Method and apparatus for determining input tags in a garbled circuit

Abstract

The embodiments of this specification provide a method and apparatus for determining input labels in an obfuscated circuit. During the calculation process of a Boolean circuit, the obfuscating party and the computing party pre-execute an oblivious transfer protocol. Among the two candidate bits and two alternative data provided by the obfuscating party, the computing party determines a selection bit and obtains the label corresponding to the selection bit as the selection label. During the gate circuit calculation process, on the one hand, the computing party determines the input label based on the current input bit. On the other hand, the obfuscating party determines the labels of the two candidate bits based on the XOR result of the current input bit and the selection bit provided by the computing party. Furthermore, by setting the relationship between the predetermined bit and the candidate bit and the alternative data, the input label obtained by the computing party is the label of the candidate bit corresponding to the input bit among the two labels obtained by the obfuscating party. This method and apparatus can reduce the amount of communication during the calculation process and improve the throughput of multi-party secure computing.

Description

Technical Field

[0001] One or more embodiments of the present disclosure relate to the field of secure computing technology, and more particularly, to a method and apparatus for determining input labels in an obfuscated circuit. Background Art

[0002] Garbled Circuit (GC) is a secure multi-party computation protocol that constructs secure function calculations using Boolean circuits, allowing participants to calculate the answer for a specific value without knowing the specific numbers they entered in the calculation formula. During the garbled circuit calculation process, the garbled party (Garber) typically uses a cryptographic function to generate a garbled table for each gate of the Boolean circuit that implements the calculation function and provides it to the evaluator (Evaluator). For a single Boolean circuit, the evaluator can obtain the label of the local input bit from the garbled party through the oblivious transfer (OT) protocol. Using the labels of other inputs sent by the garbled party, it decrypts the garbled table according to the garbled table to obtain the execution result of the Boolean circuit. During the calculation process, neither the garbled party nor the evaluator leaks their local input to the other party.

[0003] If the computational side obtains the labels corresponding to the local input bits from the obfuscating side through over-the-air (OT) for each gate, the communication requirements are obviously very high. This communication volume is enormous during the computation of obfuscated circuits with a large number of gates, potentially creating a bottleneck in the throughput limit. Summary of the Invention

[0004] One or more embodiments of this specification describe a method and apparatus for determining input labels in an obfuscation circuit, to solve one or more problems mentioned in the background art.

[0005] According to a first aspect, a method for determining an input label in an obfuscation circuit is provided, for use by a computing party. The method comprises: obtaining a current input bit, detecting whether the current input bit is a predetermined bit, and determining an input label based on the detection result and a selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through an oblivious transfer, and is one of two candidate data corresponding to the two candidate bits; and providing an exclusive-or result of the current input bit and the selection bit as a first intermediate quantity to the obfuscating party, so that the obfuscating party determines, based on the first intermediate quantity and the two candidate data, two candidate labels corresponding to the two candidate bits, respectively, thereby ensuring that the current input label is the candidate label corresponding to the candidate bit consistent with the input bit among the two candidate labels.

[0006] In one embodiment, when the detection result is that the current input bit is a predetermined bit, determining the input tag according to the detection result and the selection tag includes: determining the selection tag as the input tag.

[0007] In one embodiment, when the detection result indicates that the current input bit is not a predetermined bit, determining the input tag based on the detection result and the selection tag includes: determining the input tag based on an XOR result of the selection tag and a reference string obtained from an obfuscating party, where the reference string is a string obtained by performing an XOR operation on an XOR result of two candidate data and a random string.

[0008] In one embodiment, the predetermined bit is 0 or 1.

[0009] According to a second aspect, a method for determining candidate labels in an obfuscation circuit is provided, for use by an obfuscator. The method comprises: obtaining a first intermediate quantity provided by a computing party, the first intermediate quantity being an exclusive-OR result of a current input bit and a selection bit, the selection bit being pre-selected by the computing party from two candidate bits of the obfuscator via oblivious transmission; determining two candidate labels corresponding to the two candidate bits, respectively, based on the first intermediate quantity and two candidate data corresponding to the two candidate bits, thereby ensuring that an input label determined by the computing party for the current input bit is the candidate label corresponding to the candidate bit consistent with the input bit among the two candidate labels, the input label being determined by the computing party via a selection label based on a comparison of the current input bit with a predetermined bit, the selection label being the label corresponding to the selection bit in the two candidate data.

[0010] In one embodiment, the first candidate bit of the two candidate bits is consistent with the first intermediate quantity, and the first candidate bit corresponds to the first data of the two alternative data; the determining of the two labels corresponding to the two candidate bits based on the first intermediate quantity and the two alternative data corresponding to the two candidate bits respectively includes: determining the first data as the first label corresponding to the predetermined bit; and taking the XOR result of the first label and a random string as the second label, and the second label corresponds to the second candidate bit of the two candidate bits.

[0011] According to a third aspect, a method for executing a Boolean circuit is provided, the method comprising an offline preparation phase and an online execution phase, wherein:

[0012] In the offline preparation phase, the obfuscating party performs the following operations: generates multiple sets of candidate data, where a single set of candidate data includes two data corresponding to two candidate bits respectively, so that for the single set of candidate data, the computing party determines a single selection result based on the oblivious transfer protocol, the single selection result including a selected bit from the two candidate bits and a selection label corresponding to the selected bit in the single set of candidate data;

[0013] During the online execution phase, the computing party performs the following operations: in response to obtaining a current input bit of a current Boolean circuit, obtaining a set of selection results, detecting whether the current input bit is a predetermined bit, determining the current input label based on the detection result and the selection labels in the set of selection results to perform a Boolean circuit operation, and sending the XOR result of the current input bit and the selection bits in the set of selection results as an intermediate quantity to the obfuscation party, so that the obfuscation party can determine two labels corresponding to two candidate bits respectively based on the intermediate quantity and two candidate data in the set of selection results, thereby ensuring that the current input label is the label of the candidate bit corresponding to the input bit among the two labels.

[0014] According to a fourth aspect, there is provided an apparatus for determining an input label in an obfuscation circuit, the apparatus being provided on a computing side, the apparatus comprising:

[0015] an acquisition unit configured to acquire a current input bit;

[0016] a determination unit configured to detect whether the current input bit is a predetermined bit, and determine an input label based on the detection result and the selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through an oblivious transfer method, and is one of two candidate data corresponding to the two candidate bits respectively;

[0017] a providing unit configured to provide an XOR result of the current input bit and the selected bit as a first intermediate quantity to an obfuscating party, so that the obfuscating party determines two candidate labels corresponding to two candidate bits respectively based on the first intermediate quantity and two candidate data, thereby ensuring that the current input label is the candidate label corresponding to the candidate bit consistent with the input bit among the two candidate labels.

[0018] In one embodiment, when the detection result is that the current input bit is a predetermined bit, the determining unit is further configured to:

[0019] The selection tag is determined as an input tag.

[0020] In one embodiment, when the detection result is that the current input bit is not a predetermined bit, the determining unit is further configured to:

[0021] The input label is determined based on the XOR result of the selected label and the reference string obtained from the obfuscation party. The reference string is a string obtained by performing an XOR operation on the XOR result of two candidate data and a random string.

[0022] According to a fifth aspect, a device for determining candidate labels in an obfuscation circuit is provided, the device being provided on an obfuscation side, the device comprising:

[0023] an acquiring unit configured to acquire a first intermediate quantity provided by a computing party, where the first intermediate quantity is an exclusive-OR result of a current input bit and a selected bit, where the selected bit is pre-selected by the computing party from two candidate bits of the obfuscating party through an oblivious transfer;

[0024] A determination unit is configured to determine two alternative labels corresponding to the two candidate bits respectively based on the first intermediate quantity and the two alternative data corresponding to the two candidate bits respectively, so as to ensure that the input label determined by the calculation party for the current input bit is the alternative label corresponding to the candidate bit consistent with the input bit among the two alternative labels, and the input label is determined by the calculation party based on the comparison between the current input bit and the predetermined bit through the selection label, and the selection label is the label corresponding to the selection bit in the two alternative data.

[0025] In one embodiment, a first candidate bit of the two candidate bits is consistent with the first intermediate value, and the first candidate bit corresponds to the first data of the two candidate data; and the determining unit is further configured to:

[0026] Determining the first data as a first label corresponding to the predetermined bit;

[0027] An exclusive OR result of the first label and the random character string is used as a second label, where the second label corresponds to the second candidate bit of the two candidate bits.

[0028] According to a sixth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

[0029] According to the seventh aspect, a computing device is provided, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0030] Through the method and apparatus provided by the embodiments of this specification, during the calculation process of the Boolean circuit, the obfuscating party and the calculating party pre-execute the oblivious transfer protocol, and the calculating party determines a selection bit from the two candidate bits and two alternative data provided by the obfuscating party, and obtains the label corresponding to the selection bit as the selection label. During the gate circuit calculation process, on the one hand, the calculating party determines the input label based on the current input bit, and on the other hand, the obfuscating party determines the labels of the two candidate bits based on the XOR result of the current input bit and the selection bit provided by the calculating party. Furthermore, by setting the relationship between the predetermined bit and the candidate bit and the alternative data, the input label obtained by the calculating party is the label of the candidate bit corresponding to the input bit in the two labels obtained by the obfuscating party. This method and apparatus can increase the flexibility between the input label and the input bit on the basis of ensuring privacy and label consistency, reduce the communication volume during the calculation process, and improve the throughput of multi-party secure calculation. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 A schematic diagram showing a specific application scenario of a confusion circuit is shown;

[0033] Figure 2 A flow chart of an improved method for determining input labels in a confusion circuit is shown;

[0034] Figure 3 A flow chart of a method for determining input labels in a confusion circuit according to the technical concept of this specification is shown;

[0035] Figure 4 A flow chart showing a method for determining input labels in an obfuscation circuit according to one embodiment is shown;

[0036] Figure 5 A flow chart showing a method for determining candidate labels in an obfuscation circuit according to one embodiment is shown;

[0037] Figure 6 A schematic block diagram illustrating an apparatus for determining an input label in an obfuscation circuit according to one embodiment;

[0038] Figure 7 A schematic block diagram shows an apparatus for determining candidate labels in an obfuscation circuit according to one embodiment. DETAILED DESCRIPTION

[0039] The technical solution provided in this specification is described below in conjunction with the accompanying drawings.

[0040] First, the principle of aliasing circuit is described. Figure 1 The following is a schematic diagram showing a specific application scenario of the aliasing circuit. Figure 1 As shown in the figure, in this specific application scenario, a combination of multiple Boolean circuits (hereinafter also referred to as gate circuits) is involved. There are three inputs a0, b0, and c0, and four gate circuits finally output c1. There are seven lines a0, b0, c0, d, e, f, and c1. Assume that the obfuscator (Garbler) is denoted as A and the evaluator (Evaluator) is denoted as B. For each line, A can generate a corresponding string of predetermined length, such as X. i 0 、X i 1 , representing the true value 0 and the true value 1 respectively, i = a0, b0, c0, d, e, f, c1. Then, the obfuscator A can generate an obfuscation table for each gate circuit. For example, assuming that the initial input bits a0 and c0 are held by the obfuscator A, and b0 is held by the calculator B, for the NAND gate circuit with input a0 and c0 and output d, there are four cases of true value, and the values of a0, c0, and d are: (0, 0, 0), (0, 1, 1), (1, 0, 1), (1, 1, 0). The obfuscator A uses each string of predetermined length as the label of the corresponding true value to identify the corresponding true value. The truth value correspondence can be expressed as a string: (X a0 0 , X c0 0 , X d 0 )、(X a0 0 , X c0 1 , X d 1 )、(X a0 1 , X c0 0 , X d 1 )、(X a0 1 , X c0 1 , X d 0 ). Further, the output tag is encrypted with the input tag, such as using X a0 0 、X c0 0 Encryption X d 0 Recorded as Similarly, the four cases are encrypted separately and their order is disrupted, i.e., obfuscated. In this way, an obfuscated table for the a0 and c0 NAND gate circuits can be obtained and sent to the computing party. Figure 1 In the example shown, the obfuscator A can provide the computing party B with four obfuscation tables corresponding to four gate circuits.

[0041] In addition, during the computation between the obfuscating party and the computing party, the obfuscating party sends the label corresponding to the local input corresponding to the true value bit (e.g., a0=0) to the computing party B. The computing party B does not know the true value represented by the label. For the input value (e.g., b0) held by the computing party, the corresponding label can be selected from the obfuscating party A through the oblivious transfer protocol, while the obfuscating party A does not know which label is selected, for example, it does not know whether the selected label is X. b0 1 Or X b0 0 After the computing party obtains the confusion table and input label of each gate circuit, it decrypts along the circuit. For each circuit's confusion table, there is a row that can be decrypted to obtain the corresponding label. Figure 1 Circuit, assuming that the input label obtained by the computing party B is X a0 1 , X b0 1 , X c0 0 , based on which X can be decrypted in sequence d 1 、X e 1 、X f 1 、X c1 0 Afterwards, the obfuscating party A and the computing party B can share the results, for example, computing party B shares X with obfuscating party A. c1 0 , or the obfuscating party A shares X with the computing party B c1 0 、X c1 1 .

[0042] exist Figure 1In the example, if only one input appears to the computing party B, then during the circuit calculation process, the input label needs to be obtained once through the oblivious transfer protocol. In conventional technology, computing party B can obtain the input label by directly sending two labels corresponding to two candidate bits (0, 1) by the obfuscating party A. With the obfuscating party A as the sender and the computing party B as the receiver, computing party B selects the one corresponding to the input bit through the oblivious transfer method. In these methods, two ciphertext data are sent. In the case where computing party B has input bits for more gate circuits, the circuit calculation process needs to select the input label corresponding to computing party B's input bit through multiple oblivious transfer protocols. This puts great pressure on network communication.

[0043] In order to reduce this communication pressure, the process of determining the input label can be modified in advance. Figure 2 The figure shows a schematic diagram of the process of determining the input label of the computing party in a modified obfuscation circuit. In this improved method, the transmission amount can be reduced from 2 data to 1 data. First, the obfuscation party generates candidate data L0 and L1 for candidate bits 0 and 1. After an inadvertent transmission operation, the computing party can randomly select a candidate bit from the obfuscation party as a selection bit, for example, denoted as c. The computing party can also obtain the selection label Lc corresponding to the selection bit c. Afterwards, the obfuscation party modifies the candidate data L0 and L1 to obtain the candidate labels k0 and k1 corresponding to the two candidate bits 0 and 1, respectively, and transmits a single reference value y to the computing party. The computing party determines the input label k based on the reference value y, the selection label Lc, and the input bit input, and makes the input label k be one of the labels k0 and k1 of the candidate bit.

[0044] To achieve this goal, Figure 2 In the example shown, candidate labels k0 and k1 are constructed using symmetric XOR encryption and a random offset R (the XOR result of k0 and k1 is R). For example, let the label corresponding to one candidate bit (called the first bit, such as 0) be one of the candidate data, such as k0 = L0 (it can also be set to L1). Then the label corresponding to the other candidate bit (called the second bit, such as 1) is k1 = L0 ^ R, where ^ represents the XOR operation. To reduce communication traffic, a reference quantity y related to the two candidate data is set, such as y = L0 ^ L1 ^ R. This is equivalent to encrypting k1 with L1. Correspondingly, when the input bit input is the same as the selection bit c, if the input bit input is the same as the predetermined bit (such as 0), the input label can be set to the selection label Lc; otherwise, the input bit input is the same as another candidate bit (such as 1), for example, the selection bit c=1, the selection label Lc=L1, and the input label k is the XOR result of the selection label Lc and the reference amount y, which is equivalent to decrypting k1 with L1 to obtain k1.

[0045] This scheme can effectively reduce the amount of communication when the input bits and the selection bits are the same, making the communication amount the bit length of the reference quantity y (consistent with the string length of R, L0, and L1). However, when the input bits and the selection bits are different, it is difficult to construct a corresponding label determination method. Therefore, this method requires knowing the input bits in order to use the corresponding ROT (random oblivious transfer) for selection.

[0046] In order to reduce the amount of online computing communication while increasing flexibility and versatility, this specification further provides a concept based on this, whereby the obfuscating party can generate alternative data for candidate bits 0 and 1, and after the obfuscating party and the computing party pre-execute the random oblivious transfer (ROT) protocol, the computing party randomly obtains the selection label corresponding to the selection bit. Since the obfuscating party does not know the selection bit obtained by the computing party, when executing the gate circuit, the computing party can, on the one hand, determine the input label based on the selection label locally by the relationship between the selection bit and the input bit, and on the other hand, encrypt the input bit (perform an XOR operation) by the selection bit and send it to the obfuscating party, and the obfuscating party constructs two alternative labels corresponding to the two candidate bits respectively based on the alternative data. In this way, it can be ensured that the input label determined by the computing party is one of the two alternative labels corresponding to the two candidate bits respectively, and is the label corresponding to the candidate bit consistent with the input bit.

[0047] Reference below Figure 3 A specific example is shown to describe the technical concept of this specification.

[0048] like Figure 3 As shown, under the concept of this specification, a ROT operation is pre-performed between the obfuscating party and the computing party. After this random ROT operation, the computing party selects one of the two candidate data L0 and L1 corresponding to the two candidate bits 0 and 1 as the selection label Lc, and the corresponding candidate bit is the selection bit c. When the computing party obtains the local input bit input, on the one hand, it can encrypt the input bit input with the selection bit c (such as XOR encryption), and the intermediate encryption result is b = c ^input, and this encrypted result is sent to the obfuscating party. On the other hand, the input label k corresponding to the input bit input can be determined locally based on input and the selection label Lc.

[0049] The obfuscation party can determine the labels k0 and k1 corresponding to the two candidate bits 0 and 1 respectively based on the encrypted intermediate result b and the candidate data L0 and L1. In order to ensure the consistency of the labels determined by the obfuscation party and the calculation party for the same candidate bit, a predetermined bit can be negotiated in advance, such as Figure 3 0 is a predetermined bit. The obfuscation party and the calculation party both determine the relevant labels based on the predetermined bits. Figure 3 In the example, the obfuscator determines that the label corresponding to the predetermined bit is the data corresponding to the encryption result b in the two candidate data L0 and L1. If the predetermined bit is 0 and the encrypted intermediate result b = 0, the obfuscator can determine that the label corresponding to the predetermined bit 0 is k0 = Lb = L0. The calculation party can determine that the label corresponding to the predetermined bit 0 is the selected label Lc. That is, when the input bit input is the predetermined bit 0, the selected bit c = 0 (thus consistent with b = 0), and the input label is k = Lc = L0. At this time, k = k0. It can be seen that the labels determined by the obfuscator and the calculation party for the predetermined bits are consistent.

[0050] To ensure that, even if the input bit is not a predetermined bit, its label remains consistent with the candidate label determined by the obfuscator for the non-predetermined bit, a reference value R is introduced. Reference value R can be a randomly generated string with the same number of bits as L0 and L1, and k0 and k1 are constrained by k0 ^ k1 = R. Thus, k1 = k0 ^ R, k0 = k1 ^ R. For the reference quantity y = L0 ^ L1 ^ R, L0 ^ y = L1 ^ R, and L1 ^ y = L0 ^ R. In this way, the obfuscator can determine the candidate label for the non-predetermined candidate bit as the XOR result of the candidate bit's label and R, such as k1 = k0 ^ R. Alternatively, the obfuscator can provide the reference quantity y = L0 ^ L1 ^ R to the computation. If the input bit is not a predetermined bit, the computation will set the input label k = Lc ^ y. This is verified using the example described in the previous paragraph. If the input bit is not the intended bit 0 (i.e., it is 1), bit c is selected as 1, the label is Lc = L1, and the input label is k = Lc ^ y = L1 ^ y = L0 ^ R. The obfuscation method determines the label for non-intended bits as k1 = k0 ^ R = L0 ^ R. Thus, k = k1. It can be seen that the labels determined by the obfuscation method and the calculation method for non-intended bits are also consistent.

[0051] In this way, the candidate labels k0 and k1 corresponding to candidate bits 0 and 1 are not directly generated by the obfuscator, but are determined based on the input bits input of the computational side. This ensures that the obfuscator and computational side determine the same label for the same bit, and that the input label k obtained by the computational side is consistent with the label determined by the obfuscator for that input bit. In this way, since the labels of the candidate bits are determined by the obfuscator based on the input bits input, there is no need to know the input bits in advance, and the input bits can be decoupled from the selection bits. This allows the ROT process to be separated from the gate circuit execution process, dividing the obfuscated circuit calculation into a wiring preparation phase and an online execution phase. Furthermore, during the online execution phase, the amount of data transmitted can be reduced to just one input bit encrypted by the selection bits, resulting in a communication volume of 1 bit, which is significantly lower than the previous solution.

[0052] According to the above invention concept, Figure 4 The process of determining the input label in the obfuscation circuit of an embodiment is shown. The execution subject of this process can be the computing party opposite to the obfuscation party in the multi-party secure computation. It can be implemented as a computer, device or server with certain computing capabilities. Figure 4 As shown, the process of determining the input label in the obfuscation circuit may include the following steps: step 401, obtaining a current input bit; step 402, detecting whether the current input bit is a predetermined bit; step 403, determining the input label based on the detection result and the selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through an oblivious transfer method, and is one of two candidate data corresponding to the two candidate bits respectively; step 404, providing the XOR result of the current input bit and the selection bit as a first intermediate quantity to the obfuscating party, so that the obfuscating party can determine two labels corresponding to the two candidate bits respectively based on the first intermediate quantity and the two candidate data.

[0053] First, in step 401, the current input bit is obtained. It will be understood that during the calculation process of a Boolean circuit, the input bits in the circuit can come from either the obfuscating party or the calculating party. The obfuscating party can send the corresponding labels of the input bits to the calculating party, while the calculating party's input bits can be obtained locally during the calculation process. For secure calculation, the input bits can be calculated using the labels of the candidate bits provided by the obfuscating party that correspond to the input bits as input labels. Since the input bits are unknown in advance, the input labels need to be determined after obtaining the current input bits. The current input bits can be the local input bits of the calculating party in the current Boolean circuit.

[0054] Next, on the one hand, the computing side determines the corresponding input label locally. Specifically, in step 402, it detects whether the current input bit is a predetermined bit. In step 403, the input label is determined based on the detection result and the selected label.

[0055] The predetermined bit may be a bit pre-negotiated or designated by the obfuscating party and the computing party, and may be 0 or 1. In the examples of this specification, 0 is used as an example for illustration. In step 402, it may be detected whether the current input bit is 0, and then in step 403, the input label may be determined based on the detection result.

[0056] In one embodiment, when the current input bit is a predetermined bit, the input label may be a selection label. The selection label is a selection bit (e.g., Figure 2 、 Figure 3c in (hereinafter referred to as c) corresponds to the label Lc, where c = 0 or 1. Accordingly, the label Lc is selected as one of the two candidate data L0 and L1 corresponding to the two candidate bits 0 and 1, respectively. In another embodiment, when the current input bit is not a predetermined bit, the input label can be determined based on the selection label Lc and the reference string y obtained from the obfuscation party. For example, the input label is determined to be Lc ^ y. Wherein, y is a string obtained by performing an XOR operation on the XOR result of the two candidate data provided by the obfuscation party and the random string R, for example, L0 ^ L1 ^ R. Wherein, y can be provided to the calculation party by the obfuscation party at the same time or after the ROT operation, or it can be provided to the calculation party when required by the current process. Providing it to the calculation party at the same time or after the ROT operation is more conducive to reducing the amount of communication during the execution of the Boolean circuit.

[0057] On the other hand, the computing party also provides the XOR result of the current input bit and the selected bit as a first intermediate quantity to the obfuscating party in step 404. If the current input bit input is 0 or 1, and the selected bit c is 0 or 1, the corresponding first intermediate quantity b is also 0 or 1. If the current input bit input and the selected bit match, b = 0; otherwise, b = 1. The obfuscating party, upon receiving the value of b, cannot infer the current input bit input or the selected bit.

[0058] according to Figure 3 According to the technical concept described, the obfuscating party can use the first intermediate quantity b and two alternative data to determine the alternative labels corresponding to the candidate bits 0 and 1 respectively, so that the input label determined by the calculating party is the label of the candidate bit corresponding to the current input bit input in the two alternative labels. That is to say, when the current input bit input = 0, the input label determined in step 403 is the label k0 corresponding to the candidate bit 0, and when the current input bit input = 1, the input label determined in step 403 is the label k1 corresponding to the candidate bit 1. In order to achieve this goal, the label corresponding to the predetermined bit can be determined by the first intermediate quantity b. For a clearer description, let the one of the two candidate bits that is consistent with the first intermediate quantity b be the first candidate bit, and the data corresponding to the first candidate bit in the two alternative data be the first data, then the label corresponding to the predetermined bit is the first data. In layman's terms, assuming b = 0, the label corresponding to the predetermined bit is the alternative data corresponding to 0, such as L0, and assuming b = 1, the label corresponding to the predetermined bit can be the alternative data corresponding to 1, such as L1. For non-predetermined bits in the candidate bits, the corresponding second label can be set to be the exclusive OR result of the first label and the reference value R.

[0059] Figure 5A process for determining candidate labels in an obfuscated circuit is shown. The execution subject of this process can be the obfuscator in a multi-party secure computation, as opposed to the computational party. It can be implemented as a computer, device, or server with certain computing capabilities. Figure 5 As shown, the process of determining candidate labels in the obfuscated circuit performed by the obfuscator may include:

[0060] Step 501: Obtain a first intermediate quantity provided by a computing party. The first intermediate quantity b is the XOR result of the current input bit input and a selection bit c. The selection bit c is randomly selected by the computing party from two candidate bits provided by the obfuscating party via oblivious transfer. The computing party also selects a selection tag corresponding to the selection bit c from two candidate data provided by the obfuscating party. The two candidate data may be data of a predetermined length randomly generated by the obfuscating party. The current input bit input may be an input bit provided by the computing party in the current Boolean circuit.

[0061] Step 502: Determine two candidate labels corresponding to the two candidate bits based on the first intermediate quantity and the two candidate data corresponding to the two candidate bits. The obfuscating party determines the two candidate labels based on the first intermediate quantity to ensure that the input label determined by the computing party for the current input bit is the one corresponding to the candidate bit that matches the input bit, among the two candidate labels. The computing party determines the input label by comparing the current input bit with a predetermined bit, using a selection label Lc. The selection label Lc is the label corresponding to the selected bit c in the two candidate data.

[0062] The predetermined bit can be a bit set by the obfuscation party and the calculation party respectively, for example, to 0 or 1. Assuming that the candidate bit of the two candidate bits that is consistent with the first intermediate quantity is the first candidate bit, and the data corresponding to the first candidate bit in the two candidate data is the first data, the obfuscation party can determine the first data as the first label corresponding to the predetermined bit, and the result of the exclusive-OR of the first label and the random string R as the second label, and the second label corresponds to the second candidate bit of the two candidate bits. In this way, the consistency of the input labels determined by the obfuscation party and the calculation party for the current input bit can be ensured.

[0063] Based on the embodiments described above, the method provided in this specification for determining input labels in an obfuscated circuit, performed by a computing party, combined with the method for determining candidate labels in an obfuscated circuit performed by an obfuscating party, can implement a Boolean circuit execution method that is divided into an offline preparation phase and an online execution phase. The offline preparation phase and the online execution phase are independent of each other and can be executed in parallel. Specifically:

[0064] Offline preparation phase: The obfuscator generates multiple sets of candidate data. Each set of candidate data includes two data corresponding to two candidate bits. For each set of candidate data, the computational party determines a single selection result based on the oblivious transfer protocol. The single selection result includes a selected bit from the two candidate bits and a selection label corresponding to the selected bit in the single set of candidate data.

[0065] Online execution phase: In response to obtaining the current input bit of the current Boolean circuit, the computing party obtains a set of selection results, detects whether the current input bit is a predetermined bit, determines the current input label based on the detection result and the selection labels in the set of selection results to perform Boolean circuit operations, and sends the XOR result of the current input bit and the selection bits in the set of selection results as an intermediate quantity to the obfuscation party, so that the obfuscation party can determine the two labels corresponding to the two candidate bits based on the intermediate quantity and the two candidate data in the set of selection results, thereby ensuring that the current input label is the label of the candidate bit corresponding to the input bit among the two labels.

[0066] Optionally, because the computing party determines in some embodiments that the first reference value y that may be used for the input tag is only related to the two candidate data L0 and L1 and the random number R, the obfuscation party can also provide the computing party with the first reference value y during the offline preparation phase. In this way, during the online execution phase, for a single current input tag, the communication between the obfuscation party and the computing party is reduced to an intermediate value of one bit (e.g., b), significantly reducing the amount of communication.

[0067] According to one possible design, the offline preparation phase for some Boolean circuits can be run in parallel with the online execution phase for others. For example, after n rounds of rotation (ROT) operations are performed to generate n sets of candidate obfuscation results and calculation results, the multi-party secure computation task based on the Boolean circuits begins. The first Boolean circuit to be executed enters the online execution phase first. Furthermore, while the Boolean circuits are continuously executing, new ROT operations can be performed continuously to generate candidate obfuscation results and calculation results. These new ROT operations represent the offline preparation phase for the unexecuted Boolean circuits, further reducing computational latency.

[0068] Looking back at the above process, the technical concept provided in this specification pre-executes the ROT protocol and randomly selects from the alternative data provided by the obfuscating party. During the Boolean circuit operation, the obfuscating party determines the alternative label based on the alternative data using a secure method according to the current input bit and the predetermined bit, and the computing party also determines the input label based on the current input bit and the predetermined bit, combined with the selection label randomly selected during the ROT process, to ensure the consistency of the data of the obfuscating party and the computing party, and reduce the communication volume of a single Boolean circuit execution stage to 1 bit, greatly reducing the online communication volume and improving the efficiency of Boolean circuit execution.

[0069] According to another embodiment, a device for determining an input label in an obfuscation circuit, disposed on a computing side, is further provided. Figure 6 FIG. 6 shows an apparatus 600 for determining input labels in an obfuscated circuit according to an embodiment. Figure 6 As shown, the apparatus 600 includes:

[0070] An acquisition unit 601 is configured to acquire a current input bit;

[0071] a determination unit 602 configured to detect whether the current input bit is a predetermined bit, and determine an input label based on the detection result and a selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through an oblivious transfer method, and is one of two candidate data corresponding to the two candidate bits respectively;

[0072] The providing unit 603 is configured to provide the XOR result of the current input bit and the selected bit as a first intermediate quantity to the obfuscating party, so that the obfuscating party can determine two candidate labels corresponding to the two candidate bits based on the first intermediate quantity and the two candidate data, thereby ensuring that the current input label is the candidate label corresponding to the candidate bit that is consistent with the input bit among the two candidate labels.

[0073] In one embodiment, when the detection result shows that the current input bit is a predetermined bit, the determining unit 602 is further configured to: determine the selected label as the input label.

[0074] In one embodiment, when the detection result is that the current input bit is not a predetermined bit, the determination unit 602 is further configured to: determine the input label based on the XOR result of the selected label and a reference string obtained from the obfuscation party, where the reference string is a string obtained by performing an XOR operation on the XOR result of two alternative data and the random string.

[0075] In one embodiment, the predetermined bit is 0 or 1.

[0076] According to another embodiment, a device for determining candidate labels in an obfuscation circuit, provided at an obfuscating party, is further provided. Figure 7 FIG. 7 shows an apparatus 700 for determining candidate labels in an obfuscated circuit according to an embodiment. Figure 7 As shown, the apparatus 700 includes:

[0077] An acquiring unit 701 is configured to acquire a first intermediate quantity provided by a computing party, where the first intermediate quantity is an exclusive-OR result of a current input bit and a selected bit, where the selected bit is pre-selected by the computing party from two candidate bits of the obfuscating party through an oblivious transfer.

[0078] The determination unit 702 is configured to determine two alternative labels corresponding to the two candidate bits respectively based on the first intermediate quantity and the two alternative data corresponding to the two candidate bits respectively, so as to ensure that the input label determined by the calculation party for the current input bit is the alternative label corresponding to the candidate bit consistent with the input bit among the two alternative labels. The input label is determined by the calculation party based on the comparison between the current input bit and the predetermined bit through the selection label, and the selection label is the label corresponding to the selection bit in the two alternative data.

[0079] In one embodiment, the first candidate bit of the two candidate bits is consistent with the first intermediate value, and the first candidate bit corresponds to the first data of the two candidate data; the determining unit 702 is further configured to:

[0080] Determining the first data as a first label corresponding to a predetermined bit;

[0081] The XOR result of the first label and the random character string is used as the second label, and the second label corresponds to the second candidate bit of the two candidate bits.

[0082] It is worth mentioning that Figure 6 、 Figure 7 The devices 600 and 700 shown are respectively Figure 4 、 Figure 5 The method described corresponds to Figure 4 、 Figure 5 The corresponding descriptions in the method embodiment are also applicable to devices 600 and 700 and will not be repeated here.

[0083] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 4 、 Figure 5 The method described by et al.

[0084] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the system realizes the combination of Figure 4 、 Figure 5 The method described by et al.

[0085] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described in the embodiments of this specification may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0086] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above is only the specific implementation method of the technical concept of this specification and is not intended to limit the scope of protection of the technical concept of this specification. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the scope of protection of the technical concept of this specification.

Claims

1. A method for determining input labels in a garbled circuit, for use in computing a square, the method comprising: Obtaining a current input bit, detecting whether the current input bit is a predetermined bit, and determining an input label based on the detection result and a selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through oblivious transfer in an offline preparation phase, and is one of two candidate data corresponding to the two candidate bits, respectively. The predetermined bit is a candidate bit agreed upon with the obfuscating party; The XOR result of the current input bit and the selected bit is provided to the obfuscating party as a first intermediate quantity, so that the obfuscating party can determine two candidate labels corresponding to the two candidate bits respectively based on the first intermediate quantity and the two candidate data, thereby ensuring that the current input label is the candidate label corresponding to the candidate bit consistent with the input bit among the two candidate labels.

2. The method according to claim 1, wherein When the detection result is that the current input bit is a predetermined bit, determining the input tag according to the detection result and the selection tag includes: The selection tag is determined as an input tag.

3. The method according to claim 1, wherein When the detection result indicates that the current input bit is not a predetermined bit, determining the input tag according to the detection result and the selection tag includes: The input label is determined based on an XOR result of the selected label and a reference string obtained from the obfuscation party, where the reference string is a string obtained by performing an XOR operation on an XOR result of two candidate data and a random string.

4. The method according to claim 1, wherein The predetermined bit is 0 or 1.

5. A method for determining candidate labels in an obfuscated circuit, for use by an obfuscator, the method comprising: Obtaining a first intermediate quantity provided by the computing party, where the first intermediate quantity is an exclusive-OR result of a current input bit and a selected bit, where the selected bit is pre-selected by the computing party from two candidate bits of the obfuscating party through oblivious transfer in an offline preparation phase; Based on the first intermediate quantity and the two alternative data corresponding to the two candidate bits respectively, two alternative labels corresponding to the two candidate bits are determined, thereby ensuring that the input label determined by the calculation party for the current input bit is the alternative label corresponding to the candidate bit consistent with the input bit among the two alternative labels. The input label is determined by the calculation party based on the detection result of whether the current input bit is consistent with the predetermined bit, through the selection label. The selection label is the label corresponding to the selected bit in the two alternative data. The predetermined bit is the candidate bit agreed upon by the confusing party.

6. The method according to claim 5, wherein: A first candidate bit of the two candidate bits is consistent with the first intermediate value, and the first candidate bit corresponds to the first data of the two candidate data; The determining, based on the first intermediate quantity and the two candidate data corresponding to the two candidate bits respectively, two candidate labels corresponding to the two candidate bits includes: Determining the first data as a first label corresponding to the predetermined bit; An exclusive OR result of the first label and the random character string is used as a second label, where the second label corresponds to the second candidate bit of the two candidate bits.

7. A method for executing a Boolean circuit, the method comprising an offline preparation phase and an online execution phase, wherein: During the offline preparation phase, the obfuscator performs the following operations: generating multiple sets of candidate data, wherein a single set of candidate data includes two data corresponding to two candidate bits respectively, and determining a single selection result by a computing party based on an oblivious transfer protocol for the single set of candidate data, the single selection result including a selected bit from the two candidate bits and a selection label corresponding to the selected bit in the single set of candidate data; During the online execution phase, the computation side performs the following operations: In response to obtaining a current input bit of a current Boolean circuit, a set of selection results is obtained, whether the current input bit is a predetermined bit is detected, the current input label is determined according to the detection result and the selection label in the set of selection results to perform a Boolean circuit operation, and an exclusive OR result of the current input bit and the selection bit in the set of selection results is sent to the obfuscation party as an intermediate quantity, so that the obfuscation party can determine two candidate labels corresponding to two candidate bits respectively based on the intermediate quantity and two candidate data in the set of selection results, thereby ensuring that the current input label is an alternative label of the candidate bit corresponding to the input bit among the two candidate labels, and the predetermined bit is a candidate bit agreed upon with the obfuscation party.

8. A device for determining input labels in an obfuscated circuit, provided on a computing side, the device comprising: an acquisition unit configured to acquire a current input bit; a determination unit configured to detect whether the current input bit is a predetermined bit, and determine an input label based on the detection result and a selection label, wherein the selection label is a label corresponding to the selection bit determined in advance from two candidate bits of the obfuscating party through an oblivious transfer method in an offline preparation phase, and is one of two candidate data corresponding to the two candidate bits, respectively; and the predetermined bit is a candidate bit agreed upon with the obfuscating party; a providing unit configured to provide an XOR result of the current input bit and the selected bit as a first intermediate quantity to an obfuscating party, so that the obfuscating party determines two candidate labels corresponding to two candidate bits respectively based on the first intermediate quantity and two candidate data, thereby ensuring that the current input label is the candidate label corresponding to the candidate bit consistent with the input bit among the two candidate labels.

9. The device according to claim 8, wherein When the detection result is that the current input bit is a predetermined bit, the determining unit is further configured to: The selection tag is determined as an input tag.

10. The device according to claim 8, wherein When the detection result is that the current input bit is not a predetermined bit, the determining unit is further configured to: The input label is determined based on the XOR result of the selected label and the reference string obtained from the obfuscation party. The reference string is a string obtained by performing an XOR operation on the XOR result of two candidate data and a random string.

11. A device for determining candidate labels in an obfuscated circuit, provided at an obfuscating party, comprising: an acquiring unit configured to acquire a first intermediate quantity provided by a computing party, where the first intermediate quantity is an exclusive-OR result of a current input bit and a selected bit, where the selected bit is pre-selected by the computing party from two candidate bits of the obfuscating party through an oblivious transfer in an offline preparation phase; A determination unit is configured to determine two candidate labels corresponding to the two candidate bits respectively based on the first intermediate quantity and two candidate data corresponding to the two candidate bits respectively, so as to ensure that the input label determined by the calculation party for the current input bit is the alternative label corresponding to the candidate bit consistent with the input bit among the two alternative labels, and the input label is determined by the calculation party based on the detection result of whether the current input bit is consistent with the predetermined bit, through the selection label, the selection label is the label corresponding to the selected bit in the two alternative data, and the predetermined bit is the candidate bit agreed upon with the confusing party.

12. The device according to claim 11, wherein A first candidate bit of the two candidate bits is consistent with the first intermediate value, and the first candidate bit corresponds to the first data of the two candidate data; the determining unit is further configured to: Determining the first data as a first label corresponding to the predetermined bit; An exclusive OR result of the first label and the random character string is used as a second label, where the second label corresponds to the second candidate bit of the two candidate bits.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

14. A computing device comprising a memory and a processor, characterized in that: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 6 is implemented.

Images