Data processing method and device based on secret sharing

Abstract

The data processing method and device based on secret sharing provided in the embodiment of the present application performs protocol verification based on the commitment data on the replacement process of the shared data in the secret sharing process to ensure that each computing participant performs replacement processing on the shared data in accordance with the preset inadvertent replacement protocol. At the same time, since the commitment data in the scheme is generated based on multiplication operations, this will reduce the amount of communication required for protocol verification based on the commitment data, and will not bring excessive communication overhead to each computing participant.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of multi-party secure computing technology, and in particular, to a data processing method and device based on secret sharing. Background Art

[0002] With the rapid development of computer technology, data analysis based on big data has provided a guarantee for the development of various fields. Multi-party secure computing is a computing mechanism that can realize multi-party data joint computing without disclosing the input data of any computing participant.

[0003] When multiple computing participants perform multi-party secure computing, each computing participant needs to perform related computing operations according to the preset security protocol. If any computing participant performs related operations and does not perform the calculations according to the operations described in the security protocol, the data security in the multi-party secure computing process cannot be effectively guaranteed. Summary of the invention

[0004] The embodiments of the present application provide a data processing method and device based on secret sharing.

[0005] In a first aspect, the present application provides a data processing method based on secret sharing, the data processing method is applied to a data processing system based on secret sharing, the data processing system includes multiple computing participants; the data processing method includes:

[0006] Using the random sharing parameters generated by each computing participant, multiplication operations are performed on the shared data to be processed in the secret sharing process to obtain the committed data corresponding to the shared data; based on the inadvertent substitution protocol, each computing participant performs synchronous substitution processing on the shared data and the committed data to obtain the substitution results of the shared data and the substitution results of the committed data; using the substitution results of the committed data and the random sharing parameters, protocol verification is performed on the substitution results of the shared data to obtain a first verification result; based on the first verification result, the substitution results of the shared data are output.

[0007] It can be seen that by performing protocol verification on the permutation process of shared data in the secret sharing process, it is ensured that each computing participant performs the relevant processing of secret sharing on the shared data in accordance with the inadvertent permutation protocol. At the same time, since the protocol verification is implemented based on the commitment data generated by multiplication operation in this scheme, the communication volume required for verification is relatively low, which will not bring excessive communication overhead to each computing participant.

[0008] Optionally, the random sharing parameters generated by each computing participant are used to perform multiplication operations on the shared data to be processed in the secret sharing process to obtain commitment data corresponding to the shared data, including: for each sharing value in the shared data, calculating the product of each sharing value and the random sharing parameter to obtain the commitment value corresponding to each sharing value; each commitment value constitutes the commitment data.

[0009] It can be seen that by utilizing multiplication operations to take the product of each shared value in the shared data and the random shared parameter as the commitment data, a linear correspondence is ensured between the commitment data and the shared data, thereby facilitating the subsequent use of the commitment data to perform protocol verification processing on the shared data.

[0010] Optionally, the data processing method further includes: each computing participant generates a replacement vector based on a first preset protocol; the replacement vector is used to synchronously replace the shared data and the committed data.

[0011] It can be known that this data processing method can be specifically applied to the process of inadvertent disposal of shared data in secret sharing. By utilizing the permutation vector generated by the first preset protocol to synchronously permute the shared data and the committed data, the synchronization of data permutation can be ensured, facilitating subsequent protocol verification of the permuted data.

[0012] Optionally, a protocol verification is performed on the permutation result of the shared data using the permutation result of the committed data and the random sharing parameter to obtain a first verification result, including: multiplying the random sharing parameter and the permutation result of the shared data to obtain first multiplication data; performing a difference operation on the first multiplication data and the permutation result of the committed data to obtain first difference data; and based on a second preset protocol, performing zero confirmation processing on the first difference data to obtain a first verification result.

[0013] It can be known that since the commitment data is generated by multiplication of the shared data and the random shared parameters, based on this, when all computing participants use the security protocol to perform permutation operations, the first multiplication operation data obtained by multiplying the permutation result corresponding to the commitment data with the random shared parameters, and the first difference operation data between the permutation result of the shared data should be the result of all zero data, so as to verify whether each computing participant uses malicious security protocols for operations during the calculation process.

[0014] Optionally, the data processing method further includes: performing protocol verification on the shared data using the commitment data and the random sharing parameter to obtain a second verification result; and outputting a replacement result of the shared data based on the first verification result and / or the second verification result.

[0015] Optionally, protocol verification is performed on the shared data using the commitment data and the random sharing parameters to obtain a second verification result, including: multiplying the random sharing parameter and the shared data to obtain second multiplication data; performing a difference operation on the second multiplication data and the commitment data to obtain second difference data; and based on a second preset protocol, performing zero confirmation processing on the second difference data to obtain a second verification result.

[0016] It can be seen that since the entire data processing process involves multiple processing steps, and each processing step involves the use of different preset protocols, based on this, the commitment data corresponding to the shared data to be processed is also verified by protocol to ensure that the commitment data is generated using a secure protocol, further ensuring data security and preventing malicious attacks.

[0017] Optionally, the synchronous permutation processing of shared data and committed data includes: synchronous multiple permutation operations; the data processing method also includes: in the multiple permutation operations performed on the shared data and the committed data, selecting the intermediate result of the shared data and the intermediate result of the committed data obtained by at least one permutation operation; using the intermediate result of the committed data and the random sharing parameters, performing protocol verification on the intermediate result of the shared data to obtain a third verification result; and outputting the permutation result of the shared data based on the first verification result and / or the third verification result.

[0018] Optionally, selecting the intermediate result of the shared data and the intermediate result of the committed data obtained by at least one permutation operation includes: a first intermediate result of the shared data and a first intermediate result of the committed data obtained by performing a first permutation operation on the shared data and the committed data.

[0019] Optionally, a protocol verification is performed on the intermediate result of the shared data using the intermediate result of the committed data and the random sharing parameter to obtain a third verification result, including: multiplying the random sharing parameter and the intermediate result of the shared data to obtain third multiplication operation data; performing a difference operation on the third multiplication operation data and the intermediate result of the committed data to obtain third difference operation data; and based on the second preset protocol, performing zero confirmation processing on the third difference operation data to obtain a third verification result.

[0020] It can be seen that multiple permutation operations are involved in the permutation process. Since each permutation operation calls the relevant protocol once, in order to further ensure data security, the corresponding protocol verification can be performed on the intermediate data generated by any processing in the permutation process to further ensure data security and prevent malicious attacks.

[0021] Optionally, the zero confirmation processing includes: utilizing each random number in the random data generated by each computing participant to perform a product-sum operation on each operation value in the first difference operation data, or the second difference operation data, or the third difference operation data, to obtain a product-sum operation result; and determining a first verification result, or a second verification result, or a third verification result based on the product-sum operation result.

[0022] It can be seen that the embodiment also provides a specific process of zero confirmation processing, through which the processing efficiency of zero confirmation processing can be effectively improved, and the communication volume required for protocol verification can be further reduced.

[0023] Optionally, the data processing of secret sharing is implemented based on a repeated sharing scheme, and the number of computing participants is 3.

[0024] It can be seen that this processing scheme can effectively verify the protocol of the permutation processing in the multi-party secret sharing process, especially has a better verification effect for the three-party secret sharing process.

[0025] In a second aspect, an embodiment of the present application provides an electronic device, including:

[0026] at least one processor; and

[0027] Memory;

[0028] The memory stores computer-executable instructions;

[0029] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method as described in any one of the first aspects.

[0030] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method as described in any one of the first aspects is implemented.

[0031] In a fourth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the method as described in any one of the first aspects.

[0032] The data processing method and device based on secret sharing provided in the embodiment of the present application performs protocol verification based on the commitment data on the replacement process of the shared data in the secret sharing process to ensure that each computing participant performs replacement processing on the shared data in accordance with the preset inadvertent replacement protocol. At the same time, since the commitment data in the scheme is generated based on multiplication operations, this will reduce the amount of communication required for protocol verification based on the commitment data, and will not bring excessive communication overhead to each computing participant. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0034] Figure 1 A schematic diagram of a network architecture on which this application is based;

[0035] Figure 2 A flowchart of a data processing method based on secret sharing provided in an embodiment of the present application;

[0036] Figure 3 It is a data flow diagram of an existing (3,2) repeated sharing scheme;

[0037] Figure 4 A data flow diagram based on a (3,2) repeated sharing scheme provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of a data flow based on a (3,2) repeated sharing scheme provided in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in this application.

[0040] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0041] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0042] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of the information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0043] With the rapid development of computer technology, data analysis based on big data has provided a guarantee for the development of various fields.

[0044] In the field of e-commerce, different merchants, brands and platforms have data of different attributes from different channels. These data can be aggregated together for joint analysis to obtain more comprehensive and accurate analysis results. In order to ensure data security, the data held by merchants, brands and platforms cannot be directly provided to other merchants, brands and platforms. In this case, the use of the above-mentioned MPC will be able to effectively solve the problem of joint data analysis between different merchants, brands and platforms.

[0045] Secure multiparty computation (MPC) is a computing mechanism that can realize the joint calculation of multi-party data without disclosing the input data of any computing participants.

[0046] Specifically, each computing participant agrees on a function to be calculated, and then applies the MPC protocol, inputs the secret share of each person's data into the protocol, and jointly calculates the output of the function without leaking the private input. The function to be calculated specifically refers to the function used in any calculation process included in the joint analysis task, such as the function involved in this application is the function used in the permutation process.

[0047] Figure 1 This is a schematic diagram of a network architecture based on this application, which uses the e-commerce field as an example to illustrate the network architecture. Figure 1 , the network architecture may specifically include data providers and computing participants; wherein, the number of data providers and computing participants are both multiple.

[0048] For example, there are three data providers, which belong to different manufacturers A, B, and C. Each manufacturer holds its own data, and there is no data exchange between manufacturers. Under MPC, each manufacturer will use the protocol to input the data it holds into the protocol to obtain shared data X. However, each manufacturer cannot know the specific content of shared data X.

[0049] Exemplarily, the number of computing participants is 3, including computing participant P1, computing participant P2 and computing participant P3. Each computing participant can be a node device for performing computing tasks, and each node device will perform corresponding protocol operations according to the preset protocol in MPC to complete the joint analysis of shared data X.

[0050] Among them, for each computing participant, by triggering the preset protocol of MPC, each computing participant will obtain the secret share of shared data X, such as computing participant P1 obtains the secret share x1 of shared data, computing participant P2 obtains the secret share x2 of shared data, and computing participant P3 obtains the secret share x3 of shared data. Each computing participant will perform data calculation and data interaction based on the shared data according to the preset protocol to ultimately achieve the joint analysis task.

[0051] It is known that when all computing participants comply with the security protocol to perform computing operations, each computing participant can only know the secret share of the shared data held by it, but cannot know the complete shared data X, which will ensure data security.

[0052] However, in some cases, when a malicious node appears in a computing participant, the computing participant may not perform computing operations according to the predetermined security protocol. This will make it impossible to ensure the security of the private input in the MPC process mentioned above, and the private input is prone to leakage.

[0053] In order to overcome the above problems, the prior art provides a protocol verification scheme based on zero-knowledge proof for MPC to ensure that data security is not leaked during the replacement process. However, when the zero-knowledge proof is used to verify the protocol of each computing participant in this process, and the verification result is obtained that each computing participant has honestly executed the protocol, the confidence of the verification result is only one-half, that is, although the verification is passed, there is still a one-half probability that each computing participant has not honestly executed the protocol, that is, the probability of an error in the verification result is one-half.

[0054] Based on this, in the existing zero-knowledge proof-based protocol verification scheme, in order to obtain a higher confidence verification result, the protocol is often verified by multiple zero-knowledge proofs. In other words, the same protocol can be verified for λ consecutive times, and only when the λ verifications are passed, it is determined that each computing participant has honestly executed the protocol. At this time, the error rate of the verification result is only (1 / 2) to the power of λ.

[0055] Among them, when λ takes a larger value, (1 / 2) to the power of λ is relatively small, and the error rate of the verification result is extremely low, and the confidence of the verification result is high. For example, when λ takes 128, the value of (1 / 2) to the power of λ is close to 0, and the probability of the verification result being false is close to 0. However, the communication volume required to complete the protocol verification of each computing participant will reach O(mλ), which is obviously a large communication volume.

[0056] Based on the above problems, the present application will use the commitment data verification generated by multiplication operation to perform synchronization protocol verification on each computing participant, so as to ensure that each computing participant performs secret sharing inadvertent permutation processing on the shared data according to the preset inadvertent permutation protocol. Different from the verification method based on zero-knowledge proof in the prior art, in order to resist the operation introduced by malicious nodes, the present application only includes the synchronization processing and verification of the commitment data, and the confidence of the verification result of each verification is high, and the error rate of the verification result is close to 0, that is, the present application does not need to adopt the method of verifying the same data continuously for λ times as in the prior art, but only uses the method of verifying the same data once. This will make the communication volume required for each verification of the present application only O(m), and will not bring excessive communication overhead to each computing participant.

[0057] The data processing method and device based on secret sharing provided by the present application are described in detail below through specific embodiments. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0058] It should be noted that the execution subject of the data processing method based on secret sharing provided in this embodiment is the aforementioned data processing system based on secret sharing composed of multiple computing participants. Figure 2 A flow chart of a data processing method based on secret sharing provided in an embodiment of the present application. Figure 2 As shown, the data processing method based on secret sharing may include the following steps:

[0059] Step 201: Use the random sharing parameters generated by each computing participant to perform multiplication operation on the shared data to be processed in the secret sharing process to obtain the commitment data corresponding to the shared data.

[0060] Step 202: Based on the inadvertent replacement protocol, each computing participant performs synchronous replacement processing on the shared data and the committed data to obtain the replacement results of the shared data and the replacement results of the committed data.

[0061] Step 203: Use the replacement result of the commitment data and the random sharing parameter to perform protocol verification on the replacement result of the shared data to obtain a first verification result.

[0062] Step 204: Output the replacement result of the shared data according to the first verification result.

[0063] It can be understood that the data processing method based on secret sharing provided in the embodiment of the present application can be applied to related systems of multi-party secure computing, that is, it can be applied to Figure 1 The network architecture shown.

[0064] The shared data may be any type of data, including but not limited to the user's personal information data, or business data, etc. In some examples, the shared data may also be encrypted data in a ciphertext form.

[0065] The related processing of secret sharing may involve mathematical calculations of different calculation types, such as four arithmetic operations (such as addition, subtraction, multiplication, and division), logical calculations (such as AND, OR, XOR), etc. The implementation method of the present application is applied to the data calculation processing of the calculation type of permutation processing, and performs protocol verification on the processing process involved in the permutation processing.

[0066] As mentioned above, in the existing zero-knowledge proof-based protocol verification scheme, in order to obtain a higher confidence verification result, the protocol is often verified by multiple zero-knowledge proofs. However, the communication volume required to complete the protocol verification of each computing participant will reach O(mλ), which is obviously a large communication volume.

[0067] In the embodiment of the present application, however, zero-knowledge proof will no longer be used to verify the protocol, but commitment data will be used to verify the protocol.

[0068] During the specific verification, the embodiment of the present application will use the random sharing parameters to perform multiplication operations on the shared data to generate the commitment data; then, the shared data and the commitment data are completely synchronously replaced, and finally, the replaced commitment data and the replaced shared data should maintain a multiplication relationship based on the random sharing parameters to perform protocol verification on whether each processing process involved by each computing participant is executed in accordance with the protocol.

[0069] Since the implementation method of the present application uses the commitment data verification generated by multiplication operation to perform synchronization protocol verification on each computing participant, it is ensured that each computing participant performs the relevant processing of secret sharing of shared data in accordance with the preset security protocol. Since the scheme only includes the synchronization processing and verification of the commitment data in order to resist the operation introduced by malicious nodes, the required communication volume is O(m), which is obviously low and will not bring excessive communication overhead to each computing participant.

[0070] In the secret sharing process, this application does not limit the number of computing participants involved in the scheme. In some examples, the data processing of secret sharing provided by this scheme is implemented based on a replicated sharing scheme, and the number of computing participants is 3, that is, the data processing of secret sharing can be applied in a (3, 2) replicated sharing scheme.

[0071] In order to further illustrate the data processing method based on secret sharing provided by the present application, the present application takes the protocol verification of the permutation processing in the repeated sharing scheme (3, 2) as an example to further describe the technical solution provided by the present application.

[0072] Figure 3 Schematic diagram of data flow based on an existing (3,2) repeated sharing scheme.

[0073] like Figure 3 As shown, in the process of permuting the shared data based on the (3,2) repeated sharing scheme, the number of computing participants is 3, which are represented by P1, P2 and P3. As mentioned above, different computing participants can obtain different secret shares in the shared data X provided by the aforementioned data providers.

[0074] It should be noted that in the (3,2) repeated sharing scheme, the data X shared using the protocol will be randomly divided into three parts, represented as [X]1, [X]2 and [X]3. Among them, X = [X]1 + [X]2 + [X]3.

[0075] At the same time, in order to achieve repeated sharing, any computing participant can hold 2 of the 3 shares. As shown in the figure, P1 will hold [X]1 and [X]2, P2 will hold [X]2 and [X]3, and P3 will hold [X]1 and [X]3.

[0076] When performing a permutation process, it is necessary to determine the permutation vector π used in this permutation process. The permutation vector π is a vector used to represent the one-to-one mapping relationship between the domain and the range, which can be specifically composed of an array, such as π=(π1,……,π m ). When the permutation vector π acts on the array N = (N1, ..., N m ), we will get π·N=N'=(N1',……,N m '). Among them, for any i∈{1,……,m}, N i '=N π(i) .

[0077] Similar to the shared data X mentioned above, the permutation vector π will also be randomly divided into 3 parts, and any computing participant can hold 2 of the 3 parts. As shown in the figure, P1 will hold π1 and π2, P2 will hold π2 and π3, and P3 will hold π1 and π3. Among them, π=π1·π2·π 3。

[0078] Subsequently, in order to achieve the replacement processing of the (3,2) repeated sharing scheme, the conversion protocol is first used to convert the shared data X under the (3,2) repeated sharing scheme into the shared data |X| under the (2,2) secret sharing scheme.0 , so as to facilitate subsequent replacement processing.

[0079] The oblivious permutation protocol based on permutation processing needs to use π1, π2 and π3 to perform permutation operations in sequence based on the oblivious permutation protocol to obtain the permuted shared data |X| under (2,2) secret sharing. 3 , at this time, |X| 3 =π1·π2·π3·|X| 0 .

[0080] Finally, the secret share of the shared data of (2, 2) secret sharing |x| 3 Convert back to the shared data [X] of (3,2) secret sharing 3 , [X] 3 Then it is the shared data after the shared data X is replaced, that is, [X] 3 =π·X.

[0081] So far, the [X] obtained by each computing participant 3 The shared data is processed by the permutation vector π, and the operation result can be used by other operations in the joint analysis operation.

[0082] And in Figure 3 Based on the existing permutation processing based on the (3,2) repeated sharing scheme provided, the implementation method of the present application will add the permutation processing for the shared data [X] 3 The acquisition process performs the relevant steps of protocol verification to ensure that the shared data obtained after replacement processing [X] 3 It is obtained by each computing participant executing the preset protocol.

[0083] Specifically, Figure 4 A data flow diagram based on a (3,2) repeated sharing scheme is provided in an embodiment of the present application. Figure 4 As shown, in the process of permuting the shared data based on the (3,2) repeated sharing scheme, the number of participants is calculated to be 3, which are represented by P1, P2 and P3.

[0084] As mentioned above, different computing participants can obtain different secret shares of the shared data X provided by the aforementioned data providers, that is, each computing participant will use the protocol to share data X, which will be randomly divided into 3 parts, represented as [X]1, [X]2 and [X]3. Among them, X = [X]1 + [X]2 + [X]3. At the same time, in order to achieve repeated sharing, any computing participant can hold 2 of the 3 parts, as shown in the figure, P1 will hold [X]1, [X]2, P2 will hold [X]2, [X]3, and P3 will hold [X]1, [X]3.

[0085] certainly, Figure 4 In the illustrated solution, each computing participant still needs to generate a permutation vector π based on the first preset protocol; the permutation vector π is used to perform synchronous permutation processing on the shared data and the subsequently obtained committed data.

[0086] The permutation vector π is a vector used to represent the one-to-one mapping relationship between the domain and the range, which can be specifically composed of an array, such as π=(π1,……,π m ). When the permutation vector π acts on the array N = (N1, ..., N m ), we will get π·N=N'=(N1',……,N m '). Among them, for any i∈{1,……,m}, N i '=N π(i) The permutation vector π will also be randomly divided into 3 parts, and any computing participant can hold 2 of the 3 parts, such as Figure 4 As shown, P1 will hold π1, π2, P2 will hold π2, π3, and P3 will hold π1, π3. Where π = π1·π2·π 3。

[0087] With the aforementioned Figure 3 The difference in the example is that in order to perform protocol verification on the replaced shared data, such as Figure 4 As shown, each computing participant will also generate commitment data Y.

[0088] Specifically, in an optional implementation, the commitment data Y can be called by each computing participant to perform the protocol operator F mult The random sharing parameter a can be multiplied by the shared data X by each computing participant by calling the operator F in the protocol. rand to generate.

[0089] Specifically, when generating the commitment data Y, each computing participant can, based on the protocol, generate a value [x i ], such as (x1,…,x m ), calculate the product of each share value and the random share parameter a, such as (ax1,…ax m ), the product of each shared value obtained [ax i ] will be used as the commitment value of each [y i ], forming the commitment data Y; that is, the commitment data Y can be expressed as (y1,…y m )=(ax1,…ax m ), that is, Y=aX.

[0090] After the above processing, at this time, P1 will hold the secret shares [X]1 and [X]2 of the shared data, the secret shares π1 and π2 of the permutation vectors, and the secret shares [Y]1 and [Y]2 of the committed data; P2 will hold the secret shares [X]2 and [X]3 of the shared data, the secret shares π2 and π3 of the permutation vectors, and the secret shares [Y]2 and [Y]3 of the committed data; P3 will hold the secret shares [X]1 and [X]3 of the shared data, the secret shares π1 and π3 of the permutation vectors, and the secret shares [Y]1 and [Y]3 of the committed data.

[0091] It should be noted that the shared data X is composed of an m-dimensional array, that is, X consists of ([x1], …[x m ]); and any secret share of shared data X [X] i Each shared value in the shared data should be included in [x i ] corresponds to the partial data, such as [X]1 is composed of ([x1]1, …[x m ]1), [X]2 is composed of ([x1]2, …[x m ]2), [X]3 is composed of ([x1]3, …[x m ]3) where [x1] = [x1]1 + [x1]2 + [x1]3, and accordingly, [x i ]=[x i ]1+[x i ]2+[x i ]3.

[0092] The same is true for the commitment data Y, which is also composed of an m-dimensional array, that is, Y consists of ([y1], …[y m ]); and any secret share of the commitment data Y [Y] i Each commitment value in the commitment data [y i ] corresponds to the partial data, such as [Y]1 is composed of ([y1]1,…[y m ]1), [Y]2 is composed of ([y1]2, …[y m ]2), [Y]3 is composed of ([y1]3, …[y m ]3) is composed of, where [y1] = [y1]1 + [y1]2 + [y1]3, and accordingly, [y i ]=[y i ]1+[y i ]2+[y i ]3.

[0093] Based on the above description, we can know that the shared values ​​of shared data X [x i ] and the corresponding commitment value [y i] have a linear relationship, while there is no corresponding relationship between the secret shares of the shared data held by the computing participant Pi and the secret shares of the committed data. For example, there is no correlation between the secret shares of the shared data [X]1 and [X]2 held by P1 and the secret shares of the committed data [Y]1 and [Y]2 held by it. It is precisely by utilizing this feature that the committed data can ensure that each computing participant cannot obtain the complete shared data and committed data, and on the other hand, the linear relationship can be used to verify the protocol of the replacement processing of the shared data.

[0094] Specifically, in order to achieve the replacement processing of the (3,2) repeated sharing scheme, the conversion protocol is first used to convert the shared data X under the (3,2) repeated sharing scheme into the shared data |X| under the (2,2) secret sharing scheme. 0 , synchronously, convert the commitment data Y under the (3,2) repeated sharing scheme into the commitment data |Y| under the (2,2) secret sharing scheme. 0 . Among them, |X| 0 The array in will include X, |Y| 0 The array in will include Y.

[0095] like Figure 4 As shown, after converting the (3,2) repeated sharing scheme to the (2,2) secret sharing scheme (taking P1 and P3 as examples), P1 will hold the secret share of the shared data under the (2,2) secret sharing scheme |x1| 0 and the secret share of the commitment data |y1| 0 ; P3 will hold the secret share of the shared data under the (2,2) secret sharing scheme |x3| 0 and the secret share of the commitment data |y3| 0 .in,

[0096] |X| 0 =|x1| 0 +|x3| 0 , and |Y| 0 =|y1| 0 +|y3| 0 .

[0097] After completing the protocol conversion, each computing participant needs to use π1, π2 and π3 to perform synchronous permutation operations on the shared data X and the committed data Y based on the oblivious permutation protocol, and obtain the permuted shared data |X| under (2,2) secret sharing. 3 and |Y| 3 , at this time, |X| 3 =π1·π2·π3·|X| 0 , and |Y| 3=π1·π2·π3·|Y| 0 .

[0098] Specifically, if Figure 4 As shown, since both P1 and P3 hold the secret share π1 of the permutation vector, at this time, P1 will use its own π1 to permute its |x1| 0 and |y1| 0 Perform a synchronous permutation operation and get |x1| 1 and |y1| 1 ; synchronously, P3 will use its own π1 to its |x3| 0 and |y3| 0 Perform a synchronous permutation operation and get |x3| 1 and |y3| 1 .

[0099] At this time, |X| 1 =|x1| 1 +|x3| 1 , where |x1| 1 =π1·|x1| 0 ,|x3| 1 =π1·|x3| 0 , then |X| 1 =π1·|X| 0 ;

[0100] At the same time, |Y| 1 =|y1| 1 +|y3| 1 , where |y1| 1 =π1·|y1| 0 ,|y3| 1 =π1·|y3| 0 , then |Y| 1 =π1·|Y| 0 .

[0101] After completing the permutation operation using π1, the permutation operation using π2 will be continued. For the permutation operation of π2, it needs to be performed by P1 and P2 holding π2, that is, P3 needs to send the secret share it holds to P2.

[0102] In order to prevent P2 from knowing the specific content of the secret share π1 of the permutation vector held by P3, before performing the permutation operation of π2, a protocol will be triggered to perform |x1| 1 and |x3| 1 Perform a re-randomization process and change |y1| 1 and |y3| 1A synchronous re-randomization process is also performed to redistribute the secret shares currently held by P1 and P3. After this re-randomization process, P1 will hold |x1| 1 'and |y1| 1 ', and P3 will hold |x3| 1 'and |y3| 1 '.

[0103] At this point, we know that |x1| 1 '+|x3| 1 '=|x1| 1 +|x3| 1 , and,|y1| 1 '+|y3| 1 '=|y1| 1 +|y3| 1 ; then, |X| 1 =|x1| 1 '+|x3| 1 '=π1·|X| 0 , and |Y| 1 =|y1| 1 '+|y3| 1 '=π1·|Y| 0 .

[0104] That is to say, after this re-randomization process, the secret shares obtained by each computing participant Pi will change. When the secret shares after the re-randomization process are used for exchange, the permutation vector will not be easy to be reverse solved.

[0105] That is to say, at this time, P3 can change its current |x3| 1 'and |y3| 1 'When sent to P2, P2 will not be able to decipher the specific content of π1 used by P3. At the same time, the |x3| 1 'and |y3| 1 'Will be held by P2 as |x2| 1 and |y2| 1 , to participate in subsequent operations.

[0106] Still see Figure 4 , for the secret share π2 of the permutation vector, it is only held by P1 and P2. At this time, P1 will use its own π2 to its |x1| 1 'and |y1| 1 'Perform a synchronous permutation operation to obtain |x1| 2 and |y1| 2 , synchronously, P2 will use its own π2 to its |x2| 1 and |y2|1 Perform a synchronous permutation operation and get |x2| 2 and |y2| 2 .

[0107] At this time, |X| 2 =|x1| 2 +|x2| 2 , where |x1| 2 =π2·|x1| 1 ',|x2| 1 =π2·|x2| 1 =π2·|x3| 1 ', then |X| 2 =π2·|X| 1 ;

[0108] At the same time, |Y| 2 =|y1| 2 +|y2| 2 , where |y1| 2 =π2·|y1| 1 ',|y2| 1 =π2·|y2| 1 =

[0109] π2·|y3| 1 ', then |Y| 2 =π2·|Y| 1 .

[0110] After completing the permutation operation using π2, the permutation operation using π3 will be continued. For the permutation operation of π3, it needs to be performed by P2 and P3 holding π3, that is, P1 needs to send the secret share it holds to P3.

[0111] In order to prevent P3 from knowing the specific content of the secret share π2 of the permutation vector held by P1, before performing the permutation operation of π3, a protocol will be triggered to perform |x1| 2 +|x2| 2 Perform a re-randomization process and at the same time, |y1| 2 and |y2| 2 A re-randomization process is also performed to redistribute the secret shares currently held by P1 and P2. After this re-randomization process, P1 will hold |x1| 2 'and |y1| 2 ', and P2 will hold |x2| 2 'and |y2| 2 '.

[0112] At this point, we know that |x1| 2'+|x2| 2 '=|x1| 2 +|x2| 2 , and,|y1| 2 '+|y2| 2 '=|y1| 2 +|y2| 2 ; then, |X| 2 =|x1| 2 '+|x2| 2 '=π2·|X| 1 =π2·π1·|X| 0 , and,|Y| 2 =|y1| 2 '+|y2| 2 '=π2·|Y| 1 =π2·π1·|Y| 0 That is to say, after this re-randomization process, the secret shares obtained by each computing participant Pi will change. When the secret shares after the re-randomization process are used for exchange, the permutation vector will not be easy to be reverse solved.

[0113] That is to say, at this time, P1 can change its current |x1| 2 'and |y1| 2 'When sent to P3, P3 will not be able to decipher the specific content of π2 used by P1. At the same time, the |x1| 2 'and |y1| 2 'Will be held by P3 as |x3| 2 and |y3| 2 , to participate in subsequent operations.

[0114] Continue to see Figure 4 , for the secret share π3 of the permutation vector, it is only held by P2 and P3. At this time, P2 will use its own π3 to its |x2| 2 'and |y2| 2 'Perform a synchronous permutation operation to obtain |x2| 3 and |y2| 3 , synchronously, P3 will use its own π3 to its |x3| 2 and |y3| 2 Perform a synchronous permutation operation and get |x3| 3 and |y3| 3 .

[0115] At this time, |X| 3 =|x2| 3 +|x3| 3 , where |x2| 3=π3·|x2| 2 ',|x3| 3 =π3·|x3| 2 =π3·|x1| 2 ', then |X| 3 =π3·|X| 2 =π3·π2·π1·|X| 0 ;

[0116] At the same time, |Y| 3 =|y2| 3 +|y3| 3 , where |y2| 3 =π3·|y2| 2 ',|y3| 3 =π3·|y3| 2 =

[0117] π3·|y1| 2 ', then |Y| 3 =π3·|Y| 2 =π3·π2·π1·|Y| 0 .

[0118] After completing the above three permutation operations, by triggering the protocol, each computing participant will share the secret data |X| of (2, 2). 3 and |Y| 3 Reconvert back to the (3,2) secret shared data [X] 3 and [Y] 3 At this time, the shared data after replacement processing will be obtained [X] 3 , where [X] 3 =π·X; at the same time, we will also get the commitment data after replacement processing [Y] 3 , where [Y] 3 =π·Y.

[0119] The shared data obtained after the replacement process [X] 3 It is not verified by the protocol.

[0120] Afterwards, each computing participant will use the replacement result of the committed data and the random sharing parameter to perform protocol verification on the replacement result of the shared data, obtain a first verification result, and output the replacement result of the shared data based on the first verification result.

[0121] Specifically, when each computing participant performs the corresponding operation according to the protocol during the above-mentioned operation process, the current [X] 3 Should be an m-dimensional array ([x1] 3 ,…[x m ]3 ) is composed of data, and at the same time, for each value [x i ] 3 , both have [x i ] 3 =π·x i And, the current [Y] 3 The same should be done by an m-dimensional array ([y1] 3 ,…[y m ] 3 ) is composed of data, and at the same time, for each value [y i ] 3 , both have [y i ] 3 =π·y i relationship.

[0122] And because y i With x i There is y between i =ax i The linear relationship between i =π·ax i The linear relationship between a[x i ] 3 -[y i ] 3 =0.

[0123] That is to say, when each computing participant performs the corresponding operation in accordance with the agreement during the above-mentioned operation process, [Y] 3 and a[X] 3 The difference data M1 between them should be data consisting of m zeros.

[0124] By using this feature, it is possible to verify whether each computing participant in the above computing process performs the corresponding operation in accordance with the protocol:

[0125] By replacing the random sharing parameter a with the shared data [X] 3 Perform multiplication operation to obtain the first multiplication data a[X] 3 Then, the first multiplication data a[X] is 3 The replacement result with the promised data [Y] 3 A difference operation is performed to obtain first difference operation data M1; based on the second preset protocol, each computing participant will perform zero confirmation processing on the first difference operation data M1 to obtain a first verification result.

[0126] The zero confirmation processing refers to the processing of each element m in the first difference operation data M1. 1iSince the first difference operation data M1 is an m-dimensional array, when the value of m is large, in order to improve the processing efficiency of the zero confirmation processing, in an optional implementation, a random number-based method can be used to implement the zero confirmation processing. Specifically, the random numbers in the random data [Z1] generated by each computing participant are used, such as (z 11 ,…,z 1m ), for each operation value (m 11 ,…m 1m ), perform product sum operation, and obtain the product sum operation result, such as z 11 m 11 +z 12 m 12 …+z 1m m 1m = F1; determine the first verification result according to the product sum operation result F1. Generally, when F1 is 0, each element m in the first difference operation data M1 1i are all 0; when F1 is not 0, any element m in the first difference operation data M1 1i Not 0.

[0127] In other words, if the first verification result obtained by the zero confirmation processing indicates that the first difference operation data M1 is not data composed of 0, it means that a computing participant in the protocol processing process does not process the shared data according to the preset security protocol, and the data in the protocol process has the risk of data leakage. At this time, the protocol will be terminated and the replacement result will not be output;

[0128] If the first verification result obtained by the zero processing indicates that the first difference operation data M1 is data composed entirely of 0s, it means that each computing participant in the protocol processing process processes the shared data according to the preset security protocol, then there is no risk of data leakage in the data during the protocol process. At this time, the protocol will be authenticated as valid, and the replacement result of the shared data can be used for output.

[0129] Through the above-mentioned method, the commitment data verification generated by the multiplication operation can be used to perform synchronization protocol verification on each computing participant, thereby ensuring that each computing participant performs relevant processing of secret sharing of shared data in accordance with the preset security protocol.

[0130] It is understandable that, in order to ensure the security of data, the random sharing parameter a is also stored in each computing participant in the form of a secret share of secret sharing. When the permutation result of the shared data needs to be verified by the protocol, in order to facilitate the calculation, each computing participant will trigger the protocol to make the random sharing parameter a public. At this time, each computing participant will obtain the complete random sharing parameter a in order to perform subsequent protocol verification processing, which is conducive to improving processing efficiency.

[0131] Figure 5 Another data flow diagram based on the (3,2) repeated sharing scheme provided in the embodiment of the present application. In actual scenarios, malicious computing participants can attack the protocol at different processing stages. For example, the attack can occur at the generation stage of the commitment data, that is, the malicious computing participant can attack the protocol operator F mult Increase the selected constant to change the commitment data Y and the commitment values ​​therein.

[0132] In an alternative embodiment, if Figure 5 As shown, the protocol verification can be performed on the committed data to ensure that each computing participant honestly executes the protocol. The data processing method also includes: using the committed data and random sharing parameters to perform protocol verification on the shared data to obtain a second verification result; based on the first verification result and / or the second verification result, outputting the replacement result of the shared data.

[0133] Specifically, each computing participant follows the protocol operator F mult Generate a random sharing parameter a and use the protocol operator F rand When generating the commitment data Y, the current commitment data Y should be composed of an m-dimensional array (y1,…y m ), and for each commitment value y i , both have y i =ax i , where x i is the shared value x that constitutes the shared data X i .

[0134] And because y i With x i There is y between i =ax i The linear relationship between i -y i =0.

[0135] That is to say, when in the above processing, each computing participant performs the corresponding operation according to the protocol, the difference data M2 between Y and aX should be data composed of m zeros.

[0136] By using this feature, it is possible to verify whether each computing participant in the above computing process performs the corresponding operation in accordance with the protocol:

[0137] By multiplying the random sharing parameter a and the shared data X, a second multiplication data aX is obtained; a difference operation is performed on the second multiplication data aX and the commitment data Y to obtain a second difference operation data M2; based on the second preset protocol, the second difference operation data M2 is processed to confirm zero to obtain a second verification result.

[0138] The process of performing zero confirmation processing on the second difference operation data M2 is similar to the process of performing zero confirmation processing on the first difference operation M1. 2i The process of judging whether they are all 0.

[0139] Since the second difference operation data M2 is an m-dimensional array, when the value of m is large, in order to improve the processing efficiency of the zero confirmation processing, in an optional implementation, a random number-based method can be used to implement the zero confirmation processing. Specifically, the random numbers in the random data [Z2] generated by each computing participant are used, such as (z 21 ,…,z 2m ), for each operation value (m 21 ,…m 2m ), perform product sum operation, and obtain the product sum operation result, such as z 21 m 21 +z 22 m 22 …+z 2m m 2m = F2; determine the second verification result according to the product sum operation result F2. Generally, when F2 is 0, each element m in the second difference operation data M2 2i are all 0; when F2 is not 0, any element m in the second difference operation data M2 2i Not 0.

[0140] In other words, if the second verification result obtained by the zero confirmation processing indicates that the second difference operation data M2 is not data composed of 0, it means that there is a computing participant in the protocol processing process who does not process the shared data according to the preset security protocol, then there is a risk of data leakage in the data in the protocol process. At this time, the protocol will be terminated and the replacement result will not be output.

[0141] It can be known that the steps of performing protocol verification on the replacement result of shared data to obtain a first verification result and performing protocol verification on the shared data to obtain a second verification result can be performed synchronously or asynchronously. When any verification result indicates that a computing participant does not process the shared data in accordance with the preset security protocol, the protocol will be terminated and the replacement result will not be output.

[0142] Based on the above implementation methods, malicious computing participants can also be in the permutation processing stage. In the multi-party secure computing based on secret sharing, the permutation processing process is based on multiple permutation operations. Any permutation operation is at risk of being attacked. In order to further ensure data security, see Figure 5 , the corresponding protocol verification can be performed on the intermediate data generated by any permutation operation in the permutation process to prevent malicious attacks.

[0143] That is, the synchronous permutation processing performed on the shared data X and the committed data Y includes multiple synchronous permutation operations. Among the multiple permutation operations performed on the shared data X and the committed data Y, an intermediate result of the shared data and an intermediate result of the committed data obtained by at least one permutation operation are selected; the intermediate result of the committed data and the random sharing parameter are used to perform protocol verification on the intermediate result of the shared data to obtain a third verification result; and the permutation result of the shared data is output according to the first verification result and / or the third verification result.

[0144] In a possible implementation, the protocol verification may be performed on the intermediate result obtained by the first permutation operation. That is, the intermediate result may be the first intermediate result of the shared data and the first intermediate result of the committed data obtained by performing the first permutation operation on the shared data and the committed data.

[0145] As mentioned above Figure 4 Taking the processing process shown in the figure as an example, the first intermediate result of the shared data X obtained by performing the first permutation operation on the shared data X and the committed data Y can be expressed as [X] 1 and the first intermediate result of the commitment data Y [Y] 1 .

[0146] Specifically, after the first permutation operation, the first intermediate data |X| of the shared data X will be obtained. 1 and the first intermediate data of the commitment data |Y| 1 , through each computing participant triggering the protocol, the first intermediate data |X| of the secret sharing of (2, 2) is 1 and |Y| 1 Reconvert back to the first intermediate result of the secret sharing of (3,2) [X] 1 and [Y] 1 .

[0147] At this time, the first intermediate result of the shared data currently obtained is [X] 1 From the m-dimensional array (π1·x1,…π1·x m ) constitutes the first intermediate result of the currently obtained commitment data [Y] 1 From the m-dimensional array (π1·y1,…π1·y m ) is composed. At the same time, due to y i With x i There is y between i =ax i The linear relationship between aπ1·x and π1·x can be deduced. i -π1·y i = 0. Then we get [Y] 1 =a[X] 1 .

[0148] That is to say, when each computing participant performs the corresponding operation according to the agreement during the above process, [Y] 1 and a[X] 1 The difference data M3 between them should be data consisting of m zeros.

[0149] By using this feature, it is possible to verify whether each computing participant in the above computing process performs the corresponding operation in accordance with the protocol:

[0150] By randomly sharing the parameter a and the intermediate result of the shared data [X] 1 Perform multiplication operation to obtain the third multiplication data a[X] 1 ; For the third multiplication data a[X] 1 Intermediate result with promised data [Y] 1 Perform a difference operation to obtain third difference operation data M3; based on the second preset protocol, perform zero confirmation processing on the second and third difference operation data M3 to obtain a third verification result.

[0151] The process of performing zero confirmation processing on the third difference operation data M3 is similar to the process of performing zero confirmation processing on the first difference operation M1 or the second difference operation M3. 3i The process of judging whether they are all 0.

[0152] Since the third difference operation data M3 is an m-dimensional array, when the value of m is large, in order to improve the processing efficiency of the zero confirmation processing, in an optional implementation, a random number-based method can be used to implement the zero confirmation processing. Specifically, the random numbers in the random data [Z3] generated by each computing participant are used, such as (z 31 ,…,z 3m), for each operation value (m 31 ,…m 3m ), perform product sum operation, and obtain the product sum operation result, such as z 31 m 31 +z 32 m 32 …+z 3m m 3m = F3; determine the third verification result according to the product sum operation result F3. Generally, when F3 is 0, each element m in the third difference operation data M3 3i are all 0; when F3 is not 0, any element m in the third difference operation data M3 3i Not 0.

[0153] In other words, if the third verification result obtained by the zero confirmation processing indicates that the third difference operation data M2 is not data composed of 0, it means that there is a computing participant in the protocol processing process who does not process the shared data according to the preset security protocol, then there is a risk of data leakage in the data in the protocol process. At this time, the protocol will be terminated and the replacement result will not be output.

[0154] It can be known that the steps of performing protocol verification on the replacement result of shared data to obtain a first verification result, performing protocol verification on the shared data to obtain a second verification result, and performing protocol verification on the intermediate result of shared data to obtain a third verification result can be performed synchronously or asynchronously. When any verification result indicates that a computing participant does not process the shared data in accordance with the preset security protocol, the protocol will be terminated and the replacement result will not be output.

[0155] The data processing method based on secret sharing provided in the embodiment of the present application performs protocol verification based on the commitment data on the replacement process of the shared data in the secret sharing process to ensure that each computing participant performs replacement processing on the shared data in accordance with the preset inadvertent replacement protocol. At the same time, since the commitment data in this scheme is generated based on multiplication operations, this will reduce the amount of communication required for protocol verification based on the commitment data, and will not bring excessive communication overhead to each computing participant.

[0156] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in this application, such as Figure 6 As shown, the embodiment of the present application provides an electronic device, the memory of the electronic device can be used to store at least one program instruction, and the processor is used to execute at least one program instruction to implement the technical solution of the above method embodiment. Its implementation principle and technical effect are similar to those of the above method related embodiments, and will not be repeated here.

[0157] In actual application scenarios, Figure 6 The electronic device shown can specifically be a carrier device of any computing participant in a data processing system based on secret sharing. Each of the electronic devices will perform corresponding data processing according to the data processing method shown above to complete multi-party secure computing based on secret sharing.

[0158] The embodiment of the present application provides a chip. The chip includes a processor, and the processor is used to call a computer program in a memory to execute the technical solution in the above embodiment. Its implementation principle and technical effect are similar to those of the above related embodiments, and will not be repeated here.

[0159] The embodiment of the present application provides a computer program product, when the computer program product is run on an electronic device, the electronic device executes the technical solution in the above embodiment. Its implementation principle and technical effect are similar to those of the above related embodiments, and will not be repeated here.

[0160] The embodiment of the present application provides a computer-readable storage medium on which program instructions are stored. When the program instructions are executed by an electronic device, the electronic device executes the technical solution of the above embodiment. Its implementation principle and technical effect are similar to those of the above related embodiments, and will not be repeated here.

[0161] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above are only specific implementation methods of the present application and are not used to limit the protection scope of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. A data processing method based on secret sharing, characterized in that: The data processing method is applied to a data processing system based on secret sharing, wherein the data processing system includes a plurality of computing participants; The data processing method comprises: Using the random sharing parameters generated by each computing participant, multiply the shared data to be processed in the secret sharing process to obtain the commitment data corresponding to the shared data; Based on the inadvertent replacement protocol, each computing participant performs synchronous replacement processing on the shared data and the committed data to obtain a replacement result of the shared data and a replacement result of the committed data; Performing a multiplication operation on the replacement result of the random sharing parameter and the sharing data to obtain first multiplication operation data; Performing a difference operation on a replacement result of the first multiplication operation data and the commitment data to obtain first difference operation data; Based on a second preset protocol, the first difference operation data is processed to confirm zero, and a first verification result is obtained; the zero confirmation processing is to use each random number in the random data generated by each computing participant to perform a product sum operation on the first difference operation data; Outputting a replacement result of the shared data according to the first verification result; The random sharing parameters generated by various computing participants are used to perform multiplication operations on the shared data to be processed in the secret sharing process to obtain commitment data corresponding to the shared data, including: for each sharing value in the shared data, calculating the product of each sharing value and the random sharing parameter to obtain the commitment value corresponding to each sharing value; each commitment value constitutes the commitment data.

2. The data processing method according to claim 1, characterized in that: Also includes: Each computing participant generates a permutation vector based on a first preset protocol; The replacement vector is used to perform synchronous replacement processing on the shared data and the committed data.

3. The data processing method according to claim 1, characterized in that: Also includes: Using the commitment data and the random sharing parameter, performing protocol verification on the shared data to obtain a second verification result; According to the first verification result and / or the second verification result, a replacement result of the shared data is output.

4. The data processing method according to claim 3, characterized in that: The using the commitment data and the random sharing parameter to perform protocol verification on the shared data to obtain a second verification result includes: Performing a multiplication operation on the random sharing parameter and the sharing data to obtain second multiplication operation data; performing a difference operation on the second multiplication operation data and the commitment data to obtain second difference operation data; Based on a second preset protocol, the second difference operation data is processed to confirm zero to obtain the second verification result; the zero confirmation processing is to use each random number in the random data generated by each calculation participant to perform a product sum operation on the second difference operation data.

5. The data processing method according to claim 1, characterized in that: The synchronous replacement processing performed on the shared data and the committed data includes: synchronous multiple replacement operations; The data processing method further includes: Among multiple permutation operations performed on the shared data and the committed data, selecting an intermediate result of the shared data and an intermediate result of the committed data obtained by at least one permutation operation; Using the intermediate result of the commitment data and the random sharing parameter, performing protocol verification on the intermediate result of the shared data to obtain a third verification result; According to the first verification result and / or the third verification result, a replacement result of the shared data is output.

6. The data processing method according to claim 5, characterized in that: The intermediate result of the shared data and the intermediate result of the committed data obtained by selecting at least one permutation operation include: a first intermediate result of the shared data and the first intermediate result of the committed data obtained by performing a first permutation operation on the shared data and the committed data.

7. The data processing method according to claim 5, characterized in that: The using the intermediate result of the commitment data and the random sharing parameter to perform protocol verification on the intermediate result of the sharing data to obtain a third verification result includes: Performing a multiplication operation on the random sharing parameter and an intermediate result of the sharing data to obtain third multiplication operation data; Performing a difference operation on the third multiplication operation data and an intermediate result of the commitment data to obtain third difference operation data; Based on the second preset protocol, the third difference operation data is processed to confirm zero to obtain the third verification result, and the zero confirmation processing is to use each random number in the random data generated by each calculation participant to perform a product sum operation on each operation value in the third difference operation data.

8. The data processing method according to any one of claims 1 to 7, characterized in that: The data processing of the secret sharing is implemented based on a repeated sharing scheme, and the number of the calculation participants is 3.

9. An electronic device, characterized in that: include: at least one processor; as well as Memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 8 is implemented.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images