Business processing method and device based on garbled circuit

Abstract

The embodiments of this specification provide a business processing method and device based on an obfuscation circuit. In the business process of multi-party secure computing, the business processing process is divided into the continuous execution process of multiple operator circuits. Before the business processing process begins, a large amount of obfuscation table data can also be pre-stored. In the continuous execution process of multiple operator circuits, for a single operator circuit, an obfuscation table is randomly selected, and the corresponding input label is securely determined for a single input bit of the computing party through oblivious transmission. The final result of the single operator circuit is described by the first result and the second result determined independently by the obfuscation party and the computing party. In this way, by preparing multiple obfuscation tables for each type of operator circuit in advance, various types of operator circuits can be flexibly combined during the online execution process, thereby improving the online execution efficiency of business processing.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of secure computing technology, and more particularly, to a service processing method and apparatus based on an obfuscation circuit. Background Art

[0002] Garbled Circuit (GC) is a secure multi-party computation protocol that constructs secure function calculations using Boolean circuits, allowing participants to calculate the result based on input values without knowing the specific numbers they entered in the calculation formula. Garbled circuits can be used in multi-party secure computation processes. Secure Multi-Party Computation (MPC), also known as Multi-Party Secure Computation (MPC), can be used to securely calculate a contract function without a trusted third party. Secure Multi-Party Computation can be applied to various business scenarios such as joint model training, private intersection, and secure comparison. When using the garbled circuit method for business processing, the number of Boolean circuits used varies depending on the complexity of the business scenario. For business scenarios with high computational load, the communication volume and communication efficiency during the calculation process directly affect the business processing efficiency of the secure computing. Summary of the Invention

[0003] One or more embodiments of this specification describe a service processing method and apparatus based on an obfuscation circuit, to solve one or more problems mentioned in the background art.

[0004] According to a first aspect, a business processing method based on an obfuscation circuit is provided, wherein the business processing includes the continuous execution of multiple operator circuits, and the method includes: the obfuscation party and the calculation party each obtain local input data for the current operator circuit; the obfuscation party and the calculation party select a current obfuscation table from a set of obfuscation tables predetermined for the operator type of the current operator circuit; the calculation party executes the current operator circuit according to its own local input data, input labels provided by the obfuscation party for its local input data, and the current obfuscation table, to obtain output labels corresponding to output lines of the current operator circuit; the obfuscation party and the calculation party securely determine, based on the output labels obtained by the calculation party, a first result stored on the obfuscation party and a second result stored on the calculation party for the corresponding output line, so that the single first result and the single second result jointly describe the corresponding output bit.

[0005] In one embodiment, both the obfuscation party and the calculation party store obfuscation table sets corresponding to each operator type in advance. A single operator type corresponds to at least one obfuscation table set. A single obfuscation table set includes multiple obfuscation tables for the operator circuit corresponding to the corresponding single operator type. A single obfuscation table includes the encryption results of the input labels of all gate circuits of the single operator circuit to the output labels.

[0006] In one embodiment, for a single input bit provided by a computing party in a current operator circuit, the computing party obtains a corresponding single input label from an obfuscating party based on a single set of selection data in a pre-stored selection data set, wherein the single set of selection data corresponds to a single set of reference strings on the obfuscating party, the single set of reference strings including two reference strings corresponding to two candidate bits respectively, and the single set of selection data including a selection bit obtained by selecting the two candidate bits of the obfuscating party through a random oblivious transfer method and a reference character corresponding to the selection bit.

[0007] In a further embodiment, the input bits provided by the computing party include a first bit, and the first input label corresponding to the first bit is determined in the following manner: the computing party randomly selects a first selected data group from the selection set, and provides a first comparison result of the first bit with a first selected bit in the first selected data group to the obfuscation party, where the first selected data group includes the first selected bit and a corresponding first selected string; the obfuscation party obtains a first reference string group corresponding to the first selected data group, and provides two ciphertexts corresponding to two candidate bits to the computing party based on the first comparison result, where the two ciphertexts are obtained by encrypting two candidate labels corresponding to the two candidate bits using two reference strings in the first reference string group; the computing party decrypts the two ciphertexts using the first selected string to obtain the first input label.

[0008] In a further embodiment, when the first comparison results are the same, the obfuscating party uses two reference strings to encrypt the two alternative labels according to the corresponding candidate bits to obtain the two ciphertexts; when the first comparison results are different, the obfuscating party uses the two reference strings to cross-encrypt the two alternative labels according to the candidate bits to obtain the two ciphertexts.

[0009] In one embodiment, the first result corresponding to a single output label is obtained by the obfuscating party from a predetermined bit of the 0 label, and the second result is obtained by the computing party from a predetermined bit of the single output label, where the predetermined bit is a bit where the exclusive-OR result of the two alternative labels generated by the obfuscating party for the single output line corresponding to the single output label is 1.

[0010] In a further embodiment, the XOR result of the two candidate labels generated by the obfuscation method for each output line is always a random string R, and the predetermined bit is determined according to the bit value of 1 in R.

[0011] In one embodiment, the XOR value of the single first result and the single second result is the true value of the corresponding output bit.

[0012] According to a second aspect, a method for business processing based on an obfuscation circuit is provided, wherein the business processing includes the continuous execution of multiple operator circuits, and the method is executed by a computing party, including: obtaining local input data of the current operator circuit;

[0013] A current obfuscation table is selected from the obfuscation table set corresponding to the operator type of the current operator circuit in synchronization with the obfuscation party; the current operator circuit is executed according to the local input data, the current obfuscation table, and the input labels obtained from the obfuscation party to obtain output labels corresponding to the output lines of the current operator circuit; and for each obtained output label, a local second result is determined for each output line, where the single second result and the corresponding first result determined locally by the obfuscation party jointly describe the corresponding output bit.

[0014] According to a third aspect, a business processing method based on an obfuscation circuit is provided, wherein the business processing includes the continuous execution of multiple operator circuits, and the method is executed by the obfuscation party, including: obtaining local input data of the current operator circuit; synchronously selecting a current obfuscation table from the obfuscation table set under the corresponding type of the current operator circuit with the calculation party; providing the calculation party with each input label related to the local input data in the current operator circuit according to the current obfuscation table, so that the calculation party executes the current operator circuit; using each output label of the current operator circuit, determining each first result of each output line of the current operator circuit locally, and the single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

[0015] According to a fourth aspect, a business processing device based on an obfuscation circuit is provided, wherein the business processing includes the continuous execution of multiple operator circuits, and the device is arranged on the computing side, including: an acquisition unit, configured to obtain local input data of the current operator circuit; a selection unit, configured to synchronize with the obfuscation side to select a current obfuscation table from a set of obfuscation tables under the corresponding type of the current operator circuit; an execution unit, configured to execute the current operator circuit according to the local input data, the current obfuscation table, and each input label obtained from the obfuscation side, to obtain each output label corresponding to each output line of the current operator circuit; and a determination unit, configured to determine each local second result of each output bit for each obtained output label, wherein the single second result and the corresponding first result determined locally by the obfuscation side jointly describe the corresponding output bit.

[0016] According to a fifth aspect, a service processing device based on an obfuscation circuit is provided, wherein the service processing includes the continuous execution of multiple operator circuits, and the device is provided on the obfuscation side, comprising:

[0017] an acquisition unit configured to acquire local input data of a current operator circuit;

[0018] A selection unit configured to synchronize with the computing party a current confusion table selected from a set of confusion tables corresponding to an operator type of a current operator circuit;

[0019] a providing unit configured to provide, according to the current confusion table, each input label associated with the local input data in the current operator circuit to the computing party, so that the computing party executes the current operator circuit;

[0020] The determination unit is configured to determine the local first results of each output line of the current operator circuit according to the alternative labels corresponding to each output line of the current operator circuit, and the single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

[0021] According to a sixth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the second aspect or the third aspect.

[0022] According to the seventh aspect, a computing device is provided, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method of the second aspect or the third aspect is implemented.

[0023] Through the method and apparatus provided in the embodiments of this specification, during the business process of multi-party secure computing, the business processing process is split into the continuous execution process of multiple operator circuits. Before the business processing process begins, a large amount of obfuscation table data can also be pre-stored. During the continuous execution of multiple operator circuits, an obfuscation table is randomly selected for a single operator circuit, and the final result of the single operator circuit is described by the first result and the second result independently determined by the obfuscating party and the computing party. In this way, through the offline preparation of the obfuscation table, various types of operator circuits can be flexibly combined during the business processing process, thereby improving the online execution efficiency of the business processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 A schematic diagram of a garbled circuit logic diagram showing a specific example;

[0026] Figure 2 An interactive flow chart of a business processing method based on an obfuscation circuit according to the technical concept of this specification is shown;

[0027] Figure 3 A flowchart of a business processing method based on an obfuscation circuit performed by a computing party according to one embodiment is shown;

[0028] Figure 4 A flowchart of a service processing method based on an obfuscation circuit performed by an obfuscation party according to one embodiment is shown;

[0029] Figure 5 A schematic block diagram of a service processing device based on an obfuscation circuit and provided at a computing side according to one embodiment is shown;

[0030] Figure 6 A schematic block diagram of a service processing device based on an obfuscation circuit and provided at an obfuscation party according to an embodiment is shown. DETAILED DESCRIPTION

[0031] The technical solution provided in this specification is described below in conjunction with the accompanying drawings.

[0032] First, the logical principle of the garbled circuit is described. Figure 1 A schematic diagram of a garbled circuit is shown as a specific example. Figure 1 As shown, in this specific application scenario, a combination of multiple Boolean circuits (hereinafter also referred to as gate circuits) is involved. There are three inputs a0, b0, and c0, and four gate circuits ultimately output c1. There are seven input and output lines a0, b0, c0, d, e, f, and c1. Assume that the obfuscator (Garbler) is denoted as A and the evaluator (Evaluator) is denoted as B. For each line, A can generate a corresponding string of predetermined length, such as X. i 0 、X i 1 , representing the true value 0 and the true value 1 respectively, i = a0, b0, c0, d, e, f, c1. Then, the obfuscator A can generate an obfuscation table for each gate circuit. For example, assuming that the initial input bits a0 and c0 are held by the obfuscator A, and b0 is held by the calculator B, for the NAND gate circuit with input a0 and c0 and output d, there are four cases of true value, and the values of a0, c0, and d are: (0, 0, 0), (0, 1, 1), (1, 0, 1), (1, 1, 0). The obfuscator A uses each string of predetermined length as the label of the corresponding true value to identify the corresponding true value. The truth value correspondence can be expressed as a string: (X a0 0 , X c0 0 , X d 0 )、(X a0 0 , X c0 1 , Xd 1 )、(X a0 1 , X c0 0 , X d 1 )、(X a0 1 , X c0 1 , X d 0 ). Further, the output tag is encrypted with the input tag, such as using X a0 0 、X c0 0 Encryption X d 0 Recorded as Similarly, the four cases are encrypted separately and their order is disrupted, i.e., obfuscated. In this way, an obfuscated table for the a0 and c0 NAND gate circuits can be obtained and sent to the computing party. Figure 1 In the example shown, the obfuscator A can provide the computing party B with four obfuscation tables corresponding to four gate circuits. Figure 1 When the four gate circuits shown are circuits for implementing a specific function (such as addition), the four confusion tables corresponding to these four gate circuits can be called a set of confusion tables for the specific function circuit.

[0033] In addition, during the computation process between the obfuscating party and the computing party, the obfuscating party sends the label corresponding to the true value bit (e.g., a0=0) corresponding to the local input to the computing party B. The computing party B does not know the true value represented by the label. For the input value (e.g., b0) held by the computing party, the corresponding label can be selected from the obfuscating party A through the oblivious transfer protocol, while the obfuscating party A does not know which label is selected, for example, it does not know whether the selected label is X. b0 1 Or X b0 0 After the computing party obtains the confusion table and input label of each gate circuit, it decrypts along the circuit. For each circuit's confusion table, there is a row that can be decrypted to obtain the corresponding label. Figure 1 Circuit, assuming that the input label obtained by the computing party B is X a0 1 , X b0 1 , X c0 0 , based on which X can be decrypted in sequence d 1 、X e 1 、X f 1 、X c10 Afterwards, the obfuscating party A and the computing party B can share the results, for example, computing party B shares X with obfuscating party A. c1 0 , or the obfuscating party A shares X with the computing party B c1 0 、X c1 1 .

[0034] exist Figure 1 In the example, if only one input bit is present in the computational party B, then during the circuit calculation process, an input label needs to be obtained once through the oblivious transfer protocol (hereinafter also referred to as OT). In the case where the computational party B holds multiple input bits, the corresponding input labels can be obtained through multiple oblivious transfer protocols. Typically, the computational party B can obtain the local input label by directly sending two labels corresponding to two candidate bits (0, 1) by the obfuscating party A, with the obfuscating party A as the sender and the computational party B as the receiver, and the computational party B selects the one corresponding to the input bit through the oblivious transfer method.

[0035] In actual business processing, a single business may require multiple operators. For example, a specific business may include 1,000 multiplication operators, 5,000 addition operators, and 30 comparison operators. A single operator can be implemented using multiple Boolean circuits, and the entire circuit corresponding to a single operator can be recorded as a single operator circuit. If conventional obfuscation circuit execution methods are used, the corresponding obfuscation circuit is constructed for each operator in sequence during business processing, the obfuscation table is generated, and the calculation is completed. This results in a high amount of communication and computation.

[0036] To this end, considering that the operator circuits corresponding to the same type of operators may have the same calculation logic, but the data processed during each call are different, this specification proposes a business processing method for pre-caching data according to the operator type. The business processing method provided in this specification can divide the business processing process into an offline preparation stage and an online business processing stage, and the obfuscation party and the calculation party each maintain a corresponding obfuscation table set for each type of operator circuit. Among them, at least one obfuscation table set can be maintained for a single type of operator circuit. A obfuscation table set can correspond to multiple obfuscation tables, and a obfuscation table can be based on the obfuscation table results of all gate circuits in the corresponding type of operator circuit. The obfuscation table set can be implemented in the form of cache data, arrays, sets, etc. in a predetermined cache area. For example, a cache area or cache container (such as a buffer) can be maintained for the multiplication operator, and the cache area can store multiple obfuscation tables and multiple sets of reference strings. A obfuscation table can include labels and obfuscation results of multiple gate circuits and can be executed by a multiplication circuit.

[0037] In the offline preparation phase, the obfuscation party generates obfuscation tables for operator circuits of various operator types, such as multiplication operator circuits, addition operator circuits, comparison operator circuits, etc. It can be understood that a circuit can be an operator circuit composed of multiple gate circuits, and the obfuscation party can generate obfuscation tables for all input lines (such as Figure 1 The corresponding labels (or ciphertexts) are randomly generated from a0, b0, and c0 in the input line, where a single input line has a label of 0, a label of 1 (e.g. Figure 1 X in a0 0 、X a0 1 For the connection lines between gate circuits, the output of the previous gate circuit (such as Figure 1 d) is used as the input of the next gate circuit. Therefore, each gate circuit can be executed in sequence according to the label to obtain the final output line (such as Figure 1 The 0 label and 1 label of c1) in the input label are encrypted and the encrypted result is recorded in random order as a confusion table of a gate circuit. The obfuscation party can generate multiple confusion tables for a type of operator circuit and store them as at least one confusion table set. The obfuscation party sends the confusion table to the calculation party, and the calculation party can also store the corresponding multiple confusion tables for a type of operator circuit in at least one confusion table set, for example, in a buffer. For example, a buffer is corresponding to a multiplication operator circuit, in which 10,000 confusion tables are stored.

[0038] In some embodiments, the obfuscation party and the calculation party may also perform a ROT operation (Rondom OT) in advance to provide a reference string for determining the input label of the calculation party, which is used to assist in the construction of the GOT (General OT), thereby determining the input label of the calculation party. The result of a single ROT execution is, for example: the obfuscation party randomly generates reference strings L0 and L1 (also referred to as a group of reference strings or a reference string group) corresponding to the two candidate bits 0 and 1 respectively; the calculation party randomly selects a bit c (c may be 0 or 1) as the selection group bit and the corresponding reference string Lc as the selection label from the two candidate bits 0 and 1 through OT. The selection bit c and the selection label Lc obtained by the calculation party can be called a set of selection data, or a selection data group. The obfuscation party and the calculation party can perform ROT multiple times, such as 100,000 times, and store the results accordingly, for example, using the same identifier for the same ROT result.

[0039] During the online business processing phase, when executing an operator circuit, the obfuscator and the computational provider can select the same obfuscation table for calculation. For example, when executing a multiplication operator circuit, both parties will select the fifth obfuscation table in the cache corresponding to the multiplication operator. When executing a gate circuit where the computational provider provides at least one input bit, the obfuscator and the computational provider can also select the same set of reference strings and determine the corresponding input labels as described above.

[0040] This segmentation allows for pre-storing as much offline data and results as possible during business processing, allowing for flexible combinations of various operator circuits during the online execution phase. This reduces real-time communication and improves business processing efficiency in multi-party secure computation. The following describes the technical concepts of this specification in detail from the perspective of the online execution phase.

[0041] Figure 2 The following illustrates a business process flow based on an obfuscation circuit according to an embodiment. Figure 2 The process shown describes the online business processing process from the perspective of the interaction between the obfuscation party and the calculation party. Among them, the obfuscation party and the calculation party can be implemented as computers, devices, and servers with certain computing capabilities. The obfuscation party and the business party can be two parties that cooperate to process a certain business, and can each hold part of the business data. For example, they can be two participants in federated learning, a platform and a cooperative merchant, etc. The obfuscation party (Garbler) and the calculation party (Evaluator) are used to represent the data processing role of the obfuscation circuit in the current business processing process based on the obfuscation circuit, which can also be called the first party and the second party. In the processing process of multi-party secure computing, when the data processing roles of the obfuscation party and the calculation party are exchanged, the party used to generate the obfuscation table after the exchange becomes the new obfuscation party, and the party that performs calculations based on the obfuscation table after the exchange becomes the new calculation party.

[0042] It's understandable that during the offline preparation phase, the obfuscation and computation parties can prepare the data needed for online processing. Offline here means that the business processing process has not yet begun, for example, no input data has been provided to the prediction model for business prediction, rather than that the two parties are disconnected from the network and do not interact. Based on the principles described above, the offline preparation phase involves two aspects of data preparation.

[0043] The data required online includes at least multiple obfuscation tables for each operator circuit type, each with its own degree rating. It may also include multiple sets of reference strings pre-determined by the obfuscating party, and multiple sets of selected data selected by the computing party from the multiple sets of reference strings by executing ROT multiple times (e.g., 100,000 times). The obfuscation party stores each set of reference strings and each set of selected data from the computing party in a one-to-one correspondence. The ROT execution results and the obfuscation table can be stored in correspondence or independently of each other, for example, the ROT results are stored in a buffer or set shared by all types of operator circuits. In one embodiment, the reference strings can be stored in correspondence with the input labels in the obfuscation table, for example, in the example above, L0, L1 and m0, m1 are stored in correspondence. Optionally, the obfuscation party can also provide the obfuscation table with the input labels corresponding to the locally known input lines. If all or part of the obfuscation party's input data is known in advance, the obfuscation party can also provide the computing party with the labels corresponding to the input bits of each operator circuit design during the offline preparation phase.

[0044] After preparing data in the offline preparation phase, the obfuscation and computation parties can now conduct online business processing. This "online" refers to the process of acquiring input data and processing it. For example, each party receives local business feature data as input and invokes various operator circuits to securely complete business processing (e.g., obtaining prediction results).

[0045] The business processing process of the online business processing stage may include the execution of at least one operator circuit. Figure 2 As shown, for a current operator circuit, the following process may be included: Step 201, the obfuscation party and the calculation party respectively obtain local input data of the current operator circuit; Step 202, the obfuscation party and the calculation party select a current obfuscation table from a set of obfuscation tables predetermined for the operator type of the current operator circuit; Step 203, the calculation party executes the current operator circuit according to its own local input data, the obfuscation party, the input labels corresponding to its local input data, and the current obfuscation table, to obtain output labels corresponding to output lines of the current operator circuit; Step 204, the obfuscation party and the calculation party securely determine, based on the output labels obtained by the calculation party, a first result stored on the obfuscation party and a second result stored on the calculation party for the corresponding output line, so that a single first result and a single second result jointly describe the corresponding output bit.

[0046] First, in step 201, the obfuscation party and the calculation party each obtain local input data for the current operator circuit. Here, the input data can be various business data, such as user feature data, vocabulary sequence data, etc. In the case where the business processing process can be divided into multiple levels (such as each layer in a multi-layer neural network can be regarded as an independent level, and in other machine learning models, a single calculation step can also be regarded as a level), the input data can also be the output data of the previous level, that is, the intermediate result data. In the specific business scenario of multi-party secure computing, one of the obfuscation party and the calculation party holds the input data, or both parties hold part of the input data.

[0047] Next, in step 202 , the obfuscation party and the computation party select at least one obfuscation table from a set of obfuscation tables predetermined for the operator type of the current operator circuit.

[0048] It can be understood that the obfuscation party and the calculation party have predetermined obfuscation table sets for each operator circuit type. Operator types may be, for example, multiplication operators, addition operators, comparison operators, and the like. An operator circuit of a single operator type may correspond to one or more obfuscation table sets. The obfuscation party and the calculation party may select a obfuscation table from the obfuscation table set under the operator type corresponding to the current operator circuit. A obfuscation table here may include obfuscation tables of one or more gate circuits, which are used to complete the calculation of the operator circuit of the corresponding operator type. For example, if the current operator circuit is a multiplication operator circuit, the obfuscation party and the calculation party may select a obfuscation table from the obfuscation table set corresponding to the multiplication operator circuit. For example, the fifth obfuscation table in the third obfuscation table set corresponding to the multiplication operator circuit may be selected.

[0049] In practice, the obfuscation party and the computing party can select the obfuscation tables in sequence, for example, starting from the first obfuscation table in the first obfuscation table set and using the obfuscation tables in sequence. Alternatively, one party can randomly select a obfuscation table and synchronize the selection result (such as the obfuscation table identifier) to the other party. Alternatively, the two parties can negotiate to determine one of the obfuscation tables. This is not limited here.

[0050] Then, through step 203, the computing party executes the current operator circuit according to its own input data, the obfuscation policy, the input label corresponding to its local input data, and the current obfuscation table to obtain the output labels corresponding to the output lines of the current operator circuit.

[0051] According to the input data, the input bits of the current operator circuit can be determined. Figure 1 The execution principle of the illustrated obfuscation circuit shows that the computing party can decrypt each circuit in turn according to each input bit and the obfuscation table to obtain the final output label of the current operator circuit.

[0052] The input bits in the current operator circuit can be provided by either the obfuscator or the computational party. Based on the principles of obfuscated circuits, the obfuscator can directly provide the corresponding input labels to the computational party for the input bits provided by the obfuscator (the computational party does not know the bit value corresponding to the label). For the input bits provided by the computational party, the corresponding input labels can be obtained from the obfuscator via oblivious transmission. Oblivious transmission allows the computational party to select one of the obfuscator's two secrets (the 0 label and the 1 label of the corresponding input line) without the obfuscator knowing which one it has chosen.

[0053] According to a possible design of this specification, in order to put more communication in the offline preparation stage, the obfuscator and the calculator pre-execute multiple ROTs and obtain corresponding execution results. The calculator can then construct a GOT based on this to determine the input label corresponding to the local input bit.

[0054] As described above, the result of executing ROT is that the obfuscator holds the reference string group and the computing party holds the selection data. The computing party can use GOT to select the input label from the two ciphertexts of label 0 and label 1 provided by the obfuscator. Among them, the two ciphertexts are obtained by the obfuscator based on the comparison result of the input bit and the selection bit, and the two reference strings are used to encrypt the label 0 and label 1 respectively by using the XOR method. Specifically, when the input bit and the selection bit are the same, the reference string corresponding to the 0 bit is used to encrypt the label 0, and the reference string corresponding to the 1 bit is used to encrypt the label 1. When the XOR result of the input bit and the selection bit is 1, the reference string corresponding to the 0 bit is used to encrypt the label 1, and the reference string corresponding to the 1 bit is used to encrypt the label 0. In this way, it can be guaranteed that the computing party can correctly decrypt the ciphertext corresponding to the local input bit through the selection label.

[0055] As an example of a reference string, for an input line, assume that the 0 label and 1 label generated by the obfuscator are m0 and m1, respectively, and the reference strings are L0 and L1. The computing party selects a candidate label c and the corresponding reference string Lc as selection data through oblivious transmission (such as ROT). c can be 0 or 1. When c = 0, Lc is L0, and when c = 1, Lc = L1. When determining the input label corresponding to the computing party's input bit, the computing party can compare the input bit with c to see if they are identical (for example, by using an XOR value or other description) and send the comparison result to the obfuscator. If the comparison result is the same, the obfuscator uses the two reference strings to encrypt the two candidate labels according to the corresponding candidate bits, respectively, to obtain the two ciphertexts. For example, the encryption result of L0 on m0, such as M0 = L0 ^ m0, and the encryption result of L1 on m1, such as M1 = L1 ^ m1, are sent to the computing party. The computing party correctly decrypts one of Lc ^ M0 or Lc ^ M1 to obtain the corresponding input label. On the other hand, when the comparison results are different, the obfuscating party uses two reference strings to cross-encrypt the two alternative labels according to the candidate bits to obtain the two ciphertexts. For example, the encryption result of L0 to m1, such as M0=L0^m1, and the encryption result of L1 to m0, such as M1=L1^m0, are sent to the computing party, and the computing party correctly decrypts one of Lc^M0 or Lc^M1 to obtain the input label corresponding to the input bit.

[0056] The current operator circuit can have multiple output lines, and the corresponding output results can have multiple output bits. For each output line, the calculation party can obtain the corresponding output label, but the calculation party does not know the bit value corresponding to the corresponding output label, and thus cannot obtain the output result of the current operator circuit.

[0057] Furthermore, in step 204 , the obfuscation party and the calculation party securely determine, based on the respective output labels obtained by the calculation party, a first result stored on the obfuscation party and a second result stored on the calculation party for the corresponding output line, such that a single first result and a single second result jointly describe the corresponding output bit.

[0058] To ensure that the output result is held by both the obfuscating party and the computing party, the single output label of the current operator circuit can be split into two parts, one for the computing party and the other for the obfuscating party. The splitting mentioned here can be understood as combining the two parts of data in a predetermined manner to produce the true value, but in reality, no data splitting is performed. This is because the obfuscating party holds all the candidate labels for the output line and clearly defines the correspondence between the candidate labels and the candidate bits. Splitting can easily leak the output label to one party, thereby allowing at least one party to know the true value of the output bit.

[0059] It is understandable that an output bit can be either 0 or 1, and the XOR result of 0 and 1 is also 0 or 1. Therefore, the output result can be described by a bit held by each of the obfuscation party and the calculation party. Therefore, according to an optional embodiment, when the two bits held by the obfuscation party and the calculation party are processed through an XOR gate, the true value of the corresponding output bit can be obtained. The splitting of a single output bit can be performed in various reasonable ways. During the bit splitting process, since the obfuscation party cannot know the value calculated by the calculation party, and the calculation party cannot know the value obtained by the obfuscation party, a bit can be obtained from each of the obfuscation party and the calculation party according to a predetermined rule, so that their XOR results can restore the output bit of the calculation party.

[0060] Considering the special properties of the XOR gate, assuming that the XOR result of the 0 label and the 1 label at a certain bit is 1, it can be guaranteed that the XOR result of the value at that bit of the 0 label or the 1 label with its own value at that bit is 0, and the XOR result with the value of the other label at that bit is 1. Therefore, if the obfuscating party takes the value at that bit of the 0 label, and the computing party takes the value at that bit of the output label as the first and second results of the split, then the XOR value of the first and second results can be restored to 0 when the output label obtained by the computing party is 0, and to 1 when the output label obtained by the computing party is 1, thereby effectively describing the output bit. It can be understood that restoring the true output bit mentioned here is merely a logical description. In practice, the process of determining the first result by the obfuscating party and the second result by the computing party are independent processes, and to protect privacy, the true value of the output bit is not truly restored.

[0061] Thus, according to one embodiment, when the obfuscator generates input labels during the offline preparation phase, it can set the XOR value of the 0 and 1 labels of a single input line to 1 at least at a predetermined position. For example, the lowest bit (the rightmost bit) is 1. Then, for an output line of the current operator circuit, after the calculation party obtains the output label, it can take the bit value of the output label at this predetermined position, and the obfuscator takes the bit value of the 0 label at this position for this output line. In one embodiment, the XOR value of the 0 and 1 labels of each input line can be a random string R (not disclosed to the calculation party), and the above predetermined position can be any bit in R with a bit value of 1.

[0062] Using this processing method, when there are other circuits connected downstream of the current operator circuit, the output bits held by both parties can be calculated using the tags through an XOR gate combined with oblivious transfer, and the calculation results can be used in the downstream circuits.

[0063] In practice, the output bits may be split and synthesized in other ways, which will not be described in detail here.

[0064] Thus, through Figure 2 In the illustrated embodiment, various types of operator circuits can be arbitrarily combined to complete various service processing processes. This not only increases the flexibility of operator circuit splitting and combination, but also significantly reduces communication traffic during the online service processing phase because a large number of obfuscation tables and ROT results can be pre-stored according to operator circuit type, which helps improve the efficiency of multi-party secure service processing.

[0065] In an optional implementation, the offline preparation phase and the online business processing phase can be executed in parallel. In this way, an appropriate amount of backup data such as confusion tables and reference strings are prepared in the offline preparation phase, and the backup data can be replenished in real time after the online business processing phase is started. In this way, the business processing efficiency can be further improved.

[0066] Further, refer to Figure 3 As shown, during the online business processing phase, the computing party may execute the following process: Step 301, obtaining local input data of the current operator circuit; Step 302, synchronously selecting a current obfuscation table from the obfuscation table set corresponding to the operator type of the current operator circuit with the obfuscation party; Step 303, executing the current operator circuit with the local input data, the current obfuscation table, and the input labels obtained from the obfuscation party to obtain the output labels corresponding to the output lines of the current operator circuit; Step 304, determining the local second results of the output lines for the obtained output labels, and the single second result and the corresponding first result determined locally by the obfuscation party jointly describe the corresponding output bit.

[0067] On the other hand, reference Figure 4 As shown, in the online business processing stage, the obfuscation party can execute the following process: step 401, obtain the local input data of the current operator circuit; step 402, synchronize with the calculation party to select the current obfuscation table from the obfuscation table set corresponding to the operator type of the current operator circuit; step 403, provide the calculation party with various input labels related to the above-mentioned local input data in the current operator circuit according to the current obfuscation table, so that the calculation party can execute the current operator circuit; step 404, use the alternative labels corresponding to the various output lines of the current operator circuit to determine the various first results of the various output lines of the current operator circuit locally, and the single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

[0068] It is worth mentioning that Figure 3 、 Figure 4 The method embodiments shown are Figure 2 The process of the calculation party and the obfuscation party in the interactive process, about Figure 2 The description of the calculation party and the obfuscation party also applies to Figure 3 、 Figure 4 The method embodiment is not described in detail here.

[0069] According to another embodiment, a business processing device based on an obfuscation circuit and located at a computing side is also provided. Figure 5 FIG. 5 shows an embodiment of a service processing device 500 based on an obfuscation circuit, which can be set in a computing device. Figure 5 As shown, the apparatus 500 includes:

[0070] An acquisition unit 501 is configured to acquire local input data of a current operator circuit;

[0071] A selection unit 502 is configured to synchronize with the obfuscation party to select a current obfuscation table from the obfuscation table set corresponding to the operator type of the current operator circuit;

[0072] An execution unit 503 is configured to execute the current operator circuit according to the input data, the current obfuscation table, and the input labels obtained from the obfuscation party, to obtain output labels corresponding to the output lines of the current operator circuit.

[0073] The splitting unit 504 is configured to securely determine, with the obfuscation party, for each obtained output label, a first result stored at the obfuscation party and a second result stored at the computation party of the corresponding output bit, such that the single second result and the corresponding first result determined locally by the obfuscation party jointly describe the corresponding output bit.

[0074] According to another embodiment, a service processing device based on an obfuscation circuit and provided at an obfuscating party is further provided. Figure 6 FIG. 6 shows a service processing device 600 based on an obfuscation circuit according to an embodiment of the present invention, which can be provided in an obfuscation area. Figure 6 As shown, the apparatus 600 includes:

[0075] An acquisition unit 601 is configured to acquire local input data of a current operator circuit;

[0076] A selection unit 602 is configured to synchronize with the computing party to select a current confusion table from a set of confusion tables corresponding to the operator type of the current operator circuit;

[0077] A providing unit 603 is configured to provide the computing party with each input label associated with the input data in the current operator circuit according to the current confusion table, so that the computing party can execute the current operator circuit;

[0078] The determination unit 604 is configured to determine the local first results of each output line of the current operator circuit according to the alternative labels corresponding to each output line of the current operator circuit, and the single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

[0079] It is worth mentioning that Figure 5 、 Figure 6The devices 500 and 600 shown are respectively Figure 3 、 Figure 4 The method described corresponds to Figure 3 、 Figure 4 The corresponding descriptions in the method embodiment are also applicable to devices 500 and 600 and will not be repeated here.

[0080] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 3 、 Figure 4 The method described by et al.

[0081] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the system realizes the combination of Figure 3 、 Figure 4 The method described by et al.

[0082] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described in the embodiments of this specification may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0083] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above is only the specific implementation method of the technical concept of this specification and is not intended to limit the scope of protection of the technical concept of this specification. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the scope of protection of the technical concept of this specification.

Claims

1. A method for processing traffic based on an obfuscation circuit, wherein the traffic processing comprises the continuous execution of multiple operator circuits, the method comprising: The obfuscation party and the calculation party each obtain local input data for the current operator circuit; The obfuscation party and the computation party select a current obfuscation table from a set of obfuscation tables that are pre-determined offline for the operator type of the current operator circuit; The computing party executes the current operator circuit based on the input labels corresponding to its own local input data, the input labels corresponding to its local input data provided by the obfuscating party, and the current obfuscation table, to obtain the output labels corresponding to the output lines of the current operator circuit. For a single input bit in the local input data provided by the computing party, the computing party obtains the corresponding input label from the obfuscating party based on a single set of selected data in a pre-stored selected data set, where the selected data is label data randomly selected through offline interaction with the obfuscating party. The obfuscation party and the calculation party securely determine, based on the respective output labels obtained by the calculation party, a first result stored on the obfuscation party and a second result stored on the calculation party for the corresponding output line, so that the single first result and the single second result jointly describe the corresponding output bit.

2. The method according to claim 1, wherein Both the obfuscation party and the calculation party store obfuscation table sets corresponding to each operator type in advance. A single operator type corresponds to at least one obfuscation table set. A single obfuscation table set includes multiple obfuscation tables for the operator circuit corresponding to the corresponding single operator type. A single obfuscation table includes the encryption results of the input labels of all gate circuits of the single operator circuit to the output labels.

3. The method according to claim 1, wherein The single set of selected data corresponds to a single set of reference strings on the obfuscating party, the single set of reference strings including two reference strings corresponding to the two candidate bits respectively, and the single set of selected data including selected bits obtained by selecting the two candidate bits of the obfuscating party through random oblivious transmission and the reference strings corresponding to the selected bits.

4. The method according to claim 3, wherein: The input bits provided by the computing party include a first bit, and a first input label corresponding to the first bit is determined in the following manner: The computing party randomly selects a first selected data group from the selected data set, and provides a first comparison result between the first bit and a first selected bit in the first selected data group to the obfuscating party, wherein the first selected data group includes the first selected bit and a corresponding first selected character string; The obfuscating party obtains a first reference string group corresponding to the first selected data group, and provides two ciphertexts corresponding to the two candidate bits to the computing party based on the first comparison result. The two ciphertexts are obtained by encrypting the two candidate labels corresponding to the two candidate bits using two reference strings in the first reference string group. The computing party decrypts the two ciphertexts using the first selected character string to obtain the first input tag.

5. The method according to claim 4, wherein When the first comparison results are the same, the obfuscating party uses two reference strings to encrypt the two candidate labels according to the corresponding candidate bits to obtain the two ciphertexts; When the first comparison results are different, the obfuscating party uses two reference character strings to cross-encrypt the two candidate labels according to the candidate bits to obtain the two ciphertexts.

6. The method according to claim 1, wherein The first result corresponding to the single output label is obtained by the obfuscator from a predetermined bit of the 0 label, and the second result is obtained by the calculator from a predetermined bit of the single output label, where the predetermined bit is the bit where the exclusive OR result of the two alternative labels generated by the obfuscator for the single output line corresponding to the single output label is 1.

7. The method according to claim 6, wherein: The XOR result of the two candidate labels generated by the obfuscation method for each output line is always a random string R, and the predetermined bit is determined according to the bit value of 1 in R.

8. The method according to claim 1, wherein The exclusive-OR value of the single first result and the single second result is the true value of the corresponding output bit.

9. A method for business processing based on an obfuscated circuit, wherein the business processing comprises the continuous execution of multiple operator circuits, the method being performed by a computing party, comprising: Get the local input data of the current operator circuit; Synchronously with the obfuscation party, select a current obfuscation table from a set of obfuscation tables that are pre-determined offline for the operator type of the current operator circuit; Executing the current operator circuit according to the input label corresponding to the local input data, the current obfuscation table, and each input label obtained from the obfuscation party to obtain each output label corresponding to each output line of the current operator circuit, wherein the input label corresponding to a single input bit in the local input data is obtained from the obfuscation party based on a single set of selected data in a pre-stored selected data set, wherein the selected data is label data randomly selected through offline interaction with the obfuscation party; For each obtained output label, a respective second result for each output line is determined locally, and the single second result and the corresponding first result determined locally by the obfuscating party together describe the corresponding output bit.

10. A method for business processing based on an obfuscation circuit, wherein the business processing comprises the continuous execution of multiple operator circuits, the method being performed by an obfuscator, comprising: Get the local input data of the current operator circuit; Synchronously with the computing party, a current confusion table is selected from a set of confusion tables that are pre-determined offline for the operator type of the current operator circuit; Providing, to the computing party, each input label associated with the local input data in the current operator circuit according to the current obfuscation table, so that the computing party executes the current operator circuit according to the input label corresponding to its own local input data, the input label corresponding to its local input data provided by the obfuscating party, and the current obfuscation table, wherein, for a single input bit in the local input data provided by the computing party, the computing party obtains the corresponding input label from the obfuscating party according to a single set of selected data in a pre-stored selected data set, wherein the selected data is label data randomly selected through offline interaction with the obfuscating party; Using the candidate labels corresponding to the output lines of the current operator circuit, the first results of the output lines of the current operator circuit are determined locally. The single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

11. A service processing device based on an obfuscation circuit, wherein the service processing includes the continuous execution of multiple operator circuits, the device being provided on a computing side, comprising: an acquisition unit configured to acquire local input data of a current operator circuit; A selection unit configured to select a current confusion table from a set of confusion tables that are pre-determined offline for an operator type of a current operator circuit in synchronization with the obfuscation party; an execution unit configured to execute the current operator circuit according to the input label corresponding to the local input data, the current obfuscation table, and each input label obtained from the obfuscation party, to obtain each output label corresponding to each output line of the current operator circuit, wherein the input label corresponding to a single input bit in the local input data is obtained from the obfuscation party based on a single set of selected data in a pre-stored selected data set, wherein the selected data is label data randomly selected through offline interaction with the obfuscation party; The determining unit is configured to determine, for each obtained output label, each second result locally for each output bit, such that the single second result and the corresponding first result locally determined by the obfuscating party jointly describe the corresponding output bit.

12. A service processing device based on an obfuscation circuit, wherein the service processing includes the continuous execution of multiple operator circuits, the device being provided on an obfuscation side, comprising: an acquisition unit configured to acquire local input data of a current operator circuit; A selection unit configured to select a current confusion table from a set of confusion tables that are pre-determined offline for an operator type of a current operator circuit in synchronization with the computing party; a providing unit configured to provide, based on the current obfuscation table, each input label associated with the local input data in the current operator circuit to the computing party, so that the computing party executes the current operator circuit based on the input label corresponding to its own local input data, the input label corresponding to its local input data provided by the obfuscating party, and the current obfuscation table, wherein for a single input bit in the local input data provided by the computing party, the computing party obtains the corresponding input label from the obfuscating party based on a single set of selected data in a pre-stored selected data set, wherein the selected data is label data randomly selected through offline interaction with the obfuscating party; The determination unit is configured to determine the local first results of each output line of the current operator circuit according to the alternative labels corresponding to each output line of the current operator circuit, and the single first result and the second result determined by the calculation party jointly describe the corresponding output bit.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to claim 9 or 10.

14. A computing device comprising a memory and a processor, characterized in that: The memory stores executable code, and when the processor executes the executable code, the method according to claim 9 or 10 is implemented.

Images