Multiplication execution method and device based on secure multi-party computing

Abstract

The embodiments of this specification provide a method and apparatus for executing multiplication based on secure multi-party computation. The method includes: a first party calculating a first intermediate value corresponding to first private data held by it, where the first intermediate value is one of two preset values; the first party sending an indication message of a length less than a preset length to a second party, the indication message being used to indicate the first intermediate value; and the second party calculating a first fragment based on second private data held by it and the first intermediate value, the first fragment being used to calculate the product of the first private data and the second private data.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of computers, and more particularly, to a method and apparatus for executing multiplication based on secure multi-party computation. Background Art

[0002] Secure Multi-party Computation (SMPC) involves multiple parties working together to compute the result of a function without disclosing the input data held by each participant. While the input data held by each participant is typically kept private, the result of the function can be disclosed to designated parties. SMPC-based multiplication is a typical SMPC method.

[0003] It is hoped to provide a new technical solution to reduce the communication overhead when performing SMPC-based multiplication. Summary of the Invention

[0004] One or more embodiments of this specification provide a multiplication execution method and apparatus based on SMPC.

[0005] In a first aspect, a multiplication execution method based on SMPC is provided, applied to a first party holding first private data. The method comprises: calculating a first intermediate value corresponding to the first private data, where the first intermediate value is one of two preset values; and sending an indication message having a length less than a preset length to a second party, the indication message being used to indicate the first intermediate value, so that the second party calculates a first fragment based on the second private data held by the second party and the first intermediate value, where the first fragment is used to calculate the product of the first private data and the second private data.

[0006] In a possible implementation manner, the first intermediate value is 1 or -1.

[0007] In a possible implementation manner, the length of the indication information is 1 bit.

[0008] In one possible implementation, the method further includes: receiving a second intermediate value corresponding to the second private data from the second party; calculating a second shard based on the first private data and the second intermediate value, the second shard being used to calculate the product of the first private data and the second private data.

[0009] In a possible implementation, the method further includes: jointly executing a 2-choose-1 oblivious transfer (OT) protocol with the second party, obtaining a selection value from two random values ​​arranged in sequence, and obtaining an arrangement sequence number corresponding to the selection value, wherein the two random values ​​are used to calculate the second intermediate value and the first fragment, and the selection value and its corresponding arrangement sequence number are used to calculate the first intermediate value and the second fragment.

[0010] In one possible implementation, the two random values ​​are used by the second party to generate a first random multiplier and a first random addend, the first random multiplier is used to generate the second intermediate value, and the first random addend is used to generate the first fragment. The method further includes: generating a second random addend based on the selected value, and generating a second random multiplier based on the permutation sequence corresponding to the selected value, wherein the product of the first random multiplier and the second random multiplier is equal to the sum of the first random addend and the second random addend, and the second random addend and the second random multiplier are used to calculate the first intermediate value and the second fragment.

[0011] In one possible implementation, the method further includes: obtaining a third shard, wherein the sum of the third shard and the second private data is equal to the third private data; calculating a first product of the third shard and the first private data, wherein the first product, the first shard, and the second shard are used to calculate the product of the first private data and the third private data.

[0012] In a possible implementation, the value of the first privacy data is 0 or 1.

[0013] In one possible implementation, the result of an XOR operation on the first private data and the fourth shard is equal to the fourth private data, the second private data is calculated by the second party based on the fourth shard and the third private data it holds, and the first shard, the second shard, and the second product of the fourth shard and the third private data are used to calculate the product of the fourth private data and the third private data.

[0014] In one possible embodiment, the method further includes: obtaining a third shard, wherein the sum of the third shard and the fifth shard is equal to third private data, the second private data is calculated by the second party based on the fifth shard and the fourth shard, and the result of an XOR operation on the first private data and the fourth shard is equal to fourth private data; calculating a third product of the first private data and the third shard, wherein the first shard, the second shard, the third product, and the fourth product of the fourth shard and the fifth shard are used to calculate the product of the third private data and the fourth private data, and the fourth product is calculated by the second party.

[0015] In a second aspect, a multiplication execution method based on secure multi-party computation is provided, applied to a second party holding second private data. The method comprises: receiving, from a first party, an indication message having a length less than a preset length, the indication message indicating a first intermediate value corresponding to the first private data held by the first party, the first intermediate value being one of two preset values; and calculating a first fragment based on the second private data and the first intermediate value, the first fragment being used to calculate the product of the first private data and the second private data.

[0016] In a possible implementation manner, the first intermediate value is 1 or -1.

[0017] In a possible implementation manner, the length of the indication information is 1 bit.

[0018] In one possible implementation, the method further includes: calculating a second intermediate value corresponding to the second private data; sending the second intermediate value to the first party, so that the first party calculates a second shard based on the first private data and the second intermediate value, and the second shard is used to calculate the product of the first private data and the second private data.

[0019] In a possible implementation, the method further includes: jointly executing a 2-to-1 OT protocol with the first party, so that the first party obtains a selected value and its corresponding arrangement number from two random values ​​arranged in sequence, wherein the two random values ​​are used to calculate the second intermediate value and the first shard.

[0020] In one possible implementation, the selected value and its corresponding permutation sequence number are used by the first party to generate a second random multiplier and a second random addend, and the second random addend and the second random multiplier are used to calculate the first intermediate value and the second fragment. The method further includes: generating a first random multiplier and a first random addend based on the two random values, wherein the product of the first random multiplier and the second random multiplier is equal to the sum of the first random addend and the second random addend, the first random multiplier is used to calculate the second intermediate value, and the first random multiplier is used to calculate the first fragment.

[0021] In one possible implementation, the sum of the second private data and the third shard is equal to the third private data, the first product of the third shard and the first private data is calculated by the first party, and the first product, the first shard, and the second shard are used to calculate the product of the first private data and the third private data.

[0022] In a possible implementation, the value of the first privacy data is 0 or 1.

[0023] In one possible implementation, the result of an XOR operation on the first private data and the fourth shard is equal to the fourth private data, the second private data is calculated by the second party based on the fourth shard and the third private data it holds, and the first shard, the second shard, and the second product of the fourth shard and the third private data are used to calculate the product of the fourth private data and the third private data.

[0024] In one possible embodiment, the method further includes: calculating a fourth product of the fourth shard and the fifth shard, wherein the second private data is calculated by the second party based on the fourth shard and the fifth shard, the result of an XOR operation on the first private data and the fourth shard is equal to the fourth private data, the sum of the third shard held by the first party and the fifth shard is equal to the third private data, the first shard, the second shard, the fourth product, and the third product of the first private data and the third shard are used to calculate the product of the third private data and the fourth private data, and the third product is calculated by the first party.

[0025] According to a third aspect, a multiplication execution device based on secure multi-party computation is provided, deployed on a first party. The device includes: a computing unit configured to calculate a first intermediate value corresponding to the first private data, where the first intermediate value is one of two preset values; and a communication unit configured to send an indication message having a length less than a preset length to a second party, the indication message being used to indicate the first intermediate value, so that the second party calculates a first fragment based on the second private data it holds and the first intermediate value, the first fragment being used to calculate the product of the first private data and the second private data.

[0026] In a fourth aspect, a multiplication execution device based on secure multi-party computation is provided, deployed on a second party. The device includes: a communication unit configured to receive indication information of a length less than a preset length from a first party, the indication information being used to indicate a first intermediate value corresponding to first private data held by the first party, the first intermediate value being one of two preset values; and a calculation unit configured to calculate a first shard based on the second private data and the first intermediate value, the first shard being used to calculate the product of the first private data and the second private data.

[0027] In a fifth aspect, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed in a computing device, the computing device executes the method as described in any one of the first aspect or the second aspect.

[0028] In a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores a computer program / instruction, and the processor executes the computer program / instruction to implement a method as described in any one of the first aspect or the second aspect.

[0029] Through the methods and apparatus provided in one or more embodiments of this specification, when a first party and a second party jointly perform SMPC-based multiplication, the first party takes a first intermediate value calculated for its first private data as one of two preset values. Accordingly, the first party can transmit this first intermediate value to the second party by sending a shorter indication message to the second party, so that the second party can calculate the first fragment used to calculate the product of the first private data and the second private data based on the intermediate value and its second private data. This eliminates the need to transmit a longer first intermediate value during SMPC-based multiplication, reducing communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0031] Figure 1 Schematic diagram of two parties jointly performing SMPC-based multiplication;

[0032] Figure 2 A schematic diagram of a multiplication execution system based on SMPC provided in an embodiment of this specification;

[0033] Figure 3 This is a flowchart of a multiplication execution method based on SMPC provided in an embodiment of this specification;

[0034] Figure 4 This is a flowchart of another SMPC-based multiplication execution method provided in an embodiment of this specification;

[0035] Figure 5 A schematic diagram of a multiplication execution device based on SMPC provided in an embodiment of this specification;

[0036] Figure 6 This is a schematic diagram of another SMPC-based multiplication execution device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0037] The following describes in detail various non-limiting embodiments provided in this specification in conjunction with the accompanying drawings.

[0038] Figure 1 Schematic diagram of SMPC-based multiplication performed jointly by two parties is provided as an example. Figure 1As shown, participants A and B each hold private data a and private data b. Participant A can obtain a random multiplier u and a random addend w0, while participant B can obtain a random multiplier v and a random addend w1. The product of u and v is equal to the sum of w0 and w1. u, v, w0, and w1 can also be expressed as a multiplication triplet for SMPC. Participant A can then obtain the intermediate value e corresponding to a based on u, for example, by taking the difference between a and u as the intermediate value e and sending e to participant B. Participant B can then obtain the intermediate value f corresponding to b based on v, for example, by taking the difference between b and v as the intermediate value f and sending f to participant A. Participant A can then calculate shard c0 based on the intermediate value f, for example, by summing the product of u and f with w0 to obtain c0. Participant B can then calculate shard c1 based on the intermediate value e, for example, by summing the product of b and e with w1 to obtain c1. The sum of c0 and c1 is equal to the product of a and b, that is, c0 and c1 can be used to calculate the product of a and b.

[0039] For the intermediate values ​​directly transmitted between participants A and B, they may be affected by the random multiplier and thus have a relatively large impact, which will cause a large communication overhead in the process of executing SMPC-based multiplication. For example, when obtaining the corresponding e of a based on u, even if the value of a is 0 or 1 in the modulo 2 space, the value of e may be in the modulo 2 space. t In the space, the value of t is the length of e, which is usually much larger than 1 bit.

[0040] The embodiments of this specification provide a method, device, and system for executing multiplication based on SMPC. During a process in which a first party and a second party jointly execute SMPC-based multiplication, the first party calculates a first intermediate value obtained by calculating the first private data it holds as one of two preset values. Correspondingly, the first party can transmit the first intermediate value to the second party by sending a shorter indication message to the second party, so that the second party can calculate the first fragment for calculating the product of the first private data and the second private data it holds based on the intermediate value and the second private data it holds. During the SMPC-based multiplication execution process, there is no need to transmit a longer first intermediate value, and the communication overhead is relatively low.

[0041] Figure 2 This is an architecture diagram of a SMPC-based multiplication execution system provided in the embodiments of this specification. Figure 2As shown, the SMPC-based multiplication execution system may include at least a first party (i.e., Party A) and a second party (i.e., Party B), and optionally a third party (i.e., Party D) and / or a fourth party (i.e., Party C). Party A and Party B may jointly perform SMPC-based multiplication to calculate the product of private data a and private data b; private data a may be held by Party A or Party C, and private data b may be held by Party B or Party D.

[0042] The following combination Figure 2 The multiplication execution system based on SMPC is shown, and the multiplication execution method based on SMPC is described in detail. The method is at least applicable when the value of the private data a is 0 or 1 in the modulo 2 space, and the value of the private data b is t In the application scenario where t is greater than 1, it can be understood that this method may also be applicable to other application scenarios, and no limitation is made here. Figure 3 As shown, the method at least includes the following steps 301 to 305.

[0043] First, in step 301, participant A calculates a first intermediate value corresponding to the first private data, where the first intermediate value is one of two preset values.

[0044] For ease of description, the first intermediate value is referred to as intermediate value e. To reduce the complexity of subsequent calculations, the intermediate value e can be relatively small, for example, 1 or -1, that is, the two preset values ​​can be 1 or -1.

[0045] In order to calculate and obtain the intermediate value e that is one of the two preset values, in a possible implementation, please refer to Figure 4 , the method may also include step 401, where participant A and participant B jointly execute the 2-choose-1 OT protocol, so that participant B obtains two random values ​​arranged in sequence, and participant A obtains a selection value and an arrangement number corresponding to the selection value from the two random values. The two random values ​​can be two private data among a plurality of private data held by participant B, or two random labels used to encrypt the two private data held by participant B. For example, when participant A and participant B jointly execute the 2-choose-1 OT protocol, other participants except participant A and participant B can generate a random label r0 with an arrangement number of 0 and a random label r1 with an arrangement number of 1, send both r0 and r1 to participant B, and select one random label from r0 and r1 as the selection label / selection value r i , and r i and its corresponding arrangement number i are sent to participant A.

[0046] Correspondingly, participant A can use the selected value and its corresponding arrangement number to calculate the intermediate value e, which is one of the two preset values. Participant B can use two random values ​​in the subsequent process to calculate the second intermediate value corresponding to the first shard and the second private data it holds.

[0047] For a more specific example, see Figure 3 , step 301 specifically includes:

[0048] Step 3011: Party A generates a second random multiplier based on the permutation sequence number corresponding to the selected value.

[0049] In step 3013, party A calculates a first intermediate value corresponding to the first private data based on the second random multiplier.

[0050] Based on the aforementioned steps 3011 and 3013, the method may further include:

[0051] Step 403: Party A generates a second random addend based on the selected value.

[0052] In step 405, party B generates a first random multiplier and a first random addend based on the two random values.

[0053] For the convenience of description, the two random values ​​arranged in sequence are recorded as r0 with the sequence number 0 and r1 with the sequence number 1, and the selected value is recorded as r i In addition, the second random multiplier is recorded as u, the first random multiplier is recorded as v, the second random addend is recorded as w0, and the first random addend is recorded as w1, where u*v=w0+w1.

[0054] The aforementioned step 3011 is performed, for example, by the formula u=(-1) i The calculated value u is 1 or -1.

[0055] The aforementioned step 3013 is performed, for example, by the formula e=(-1) p u -1 e is calculated, where p represents the first private data.

[0056] The aforementioned step 403 is, for example, performed by the formula w0=2r i Calculate w0.

[0057] In step 405, for example, v is calculated using the formula v=r0-r1, and w1 is calculated using the formula w1=-r0-r1. It should be noted that u, v, w0, w1, and e can also be calculated using other methods besides the aforementioned examples, such as changing the signs of certain values ​​in u, v, w0, w1, and e, or scaling certain values ​​in u, v, w0, w1, and e, and the like, which are not limited herein.

[0058] Back to Figure 2 In step 303, participant A sends an indication message to participant B, the length of which is less than a preset length, where the indication message is used to indicate the first intermediate value. In a more specific example, when the length of the intermediate value e is less than the preset length, for example, when the value of e is 1 or -1 with a length of no more than 2 bits, the indication message may be e. In another more specific example, the indication message may also be 0 or 1 with a length of 1 bit; for example, when the value of e is 1, the indication message is 1 with a length of 1 bit, and when the value of e is -1, the indication message is 0 with a length of 1 bit.

[0059] Next, in step 305, Party B calculates a first shard based on the first intermediate value and the second private data it holds. This first shard is used to calculate the product of the first private data and the second private data. For example, if Party B determines, based on the indication information, that the first intermediate value e is 1 or -1, the first shard c1 can be calculated using the formula c1 = ceil(q - ew1) / 2, where q represents the second private data held by Party B.

[0060] Please continue to refer to Figure 3 In some embodiments, based on the aforementioned step 405, the method may further include:

[0061] Step 407: Party B calculates a second intermediate value corresponding to its second private data based on the first random multiplier.

[0062] Step 408: Party B sends the second intermediate value to Party A.

[0063] In step 409 , participant A calculates a second shard based on the second intermediate value and the first private data it holds. The second shard is used to calculate the product of the first private data and the second private data.

[0064] The aforementioned step 407 may, for example, perform a subtraction between the second private data and the random multiplier v to obtain a second intermediate value f corresponding to the second private data held by participant B.

[0065] In the aforementioned step 409, for example, the second slice c0 can be calculated by the formula c0=floor(-ew0-euf) / 2.

[0066] The sum of the second shard c0 and the first shard c1 is equal to the product of the first private data p held by participant A and the second private data q held by participant B. For example, participants A and B can transfer the second shard c0 and / or the first shard c1 to each other as needed, or they can each transfer the second shard c0 and the first shard c1 to other participants. The participants who receive the second shard c0 and the first shard c1 will then sum them to obtain the product of the first private data p and the second private data q.

[0067] When private data a is the first private data p held by participant A, and private data b is the second private data q held by participant A, through the above Figure 2 、 Figure 3 The various embodiments shown can implement the calculation of the product of private data a and private data b. However, in some scenarios, the first private data p held by participant A may be a fragment of private data a, and the second private data q held by participant B may be a fragment of private data b. In this case, private data b can also be expressed as third private data, and private data a can also be expressed as fourth private data. In other words, in addition to the scenario where participant A and participant B each hold private data a and private data b, the calculation of the product of private data a and private data b based on SMPC may also include the following scenarios:

[0068] Scenario 1: Party A holds private data a, and Party B holds shard b1 of private data b. Party A can also obtain shard b0 of private data b, for example, from Party B or Party D. The sum of shard b0 and shard b1 equals private data b. Private data b can be held by Party B or Party D, or not held by any party.

[0069] Scenario 2: Party A holds shard a0 of private data a, and Party B holds private data b. Party B can also obtain shard b0 of private data b, for example, by receiving shard a1 of private data a from Party A or Party C. When the value of private data a is 0 or 1, the result of the XOR operation between shard a0 and shard a1 equals private data a. Private data a can be held by Party A or Party C, or it can be held by neither party.

[0070] Scenario 3: Party A holds shard a0 of private data a, and Party B holds shard b1 of private data b. Party A can also obtain shard b0 of private data b, for example, from Party B or Party D. Party B can also obtain shard a1 of private data a, for example, from Party A or Party C. The sum of shards b0 and b1 equals private data b. When private data a is 0 or 1, the result of an exclusive-or operation between shards a0 and a1 equals private data a. Private data a is held by Party A or Party C, and private data b is held by Party B or Party D. Alternatively, neither party holds private data a or b.

[0071] In the aforementioned scenarios 1 to 3, shard b0 can also be expressed as the third shard, and shard b1 can also be expressed as the fifth shard; shard a0 can also be expressed as the fourth shard, and shard a1 can also be expressed as the sixth shard.

[0072] For the above scenario 1, private data a can be used as the first private data, and shard b1 can be used as the second private data. Figure 2 or Figure 3 The methods provided in the various embodiments shown calculate the first shard c1 and the second shard c0. Furthermore, Party A can also calculate the first product between private data a and the received shard b0. Subsequently, Party A, Party B, or another party can use the sum of the first product a*b0, the second shard c0, and the first shard c1 as the product of private data a and private data b.

[0073] For the aforementioned scenario 2, private data a0 can be used as the first private data, and participant B can also calculate the second private data based on the private data b and shard a1 it holds, for example, using the formula The second private data q is obtained by calculation, or the second private data q is calculated by the formula q=b-2a1b, and then the second private data q is obtained by the above Figure 2 or Figure 3 The methods provided in the various embodiments shown calculate the second shard c0 and the first shard c1. Furthermore, Party B can also calculate a second product of shard a1 and private data b. Subsequently, Party A, Party B, or another party can use the sum of the second product a1*b, the second shard c0, and the first shard c1 as the product of private data a and private data b.

[0074] For the aforementioned scenario 3, in the first execution round, shard a0 can be used as the first private data. Participant B can also calculate the second private data based on the shard b1 it holds and the shard a1 it receives. For example, the second private data q can be calculated using the formula q=b1-2a1b1, and then the second private data q can be calculated using the aforementioned Figure 2 or Figure 3 The method provided in each embodiment shown is used to calculate the second shard c0 and the first shard c1. In the second execution round, participant A can calculate the second private data q based on the shard a0 it holds and the shard b0 it receives. For example, the second private data q is calculated using the formula q = b0 - 2a0b0. Shard a1 is used by participant B as the first private data p, and then through the aforementioned Figure 2 or Figure 3 Through a process similar to the methods provided in the various embodiments shown, Party A calculates a first shard g1 similar to the first shard c1, and Party B calculates a second shard g0 similar to the second shard c0. Furthermore, Party A can also calculate a third product of shard a0 and shard b0, and Party B can also calculate a fourth product of shard a1 and shard b1. Subsequently, Party A, Party B, or other parties can use the sum of the third product a0*b0, the fourth product a1*b1, the second shard c0, the first shard c1, the first shard g1, and the second shard g0 as the product of private data a and private data b.

[0075] Based on the same concept as the aforementioned method embodiment, this specification also provides a multiplication execution device based on SMPC, which is deployed on the first party. Figure 5 As shown, the device includes: a calculation unit 501, configured to calculate a first intermediate value corresponding to the first privacy data, wherein the value of the first intermediate value is one of two preset values; a communication unit 503, configured to send an indication message with a length less than a preset length to the second party, wherein the indication message is used to indicate the first intermediate value, so that the second party calculates a first shard based on the second privacy data it holds and the first intermediate value, and the first shard is used to calculate the product of the first privacy data and the second privacy data.

[0076] Based on the same concept as the aforementioned method embodiment, this specification also provides a multiplication execution device based on SMPC, which is deployed on the second party. Figure 6As shown, the device includes: a communication unit 601, configured to receive indication information with a length less than a preset length from a first party, wherein the indication information is used to indicate a first intermediate value corresponding to the first privacy data held by the first party, and the value of the first intermediate value is one of two preset values; a calculation unit 603, configured to calculate a first shard based on the second privacy data and the first intermediate value, and the first shard is used to calculate the product of the first privacy data and the second privacy data.

[0077] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in this specification can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, the computer program corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions / codes on a computer-readable medium, so that when the computer program corresponding to these functions is executed by a computer, the method described in any embodiment of this specification is implemented by the computer.

[0078] A computer-readable storage medium is also provided in an embodiment of this specification, on which a computer program / instruction is stored. When the computer program / instruction is executed in a computing device, the computing device executes the method steps performed by participant A or participant B in any embodiment of this specification.

[0079] A computing device is also provided in an embodiment of this specification, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method steps performed by participant A or participant B in any embodiment of this specification are implemented.

[0080] The various embodiments in this specification are described in a progressive manner. References to the same or similar parts of each embodiment can be made to the other embodiments. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant details, references to the method embodiments can be made to the descriptions of the method embodiments.

[0081] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0082] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multiplication execution method based on secure multi-party computation, applied to a first party holding first private data, the method comprising: Jointly executing a 2-choose-1 oblivious transfer (OT) protocol with the second party to obtain a selected value from two sequentially arranged random values ​​and obtain a permutation sequence number corresponding to the selected value; generating a second random addend according to the selected value; generating a second random multiplier according to the permutation sequence number corresponding to the selected value; Calculating a first intermediate value corresponding to the first private data according to the second random multiplier, wherein the first intermediate value is one of two preset values; Sending an indication message of a length less than a preset length of 3 bits to the second party, the indication message being used to indicate the first intermediate value, so that the second party calculates the first fragment based on the second private data held by the second party, the first intermediate value, and a first random addend, where the first random addend is generated by the second party based on the two random values; receiving, from the second party, a second intermediate value corresponding to the second private data; A second shard is calculated according to the first intermediate value, the second intermediate value, the second random addend, and the second random multiplier, wherein the sum of the first shard and the second shard is equal to the product of the first private data and the second private data.

2. The method according to claim 1, wherein The first intermediate value is 1 or -1.

3. The method according to claim 1, wherein The length of the indication information is 1 bit.

4. The method according to claim 1, further comprising: Obtaining a third shard, wherein a sum of the third shard and the second private data is equal to the third private data; A first product of the third shard and the first private data is calculated, wherein the first product, the first shard, and the second shard are used to calculate the product of the first private data and the third private data.

5. The method according to claim 1, wherein The value of the first privacy data is 0 or 1.

6. The method according to claim 5, wherein: The result of an XOR operation on the first private data and the sixth shard is equal to the fourth private data. The second private data is calculated by the second party based on the sixth shard and the third private data it holds. The first shard, the second shard, and the second product of the sixth shard and the third private data are used to calculate the product of the fourth private data and the third private data.

7. The method according to claim 5, further comprising: Obtaining a third shard, wherein the sum of the third shard and the fifth shard is equal to the third private data, the second private data is calculated by the second party based on the fifth and sixth shards, and the result of an exclusive-OR operation on the first private data and the sixth shard is equal to the fourth private data; Calculate a third product of the first private data and the third shard, wherein the first shard, the second shard, the third product, and a fourth product of the sixth shard and the fifth shard are used to calculate the product of the third private data and the fourth private data, and the fourth product is calculated by the second party.

8. A multiplication execution method based on secure multi-party computation, applied to a second party holding second private data, the method comprising: Jointly executing a 2-choose-1 oblivious transfer (OT) protocol with the first party, causing the first party to obtain a selected value and its corresponding permutation sequence number from two sequentially arranged random values, the selected value being used to generate a second random addend, and the permutation sequence number corresponding to the selected value being used to generate a second random multiplier; receiving, from the first party, an indication message having a length less than a preset length, where the preset length is 3 bits, the indication message being used to indicate a first intermediate value corresponding to first private data held by the first party, the first intermediate value being one of two preset values, and the first intermediate value being calculated based on the second random multiplier; generating a first random multiplier and a first random addend based on the two random values; Calculating a second intermediate value corresponding to the second private data according to the first random multiplier; sending the second intermediate value to the first party, causing the first party to calculate a second fragment based on the first intermediate value, the second intermediate value, the second random addend, and the second random multiplier; A first shard is calculated according to the second private data, the first intermediate value, and the first random addend, wherein the sum of the first shard and the second shard is equal to the product of the first private data and the second private data.

9. The method according to claim 8, wherein The first intermediate value is 1 or -1.

10. The method according to claim 8, wherein The length of the indication information is 1 bit.

11. The method according to claim 8, wherein The sum of the second private data and the third shard is equal to the third private data, the first product of the third shard and the first private data is calculated by the first party, and the first product, the first shard and the second shard are used to calculate the product of the first private data and the third private data.

12. The method according to claim 8, wherein The value of the first privacy data is 0 or 1.

13. The method according to claim 12, wherein: The result of an XOR operation on the first private data and the sixth shard is equal to the fourth private data. The second private data is calculated by the second party based on the sixth shard and the third private data it holds. The first shard, the second shard, and the second product of the sixth shard and the third private data are used to calculate the product of the fourth private data and the third private data.

14. The method according to claim 12, wherein: The method also includes: calculating a fourth product of the sixth shard and the fifth shard, wherein the second private data is calculated by the second party based on the sixth shard and the fifth shard, the result of an exclusive OR operation on the first private data and the sixth shard is equal to the fourth private data, the sum of the third shard held by the first party and the fifth shard is equal to the third private data, the first shard, the second shard, the fourth product, and the third product of the first private data and the third shard are used to calculate the product of the third private data and the fourth private data, and the third product is calculated by the first party.

15. A multiplication execution device based on secure multi-party computation, deployed on a first party holding first private data, the device comprising: The communication unit is configured to jointly execute a 2-choose-1 oblivious transfer (OT) protocol with the second party to obtain a selected value from two sequentially arranged random values ​​and obtain an arrangement sequence number corresponding to the selected value; a calculation unit configured to generate a second random addend based on the selected value; generate a second random multiplier based on the permutation sequence number corresponding to the selected value; and calculate a first intermediate value corresponding to the first private data based on the second random multiplier, wherein the first intermediate value is one of two preset values; The communication unit is further configured to send an indication message having a length less than a preset length of 3 bits to the second party, the indication message being used to indicate the first intermediate value, so that the second party calculates the first fragment based on the second private data held by the second party, the first intermediate value, and a first random addend, where the first random addend is generated by the second party based on the two random values; The communication unit is further configured to receive a second intermediate value corresponding to the second private data from the second party; The calculation unit is further configured to calculate a second shard based on the first intermediate value, the second intermediate value, the second random addend and the second random multiplier, and the sum of the first shard and the second shard is equal to the product of the first private data and the second private data.

16. A multiplication execution device based on secure multi-party computation, deployed on a second party holding second private data, the device comprising: a communication unit configured to jointly execute a 2-choose-1 oblivious transfer (OT) protocol with the first party, so that the first party obtains a selected value and a corresponding permutation sequence number from two sequentially arranged random values, the selected value is used to generate a second random addend, and the permutation sequence number corresponding to the selected value is used to generate a second random multiplier; The communication unit is further configured to receive, from the first party, indication information having a length less than a preset length, where the preset length is 3 bits, the indication information being used to indicate a first intermediate value corresponding to the first private data held by the first party, the first intermediate value being one of two preset values, and the first intermediate value being calculated based on the second random multiplier; a calculation unit configured to generate a first random multiplier and a first random addend according to the two random values; and calculate a second intermediate value corresponding to the second private data according to the first random multiplier; The communication unit is further configured to send the second intermediate value to the first party, causing the first party to calculate a second fragment based on the first intermediate value, the second intermediate value, the second random addend, and the second random multiplier; The calculation unit is further configured to calculate a first shard based on the second private data, the first intermediate value, and the first random addend, wherein the sum of the first shard and the second shard is equal to the product of the first private data and the second private data.

17. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computing device, the computing device executes the method according to any one of claims 1 to 7 or claims 8 to 14.

18. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 or claims 8 to 14 is implemented.

Images