge proof is correct (eg, TRUE), then step 1216 may be performed. Step 1216 includes the selected verifier network node 106e sending a result of TRUE to the result node 104.

[0139] In the event that the zero-knowledge proof is incorrect (e.g., FALSE), then step 1218 may be performed. Step 1218 includes the selected verifier network node 106e sending a result of FALSE to the result node 104.

[0140] Reference now Fig.13, depicts a communication system 1300 in which an embodiment may be practiced. The communication system 1300 includes an input node 102, a result node 104, and a number of network nodes 106. Six network nodes 106a-106f are explicitly depicted in the network 1310. Other network nodes 106 that are not depicted may exist in a portion 1310a of the network. In the communication system 1300, network nodes 106a, 106e, and 106f have been selected to verify a zero-knowledge proof. The input node 102 performs a zero-knowledge proof (Prf) and sends the proof to each of the selected network nodes 102a, 106e, and 106f. Each selected network node 102a, 106e, and 106f verifies the proof. In one embodiment, the selected network nodes 102a, 106e, and 106f act as peers to verify the result. In one embodiment, one of the network nodes 106 acts as a notary node to notarize the result. For example, network node 106e may receive Result_a from network node 106a and Result_a from network node 106f. After notarizing the results, network node 106e may send a final result (eg, Result_final) to result node 104.

[0141] In one embodiment, a zero-knowledge proof includes a mathematical algorithm that inputs a proving key ("pk"), a random input ("x"), and a private statement ("w"). In one embodiment, a verification algorithm (V) inputs the random input ("x"), the verification key ("vk"), and the proof (prf). In one embodiment, the zero-knowledge proof is based on zero-knowledge succinct non-interactive knowledge augmentations (zk-SNARKs). Other protocols for zero-knowledge proofs may be used.

[0142] Reference now Fig.14 , depicts a flow chart of one embodiment of a process 1400 for verifying a zero-knowledge proof. The process 1400 may be used in the communication system 1300. Step 1402 includes the result node 104 sending a zero-knowledge proof request to the input node 102. The request refers to a request to perform a zero-knowledge proof on the input node 102. The request may be initiated in response to a user of the input node 102 wanting to prove a piece of information to an entity that controls the result node 104 without the user revealing the piece of information.

[0143] Step 1404 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 1402. However, the request may be sent to the network node 106 that did not process the request of step 1402. One or more network nodes 106 may respond to the request of step 1404, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0144] Step 1405 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, in step 1402, the one or more received data packets are associated with communications between nodes. However, in step 1402, the one or more data packets need not be associated with communications between nodes.

[0145] Step 1406 includes selecting a plurality of validator network nodes 106. The selection may be based on the location of the network nodes 106. For example, network nodes 106 may be selected that are close to input nodes 102 and / or result nodes 104. For purposes of discussion, network nodes 102a, 102e, and 102f are selected.

[0146] Step 1408 includes input node 102 generating a zero-knowledge proof. In one embodiment, the zero-knowledge proof has as input a proof key "pk" and a statement "w". In one embodiment, the zero-knowledge proof has as input a proof key "pk", a random parameter "x", and a statement "w".

[0147] Step 1410 includes the input node 102 sending the zero-knowledge proof to each selected verifier node (e.g., network nodes 102a, 102e, and 102f). The input node 102 may also send a verification key “vk” to the selected verifier node. Since the verification key “vk” may be publicly available, the input node 102 is not required to send the verification key “vk” to the selected verifier node. The input node 102 may also send a random parameter “x” to the selected verifier node. Since the random parameter “x” may be publicly available, the input node 102 is not required to send the random parameter “x” to the selected verifier node.

[0148] Step 1412 includes the selected verifier node (e.g., network nodes 102a, 102e, and 102f) verifying the zero-knowledge proof. In one embodiment, each selected verifier node executes a verifier algorithm that inputs the zero-knowledge proof, a verification key "vk", and a random parameter "x". In one embodiment, the verifier algorithm outputs a binary value (e.g., TRUE, FALSE). Therefore, for the sake of discussion, each selected network node 102a, 102e, and 102f generates a separate result.

[0149] Step 1414 includes the validator network node sending their respective results to the notary node. The notary node can be one of the network nodes selected to verify the zero-knowledge proof. However, the notary node is not required to verify the zero-knowledge proof. The notary node can be a network node, but is not required to be a network node. In one embodiment, for the sake of discussion, network node 106e acts as a notary node. Therefore, in one embodiment, network node 106a sends Result_a to network node 106e, and network node 106f sends Result_f to network node 106e. In one embodiment, these results are binary values ​​(e.g., TRUE, FALSE).

[0150] Step 1416 includes the notary node notarizing the result to generate a trusted result. For example, network node 106e compares its result with Result_a and Result_f to verify that all results match (e.g., all are TRUE or all are FALSE). Assuming the results match, the notary node sends the notarized result to result node 104. In one embodiment, the notarized result is "TRUE" or "FALSE".

[0151] In one embodiment, if the results do not match (e.g., a mixture of TRUE and FALSE), the notary node implements steps for notarization failure. This may include determining whether there are network nodes 106 with anomalous results. For example, it may include determining whether one network node 106 produced a different result than all other network nodes 106. The notary node may also send a message to the result node 104 indicating that the process of notarizing the result failed and that zero-knowledge should be retried, but using a different set of network nodes.

[0152] In one embodiment, the notary nodes perform a "majority rule" algorithm, where the notary nodes select the most common result as the final result. For example, if each network node provides a TRUE or FALSE result, the notary node determines whether there are more TRUE or FALSE results. In one embodiment, an odd number of network nodes is used to prevent ties. In another embodiment, an even number of network nodes is allowed, and the results are discarded in the event of a tie.

[0153] Reference now Fig.15 , depicting a communication system 1500 in which an embodiment may be practiced. The communication system 1500 includes an input node 102, a result node 104, and a number of network nodes 106. Six network nodes 106a-106f are explicitly depicted in the network 1510. Other network nodes 106 that are not depicted may exist in a portion 1510a of the network. In the communication system 1500, network nodes 106a, 106e, and 106f have been selected to verify a zero-knowledge proof. The input node 102 performs a zero-knowledge proof (Prf) and sends the proof to each selected network node 102a, 106e, and 106f. In one embodiment, each selected network node 102a, 106e, and 106f is a peer in a blockchain network. Each selected network node 102a, 106e, and 106f verifies the proof. Each selected network node 102a, 106e, and 106f stores a result 1504 in a blockchain ledger. For example, network node 102a stores the result in blockchain ledger 1502a; network node 102e stores the result 1504 in blockchain ledger 1502e; and network node 102f stores the result 1504 in blockchain ledger 1502f. Reference number 1502 may be used to refer to the blockchain ledger in general, rather than to a specific copy of the blockchain ledger. Thus, in one embodiment, a different copy of blockchain ledger 1502 is stored on each selected network node 102a, 106e, and 106f. Result node 104 is able to obtain result 1504 from blockchain ledger 1502 stored on at least one selected network node 106.

[0154] In one embodiment, a zero-knowledge proof includes a mathematical algorithm that inputs a proving key ("pk"), a random input ("x"), and a private statement ("w"). In one embodiment, a verification algorithm (V) inputs the random input ("x"), the verification key ("vk"), and the proof (prf). In one embodiment, the zero-knowledge proof is based on zero-knowledge succinct non-interactive knowledge augmentations (zk-SNARKs). Other protocols for zero-knowledge proofs may be used.

[0155] Reference now Fig.16 , depicts a flow chart of one embodiment of a process 1600 for verifying a zero-knowledge proof. The process 1600 may be used in the communication system 1500. Step 1602 includes the result node 104 sending a zero-knowledge proof request to the input node 102. The request refers to a request to perform a zero-knowledge proof on the input node 102. The request may be initiated in response to a user of the input node 102 wanting to prove a piece of information to an entity that controls the result node 104 without the user revealing the piece of information.

[0156] Step 1604 (option A) includes the result node 104 or the input node 102 sending one or more requests to the network 110 to find a network node 106 that can perform the secure computation. In one embodiment, the one or more requests are sent to the network node 106 that processed the request of step 1602. However, the request may be sent to the network node 106 that did not process the request of step 1602. One or more network nodes 106 may respond to the request of step 1604, indicating that the corresponding network node 106 is capable of performing the secure computation.

[0157] Step 1605 (option B) includes the result node 104 or input node 102 examining the header of one or more received data packets to determine which network node (or nodes) 106 is capable of performing the secure computation. In one embodiment, in step 1602, the one or more received data packets are associated with communications between nodes. However, in step 1602, the one or more data packets need not be associated with communications between nodes.

[0158] Step 1606 includes selecting a plurality of validator network nodes 106. The selection may be based on the location of the network nodes 106. For example, network nodes 106 may be selected that are close to input nodes 102 and / or result nodes 104. For purposes of discussion, network nodes 102a, 102e, and 102f are selected.

[0159] Step 1608 includes input node 102 generating a zero-knowledge proof. In one embodiment, the zero-knowledge proof has as input a proof key "pk" and a statement "w". In one embodiment, the zero-knowledge proof has as input a proof key "pk", a random parameter "x", and a statement "w".

[0160] Step 1610 includes the input node 102 sending a zero-knowledge proof to each selected verifier node (e.g., network nodes 102a, 102e, and 102f). The input node 102 may also send a verification key “vk” to the selected verifier node. Since the verification key “vk” may be publicly available, the input node 102 is not required to send the verification key “vk” to the selected verifier node. The input node 102 may also send a random parameter “x” to the selected verifier node. Since the random parameter “x” may be publicly available, the input node 102 is not required to send the random parameter “x” to the selected verifier node.

[0161] Step 1612 includes the selected verifier node (e.g., network nodes 102a, 102e, and 102f) verifying the zero-knowledge proof. In one embodiment, each selected verifier node executes a verifier algorithm that inputs the zero-knowledge proof, a verification key "vk", and a random parameter "x". In one embodiment, the verifier algorithm outputs a binary value (e.g., TRUE, FALSE). Therefore, for the sake of discussion, each selected network node 102a, 102e, and 102f generates a separate result.

[0162] Step 1614 includes a validator network node (e.g., network nodes 102a, 102e, and 102f) acting as a peer node in the blockchain network. The peer node can compare the results from each validator network node to ensure that the results can be trusted to be correct. For example, the peer node can determine whether all results match (e.g., all TRUE or all FALSE). In the event that the results do not all match, the process can perform a failure process.

[0163] In one embodiment, the peer nodes perform a "majority rule" algorithm in which the peer nodes select the most common result as the final result. For example, if each peer node provides a TRUE or FALSE result, the peer node determines whether there are more TRUE or FALSE results. In one embodiment, an odd number of peer nodes is used to prevent ties. In another embodiment, an even number of peer nodes is allowed and the results are discarded in the event of a tie.

[0164] Step 1616 includes at least one validator network node 106 recording the result in blockchain ledger 1502. In one embodiment, each validator network node 106 that verifies the zero-knowledge proof stores the result in a blockchain ledger stored on the corresponding network node 106. For example, network node 106a stores the result in blockchain ledger 1502a, network node 106e stores the result in blockchain ledger 1502e, and network node 106f stores the result in blockchain ledger 1502f.

[0165] Step 1618 includes the result node 104 obtaining the result from the blockchain ledger 1502.

[0166] The technology described herein can be implemented by using hardware, software, or a combination of hardware and software. The software used is stored in one or more processor-readable storage devices to program one or more processors to perform the functions described herein. The processor-readable storage device may include computer-readable media, such as volatile and non-volatile media, removable and non-removable media. As an example and not limitation, computer-readable media may include computer-readable storage media and communication media. Computer-readable storage media can be implemented in any method or technology for information storage, such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media are examples of non-temporary computer-readable media. Examples of computer-readable storage media include RAM, ROM, EEPROM, flash memory or other storage technology, CD-ROM, digital versatile disks (digital versatile disks, DVD) or other optical disk storage, cassettes, tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. Computer-readable media or media do not include propagation, modulation or transient signals.

[0167] Communication media typically embodies computer readable instructions, data structures, program modules or other data in a propagated, modulated or transient data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term "modulated data signal" refers to a signal that has one or more characteristics set or changed in a manner that encodes the information in the signal. By way of example and not limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as RF and other wireless media. Any combination of the above is also included within the scope of computer readable media.

[0168] In alternative embodiments, some or all of the software may be replaced by dedicated hardware control circuit components. For example, but not limited to, illustrative types of hardware control circuit components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-a-chip systems (SOCs), complex programmable control devices (CPLDs), special-purpose computers, etc. In one embodiment, software (stored on a storage device) that implements one or more embodiments is used to program one or more processors. One or more processors may communicate with one or more computer-readable media / storage devices, peripheral devices, and / or communication interfaces.

[0169] It should be understood that the present subject matter can be embodied in a variety of different forms and should not be construed as being limited to the set of embodiments set forth herein. On the contrary, these embodiments are provided so that the subject matter will be thorough and complete, and the disclosure will be fully communicated to those skilled in the art. In fact, the subject matter is intended to cover the substitution, modification and equivalence of these embodiments, which are included in the scope and thought of the subject matter defined by the appended claims. In addition, in the following detailed description of the subject matter, many specific details are set forth to provide a thorough understanding of the subject matter. However, it will be clear to those of ordinary skill in the art that the subject matter can be practiced without these specific details.

[0170] Aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each block of the flowchart and / or block diagram, and the combination of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable instruction execution device create a mechanism for implementing the function / behavior specified in the flowchart and / or block diagram block or block.

[0171] The description of the present disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosure in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the present disclosure. The disclosure herein was chosen and described in order to best explain the principles of the disclosure and the practical application, and to enable others of ordinary skill in the art to understand the disclosure with various modifications as are suited to the particular use contemplated.

[0172] For the purposes of this document, each process associated with the disclosed technology can be performed serially by one or more computing devices. Each step in the process can be performed by the same or different computing device as the computing device used in other steps, and each step does not necessarily need to be performed by a single computing device.

[0173] Although the subject matter has been described in language specific to structural features and / or acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A network device, characterized in that: include: non-transitory memory, including instructions; and one or more processors in communication with the non-transitory memory, wherein the one or more processors execute the instructions to: Receive and process routing requests in the network; sending to the network an indication of a type of secure computation that the network device is capable of performing, wherein the indication is added to a header of a data packet when processing the routing request; performing a secure computation of the type described based on input received from an input device via the network; ensuring that the result of the secure computation is trustworthy as the correct result of the secure computation; and The trusted result of the secure computation is provided to a result device connected to the network.

2. The network device according to claim 1, characterized in that: Wherein, in order to ensure that the result of the secure computation is credible, the one or more processors execute the instructions to: The network device acts as a peer with other network devices in the network that perform the secure computation to generate the trusted result.

3. The network device according to claim 1, characterized in that: Wherein, in order to provide the trusted result of the secure computation to a result device, the one or more processors execute the instructions to: The trusted result is recorded in the blockchain ledger.

4. The network device according to claim 1, characterized in that: Wherein, in order to ensure that the result of the secure computation is credible, the one or more processors execute the instructions to: Results of the secure computation from a plurality of network devices are notarized to produce the trusted result.

5. The network device according to claim 1, characterized in that: In order to ensure that the result of the secure calculation is trustworthy, the one or more processors execute the instructions in a trusted execution environment TEE.

6. The network device according to claim 1, characterized in that: Wherein, in order to send the indication to the network that the network device is capable of performing secure computing, the one or more processors execute the instructions to: receiving, via the network, a query as to whether the network device is capable of performing the type of secure computing; The query is responded to to indicate that the network device is capable of performing the type of secure computation.

7. The network device according to claim 1, characterized in that: Wherein the input from the input device comprises a zero-knowledge proof.

8. The network device according to claim 7, characterized in that: To perform the secure computation, the one or more processors execute the instructions to verify the correctness of the zero-knowledge proof according to a verification protocol.

9. The network device according to claim 8, characterized in that: Wherein, in order to provide the trusted result of the secure computation to the result device, the one or more processors execute the instructions to: In response to the zero-knowledge proof being correct, returning a true result to the result device; as well as In response to the zero-knowledge proof being incorrect, returning a false result to the result device.

10. The network device according to claim 1, characterized in that: Wherein, in order to process a routing request in a network, the one or more processors execute the instructions to: Routes packets according to the Open Systems Interconnection (OSI) Layer 3 protocol.

11. The network device according to claim 1, characterized in that: Wherein, in order to process a routing request in a network, the one or more processors execute the instructions to: Frames are transmitted according to the Open Systems Interconnection (OSI) Layer 2 protocol.

12. The network device according to claim 1, characterized in that: in: said input received from said input device via said network is encrypted; as well as The one or more processors execute the instructions to perform the secure computation without decrypting the input.

13. The network device according to any one of claims 1 to 12, characterized in that: Also included is a hardware accelerator for performing said secure computations.

14. A computer-implemented method for secure computing, characterized in that: include: Network devices receive and process routing requests in the network; the network device sending an indication to the network of a type of secure computation that the network device is capable of performing, wherein the indication is added to a header of a data packet when processing the routing request; The network device performs a secure computation of the type based on input received from an input device via the network; The network device ensures that the result of the secure computation is credible as a correct result of the secure computation; and The trusted result of the secure computation is provided from the network device to a result device connected to the network.

15. The computer-implemented secure computing method of claim 14, wherein: The step of ensuring that the result of the secure computation is credible comprises: The network device acts as a peer device with other network devices that perform the secure computation to generate the trusted result.

16. The computer-implemented secure computing method of claim 14, wherein: The step of providing the trusted result of the secure computation from the network device to the result device comprises: The network device records the trusted result of the secure computation in a blockchain ledger.

17. The computer-implemented secure computing method of claim 16, wherein: Also includes: The result device obtains the result of the secure computation from the blockchain ledger.

18. The computer-implemented secure computing method of claim 14, wherein: The step of ensuring that the result of the secure computation is credible comprises: The network device executes the secure computing in a trusted execution environment TEE.

19. The computer-implemented secure computing method of claim 14, wherein: The network device sending the indication that the network device can perform secure computing to the network includes: Responding to a query as to whether the network device is capable of performing the type of secure computation.

20. The computer-implemented secure computing method of claim 14, wherein: Also includes: A query is sent to network devices in the network to find one or more network devices qualified to perform the type of secure computation.

21. The computer-implemented secure computing method of claim 14, wherein: Also includes: selecting the network device from a plurality of network devices indicating that the corresponding network device is capable of performing the type of secure computation; as well as The input from the input device is provided to the selected network device over the network.

22. The computer-implemented secure computing method of claim 14, wherein: Also includes: selecting a plurality of network devices to perform the security computation; as well as The input is provided to the plurality of selected network devices over the network.

23. The computer-implemented secure computing method of claim 14, wherein: Wherein the input from the input device comprises a zero-knowledge proof.

24. The computer-implemented secure computing method of claim 23, wherein: The step of performing the secure computation according to the input from the input device comprises: The correctness of the zero-knowledge proof is verified according to a verification protocol.

25. The computer-implemented secure computing method of claim 14, wherein: The processing of the routing request in the network includes: Routes packets according to the Open Systems Interconnection (OSI) Layer 3 protocol.

26. The computer-implemented secure computing method of claim 14, wherein: Wherein processing the routing request in the network comprises: Frames are transmitted according to the Open Systems Interconnection (OSI) Layer 2 protocol.

27. The computer-implemented secure computing method of claim 14, wherein: in: said input received from said input device via said network is encrypted; as well as Performing the secure computation includes performing the secure computation without decrypting the input.

28. A computer-implemented secure computing method according to any one of claims 14 to 27, characterized in that: The secure computation is performed in a hardware accelerator in the network device.

29. A non-transitory computer-readable medium for secure computing, characterized in that: The device stores computer instructions which, when executed by one or more processors, cause the one or more processors to: Receive and process routing requests in the network through network devices; sending to the network an indication of a type of secure computation that the network device is capable of performing, wherein the indication is added to a header of a data packet when processing the routing request; performing a secure computation of the type described based on input received from an input device via the network; ensuring that the result of the secure computation is trustworthy as the correct result of the secure computation; and The trusted results of the secure computation are provided to one or more result devices connected to the network.

30. The non-transitory computer readable medium of claim 29, wherein: To ensure that the result of the secure computation is credible, the computer instructions further cause the one or more processors to: The network device acts as a peer device with other network devices that perform the secure computation to generate the trusted result.

31. The non-transitory computer readable medium of claim 29, wherein: wherein the trusted result of the secure computation is provided from the network device to one or more result devices, the computer instructions further causing the one or more processors to: The trusted result of the secure computation is recorded in a blockchain ledger.

32. The non-transitory computer readable medium of claim 29, wherein: The computer instructions further cause the one or more processors to: The result of the secure computation is obtained from a blockchain ledger.

33. The non-transitory computer readable medium of claim 29, wherein: To ensure that the result of the secure computation is credible, the computer instructions further cause the one or more processors to: The secure computation is performed in a trusted execution environment.

34. The non-transitory computer readable medium of claim 29, wherein: The computer instructions further cause the one or more processors to: A query is sent to network devices in the network to find one or more network devices qualified to perform the type of secure computation.

35. The non-transitory computer readable medium of claim 29, wherein: The computer instructions further cause the one or more processors to: selecting the network device from a plurality of network devices that indicate that the corresponding network device is qualified to perform the type of secure computation; and The input is provided to the selected network device.

36. The non-transitory computer readable medium of claim 29, wherein: The computer instructions further cause the one or more processors to: selecting the network device from a plurality of network devices indicating that the corresponding network device is qualified to perform the type of secure computation; and The input is provided to the plurality of selected network devices.

37. The non-transitory computer readable medium of claim 29, wherein: The computer instructions further cause the one or more processors to: comparing results of said security computation from each of a plurality of selected network devices; The trusted result is selected based on the result of the secure computation from each of a plurality of selected network devices.

38. The non-transitory computer readable medium of claim 29, wherein: Wherein the input from the input device comprises a zero-knowledge proof.

39. The non-transitory computer readable medium of claim 38, wherein: Wherein the secure computation is performed on the network device, the computer instructions further cause the one or more processors to: The correctness of the zero-knowledge proof is verified based on the zero-knowledge proof from the input device and a verification protocol.

40. The non-transitory computer readable medium of claim 29, wherein: The data packets are transferred between the input device and the one or more result devices.

41. The non-transitory computer readable medium of claim 29, wherein: wherein the indication of the type of secure computation that the network device is capable of performing is sent to the network, and the one or more processors execute the instructions to: Responding to inquiries regarding capabilities of the network device.

42. The non-transitory computer readable medium of any one of claims 29 to 41, wherein: in: said input received from said input device via said network is encrypted; as well as The one or more processors execute the instructions to perform the secure computation without decrypting the input.

Images