multi-party secure division

Abstract

Embodiments of the specification disclose a multi-party secure division, involving n parties, n being a positive integer not less than 3, each party holding a local share of a dividend and a local share of a divisor. Any computing party can obtain a local share of an absolute value of a quotient based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor, in cooperation with the remaining n-1 parties through one or more rounds of processing. Further, the any computing party can obtain a local share of the quotient based on the local share of the absolute value of the quotient, a local share of a sign identifier of the dividend and a local share of a sign identifier of the divisor, in cooperation with the remaining n-1 parties.

Description

TECHNICAL FIELD

[0001] The specification relates to the technical field of information security, and particularly relates to a multi-party secure division. BACKGROUND

[0002] In the big data era, the application of machine learning is increasingly widespread. Although machine learning models can provide convenient prediction services for users, the training and / or prediction of machine learning models in plaintext has the risk of exposing private data.

[0003] Implementing a machine learning framework in a ciphertext state, i.e., implementing a secure machine learning framework, requires providing a perfect underlying protocol. SUMMARY

[0004] One of the embodiments of the specification provides a multi-party secure multiplication, involving n parties, n being a positive integer not less than 3, each party holding a shard of a first multiplier and a shard of a second multiplier, the multiplication being performed by one of the parties, comprising: transmitting a local shard of the first multiplier and a local shard of the second multiplier to the remaining one party or the remaining multiple parties; obtaining other shards of the first multiplier and other shards of the second multiplier from the remaining one party or the remaining multiple parties, wherein the number of the remaining multiple parties is not greater than n-2; multiplying the local shard of the first multiplier and the local shard of the second multiplier to obtain a local product term; multiplying the local shard of the first multiplier and other shards of the second multiplier respectively to obtain one or more first cross terms; multiplying the local shard of the second multiplier and other shards of the first multiplier respectively to obtain one or more second cross terms; and obtaining a local shard of the product of the first multiplier and the second multiplier based on the local product term, the one or more first cross terms, and the one or more second cross terms.

[0005] One of the embodiments of the present specification provides a multi-party secure multiplication system, involving n parties, n is a positive integer not less than 3, each party holds a fragment of a first multiplier and a fragment of a second multiplier, the system is implemented in one of the parties, and the system comprises a multiplier fragment sending module, a multiplier fragment receiving module, a local product item calculation module, a first cross item calculation module, a second cross item calculation module and a product fragment calculation module. The multiplier fragment sending module is configured to send the local fragment of the first multiplier and the local fragment of the second multiplier to the remaining one party or the remaining multiple parties. The multiplier fragment receiving module is configured to receive other fragments of the first multiplier and other fragments of the second multiplier from the remaining one party or the remaining multiple parties. Wherein, the number of the remaining multiple parties is not more than n-2. The local product item calculation module is configured to multiply the local fragment of the first multiplier and the local fragment of the second multiplier to obtain a local product item. The first cross item calculation module is configured to multiply the local fragment of the first multiplier and other fragments of the second multiplier respectively to obtain one or more first cross items. The second cross item calculation module is configured to multiply the local fragment of the second multiplier and other fragments of the first multiplier respectively to obtain one or more second cross items. The product fragment calculation module is configured to obtain the local fragment of the product of the first multiplier and the second multiplier based on the local product item, the one or more first cross items and the one or more second cross items.

[0006] One of the embodiments of the present specification provides a multi-party secure multiplication device, comprising a processor and a storage device, the storage device is configured to store instructions, wherein when the processor executes the instructions, the multi-party secure multiplication as described in any embodiment of the present specification is implemented.

[0007] One of the embodiments of the present specification provides a multi-party secure comparison method, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number and a shard of a second number, the method is executed by one of the parties, comprising: obtaining a local shard of a first selected random number, a local shard of a second selected random number and a local shard of a mask random number; the first selected random number is related to the second selected random number; obtaining a local shard of a first comparison function, the first comparison function reflects the difference between the first number and the second number; obtaining a local shard of a second comparison function, the second comparison function reflects the difference between the second number and the first number; based on the local shard of the first selected random number and the local shard of the first comparison function, cooperate with the remaining n-1 parties, obtain the local shard of the first product of the first selected random number and the first comparison function through the multi-party secure multiplication as described in any embodiment of the present specification; based on the local shard of the second selected random number and the local shard of the second comparison function, cooperate with the remaining n-1 parties, obtain the local shard of the second product of the second selected random number and the second comparison function through the multi-party secure multiplication as described in any embodiment of the present specification; based on the local shard of the first product and the local shard of the second product, obtain the local shard of the target difference value; based on the local shard of the target difference value and the local shard of the mask random number, cooperate with the remaining n-1 parties, obtain the local shard of the intermediate product through the multi-party secure multiplication as described in any embodiment of the present specification, the intermediate product is equal to the product of the target difference value and the mask random number; based on the local shard of the intermediate product, cooperate with the remaining n-1 parties to reveal the intermediate product; when the intermediate product is greater than 0, based on the local shard of the first selected random number and the local shard of the second preset value, cooperate with the remaining n-1 parties to obtain the local shard of the exclusive or result of the first selected random number and the second preset value, and take it as the local shard of the result identifier; otherwise, based on the local shard of the first selected random number and the local shard of the first preset value, cooperate with the remaining n-1 parties to obtain the local shard of the exclusive or result of the first selected random number and the first preset value, and take it as the local shard of the result identifier. The first preset value is equal to 1, the second preset value is equal to 0, when the result identifier is equal to 1, it indicates that the first number is not less than the second number, when the result identifier is equal to 0, it indicates that the first number is less than the second number.

[0008] One of the embodiments of the present specification provides a multi-party secure comparison system, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number and a shard of a second number, the system is implemented in one of the parties, comprising a random number shard acquisition module, a first comparison function shard acquisition module, a second comparison function shard acquisition module, a first product calculation module, a second product calculation module, a target difference calculation module, an intermediate product calculation module, an intermediate product exposure module and a result identifier calculation module. The random number shard acquisition module is used to obtain a local shard of a first selected random number, a local shard of a second selected random number and a local shard of a mask random number, the first selected random number is related to the second selected random number. The first comparison function shard acquisition module is used to obtain a local shard of a first comparison function, the first comparison function reflects the difference between the first number and the second number. The second comparison function shard acquisition module is used to obtain a local shard of a second comparison function, the second comparison function reflects the difference between the second number and the first number. The first product calculation module is used to obtain a local shard of a first product of the first selected random number and the first comparison function based on the local shard of the first selected random number and the local shard of the first comparison function, in cooperation with the remaining n-1 parties, through the multi-party secure multiplication as described in any embodiment of the present specification. The second product calculation module is used to obtain a local shard of a second product of the second selected random number and the second comparison function based on the local shard of the second selected random number and the local shard of the second comparison function, in cooperation with the remaining n-1 parties, through the multi-party secure multiplication as described in any embodiment of the present specification. The target difference calculation module is used to obtain a local shard of a target difference based on the local shard of the first product and the local shard of the second product. The intermediate product calculation module is used to obtain a local shard of an intermediate product based on the local shard of the target difference and the local shard of the mask random number, in cooperation with the remaining n-1 parties, through the multi-party secure multiplication as described in any embodiment of the present specification, the intermediate product is equal to the product of the target difference and the mask random number. The intermediate product exposure module is used to expose the intermediate product based on the local shard of the intermediate product, in cooperation with the remaining n-1 parties. The result identifier calculation module is used to: when the intermediate product is greater than 0, obtain a local shard of the exclusive or result of the first selected random number and a second preset value based on the local shard of the first selected random number and the local shard of the second preset value, in cooperation with the remaining n-1 parties, and take it as a local shard of a result identifier; otherwise, obtain a local shard of the exclusive or result of the first selected random number and a first preset value based on the local shard of the first selected random number and the local shard of the first preset value, in cooperation with the remaining n-1 parties, and take it as a local shard of a result identifier. The first preset value is equal to 1, the second preset value is equal to 0, when the result identifier is equal to 1, it indicates that the first number is not less than the second number, when the result identifier is equal to 0, it indicates that the first number is less than the second number.

[0009] One of the embodiments of the present specification provides a multi-party secure comparison device, comprising a processor and a storage device for storing instructions, wherein when the processor executes the instructions, the multi-party secure comparison method as described in any embodiment of the present specification is implemented.

[0010] One of the embodiments of the present specification provides a multi-party secure natural exponential function calculation method, involving n parties, n is a positive integer not less than 3, each party holds a fragment of a first number, the method is executed by one of the parties, comprising: obtaining other fragments of the first number from the remaining k parties, k is not greater than n-2; summing the local fragment of the first number and the k other fragments to obtain a first reorganized fragment of the first number; calculating the natural exponential function value of the first reorganized fragment of the first number to obtain a first natural exponential function value, the natural exponential function value of a number is the output value when the natural exponential function takes the number as the input value; splitting the first natural exponential function value into n parts, and distributing n-1 parts to the remaining n-1 parties, and taking the remaining 1 part as the local fragment of the first natural exponential function value; obtaining the fragments of the second natural exponential function value from the remaining parties as the local fragment of the second natural exponential function value, the second natural exponential function value is equal to the natural exponential function value of the second reorganized fragment of the first number, the second reorganized fragment of the first number is equal to the sum of the other fragments of the first number of the remaining n-(1+k) parties; based on the local fragment of the first natural exponential function value and the local fragment of the second natural exponential function value, cooperating with the remaining n-1 parties to obtain the local fragment of the natural exponential function value of the first number by the multi-party secure multiplication as described in any embodiment of the present specification.

[0011] One of the embodiments of the present specification provides a multi-party secure natural exponential function calculation system, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number, the system is implemented in one of the parties, comprising a first number shard acquisition module, a first reorganization module, a first natural exponential function calculation module, a first secret sharing module, a second natural exponential function value shard obtaining module and a second natural exponential function calculation module. The first number shard acquisition module is used to acquire other shards of the first number from the remaining k parties, k is not greater than n-2. The first reorganization module is used to sum the local shard of the first number and the k other shards to obtain the first reorganization shard of the first number. The first natural exponential function calculation module is used to calculate the natural exponential function value of the first reorganization shard of the first number to obtain the first natural exponential function value. The natural exponential function value of a number is the output value of the natural exponential function when the number is the input value. The first secret sharing module is used to split the first natural exponential function value into n parts, and distribute n-1 parts to the remaining n-1 parties, and the remaining 1 part is taken as the local shard of the first natural exponential function value. The second natural exponential function value shard obtaining module is used to obtain the shard of the second natural exponential function value from the remaining parties as the local shard of the second natural exponential function value, the second natural exponential function value is equal to the natural exponential function value of the second reorganization shard of the first number, and the second reorganization shard of the first number is equal to the sum of the other shards of the first number of the remaining n-(1+k) parties. The second natural exponential function calculation module is used to obtain the local shard of the natural exponential function value of the first number based on the local shard of the first natural exponential function value and the local shard of the second natural exponential function value, in cooperation with the remaining n-1 parties, through the multi-party secure multiplication as described in any embodiment of the present specification.

[0012] One of the embodiments of the present specification provides a multi-party secure natural exponential function calculation device, comprising a processor and a storage device, the storage device is used to store instructions, wherein when the processor executes the instructions, the multi-party secure natural exponential function calculation method as described in any embodiment of the present specification is implemented.

[0013] One of the embodiments of the present specification provides a multi-party secure linear rectifier function calculation method, involving n parties, n is a positive integer not less than 3, each party holds a piece of a first number, the method is executed by one of the parties, comprising: based on the local piece of the first number and the local piece of a second preset value, cooperating with the remaining n-1 parties, obtaining the local piece of the comparison result through the multi-party secure comparison method as described in any embodiment of the present specification, the second preset value is equal to 0; based on the local piece of the first number and the local piece of the comparison result, cooperating with the remaining n-1 parties, obtaining the local piece of the product result of the first number and the comparison result through the multi-party secure multiplication as described in any embodiment of the present specification, and taking the local piece of the product result as the local piece of the function value, the function value is the output value of the linear rectifier function when the first number is the input value.

[0014] One of the embodiments of the present specification provides a multi-party secure linear rectifier function calculation system, involving n parties, n is a positive integer not less than 3, each party holds a piece of a first number, the system is implemented in one of the parties, comprising a first secure comparison module and a first secure multiplication module. The first secure comparison module is used to cooperate with the remaining n-1 parties based on the local piece of the first number and the local piece of a second preset value, obtain the local piece of the comparison result through the multi-party secure comparison method as described in any embodiment of the present specification, and the second preset value is equal to 0. The first secure multiplication module is used to cooperate with the remaining n-1 parties based on the local piece of the first number and the local piece of the comparison result, obtain the local piece of the product result of the first number and the comparison result through the multi-party secure multiplication as described in any embodiment of the present specification, and take the local piece of the product result as the local piece of the function value, the function value is the output value of the linear rectifier function when the first number is the input value.

[0015] One of the embodiments of the present specification provides a multi-party secure linear rectifier function calculation device, comprising a processor and a storage device, the storage device is used to store instructions, when the processor executes the instructions, the multi-party secure linear rectifier function calculation method as described in any embodiment of the present specification is implemented.

[0016] One of the embodiments of the present specification provides a multi-party secure division, involving n parties, n being a positive integer not less than 3, each party holding a local share of a dividend and a local share of a divisor, the division being performed by one of the parties, comprising: determining a local share of a sign of the dividend and a local share of a sign of the divisor based on the local share of the dividend and the local share of the divisor respectively, in cooperation with the remaining n-1 parties, through a multi-party secure sign protocol; determining a local share of an absolute value of the dividend and a local share of an absolute value of the divisor based on the local share of the dividend and the local share of the divisor respectively, in cooperation with the remaining n-1 parties, through a multi-party secure absolute value protocol; obtaining a local share of an absolute value of a quotient based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through one or more rounds of processing; and obtaining a local share of the quotient based on the local share of the absolute value of the quotient, the local share of the sign of the dividend and the local share of the sign of the divisor, in cooperation with the remaining n-1 parties. Wherein one round of processing comprises the following steps when a precision number meets a preset condition, otherwise the round of processing is ended: determining whether the absolute value of the dividend is less than the absolute value of the divisor based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure comparison protocol; when the absolute value of the dividend is not less than the absolute value of the divisor, the local share of the absolute value of the dividend and the local share of the absolute value of the quotient are not updated, otherwise one or more of the following updates are performed until the absolute value of the dividend is not less than the absolute value of the divisor or the precision number no longer meets the preset condition: updating the local share of the absolute value of the dividend so that the absolute value of the dividend is expanded by a multiple, updating the local share of the absolute value of the quotient so that the absolute value of the quotient is expanded by the same multiple, and updating the precision number; obtaining a local share of a multiple and a local share of a remainder based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure decomposition protocol, wherein the multiple multiplied by the absolute value of the divisor plus the remainder equals the absolute value of the dividend; accumulating the local share of the multiple into the local share of the absolute value of the quotient, thereby updating the local share of the absolute value of the quotient again; and taking the local share of the remainder as the local share of the absolute value of the dividend after the update again.

[0017] One of the embodiments of the present specification provides a multi-party secure division system, involving n parties, n is a positive integer not less than 3, each party holds a local piece of the dividend and a local piece of the divisor, and the system is implemented in one of the parties, including a sign determination module, an absolute value determination module, an absolute value of quotient calculation module and a quotient restoration module. The sign determination module is used to determine the local piece of the sign identification of the dividend and the local piece of the sign identification of the divisor based on the local piece of the dividend and the local piece of the divisor, respectively, in cooperation with the remaining n-1 parties, through a multi-party secure sign protocol. The absolute value determination module is used to determine the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor based on the local piece of the dividend and the local piece of the divisor, respectively, in cooperation with the remaining n-1 parties, through a multi-party secure absolute value protocol. The absolute value of quotient calculation module is used to obtain the local piece of the absolute value of the quotient based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through one or more rounds of processing. The quotient restoration module is used to obtain the local piece of the quotient based on the local piece of the absolute value of the quotient, the local piece of the sign identification of the dividend and the local piece of the sign identification of the divisor, in cooperation with the remaining n-1 parties. Wherein, one round of processing includes the following steps when the precision number meets the preset condition, otherwise the current round of processing is ended: determining whether the absolute value of the dividend is less than the absolute value of the divisor based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure comparison protocol; when the absolute value of the dividend is not less than the absolute value of the divisor, the local piece of the absolute value of the dividend and the local piece of the absolute value of the quotient are not updated, otherwise one or more of the following updates are performed until the absolute value of the dividend is not less than the absolute value of the divisor or the precision number no longer meets the preset condition: updating the local piece of the absolute value of the dividend so that the absolute value of the dividend is expanded by a certain multiple, updating the local piece of the absolute value of the quotient so that the absolute value of the quotient is expanded by the same multiple, updating the precision number; obtaining the local piece of the multiple and the local piece of the remainder based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure decomposition protocol, wherein the multiple multiplied by the absolute value of the divisor plus the remainder is equal to the absolute value of the dividend; the local piece of the multiple is added to the local piece of the absolute value of the quotient, thereby updating the local piece of the absolute value of the quotient again; and the local piece of the remainder is used as the local piece of the absolute value of the dividend after the update.

[0018] One of the embodiments of the present specification provides a multi-party secure division system, involving n parties, n is a positive integer not less than 3, each party holds a local piece of the dividend and a local piece of the divisor, and the system is implemented in one of the parties, including a sign determination module, an absolute value determination module, an absolute value of quotient calculation module and a quotient restoration module. The sign determination module is used to determine the local piece of the sign identification of the dividend and the local piece of the sign identification of the divisor based on the local piece of the dividend and the local piece of the divisor, respectively, in cooperation with the remaining n-1 parties, through a multi-party secure sign protocol. The absolute value determination module is used to determine the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor based on the local piece of the dividend and the local piece of the divisor, respectively, in cooperation with the remaining n-1 parties, through a multi-party secure absolute value protocol. The absolute value of quotient calculation module is used to obtain the local piece of the absolute value of the quotient based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through one or more rounds of processing. The quotient restoration module is used to obtain the local piece of the quotient based on the local piece of the absolute value of the quotient, the local piece of the sign identification of the dividend and the local piece of the sign identification of the divisor, in cooperation with the remaining n-1 parties. Wherein, one round of processing includes the following steps when the precision number meets the preset condition, otherwise the current round of processing is ended: determining whether the absolute value of the dividend is less than the absolute value of the divisor based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure comparison protocol; when the absolute value of the dividend is not less than the absolute value of the divisor, the local piece of the absolute value of the dividend and the local piece of the absolute value of the quotient are not updated, otherwise one or more of the following updates are performed until the absolute value of the dividend is not less than the absolute value of the divisor or the precision number no longer meets the preset condition: updating the local piece of the absolute value of the dividend so that the absolute value of the dividend is expanded by a certain multiple, updating the local piece of the absolute value of the quotient so that the absolute value of the quotient is expanded by the same multiple, updating the precision number; obtaining the local piece of the multiple and the local piece of the remainder based on the local piece of the absolute value of the dividend and the local piece of the absolute value of the divisor, in cooperation with the remaining n-1 parties, through a multi-party secure decomposition protocol, wherein the multiple multiplied by the absolute value of the divisor plus the remainder is equal to the absolute value of the dividend; the local piece of the multiple is added to the local piece of the absolute value of the quotient, thereby updating the local piece of the absolute value of the quotient again; and the local piece of the remainder is used as the local piece of the absolute value of the dividend after the update.

[0019] One of the embodiments of the present specification provides a method for multi-party secure computation of absolute value, involving n parties, n is a positive integer not less than 3, each party holds a fragment of a target number, the method is executed by one of the parties, comprising: based on the local fragment of the target number and the local fragment of the first preset value, cooperating with the remaining n-1 parties, obtaining the local fragment of the result identifier through the multi-party secure comparison protocol, the result identifier indicates whether the target number is negative; based on the local fragment of the target number and the local fragment of the result identifier, cooperating with the remaining n-1 parties, obtaining the local fragment of the absolute value of the target number through the multi-party secure multiplication protocol.

[0020] One of the embodiments of the present specification provides a system for multi-party secure computation of absolute value, involving n parties, n is a positive integer not less than 3, each party holds a fragment of a target number, the system is implemented in one of the parties, comprising a result identifier calculation module and an absolute value calculation module. The result identifier calculation module is used to obtain the local fragment of the result identifier by cooperating with the remaining n-1 parties through the multi-party secure comparison protocol based on the local fragment of the target number and the local fragment of the first preset value, the result identifier indicates whether the target number is negative. The absolute value calculation module is used to obtain the local fragment of the absolute value of the target number by cooperating with the remaining n-1 parties through the multi-party secure multiplication protocol based on the local fragment of the target number and the local fragment of the result identifier.

[0021] One of the embodiments of the present specification provides a device for multi-party secure computation of absolute value, comprising a processor and a storage device, the storage device is used to store instructions, wherein when the processor executes the instructions, the method for multi-party secure computation of absolute value as described in any embodiment of the present specification is implemented.

[0022] One of the embodiments of the present specification provides a multi-party secure decomposition method, involving n parties, n being a positive integer not less than 3, each party holding a share of a first number and a share of a second number, the method being performed by one of the parties, comprising m+1 rounds of loops, m being a positive integer, wherein one round of loop comprises: determining a local share of a current multiple of a current round; based on the local share of the current multiple and a local share of the second number, cooperating with the remaining n-1 parties to obtain a local share of an intermediate product through a multi-party secure multiplication protocol, the intermediate product being equal to the current multiple multiplied by the second number; based on the local share of the intermediate product and a local share of the first number, cooperating with the remaining n-1 parties to obtain a local share of a result identifier through a multi-party secure comparison protocol, the result identifier indicating whether the intermediate product is less than the first number; based on the local share of the result identifier, cooperating with the remaining n-1 parties to reveal the result identifier; when the result identifier indicates that the intermediate product is less than the first number, accumulating the local share of the current multiple into a local share of a target multiple; and subtracting the local share of the intermediate product from the local share of the first number, thereby updating the local share of the first number. The local share of the target multiple of the last round of loop and the updated local share of the first number are taken as the local share of the multiple and the local share of the remainder respectively, wherein the multiple multiplied by the second number plus the remainder is equal to the first number.

[0023] One of the embodiments of the present specification provides a multi-party secure decomposition system, involving n parties, n being a positive integer not less than 3, each party holding a share of a first number and a share of a second number, the system being implemented in one of the parties, comprising a decomposition module for performing m+1 rounds of loops, m being a positive integer, wherein one round of loop comprises: determining a local share of a current multiple of a current round; based on the local share of the current multiple and a local share of the second number, cooperating with the remaining n-1 parties to obtain a local share of an intermediate product through a multi-party secure multiplication protocol, the intermediate product being equal to the current multiple multiplied by the second number; based on the local share of the intermediate product and a local share of the first number, cooperating with the remaining n-1 parties to obtain a local share of a result identifier through a multi-party secure comparison protocol, the result identifier indicating whether the intermediate product is less than the first number; based on the local share of the result identifier, cooperating with the remaining n-1 parties to reveal the result identifier; when the result identifier indicates that the intermediate product is less than the first number, accumulating the local share of the current multiple into a local share of a target multiple; and subtracting the local share of the intermediate product from the local share of the first number, thereby updating the local share of the first number. The local share of the target multiple of the last round of loop and the updated local share of the first number are taken as the local share of the multiple and the local share of the remainder respectively, wherein the multiple multiplied by the second number plus the remainder is equal to the first number.

[0024] One of the embodiments of the present specification provides a multi-party secure decomposition device, comprising a processor and a storage device for storing instructions, wherein when the processor executes the instructions, the method for multi-party secure calculation of absolute value as described in any embodiment of the present specification is implemented.

[0025] One of the embodiments of the present specification provides a multi-party secure Sigmoid function calculation method, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number, the method is executed by one of the parties, comprising: calculating the difference between the local shard of a first preset value and the local shard of the first number to obtain the local shard of a first opposite number, the first preset value is equal to 0; based on the local shard of the first opposite number, collaborate with the remaining n-1 parties, and obtain the local shard of the natural exponential function value of the first opposite number through the multi-party secure natural exponential function calculation method; calculate the sum of the local shard of a third preset value and the local shard of the natural exponential function value of the first opposite number to obtain the local shard of an intermediate sum value; based on the local shard of the third preset value and the local shard of the intermediate sum value, collaborate with the remaining n-1 parties, and obtain the local shard of the Sigmoid function value of the first number through the multi-party secure division as described in any embodiment of the present specification, the Sigmoid function value of the first number is the output value of the Sigmoid function when the Sigmoid function takes the first number as the input value, which is equal to the third preset value divided by the intermediate sum value, and the third preset value is equal to 1.

[0026] One of the embodiments of the present specification provides a multi-party secure Sigmoid function calculation system, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number, the system is implemented in one of the parties, comprising a first opposite number calculation module, a third natural exponential function calculation module, an intermediate sum value calculation module and a Sigmoid function value calculation module. The first opposite number calculation module is used to calculate the difference between the local shard of a first preset value and the local shard of the first number to obtain the local shard of a first opposite number, the first preset value is equal to 0. The third natural exponential function calculation module is used to obtain the local shard of the natural exponential function value of the first opposite number based on the local shard of the first opposite number, collaborate with the remaining n-1 parties, and obtain the local shard of the natural exponential function value of the first opposite number through the multi-party secure natural exponential function calculation method. The intermediate sum value calculation module is used to calculate the sum of the local shard of a third preset value and the local shard of the natural exponential function value of the first opposite number to obtain the local shard of an intermediate sum value. The Sigmoid function value calculation module is used to obtain the local shard of the Sigmoid function value of the first number based on the local shard of the third preset value and the local shard of the intermediate sum value, collaborate with the remaining n-1 parties, and obtain the local shard of the Sigmoid function value of the first number through the multi-party secure division as described in any embodiment of the present specification, the Sigmoid function value of the first number is the output value of the Sigmoid function when the Sigmoid function takes the first number as the input value, which is equal to the third preset value divided by the intermediate sum value, and the third preset value is equal to 1.

[0027] One of the embodiments of the present specification provides a multi-party secure Sigmoid function calculation device, comprising a processor and a storage device, the storage device is used to store instructions, wherein when the processor executes the instructions, the Sigmoid function calculation method as described in any embodiment of the present specification is realized.

[0028] One of the embodiments of the present specification provides a multi-party secure Tanh function calculation method, involving n parties, n is a positive integer not less than 3, each party holds a shard of a first number, the method is executed by one of the parties, comprising: calculating the difference between the local shard of a first predetermined value and the local shard of the first number, obtaining the local shard of a first opposite number, the first predetermined value is equal to 0; based on the local shard of the first number, cooperate with the remaining n-1 parties, through the multi-party secure natural exponential function calculation method, obtain the local shard of the natural exponential function value of the first number; based on the local shard of the first opposite number, cooperate with the remaining n-1 parties, through the multi-party secure natural exponential function calculation method, obtain the local shard of the natural exponential function value of the first opposite number; calculate the difference between the local shard of the natural exponential function value of the first number and the local shard of the natural exponential function value of the first opposite number, obtain the local shard of the intermediate difference value; calculate the sum of the local shard of the natural exponential function value of the first number and the local shard of the natural exponential function value of the first opposite number, obtain the local shard of the intermediate sum value; based on the local shard of the intermediate difference value and the local shard of the intermediate sum value, cooperate with the remaining n-1 parties, through the multi-party secure division as described in any embodiment of the present specification, obtain the local shard of the Tanh function value of the first number, the Tanh function value of the first number is the output value when the first number is taken as the input value of the Tanh function, which is equal to the intermediate difference divided by the intermediate sum.

[0029] One of the embodiments of the present specification provides a multi-party secure Tanh function calculation system, involving n parties, n is a positive integer not less than 3, each party holds a slice of a first number, the system is implemented in one of the parties, comprising a first opposite number calculation module, a fourth natural exponential function calculation module, a third natural exponential function calculation module, an intermediate difference calculation module, an intermediate sum calculation module and a Tanh function calculation module. The first opposite number calculation module is used to calculate the difference between the local slice of the first preset value and the local slice of the first number, to obtain the local slice of the first opposite number, and the first preset value is equal to 0. The fourth natural exponential function calculation module is used to obtain the local slice of the natural exponential function value of the first number based on the local slice of the first number, in cooperation with the remaining n-1 parties, through a multi-party secure natural exponential function calculation method. The third natural exponential function calculation module is used to obtain the local slice of the natural exponential function value of the first opposite number based on the local slice of the first opposite number, in cooperation with the remaining n-1 parties, through a multi-party secure natural exponential function calculation method. The intermediate difference calculation module is used to calculate the difference between the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, to obtain the local slice of the intermediate difference. The intermediate sum calculation module is used to calculate the sum of the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, to obtain the local slice of the intermediate sum. The Tanh function calculation module is used to obtain the local slice of the Tanh function value of the first number based on the local slice of the intermediate difference and the local slice of the intermediate sum, in cooperation with the remaining n-1 parties, through the multi-party secure division as described in any embodiment of the present specification, the Tanh function value of the first number is the output value when the first number is taken as the input value of the Tanh function, which is equal to the intermediate difference divided by the intermediate sum.

[0030] One of the embodiments of the present specification provides a multi-party secure Tanh function calculation device, comprising a processor and a storage device, the storage device is used to store instructions, wherein when the processor executes the instructions, the Tanh function calculation method as described in any embodiment of the present specification is implemented.

[0031] One of the embodiments of the present specification provides a multi-party secure unsigned number division, involving n parties, n being a positive integer not less than 3, each party holding a shard of a dividend and a shard of a divisor, the dividend and the divisor being unsigned numbers, the division being performed by one of the parties, including obtaining a local shard of a quotient through one or more rounds of processing. One round of processing includes, when a precision number meets a preset condition, performing the following steps, otherwise ending the round of processing: based on the local shard of the dividend and the local shard of the divisor, cooperating with the remaining n-1 parties, determining whether the dividend is less than the divisor through a multi-party secure comparison protocol; when the dividend is not less than the divisor, not updating the local shard of the dividend and the local shard of the quotient, otherwise updating one or more times the following: updating the local shard of the dividend to make the dividend expand by a multiple, updating the local shard of the quotient to make the quotient expand by the same multiple, updating the precision number; based on the local shard of the dividend and the local shard of the divisor, cooperating with the remaining n-1 parties, obtaining a local shard of the multiple and a local shard of a remainder through a multi-party secure decomposition protocol, wherein the multiple multiplied by the divisor plus the remainder equals the dividend; adding the local shard of the multiple to the local shard of the quotient to update the local shard of the quotient again; and based on the local shard of the remainder as the updated local shard of the dividend.

[0032] One of the embodiments of the present specification provides a multi-party secure unsigned number division system, involving n parties, n being a positive integer not less than 3, each party holding a shard of a dividend and a shard of a divisor, the dividend and the divisor being unsigned numbers, the system being implemented in one of the parties, including a quotient calculation module for obtaining a local shard of a quotient through one or more rounds of processing. One round of processing includes, when a precision number meets a preset condition, performing the following steps, otherwise ending the round of processing: based on the local shard of the dividend and the local shard of the divisor, cooperating with the remaining n-1 parties, determining whether the dividend is less than the divisor through a multi-party secure comparison protocol; when the dividend is not less than the divisor, not updating the local shard of the dividend and the local shard of the quotient, otherwise updating one or more times the following: updating the local shard of the dividend to make the dividend expand by a multiple, updating the local shard of the quotient to make the quotient expand by the same multiple, updating the precision number; based on the local shard of the dividend and the local shard of the divisor, cooperating with the remaining n-1 parties, obtaining a local shard of the multiple and a local shard of a remainder through a multi-party secure decomposition protocol, wherein the multiple multiplied by the divisor plus the remainder equals the dividend; adding the local shard of the multiple to the local shard of the quotient to update the local shard of the quotient again; and based on the local shard of the remainder as the updated local shard of the dividend.

[0033] One of the embodiments of the present specification provides a multi-party secure unsigned number division device, comprising a processor and a storage device, the storage device is used to store instructions, wherein when the processor executes the instructions, the multi-party secure unsigned number division as described in any embodiment of the present specification is realized. BRIEF DESCRIPTION OF DRAWINGS

[0034] The present specification will be further illustrated in the form of exemplary embodiments, which will be described in detail through the accompanying drawings. These embodiments are not restrictive, and in these embodiments, the same numbers represent the same structures, wherein:

[0035] Figure 1 is a schematic diagram of an application scenario of multi-party secure computation according to some embodiments of the present specification;

[0036] Figure 2 is an exemplary flowchart of multi-party secure multiplication according to some embodiments of the present specification;

[0037] Figure 3 is an exemplary flowchart of a multi-party secure comparison method according to some embodiments of the present specification;

[0038] Figure 4 is an exemplary flowchart of a multi-party secure natural exponential function calculation method according to some embodiments of the present specification;

[0039] Figure 5 is an exemplary flowchart of a multi-party secure linear rectifier function calculation method according to some embodiments of the present specification;

[0040] Figure 6 is an exemplary flowchart of multi-party secure division according to some embodiments of the present specification;

[0041] Figure 7 is an exemplary flowchart of a multi-party secure calculation absolute value method according to some embodiments of the present specification;

[0042] Figure 8 is an exemplary flowchart of obtaining local shards of absolute values of quotients according to some embodiments of the present specification;

[0043] Figure 9 is an exemplary flowchart of a multi-party secure decomposition method according to some embodiments of the present specification;

[0044] Figure 10 is an exemplary flowchart of restoring absolute values of quotients to quotients in a ciphertext according to some embodiments of the present specification;

[0045] Figure 11is an exemplary flowchart of a multi-party secure unsigned number division according to some embodiments shown in the specification;

[0046] Figure 12 is an exemplary flowchart of a method of computing a multi-party secure Sigmoid function according to some embodiments shown in the specification;

[0047] Figure 13 is an exemplary flowchart of a method of computing a multi-party secure Tanh function according to some embodiments shown in the specification;

[0048] Figure 14 is an exemplary module diagram of a multi-party secure multiplication system according to some embodiments shown in the specification;

[0049] Figure 15 is an exemplary module diagram of a multi-party secure comparison system according to some embodiments shown in the specification;

[0050] Figure 16 is an exemplary module diagram of a multi-party secure natural exponential function computing system according to some embodiments shown in the specification;

[0051] Figure 17 is an exemplary module diagram of a multi-party secure linear rectifier function computing system according to some embodiments shown in the specification;

[0052] Figure 18 is an exemplary module diagram of a multi-party secure division system according to some embodiments shown in the specification;

[0053] Figure 19 is an exemplary module diagram of a multi-party secure absolute value computing system according to some embodiments shown in the specification;

[0054] Figure 20 is an exemplary module diagram of a multi-party secure decomposition system according to some embodiments shown in the specification;

[0055] Figure 21 is an exemplary module diagram of a multi-party secure unsigned number division system according to some embodiments shown in the specification;

[0056] Figure 22 is an exemplary module diagram of a multi-party secure Sigmoid function computing system according to some embodiments shown in the specification;

[0057] Figure 23 is an exemplary module diagram of a multi-party secure Tanh function computing system according to some embodiments shown in the specification. DETAILED DESCRIPTION

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings needed to be used in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some examples or embodiments of the present specification, and for those skilled in the art, the present specification can also be applied to other similar scenarios without creative labor on the basis of these drawings. Unless it is obvious from the language environment or otherwise stated, the same reference numbers in the drawings represent the same structures or operations.

[0059] It should be understood that the "system", "device", "unit" and / or "module" used herein is a method for distinguishing different components, elements, parts, sections or assemblies at different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.

[0060] As shown in the present specification, unless the context clearly indicates otherwise, the words "one", "a", "an" and / or "the" do not refer to the singular, but can also include the plural. Generally speaking, the terms "comprise" and "include" only indicate the inclusion of the steps and elements explicitly identified, and these steps and elements do not constitute an exclusive list, and the method or device can also include other steps or elements.

[0061] Flowcharts are used in the present specification to illustrate the operations performed by the system according to the embodiments of the present specification. It should be understood that the preceding or subsequent operations are not necessarily performed in sequence. On the contrary, each step can be processed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or more steps of the operation can be removed from these processes.

[0062] The present specification relates to multi-party secure computation, so the multi-party secure computation and related concepts are introduced first.

[0063] Multi-party secure computation, also known as secure multi-party computation (SMPC / MPC), refers to the computation between multiple computing participants without leaking data privacy.

[0064] Multi-party secure computation can be implemented based on secret sharing (SS, also known as secret sharing). Secret sharing refers to distributing original data, such as private data (input) held by a data provider, intermediate calculation results, final calculation results (output), in a fragmented form among different computing participants. Among them, the fragmentation method includes multiple methods, and the common one is additive fragmentation. Additive fragmentation means that all fragments of the original data can restore the original data by adding them up. For example, the original data x has n fragments, denoted as x1, x2, …, xn. The sum of all fragments is x1+x2+…+xn=x. The original data can be restored by adding all fragments. nThe n shards can be respectively held by n participants, such as each participant holding one shard, satisfying x = x1 + x2 + … + xn. n For any computing participant, the shard held by the participant can be referred to as a local shard.

[0065] As can be seen, in multi-party secure computation based on secret sharing, once all shards of the original data are disclosed, such as all computing participants colluding with each other or all being attacked, the original data (plaintext) will be exposed. Exposure of the original data poses a certain risk of privacy leakage, i.e., is considered unsafe. For example, exposure of the private data of the data provider directly leaks the private data. In some cases, exposure of the intermediate calculation result and / or the final calculation result can lead to the private data being deduced. Of course, in some cases, although the input is processed by shards, the plaintext output can also be performed, for example, the plaintext exposure of the comparison result is allowed in some cases, i.e., is considered safe.

[0066] Multi-party secure computation can use a group operation system. In mathematics, a "group" represents an algebraic structure of a binary operation that satisfies closure, satisfies the associative law, has a unit element, and has an inverse element, including Abelian groups, homomorphisms, and conjugate classes. Among them, the multiplication symbol "*" (which can be omitted when unambiguous) or the addition symbol "+" can usually be used as the symbol of the binary operation, but it should be noted that the binary operation is not necessarily equal to the multiplication or addition in the four arithmetic operations.

[0067] The binary operation of the group satisfies: 1. closure law, for any elements a, b in G, a * b is still in G; 2. associative law, for any elements a, b, and c in G, (a * b) * c = a * (b * c); 3. there is a unit element e in G, such that a * e = e * a; 4. there is an inverse element b in G for any element a in G, such that a * b = b * a = e, a and b are inverses of each other, and e is the unit element. It should be noted that for the binary operation represented by "+", e can also be referred to as the zero element, and the inverse element can also be referred to as the negative element (such as the opposite number in this article). For any elements a, b in G, a - b can represent a + (the inverse of b). The order of the group operation is important. Combining element a with element b, the result obtained is not necessarily the same as combining element b with element a, i.e., the commutative law a * b = b * a does not necessarily hold. The group that satisfies the commutative law is called an Abelian group (commutative group), and the group that does not satisfy the commutative law is called a non-Abelian group (non-commutative group). The Abelian group is composed of a set G and a binary operation *.

[0068] The multi-party secure computation protocol in this specification can be designed based on an integer Abelian group (containing negative numbers and non-negative numbers). In particular, for multi-party secure unsigned number division, it can also be designed based on a non-negative integer Abelian group (containing only non-negative numbers).

[0069] Figure 1 is a schematic diagram of an application scenario of multi-party secure computation according to some embodiments of the present specification. The scenario 100 can include one or more data providers 110 (only one is shown in the figure), and a plurality of computing participants 120, such as computing participants 120-1, 120-2, 120-3,..., 120-n. Figure 1

[0070] The data provider, which can also be referred to as a data holder, holds complete original data that needs to be protected by privacy. The data provider can split the original data (input) x into n parts, each of which is assigned to a computing participant as a shard. For ease of description, the shard assigned to the computing participant 120-i can be denoted as xi. i Referring to the foregoing, for additive shards, xi satisfies x = x1+ x2+ … + xn. n

[0071] By way of example only, the scenario 100 can be used to implement a secure machine learning framework. More specifically, the secure machine learning framework can include a secure MPNN (Message Passing Neural Network) framework for drug property prediction. In the secure MPNN framework for drug property prediction, a drug laboratory can act as a provider of drug data. In order to prevent leakage of drug data, the original (plaintext) drug data is provided to each computing participant (such as a cloud computing server) as input data in the form of shards, and each computing participant can also return the prediction result in the form of shards to the drug laboratory. The drug laboratory can obtain the prediction result in the form of plaintext by merging the obtained shards (such as addition). In addition, the plaintext prediction model can be obtained by training in advance, and the model parameters are then disassembled into shards and distributed to each computing participant to facilitate multi-party secure computation.

[0072] The MPNN has three data processing stages, namely a message passing stage, an update stage, and a readout stage. The message passing stage can be implemented based on a fully connected layer and a ReLU layer. The update stage can be implemented based on a GRU (Gated Recurrent Unit) layer. The readout stage can be implemented based on two fully connected networks, which can employ a fully connected layer and a ReLU layer, and the outputs of the two fully connected networks can be connected by a Sigmoid function and a bitwise multiplication. The fully connected layer involves multiplication, the ReLU layer involves a ReLU function, and the GRU layer involves a Sigmoid function, a Tanh function, and a bitwise multiplication.

[0073] ​​It can be understood that, to implement a secure MPNN framework, it is necessary to rely on the secure implementation of the basic operations involved in the MPNN, including the multiplication, ReLU function, Sigmoid function, Tanh function mentioned above and related operations thereof, such as the Sigmoid function and Tanh function both involving the natural exponential function and division, and the ReLU function involving comparison. That is, it is necessary to provide the framework with basic multi-party secure computation protocols, such as a multi-party secure multiplication protocol, a comparison protocol, a division protocol, and the like. In some embodiments, multi-party secure computation is mostly applicable to two-party scenarios, which is difficult to meet the scenarios of larger computing tasks and more nodes participating in computation. In some embodiments, there are also three-party secure computation protocols, but these protocols are mostly only applicable to three parties, and are difficult to be extended to more-party secure computation scenarios, or require deep involvement of a trusted central server (such as relying on the central server to perform part of the operation) to assist more parties to complete multi-party secure computation, which undoubtedly increases the hardware cost. Therefore, some embodiments of the present specification provide a series of multi-party secure computation protocols that do not rely on the participation of a trusted central server in the operation, while being applicable to three-party or more-party secure computation scenarios.

[0074] Some embodiments of the present specification provide a certain dependency relationship between the multi-party secure computation protocols. Generally, the multiplication protocol is a more basic multi-party secure computation protocol, so this document starts from the multi-party secure multiplication and then introduces the related multi-party secure computation protocols in turn.

[0075] In some multi-party secure computation protocols, the steps / processes performed by two or more computing participants (which can be part of the computing participants or all of the computing participants) are symmetrical, so the related drawings only show the single-party process. For ease of description, the number of computing participants is denoted as n, n is a positive integer not less than 3, and the multi-party can include the 0th party, the 1st party,..., and the (n-1)th party. The execution party of the related process can be denoted as the ith party.

[0076] Figure 2 is an exemplary flowchart of the multi-party secure multiplication according to some embodiments of the present specification. The flow 200 can be performed by any of the n parties, such as Figure 2 As shown in the flow 200 can include the following steps.

[0077] Step 210, transmitting the local slice of the first multiplier and the local slice of the second multiplier to the remaining one party or the remaining multiple parties.

[0078] Step 220, obtaining the other slice of the first multiplier and the other slice of the second multiplier from the remaining one party or the remaining multiple parties.

[0079] For ease of description, the first multiplier can be denoted as a, and the second multiplier can be denoted as b. For the ith party (referred to as S iThe local fragment of the first multiplier a held by it can be denoted as a. i The local partition of the second multiplier b is denoted as b. i For additive fragmentation, satisfying and

[0080] In steps 210 and 220, the number of other parties is no greater than n-2. Excluding the current party, the total number of other parties is n-1. Therefore, the restriction here is to exclude the remaining n-1 parties to prevent the plaintext of the first and second multipliers from being exposed. From the receiver's perspective, if the i-th party obtains the remaining (n-1) fragments of any multiplier (excluding the local fragment) from the remaining (n-1) parties, the i-th party can collect all n fragments of that multiplier and thus obtain the plaintext of that multiplier. Similarly, from the sender's perspective, if the i-th party sends the local fragment of any multiplier to the remaining n-1 parties, the adversary only needs to compromise the remaining (n-1) parties (without needing to compromise all participating parties) to collect all n fragments of that multiplier and thus obtain the plaintext of that multiplier. Therefore, for data security reasons, the number of other parties in steps 210 and 220 is no greater than n-2.

[0081] Step 230: Multiply the local partitions of the first multiplier and the local partitions of the second multiplier to obtain the local product term.

[0082] The i-th party can divide the local partition a of the first multiplier a. i Local partitions of the second multiplier b i Multiplying them together yields the local product term a. i b i .

[0083] Step 240: Multiply the local fragments of the first multiplier by the other fragments of the second multiplier to obtain one or more first cross terms.

[0084] The i-th party can divide the local partition a of the first multiplier a. i Other parts b of the second multiplier b j Multiplying them together yields one or more first cross terms a. i b j Where j ≠ i. For each received b j (Refer to step 220), S i A corresponding first cross term a can be obtained. i b j .

[0085] Step 250: Multiply the local fragments of the second multiplier with the other fragments of the first multiplier to obtain one or more second cross terms.

[0086] The i-th party can multiply its local share b i of the second multiplier b with the other shares a j of the first multiplier a, respectively, to obtain one or more second cross terms b i a j , where j≠i. For each a j received (cf. step 220), the S i may obtain a corresponding second cross term b i a j .

[0087] Step 260, based on the local product term, the one or more first cross terms and the one or more second cross terms, obtain a local share of the product of the first and second multipliers.

[0088] For additive shares, the product ab of the first and second multipliers a and b can be decomposed into two types of product terms, namely local product terms and cross terms (e.g. first / second cross terms), so that each computing participant can obtain a local share of the product ab based on the local product terms and the cross terms.

[0089] In some embodiments, for efficiency and the like, each cross term can be assigned to a unique computing participant for computation, so that each cross term and each local product term in the product is computed by the corresponding computing participant. Accordingly, each computing participant can obtain a local share of the product as the sum of the local product term, the one or more first cross terms and the one or more second cross terms. That is, for the i-th party, the local share of the product ab can be equal to the sum of the local product term a i b i , the one or more first cross terms a i b j , and the one or more second cross terms b i a j . As a variant of the above computation, the local share of the product ab can also be equal to the sum of the local product term a i b i , the one or more first cross terms a i b j , the one or more second cross terms b i a j , and a constant term c i , as long as the sum of the constant terms c i of the n computing participants is equal to 0 (i.e. ).

[0090] The computation assignment of the cross terms can depend on the transmission strategy of the shares of the multipliers. Exemplary share transmission strategies are provided below.

[0091] In some embodiments, each computational participant (denoted as the i-th party) can allocate a local fragment a of the first multiplier a. i Send them to the (i+n-1)%n, (i+n-2)%n, (i+n-3)%n parties respectively, and so on until the nth party. Fang; the local partition b of the second multiplier b i Send them to the (i+n-1)%n, (i+n-2)%n, (i+n-3)%n parties respectively, and so on until the nth party. The % operator represents the remainder operation (the sign of the remainder is the same as the dividend preceding the % operator). This indicates rounding down to the nearest integer.

[0092] Correspondingly, the i-th power can be derived from the (i+1)%n power, the (i+2)%n power, and so on until the i-th power. Fang receives other fragments a of the first multiplier a. j Starting from the (i+1)%n power, the (i+2)%n power, and so on until the [i+1]th power. The other fragments b of the second multiplier b are received by the other fragments b. j .

[0093] Other fragments a that receive the first multiplier a j Other pieces of the second multiplier b j Then, the i-th party can press Calculate the local partition (ab) of the product ab. i .

[0094] For example, when n = 3, S i The local partition a of the first multiplier a can be... i Local partitions of the second multiplier b i Send to and That is, S (i+2)mod3 .from and That is, S (i+1)mod3 Other fragments a that receive the first multiplier a (i+1)mod3 Other pieces of the second multiplier b (i+1)mod3 Afterwards, S i It can compute the local partition (ab) of the product ab. i =a i b i +a i b (i+1)mod3 +b i a (i+1)mod3where mod denotes a modulo operation (the remainder is always a non-negative integer). Specifically, S0obtains a1, b1from S1, S1obtains a2, b2from S2, and S2obtains a0, b0from S0.

[0095] In some embodiments, in order to improve the data security level, the local shards used to calculate the local product term and the cross term can be obtained by re-sharding the original shards. That is, the local shard of the first multiplier and the local shard of the second multiplier in step 210 can be obtained by the ith party in cooperation with the other n-1 parties based on the respective original shards. It can be understood that re-sharding does not change the original data corresponding to each shard. For example, the ith party holds the original shard a i of the first multiplier a and the original shard b i of the second multiplier b, and after re-sharding, the ith party can obtain the local shard a i of the first multiplier a and the local shard b i of the second multiplier b, which satisfy and Further, the ith party can multiply the local shard a i of the first multiplier a and the local shard b i of the second multiplier b to obtain the local product term a i b i ; multiply the local shard a i of the first multiplier with the other shards b j of the second multiplier (j≠i) to obtain one or more first cross terms a i b j ; and multiply the local shard b i of the second multiplier with the other shards a j of the first multiplier (j≠i) to obtain one or more second cross terms b i a j .

[0096] In some embodiments, for any computing participant (denoted as S i ), the re-sharding process of the original shard can include: generating a local first random number (denoted as r i,j1 , j1≠i), transmitting the local first random number r i,j1 to the remaining one party S j1 ; obtaining another first random number r j2 from the remaining one party (denoted as S j2,i , j2≠j1); and obtaining the local shard s i,j1 of the original data s (such as the first multiplier / second multiplier) based on the difference between the local first random number r j2,i and the other first random number r i and the original shard s iIt's understandable that for additive sharding, since the sum of the original shards of each party is already equal to the original data, the sum of the random number differences between each party can be equal to 0, so that the sum of the local shards of each party after resharding still equals the original data. For example, it can be done by pressing s′ i =s i +r i,j1 -r j2,i Calculate local fragment s′ i ,satisfy

[0097] In some embodiments, S i You can use the first random number r from the local machine. i,(i+n-1)％n Transmitted to S (i+n-1)％n And from S (i+1)％n Receive other first random numbers r (i+1)％n,i That is, j1 = (i+n-1)%n, the other side is the (i+n-1)%n side, and correspondingly, j2 = (i+1)%n, the other side is the (i+1)%n side.

[0098] In some embodiments, S i You can use the first random number r locally i,(i+1)％n Transmitted to S (i+1)％n And from S (i+n-1)％n Receive other first random numbers r (i+n-1)％n,i That is, j1 = (i+1)%n, the other side is the (i+1)%n side, and correspondingly, j2 = (i+n-1)%n, the other side is the (i+n-1)%n side.

[0099] In some embodiments, S i You can use the first random number r from the local machine. i,(i+n-δ)％n Transmitted to S (i+n-δ)％n And from S (i+δ)％n Receive other first random numbers r (i+δ)％n,i Where δ is a positive integer between 0 and n (excluding 0 and n). That is, j1 = (i+n-δ)%n, the other side is the (i+n-δ)%n side, and correspondingly, j2 = (i+δ)%n, the other side is the (i+δ)%n side.

[0100] In some embodiments, S i You can use the first random number r from the local machine. i,(i+δ)％n Transmitted to S (i+δ)％n And from S (i+n-δ)％n Receive other first random numbers r (i+n-δ)％n,iwherein d is a positive integer between 0 and n (not including 0 and n). That is, j1= (i+d) % n, and the other party is the (i+d) % n party, and correspondingly, j2= (i+n-d) % n, and the other party is the (i+n-d) % n party.

[0101] Figure 3 is an exemplary flowchart of a multi-party secure comparison method according to some embodiments of the present specification. Each party holds a share of a first number (denoted as a) and a share of a second number (denoted as b), where the first number and the second number are two numbers participating in the secure comparison. The i-th party holds a local share of the first number a, denoted as a i , and a local share of the second number b, denoted as b i . The flowchart 300 can be performed by any of the n parties, as shown in Figure 3 the flowchart 300 can include the following steps.

[0102] Step 310, obtaining a local share of a first selection random number a i , a local share of a second selection random number b i , and a local share of a masking random number r i .

[0103] wherein the second selection random number b is related to the first selection random number a, i.e., the value of the second selection random number b is influenced by the value of the first selection random number a. For the role of the first / second selection random number and the masking random number, please refer to the detailed description of steps 360-380.

[0104] Step 320, obtaining a local share of a first comparison function f i .

[0105] The first comparison function f reflects the difference a-b of the first number a minus the second number b.

[0106] Step 330, obtaining a local share of a second comparison function g i .

[0107] The second comparison function g reflects the difference b-a of the second number b minus the first number a.

[0108] Step 340, based on the local share of the first selection random number a i and the local share of the first comparison function, a first product (a f) of the first selection random number a and the first comparison function f is obtained in cooperation with the remaining n-1 parties. i .

[0109] It can be understood that the steps of calculating the local share of the product in the present specification (such as steps 340, 350, 370, 392, 394, etc.) can be implemented by multi-party secure multiplication. In some embodiments, the multi-party secure multiplication used in the steps related to the present specification can be the multi-party secure multiplication as shown in Figure 3

[0110] Step 350, based on the local share of the second selection random number β i and the local share of the second comparison function g, in cooperation with the remaining n-1 parties, obtain the local share of the second product βg of the second selection random number β and the second comparison function g (βg) i .

[0111] Step 360, based on the local share of the first product αf (αf) i and the local share of the second product βg (βg) i , obtain the local share of the target difference sub (sub) i .

[0112] It can be understood that the target difference sub is equal to the result of the combination of the first product αf and the second product βg, for example, the target difference sub can be the sum of the first product αf and the second product βg αf+βg. The value of the selection random number determines whether the selected object multiplied by it is selected, and the values of the two selection random numbers (α and β) affect each other, so only one of the two selected objects (the first comparison function f and the second comparison function g) will be selected. That is, depending on the value of the selection random number, the target difference sub reflects either the difference a-b between the first number a and the second number b, or the difference b-a between the second number b and the first number a. Therefore, it can also be concluded that the positivity or negativity of the target difference and the value of the selection random number can reflect the size relationship between the first number a and the second number b, and the subsequent step 380 will use this to calculate the share of the comparison result (result identifier), which will not be described in detail here.

[0113] In some embodiments, the first selection random number α can be 0 or 1, and accordingly, the second selection random number β can be equal to (1-α). In this way, the first selection random number α and the second selection random number β always have one number as 0 and the other number as 1, and after multiplying the respective corresponding selected objects (α corresponds to f, β corresponds to g), one object is always canceled under the action of 0 so that the other object is selected, that is, either the first comparison function f is selected or the second comparison function g is selected. Of course, when the first selection random number α is 0 or 1, the second selection random number β can also be set to a multiple of (1-α), such as 2(1-α).

[0114] ​In some embodiments, when the first selection random number a is 0 or 1 and the second selection random number b is equal to (1-a), the local share a i may be obtained from an independent device. The independent device can refer to a device that does not participate in the secure computation, such as a device of a data provider or other trusted party, which can generate a random number as the first selection random a, split a into n shares and distribute them to the n computing parties. When the ith party obtains the local share a i of the first selection random a i , the local share (1-a) i of the second selection random number (1-a) can be obtained by subtracting the local share a i of the first selection random a from the local share of the first preset value, where the first preset value is equal to 1. It can be understood that the parties can agree on the share value so that the sum of the shares of the first preset value held by each party is 1, i.e. the local share of the first preset value held by each party can be pre-configured. For example, the parties can agree that the share of a certain party is equal to 1 and the shares of the other parties are all equal to 0. It can be understood that any preset value mentioned in this specification can be obtained by pre-configuration.

[0115] Step 370, based on the local share sub i of the target difference sub and the local share r i of the masking random number r, the local share e i of the intermediate product e is obtained in cooperation with the remaining n-1 parties.

[0116] The intermediate product e is equal to the product of the target difference sub and the masking random number r. According to step 380, the intermediate product is to be disclosed by the n parties, but due to the presence of the masking random number r (any party cannot know the size of r), the target difference reflecting the difference between the first number and the second number can be avoided. It can be understood that the exposure of the target difference is considered to be unsafe or there is a risk of privacy leakage.

[0117] Step 380, based on the local share e i of the intermediate product e, the intermediate product e is disclosed in cooperation with the remaining n-1 parties.

[0118] In some embodiments, the parties can agree that one of the parties collects all the shares of the intermediate product e, i.e. the other n-1 parties can receive the other shares of the intermediate product e from the one party, and based on the local share of the intermediate product e and the n-1 other shares of the intermediate product e, the intermediate product e is obtained. The other party (such as S0) can send the intermediate product e to the remaining n-1 parties (such as S1, S2, …, Sn-1) or notify the remaining n-1 parties of the positive or negative nature of the intermediate product e. n-1

[0119] In some embodiments, each computing participant can also send its local share of the intermediate product e to the remaining n-1 participants respectively. In this way, each computing participant can receive other shares of the intermediate product e from the remaining n-1 participants, and obtain the intermediate product e based on the local share of the intermediate product and the n-1 other shares of the intermediate product e.

[0120] When the intermediate product e is greater than 0, step 392 can be performed. When the intermediate product e is less than or equal to 0, step 394 can be performed.

[0121] Step 392, obtaining the local share d of the comparison result identifier d based on the local share a of the first selected random number a i obtaining the local share d of the comparison result identifier d based on the local share a of the first selected random number a i wherein,

[0122] Step 394, obtaining the local share a of the first selected random number a i obtaining the local share d of the comparison result identifier d based on the local share a of the first selected random number a i wherein,

[0123] In this specification, represents XOR.

[0124] The mask random number r can be a positive-negative known number, but the specific value is unknown and not 0, so as to determine the positive-negative of the target difference sub according to the positive-negative of the intermediate product e (the product of the target difference sub and the mask random number r), and then determine the size relationship between the first number a and the second number b in combination with the value of the first selected random number a.

[0125] In order to intuitively understand the relationship between the positive-negative of the intermediate product e and the comparison result, it is assumed that the mask random number r is a positive number, and the first number a and the second number b are both integers, then: (1) e>0 and a=1, a>b; (2) e>0 and a=0, a<b; (3) e<0 and a=1, a<b; (4) e<0 and a=0, a>b. Based on this, when e>0, the XOR result of the first selected random number a and 0 can be determined as the comparison result identifier d. When e<0, the XOR result of the first selected random number a and 1 can be determined as the comparison result identifier d. Wherein, d=1 indicates a>b, and d=0 indicates a<b.

[0126] In some embodiments, the case of a = b also needs to be considered. Generally, the case of two numbers being equal can be classified into one of the two comparison results. In some embodiments, the first comparison function can be set as a - b, and the second comparison function can be set as b - a. However, when a and b are equal, the target difference value is equal to 0, and then the intermediate product e is also equal to 0, which can expose the privacy information that a is equal to b. Therefore, in some alternative embodiments, a basic numerical interval can be added to one of the comparison functions. For example, the first comparison function can be specifically 1 + a - b, where 1 is the basic numerical interval when the secure multi-party computation is defined on the set of integers, that is, the minimum difference between any two numbers in the set of integers can only be 1. Then, the case of a = b can be effectively hidden by combining the selection of random numbers. Specifically: (1) e > 0 and a = 1, a > b; (2) e > 0 and a = 0, a < b; (3) e < 0 and a = 1, a < b; (4) e < 0 and a = 0, a > b. Based on this, when e > 0, the exclusive or result of the first selection random number a and 0 can be determined as the comparison result identifier d. When e < 0, the exclusive or result of the first selection random number a and 1 can be determined as the comparison result identifier d. Wherein, d = 1 indicates that a > b, and d = 0 indicates that a < b.

[0127] In some embodiments, the exclusive or operation in binary can be equivalent to the combination of binary addition and binary multiplication. Specifically, p ^ q = p + q - 2pq. Correspondingly, in the multi-party secure computation, S i can sum the local slices of p i and the local slices of q i to obtain the first part of the local slices of the exclusive or result of p and q (p i + q i ); based on the local slices of p i and the local slices of q i , S i obtains the second part of the local slices of the exclusive or result of p and q (2pq) i . Then, S i subtracts the second part of the local slices of the exclusive or result of p and q from the first part of the local slices of the exclusive or result of p and q to obtain the local slices of the exclusive or result of p and q.

[0128] For example, when the comparison result identifier is equal to the exclusive or result of the first selection random number a and 0, S i can sum the local slices of the first selection random number a i and the local slices of the second preset value (equal to 0) to obtain the first part of the local slices of the comparison result identifier d i ; based on the local slices of the first selection random number a iThe local fragment with the second preset value, together with the other n-1 parties, obtains the local fragment d with the comparison result identifier d. i The second part. Furthermore, S i The comparison result can be used to identify the local fragment d of d. i Subtracting the second part from the first part yields the local fragment d of the comparison result identifier d. i It is understandable that the parties can agree on a sharding value to ensure that the sum of the shards held by each party with the second preset value is equal to 0. For example, each party can set the shards with the second preset value to 0.

[0129] For example, when the comparison result identifier is equal to the XOR result of the first selected random number α and 1, S i We can sum the local partitions α of the first-choice random number α. i The local fragment d is compared with the local fragment with the first preset value (equal to 1) to obtain the local fragment d with the identifier d of the comparison result. i The first part; local partitioning α based on the first selected random number α i The local fragment with the first preset value, together with the other n-1 parties, obtains the local fragment d with the comparison result identifier d. i The second part. Furthermore, S i The comparison result can be used to identify the local fragment d of d. i Subtracting the second part from the first part yields the local fragment d of the comparison result identifier d. i .

[0130] In some embodiments, the i-th party can generate a random number and use it as a local fragment r of the mask random number r. i To ensure that the masking random number r is either positive or negative, the parties may agree that local fragments r can be generated within either a positive or negative range. i Referring to the previous section on obtaining the first random local fragment, the i-th party can also obtain the local fragment r of the mask random number r from an independent device. i To ensure that the masking random number r is either positive or negative, a separate device can generate the masking random number r within either a positive or negative range.

[0131] Figure 4 This is an exemplary flowchart of a multi-party secure natural exponential function calculation method according to some embodiments of this specification. Each party holds a slice of a first number (denoted as x), which is the input (i.e., the exponent) of the natural exponential function. The local slice of the first number x held by the i-th party can be denoted as xi. i .

[0132] One characteristic of exponential functions is that the sum of the input values ​​can be converted into the product of the output values, i.e. Based on this, the fragments of the first number x can be recombined to obtain two recombined fragments. Furthermore, the multi-party secure computation of the exponential function can be transformed into multi-party secure multiplication. Specifically, any two of the n parties can obtain the recombined fragments of the first number x. For ease of description, these two parties are denoted as S0 and S... n-1 That is, the executor of process 400 can be S0 or S. n-1 .

[0133] like Figure 4 As shown, process 400 may include the following steps.

[0134] Step 410: Obtain the other slices of the first number from the remaining k squares.

[0135] Referring to the relevant descriptions of steps 210 and 220, k is no greater than n-2 to avoid exposing the first number.

[0136] Suppose S0 obtains the remaining fragments of the first number from the other k0 sides, S n-1 From the remaining k n-1 If the first number of other fragments is obtained, then the remaining k0 and the remaining k n-1 The square constitutes S0 and S n-1 The remaining n-2 squares, where k0+k n-1 = n-2.

[0137] Step 420: Sum the local fragment of the first number and k other fragments to obtain the first recombined fragment of the first number.

[0138] Continuing with the previous assumptions, the recombined fragment obtained by S0 (denoted as x1) can be the sum of (k0+1) fragments of the first number x, S n-1 The obtained recombined fragment (denoted as x2) can be the (k)th of the first number x. n-1 The sum of (+1) pieces satisfies x = x1 + x2.

[0139] It should be understood that the recombinant fragment obtained by S0 is the first recombinant fragment for itself, but for S... n-1 This refers to the second recombinant fragment (see step 450). Similarly, S n-1 The obtained recombinant fragment is the first recombinant fragment for itself, but the second recombinant fragment for S0.

[0140] Step 430: Calculate the output value of the natural exponential function when the first recombined fragment of the first number is used as the input value, and obtain the value of the first natural exponential function.

[0141] S0 can input the recombined fragment x1 of the first number into the natural exponential function to obtain the output value e. x1 S n-1The first number of recombined pieces x2 can be input into the natural exponential function to obtain an output value e x2 .

[0142] It should be understood that the natural exponential function value calculated by S0 is the first natural exponential function value for itself, but is the second natural exponential function value for S n-1 . Similarly, the natural exponential function value obtained by S n-1 is the first natural exponential function value for itself, but is the second natural exponential function value for S0.

[0143] In step 440, the first natural exponential function value is split into n parts, and n-1 parts are distributed to the remaining n-1 parties, and the remaining 1 part is taken as the local piece of the first natural exponential function value.

[0144] S0 can split the function value e x1 into n parts, and n-1 parts are distributed to the remaining n-1 parties, and the remaining 1 part is taken as the local piece of the function value e x1 . n-1 can split the function value e x2 into n parts, and n-1 parts are distributed to the remaining n-1 parties, and the remaining 1 part is taken as the local piece of the function value e x2 .

[0145] In step 450, the pieces of the second natural exponential function value obtained from the remaining parties are taken as the local pieces of the second natural exponential function value.

[0146] The second natural exponential function value is equal to the natural exponential function value of the second recombined piece of the first number, and the second recombined piece of the first number is equal to the sum of the other pieces of the first number of the remaining n-(1+k) parties.

[0147] Referring to step 440, S0 can obtain the pieces of the function value e n-1 from S x2 as the local pieces of the function value e x2 , and S n-1 can obtain the pieces of the function value e x1 from S0 as the local pieces of the function value e x1 . In fact, each party among the n parties except S0 and S n-1 can obtain the pieces of the function value e n-1 from S x2 as the local pieces of the function value e x2 , and can obtain the pieces of the function value e x1 from S0 as the local pieces of the function value e x1 .

[0148] At step 460, based on the local share of the first natural exponential function value and the local share of the second natural exponential function value, each of the n parties collaborates with the other n-1 parties to obtain a local share of the target natural exponential function value.

[0149] wherein the target natural exponential function value (denoted as c) is the output value of the natural exponential function when the first number x is inputted, i.e., c = e x and the target natural exponential function value c is equal to the product of the first natural exponential function value a and the second natural exponential function value b, i.e., c = ab or .

[0150] In fact, it is not only S0or S n-1 The local share of the target natural exponential function value can be obtained, and each of the n parties can collaborate with the other n-1 parties to obtain a local share of the target natural exponential function value based on the local share of the first natural exponential function value and the local share of the second natural exponential function value.

[0151] In some embodiments, the first natural exponential function value can be regarded as a first multiplier, and the second natural exponential function value can be regarded as a second multiplier, so that step 460 can be implemented by a multi-party secure multiplication as shown in Figure 2 .

[0152] Figure 5 is an exemplary flowchart of a multi-party secure linear rectifier function calculation method according to some embodiments of the present specification. Each party holds a share of a first number x, which is the input value of a linear rectifier function (i.e., a ReLU function).

[0153] The ReLU function can be represented as ReLU(x) = max(x, 0), wherein max represents the maximum value, i.e., when x ≥ 0, ReLU(x) = x; when x < 0, ReLU(x) = 0. It can be understood that the ReLU function can be converted into the product of a sign function and the input value, i.e., ReLU(x) = x * sgn(x, 0). Wherein, when x ≥ 0, sgn(x) = 1; when x < 0, sgn(x) = 0. Further, the multi-party secure calculation of the ReLU function can be converted into a multi-party secure multiplication. In addition, the multi-party secure calculation of the sign function can be implemented by a multi-party secure comparison.

[0154] The flowchart 500 can be executed by any of the n parties, as shown in Figure 5 The flowchart 500 can include the following steps.

[0155] At step 510, based on the local share of the first number and the local share of the second preset value, each of the n parties collaborates with the other n-1 parties to obtain a local share of the comparison result by a multi-party secure comparison protocol.

[0156] The second preset value is equal to 0, and the comparison result is a comparison result of the first number x and 0 (indication), that is, a sign indication of the first number x.

[0157] In some embodiments, the second preset value (0) can be regarded as a second number, so that the sign indication can be obtained by a multi-party secure comparison method as shown in Figure 3

[0158] Step 520, based on the local shard of the first number and the local shard of the comparison result, in cooperation with the remaining n-1 parties, the local shard of the product of the first number and the comparison result is obtained through a multi-party secure multiplication protocol, and the local shard of the product is taken as the local shard of the function value.

[0159] The function value is an output value of a linear rectified function when the first number x is taken as an input value, that is, ReLU(x).

[0160] In some embodiments, the first number x can be regarded as a first multiplier, and the comparison result sgn(x) can be regarded as a second multiplier, so that the local shard of the product x*sgn(x) can be obtained by a multi-party secure multiplication as shown in Figure 2

[0161] Figure 6 is an exemplary flowchart of multi-party secure division according to some embodiments of the present specification. Each party holds a shard of the dividend a and a shard of the divisor b.

[0162] The flow 600 can be performed by any of the n parties, as shown in Figure 6 The flow 600 can include the following steps.

[0163] Step 610, based on the local shard of the dividend and the local shard of the divisor respectively, in cooperation with the remaining n-1 parties, the local shard of the sign indication of the dividend and the local shard of the sign indication of the divisor are determined through a multi-party secure sign protocol.

[0164] The multi-party secure sign protocol can be implemented based on a multi-party secure comparison protocol, for example, to implement a secure comparison of a target number (such as a dividend or a divisor) and 0. That is, the multi-party secure sign protocol can include a party secure comparison protocol. For more details of the multi-party secure sign protocol, please refer to the detailed description of step 510.

[0165] Step 620, based on the local shard of the dividend and the local shard of the divisor respectively, in cooperation with the remaining n-1 parties, the local shard of the absolute value of the dividend and the local shard of the absolute value of the divisor are determined through a multi-party secure absolute value protocol.

[0166] ​​The absolute value of a number is related to the positivity of the number, i.e., the absolute value of a non-negative number is equal to itself, and the absolute value of a negative number is equal to its opposite. Based on this, in some embodiments, for any computing party, the multi-party secure absolute value protocol can include: based on the local share of the target number and the local share of the first preset value, in collaboration with the remaining n-1 parties, obtaining the local share of the result identifier through a multi-party secure comparison protocol, where the result identifier indicates whether the target number is negative; based on the local share of the target number and the local share of the result identifier, in collaboration with the remaining n-1 parties, obtaining the local share of the absolute value of the target number through a multi-party secure multiplication protocol. Specifically, when determining the local share of the absolute value of the dividend, the local share of the target number is the local share of the dividend, i.e., the target number is the dividend; when determining the local share of the absolute value of the divisor, the local share of the target number is the local share of the divisor, i.e., the target number is the divisor.

[0167] With reference to the content about the symbol identifier elsewhere in this article, the first preset value can take a critical value for judging the positivity, i.e., comparing the target number with the critical value can judge the positivity of the target number (such as whether it is negative), for example, the first preset value can be equal to 0 or a value near 0 (such as ±1).

[0168] It can be understood that the result identifier can indicate the case that the target number is negative and the case that the target number is not negative through two different values. Further, based on the target number and the result identifier, the absolute value of the target number can be reconstructed. For example, let the target number be x, the result identifier can be equal to sgn(x). Wherein, when x≥0, sgn(x)=1; when x<0, sgn(x)=0. Correspondingly, the absolute value of the target number x can be reconstructed as (2sgn(x)-1)x. It can be seen that the reconstructed absolute value is essentially the product of the target number x and ±1, so it needs to use the multi-party secure multiplication protocol. When the result identifier indicates that the target number is negative, the result identifier (such as 0) can be mapped to -1; when the result identifier indicates that the target number is not negative (i.e., non-negative), the result identifier (such as 1) can be mapped to +1.

[0169] For more details of the multi-party secure absolute value protocol, please refer to Figure 7 and the related description.

[0170] Step 630, based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor, in collaboration with the remaining n-1 parties, through one or more rounds of processing, obtaining the local share of the absolute value of the quotient.

[0171] The quotient is essentially a multiple of the divisor, and the process of obtaining the quotient can be regarded as a process of decomposing the dividend into a certain multiple (integer multiple) of the divisor. However, it should be noted that decomposition generally means that the dividend as the decomposition object is greater than or equal to the divisor as the decomposition unit. On the one hand, if only the decomposition means is relied on to calculate the quotient, the case where the dividend is less than the divisor cannot be handled. On the other hand, when the dividend is greater than the divisor (for example, 11 divided by 4, the determined multiple is 2, and the remainder 3 is ignored), the quotient can be approximated as the multiple determined by decomposing the dividend; when the dividend is less than the divisor (for example, 3 divided by 6), the quotient can be determined as 0 (equivalent to the dividend being directly ignored as the remainder). Obviously, this method of ignoring the remainder will result in a loss of calculation accuracy, and the closer the remainder is to the divisor, the greater the calculation error. In view of this, the multi-party secure division protocol provided in the specification can obtain a calculation result that meets a certain accuracy requirement by amplifying the remainder and continuing to decompose the amplified remainder, regardless of the size relationship between the dividend and the divisor. For more details of the multi-party secure division protocol provided in the specification, please refer to Figure 8 and the related description.

[0172] Step 640, based on the local slice of the absolute value of the quotient, the local slice of the sign identifier of the dividend, and the local slice of the sign identifier of the divisor, and in cooperation with the remaining n-1 parties, the local slice of the quotient is obtained.

[0173] The sign identifier of the dividend can indicate the positive or negative of the dividend, and the sign identifier of the divisor can indicate the positive or negative of the divisor, and the positive or negative of the dividend and the divisor determines the positive or negative of the quotient, therefore, based on the sign identifier of the dividend and the sign identifier of the divisor, the absolute value of the quotient can be restored to the quotient, and thus the local slice of the quotient can be obtained based on the local slice of the absolute value of the quotient, the local slice of the sign identifier of the dividend, and the local slice of the sign identifier of the divisor.

[0174] For specific implementation of step 640, please refer to Figure 10 and the related description.

[0175] Figure 7 is an exemplary flowchart of a multi-party secure calculation of an absolute value method according to some embodiments of the specification. Each party holds a slice of a target number x.

[0176] Flow 700 can be performed by any of the n parties, as shown in Figure 7 Flow 700 can include the following steps.

[0177] Step 710, based on the local slice of the target number and the local slice of the first preset value, and in cooperation with the remaining n-1 parties, the local slice of the result identifier is obtained through a multi-party secure comparison protocol.

[0178] The first preset value can be 0 or a value close to 0 (such as ±1), and the result identifier indicates whether the target number is a negative number. For example, the first preset value can be equal to 0. When the target number is not less than 0, that is, x≥0, the result identifier is equal to 1; otherwise, that is, x<0, the result identifier is equal to 0.

[0179] In step 720, based on the local share of the target number and the local share of the result identifier, each party collaborates with the remaining n-1 parties to obtain the local share of the absolute value of the target number through a multi-party secure multiplication protocol.

[0180] Based on the target number and the result identifier, the absolute value of the target number can be reconstructed. Specifically, the result identifier can be mapped to ±1, and the absolute value of the target number |x| is equal to the product of the target number x and ±1. Correspondingly, each party can obtain the local share [|x|] of the absolute value of the target number |x| based on the local share [x] of the target number x and the local share of the result identifier through a multi-party secure multiplication protocol in collaboration with the remaining n-1 parties.

[0181] In some embodiments, the first preset value can be equal to 0. When the target number is not less than 0, i.e., x≥0, the result identifier is equal to 1, otherwise, it is equal to 0. Without loss of generality, the result identifier here can be denoted as sgn(x). Based on this, the i-th party can obtain the local share of the sign identifier by cooperating with the remaining n-1 parties through a multi-party secure multiplication protocol based on the local share of the result identifier sgn(x) and the local share of the second preset value. The sign identifier indicates the sign of the target number. Specifically, a non-negative number can correspond to +, and correspondingly, the sign identifier can be equal to +1; a negative number can correspond to -, and correspondingly, the sign identifier can be equal to -1. Further, each party can obtain the local share of the absolute value of the target number |x| (equal to the product of the target number x and ±1) by cooperating with the remaining n-1 parties through a multi-party secure multiplication protocol based on the local share of the sign identifier (such as ±1) and the local share of the target number x. The second preset value can be determined according to the specific result identifier and the sign identifier. For example, assuming that the result identifier is denoted as sgn(x); when x≥0, sgn(x) = 1, and the sign identifier is equal to +1; when x<0, sgn(x) = 0, and the sign identifier is equal to -1. Then, the second preset value can be equal to 2, and each party can obtain the local share of the third product (equal to 2*sgn(x)) by cooperating with the remaining n-1 parties through a multi-party secure multiplication protocol based on the local share of the result identifier sgn(x) and the local share of the second preset value. Further, each party can obtain the local share of the sign identifier (equal to 2*sgn(x)-1, which can be regarded as an updated third product) by subtracting the local share of the third preset value (equal to 1) from the local share of the third product. The absolute value of the target number is equal to the updated third product multiplied by the target number, i.e., |x| = (2*sgn(x)-1)*x, so each party can obtain the local share of the absolute value of the target number |x| by cooperating with the remaining n-1 parties through a multi-party secure multiplication protocol based on the local share of the updated third product and the local share of the target number.

[0182] Figure 8 is an exemplary flowchart of obtaining the local share of the absolute value of the quotient according to some embodiments of the present specification. The process can include one or more rounds of processing. Each round of processing can include performing steps 810-840 when the precision number meets the preset condition, otherwise ending the current round of processing. The precision number can be used to determine whether the precision meets the requirement. For example, the preset condition can be p>0, where p represents the precision number. In addition, the precision number is updateable (see the related description of step 810), and when the precision number is updated to no longer meet the preset condition, the quotient absolute value calculation result that meets the precision requirement can be obtained. Specifically, the precision requirement here can refer to retaining a preset number of decimal places, such as 16 bits (i.e., setting p = 16).

[0183] Step 810, determine whether the absolute value of the dividend |a| is less than the absolute value of the divisor |b|.

[0184] Each party holds a shard of the absolute value of the dividend |a| and a shard of the absolute value of the divisor |b|, so the size relationship between the absolute value of the dividend |a| and the absolute value of the divisor |b| can be determined by a multi-party secure comparison protocol. Specifically, any party can determine whether the absolute value of the dividend |a| is less than the absolute value of the divisor |b| based on the local shard of the absolute value of the dividend [|a|] and the local shard of the absolute value of the divisor [|b|], and in cooperation with the remaining n-1 parties through a multi-party secure comparison protocol. The comparison result can be disclosed to the n parties, and the disclosure details can refer to the related description of step 380.

[0185] Reference Figure 8 When |a|≥|b| or the precision number (before updating) does not satisfy the preset condition (for example, p>0), no updating is performed, and step 820 can be continued to be executed; otherwise, when |a|<|b| and the precision number satisfies the preset condition (for example, p>0), one or more updates 812 need to be performed until the absolute value of the dividend is not less than the absolute value of the divisor (that is, |a|≥|b|) or the precision number (after updating) no longer satisfies the preset condition (for example, p=0). Each update involves three variables: first, updating the local shard of the absolute value of the dividend [|a|] so that the absolute value of the dividend |a| is expanded by a multiple; second, updating the local shard of the absolute value of the quotient [|d|] so that the absolute value of the quotient |d| is expanded by the same multiple; and third, updating the precision number. That is, when step 820 is executed, the absolute value of the dividend is not less than the absolute value of the divisor or the precision number (after updating) has not satisfied the preset condition.

[0186] For example, when a decimal fixed-point number is used, reference Figure 8 Each update can expand the absolute value of the dividend |a| and the absolute value of the quotient |d| by 10 times. In some embodiments, the expansion of the absolute value of the dividend |a| and the absolute value of the quotient |d| can be achieved through a multi-party secure multiplication protocol. In some embodiments, the expansion of the absolute value of the dividend |a| and the absolute value of the quotient |d| can be achieved locally at each party, that is, each party can expand the local shard of the absolute value of the dividend [|a|] and the local shard of the absolute value of the quotient [|d|] by the same multiple, for example, as shown in Figure 8 , both are expanded by 10 times (that is, [|a|]=10[|a|], [|d|]=10[|d|]). In this way, the absolute value of the dividend |a| and the absolute value of the quotient |d| can also be expanded by the same multiple, and local expansion can save the communication amount between the computing parties.

[0187] As Figure 8After the update, the precision number p can be reduced to 0 (i.e., the precision number no longer satisfies the preset condition), and the last round of processing is ended, and the slice of the absolute value of the quotient with the required precision is obtained. For example, in the previous example, the initial value of the precision number can be 16, and after 16 updates, the precision number is reduced to 0, and in the 17th round of processing, the slice of the absolute value of the quotient with 16 digits after the decimal point (approximately equal to 3.6) is obtained. For another example, if the precision requirement in the previous example is adjusted to 1 digit after the decimal point, the initial value of the precision number can be 1, and after 1 update, the precision number is reduced to 0, and in the 2nd round of processing, the slice of the absolute value of the quotient with 1 digit after the decimal point (equal to 3.6) is obtained.

[0188] The initial value of the precision number and the update rule of the precision number are not limited in the specification. For example, in some embodiments, for the first round of processing, the precision number p can be a preset integer (denoted as p0, such as p0=0). The preset condition for the precision number p can include that the precision number p is less than a threshold p1, satisfying p0

[0189] Step 820, obtaining the local slice [Δd] of the multiple Δd and the local slice [Δa] of the remainder Δa.

[0190] Any party can obtain the local slice [Δd] of the multiple Δd and the local slice [Δa] of the remainder Δa based on the local slice [|a|] of the absolute value of the dividend |a| and the local slice [|b|] of the absolute value of the divisor |b|, and in collaboration with the other n-1 parties, through a multi-party secure decomposition protocol.

[0191] For more details of the multi-party secure decomposition protocol, please refer to Figure 9 and related descriptions.

[0192] Step 830, adding the local slice [Δd] of the multiple Δd to the local slice [|d|] of the absolute value of the quotient |d| to update the local slice [|d|] of the absolute value of the quotient |d|. That is, [|d|]=[|d|]+[Δd].

[0193] It can be understood that in the first round of processing, the absolute value of the quotient |d| before updating can be equal to 0. Specifically, in the first round of processing, each party can add the local slice of the multiple Δd [Δd] to the local slice of the first preset value (equal to 0) to update the local slice of the absolute value of the quotient |d| [|d|]. Of course, in the first round of processing, each party can also directly take the local slice of the multiple Δd [Δd] as the local slice of the updated absolute value of the quotient |d| [|d|], which is actually equivalent to the foregoing method.

[0194] Step 840, taking the local slice of the remainder Δa [Δa] as the local slice of the updated absolute value of the dividend |a| [|a|]. That is, [|a|] = [Δa].

[0195] In combination with steps 820-840, it can be understood that the same multiple expansion of the absolute value of the dividend |a| and the absolute value of the quotient |d| is to ensure the correctness of the multiple accumulation. Specifically, the expanded absolute value of the dividend |a| in the i+1th round of processing is actually the remainder generated in the previous i th round of processing, and the expanded absolute value of the quotient |d| in the i+1th round of processing is actually the sum of the multiples (hereinafter referred to as the historical accumulated multiple) obtained in the previous i rounds of processing. For example, assuming that |a| = 11, |b| = 3, the calculation result is a decimal fixed-point number and the accuracy requirement is to retain 16 digits after the decimal point. In the first round of processing, 11 is decomposed in a secret state to obtain a multiple of 3 and a remainder of 2 (11 = 3 x 3 + 2), and the remainder 2 becomes the updated absolute value of the dividend |a| (i.e., |a| = 2). In the second round of processing, the absolute value of the dividend |a| is expanded to 10 times, and the updated absolute value of the dividend |a| is 20. 20 is decomposed in a secret state to obtain a multiple of 6 and a remainder of 2 (20 = 6 x 3 + 2), and the remainder 2 becomes the updated absolute value of the dividend |a| (i.e., |a| = 2). In the third round of processing, the absolute value of the dividend |a| is expanded to 10 times, and the updated absolute value of the dividend |a| is 20. 20 is decomposed in a secret state to obtain a multiple of 6 and a remainder of 2 (20 = 6 x 3 + 2). In this way, in the 17th round of processing, 20 is decomposed in a secret state to obtain a multiple of 6. The absolute value of the quotient |a| / |b| is equal to the infinite repeating decimal 3.66..., and the integer corresponding to the fixed-point number obtained by retaining 16 digits after the decimal point (which is equivalent to removing the decimal point of the fixed-point number or expanding the fixed-point number to 10 16 16 +6 x 10 15 +6 x 10 14 ​+... + 6x10+6). It is not difficult to see that the absolute value of the remainder of the divisor |a| (the last round) is multiplied by one, and the absolute value of the quotient |d| (historical cumulative multiplier) needs to be multiplied by the same number to ensure that the multiplier (3, 6, 6...) obtained after 17 rounds of processing is arranged in turn to form a fixed point number (approximately equal to 3.6) with 16 digits after the decimal point of the reserved theoretical value (equal to |a| / |b|) as the final calculation result. Of course, the final calculation result is distributed in the form of fragments in n parties.

[0196] Figure 9 is an exemplary flowchart of a multi-party secure decomposition method according to some embodiments of the present specification. Each party holds a fragment [a] of a first number a and a fragment [b] of a second number b, the first number a (non-negative number) is the decomposition object, and the second number b (positive number) is the decomposition unit, so a> b. The flowchart includes m+1 rounds of loops, m is a positive integer (also referred to as encryption length). As shown in Figure 9 , the i-th round of loop can include the following steps, i is a positive integer not greater than m+1. It can be understood that the first number a can be the absolute value of the divisor |a| described above, and the second number b can be the absolute value of the divisor |b| described above.

[0197] Step 910, determining the local fragment [dd i ] of the current multiplier dd i of the current round (i-th round).

[0198] In some embodiments, the local fragment of the multiplier corresponding to each round of loop can be the same or different. In order to efficiently (such as faster and more thoroughly) decompose the first number, the current multiplier dd i can be set as a variable that decreases as the loop progresses (that is, as the loop sequence number i increases), in other words, a larger scale of the current multiplier is used to try to decompose the first number in the loop of the earlier round, and the scale of the decomposition is gradually reduced as the loop progresses. As an example, the current multiplier dd i may be equal to 2 m+1-i , where i is the sequence number of the current round (i-th round). Since the current multiplier dd i may be a set of constants, the local fragment [dd i ] of the current multiplier dd i held by each party can be pre-configured, and when used, the local fragment of the corresponding current multiplier is taken out according to the sequence number of the current round of loop for calculation. For example, the current multiplier dd m+1 of the last round of training is equal to 1, and any party can pre-configure the local fragment [dd m+1 ] of dd m+1 to 1, and the remaining n-1 parties will pre-configure the local fragment [dd m+1 ] of dd m+1 to 1.is pre-configured as 0. In some embodiments, any party can locally generate the current multiplier Δd i and split it into n shares, one of which is taken as the local share [Δd i ] of the current multiplier Δd i and the remaining n-1 shares are distributed to the remaining n-1 parties, so that each party can hold a share [Δd i ] of the current multiplier Δd i It can be understood that any pre-configured share mentioned in the specification can also be generated and distributed by a party on a temporary basis.

[0199] Step 920, obtaining a local share [e] of the intermediate product e.

[0200] The intermediate product e is equal to the current multiplier Δd i multiplied by the second number β, i.e., e = Δd i β, therefore, any party can, based on the local share [Δd i ] of the current multiplier Δd i and the local share [β] of the second number β, cooperate with the remaining n-1 parties to obtain the local share [e] of the intermediate product e through a multi-party secure multiplication protocol.

[0201] Step 930, obtaining a local share [s] of the result identifier s.

[0202] The result identifier s indicates whether the intermediate product e is less than the first number α, therefore, any party can, based on the local share [e] of the intermediate product e and the local share [α] of the first number α, cooperate with the remaining n-1 parties to obtain the local share [s] of the result identifier s through a multi-party secure comparison protocol. When the intermediate product e is less than the first number α (i.e., Δd i β < α), it means that the multiplier Δd i can be taken as part of the multiplier Δd from the decomposition object α, i.e., more decomposition units β can be decomposed from the decomposition object α.

[0203] Step 940, revealing the result identifier s.

[0204] Any party can, based on the local share [s] of the result identifier s, cooperate with the remaining n-1 parties to reveal the result identifier s in order to determine whether the intermediate product e is less than the first number α. For more details about revealing the result identifier s, please refer to the relevant description of step 380.

[0205] According to the foregoing, when the result identifier s indicates that the intermediate product e is less than the first number α, the multiplier Δd i can be taken as part of the multiplier Δd, and step 950 can be performed accordingly.

[0206] Step 950, taking the current multiplier Δd iLocal fragments [Δd] i The sum is added to the local fragment [t] of the target multiple t to update the local fragment [t] of the target multiple t, that is, [t] = [t] + [Δd] i ]; and, subtract the local fragment [e] of the intermediate product e from the local fragment [α] of the first number α to update the local fragment [α] of the first number α, i.e., [α] = [α] - [e].

[0207] It is understandable that the target multiple d in the first round of the cycle is... i It can equal 0. Of course, in the first round of the loop, each side can directly set the current multiple Δd. i Local fragments [Δd] i The local partition [t] of the updated target multiple t is used as the local partition. For each round of accumulation of the current multiple (i.e., for each multiple decomposed), the first number must be subtracted from the corresponding intermediate product in a dense state to ensure that the next round continues decomposition based on the remainder of the first number (subtracted from the intermediate product). After completing m+1 rounds of iteration, the local partition [t] of the target multiple t in the last round can be used as the local partition [Δd] of the multiple Δd, and the local partition [α] of the updated first number α can be used as the local partition [Δa] of the remainder Δa. It can be seen that the local partition [Δd] of the multiple Δd is equal to all the current multiples Δd that participated in the accumulation in m+1 rounds (condition: e < α). i Local fragments [Δd] i The sum of ], i.e., Δd = ∑ e<α Δd i Equivalently, when the current multiple Δd i As described in step 910, set it to 2. m+1-i When the multiple Δd is stored as a binary number of length m+1, the relationship between the intermediate product e and the first number α determines whether each bit of the binary number is 0 or 1. Specifically, in the i-th iteration, if e < α, then the i-th bit of the binary number (the highest bit is the 1st bit, the second highest bit is the 2nd bit, and so on, with the lowest bit being the m+1th bit) is 1; otherwise, the i-th bit of the binary number is 0. The multiple Δd multiplied by the second number β plus the remainder Δa equals the first number α, i.e., Δd*β + Δα = α. It should be noted that the remainder mentioned in this specification is not entirely equivalent to the mathematical concept of remainder. In mathematics, the remainder is generally defined as less than the divisor (only discussing the non-negative range, corresponding to the second number as the unit of decomposition), but the remainder Δα (such as remainder Δa) in this specification can be less than the second number β (such as the absolute value of the divisor |b|), or it can be greater than the second number β.

[0208] The following example will help us understand this more intuitively. Figure 9 The multi-party secure decomposition method is shown. First, let's assume: α = 36, β = 7; Δd i =2m+1-i and m = 3. Then, there are 4 rounds of cycles in total: in the 1st round of cycle, the current multiplier Ad = 2 3 , the intermediate product e = 2 3 x 7 > 36, correspondingly, the slice [t] of the target multiplier t is still the slice [0] of 0 (equal to 0 x 2 3 ), and the slice [a] of the first number a is still the slice

[36] of 36; in the 2nd round of cycle, the current multiplier Ad = 2 2 x 7 < 36, correspondingly, the slice [t] of the target multiplier t is updated to the slice [4] of 4 (equal to 0 x 2 3 + 1 x 22), and the slice [a] of the first number a is updated to the slice [8] of 8 (equal to 36 - 22 x 7); in the 3rd round of cycle, the current multiplier Ad = 2 1 , the intermediate product e = 2 1 x 7 > 8, correspondingly, the slice [t] of the target multiplier t is still the slice [4] of 4 (equal to 0 x 2 3 + 1 x 22 + 0 x 2 1 ), and the slice [a] of the first number a is still the slice [8] of 8; in the 4th round of cycle, the current multiplier Ad = 2 0 , the intermediate product e = 2 0 x 7 < 8, correspondingly, the slice [t] of the target multiplier t is updated to the local slice [4] of 5 (equal to 0 x 2 3 + 1 x 22 + 0 x 2 1 + 1 x 2 0 ), and the slice [a] of the first number a is updated to the slice [1] of 1. Finally, the slice [Ad] of the multiplier Ad = [5], and the slice [Da] of the remainder Da = [1]. Since 36 = 5 x 7 + 1, it is obvious that the above process of resolving the ciphertext is as expected.

[0209] Figure 10 is an exemplary flowchart of restoring the absolute value of a quotient to the quotient in a ciphertext according to some embodiments of the present specification. Where the dividend a is not negative, i.e., a > 0, the dividend sign identifier sgn(a) is equal to 1, otherwise (i.e., a < 0) equal to 0; where the divisor b is not negative, i.e., b > 0, the divisor sign identifier sgn(b) is equal to 1, otherwise (i.e., b < 0) equal to 0.

[0210] As shown in FIG. 10, the flow 1000 can include the following steps. Figure 10

[0211] Step 1010, obtaining the local slice [d sign ] of the quotient sign identifier d sign .

[0212] ​Each party can, based on its local partition [sgn(a)] of the dividend symbol sgn(a) and its local partition [sgn(b)] of the divisor symbol sgn(b), collaborate with the other n-1 parties to obtain the quotient symbol d. sign Local fragments [d sign The quotient symbol d represents the quotient. sign It is equal to the XOR result of the dividend sign identifier sgn(a) and the divisor sign identifier sgn(b), that is... When the dividend and divisor have the same sign, i.e., sgn(a) = sgn(b), the quotient d is greater than 0, and the quotient sign indicates d. sign The quotient d is 0; when the dividend a and divisor b have opposite signs, i.e., sgn(a) ≠ sgn(b), the quotient d is not greater than 0 and the quotient sign indicates d. sign The value is 1. In some embodiments, the XOR operation can be equivalent to a combination of addition and multiplication, for example, sgn(a)⊕sgn(b)=sgn(a)+sgn(b)-2sgn(a)*sgn(b). Based on this, the parties can obtain the quotient symbol identifier d through a multi-party secure multiplication protocol. sign Local fragments [d sign ], where the quotient symbol identifies d sign It equals the sum of the dividend and divisor signs minus twice the product of the dividend and divisor signs, i.e., d. sign =sgn(a)+sgn(b)-2sgn(a)*sgn(b).

[0213] Step 1020, obtain the fourth product 2*d sign Local fragments [2*d sign ].

[0214] Each party can use a local fragment based on a second preset value (equal to 2) [2] and a quotient symbol d. sign Local fragments [d sign In collaboration with the remaining n-1 parties, and through a multi-party secure multiplication protocol, the fourth product 2*d is obtained. sign Local fragments [2*d sign In some embodiments, each party may also directly calculate 2 multiplied by the quotient symbol d locally. sign Local fragments [d sign ], thus obtaining [2*d sign ].

[0215] Step 1030: Subtract the local fragments of the fourth product from the local fragments of the third preset value to obtain the updated local fragments of the fourth product [1-2*d]. sign ].

[0216] wherein the third preset value equals 1, and the step 1030 can be represented as [1-2*d sign ] = [1] - [2*d sign ].

[0217] In step 1040, the local share [d] of the quotient d is obtained.

[0218] Each party can obtain the local share [d] of the quotient d by cooperating with the remaining n-1 parties through a multi-party secure multiplication protocol based on the local share [1-2*d sign ] of the updated fourth product and the local share [|d|] of the absolute value |d| of the quotient d. The quotient d is equal to the fourth product (updated as 1-2*d sign ) multiplied by the absolute value |d| of the quotient, i.e., d = (1-2*d sign )*|d|. According to the foregoing, when d>0, d sign =0; when d≤0, d sign =1. Thus, when d>0, d = |d|; when d≤0, d = -|d|, and it is obvious that the quotient restoration is as expected.

[0219] Figure 11 is an exemplary flowchart of multi-party secure unsigned number division according to some embodiments of the present disclosure. Each party holds a share of the dividend a and a share of the divisor b, both of which are unsigned numbers. The flowchart can be executed by any of the n parties.

[0220] It is worth noting that Figure 11 The multi-party secure unsigned number division shown in FIG. 11 can also be applied to signed number division. Specifically, when the sign of the dividend a' and the sign of the divisor b' are both public information, such as when the sign does not involve data privacy or all relevant data are non-negative numbers, the sign of the quotient d' is also public information. In this way, the n parties can separately calculate the quotient d of the dividend value part a and the divisor value part b in a secret state as the value part of the quotient d' of the dividend a' and the divisor b', i.e., the dividend value part a and the divisor value part b can be substituted into the unsigned number division as unsigned numbers (or absolute values of signed numbers). It can be understood that unsigned numbers do not need to consider the sign and the absolute value, and therefore, the i-th party can obtain the local share d i of the quotient d by cooperating with the remaining n-1 parties through one or more rounds of processing based on the local share a i of the dividend a and the local share b i of the divisor b. One round of processing can include that each round of processing can include executing steps 1110-1040 when the precision number p satisfies a preset condition (such as p>0), and otherwise ending the round of processing.

[0221] In step 1110, it is determined whether the dividend a is less than the divisor b.

[0222] Each party holds a share of the dividend a and a share of the divisor b, so the size relationship between the dividend a and the divisor b can be determined by a multi-party secure comparison protocol. Specifically, any party can determine whether the dividend a is smaller than the divisor b based on its local share of the dividend a and its local share of the divisor b, in collaboration with the remaining n-1 parties, by a multi-party secure comparison protocol. The comparison result can be disclosed to the n parties, and the disclosure details can be referred to the description of step 380.

[0223] When a 0, one or more updates are performed until the dividend is not smaller than the divisor (i.e., a ≥ b) or the precision number does not satisfy the preset condition (e.g., p = 0). Otherwise, no update is performed, and step 820 can be continued. Each update involves three variables: first, updating the local share of the dividend a so that the dividend a is multiplied by a factor; second, updating the local share of the quotient d so that the quotient d is multiplied by the same factor; and third, updating the precision number p.

[0224] In some embodiments, as shown in FIG. 8B, each party can multiply the local share of the dividend a and the local share of the quotient d by a factor of 10. Figure 11

[0225] Step 1120, obtaining the local share of the factor Δd and the local share of the remainder Δa.

[0226] Any party can obtain the local share of the factor Δd and the local share of the remainder Δa based on its local share of the dividend a and its local share of the divisor b, in collaboration with the remaining n-1 parties, by a multi-party secure decomposition protocol.

[0227] For more details about the multi-party secure decomposition protocol, please refer to Figure 9 and the related description.

[0228] Step 1130, adding the local share of the factor Δd to the local share of the quotient d to update the local share of the quotient d. That is, [d] = [d] + [Δd].

[0229] Step 1140, taking the local share of the remainder Δa as the updated local share of the dividend a. That is, [a] = [Δa].

[0230] Since the absolute value of a signed number can be regarded as an unsigned number, for more details about the process shown in FIG. 8C, please refer to Figure 11 and the related description. Figure 8

[0231] Figure 12 ​​is an exemplary flowchart of a method for calculating a multi-party secure sigmoid function according to some embodiments of the present disclosure. Each party holds a local share of a first number a, the first number being an input of the sigmoid function.

[0232] The flow 1200 can be performed by any of the n parties, as Figure 12 shown, the flow 1200 can include the following steps.

[0233] Step 1210, calculate a difference between a local share of a first preset value and a local share of the first number a [a], to obtain a local share of a first opposite number -a [-a].

[0234] wherein the first preset value is equal to 0, and the step 1210 can be represented as [-a] = [0] - [a].

[0235] Step 1220, obtain a local share of a natural exponential function value of the first opposite number -a [e -a ].

[0236] The natural exponential function value of the first opposite number refers to an output value of the natural exponential function when the first opposite number is used as an input value. Each party can obtain, based on the local share of the first opposite number -a [-a], a local share of the natural exponential function value e -a of the first opposite number -a [e -a ] by collaborating with the remaining n-1 parties through a multi-party secure natural exponential function calculation method.

[0237] In some embodiments, the step 1220 can be implemented through a multi-party secure natural exponential function calculation method as Figure 4 shown.

[0238] Step 1230, calculate a sum between a local share of a third preset value and a local share of the natural exponential function value e -a [e -a ] to obtain a local share of an intermediate sum value 1+e -a [1+e -a ].

[0239] wherein the third preset value is equal to 1, and the step 1230 can be represented as [1+e -a ] = [1] + [e -a ].

[0240] Step 1240, obtain a local share of a sigmoid function value of the first number a [Sigmoid(a)].

[0241] The Sigmoid function value for the first number refers to the output value of the Sigmoid function when the first number is taken as the input value. The Sigmoid function can be defined as Sigmoid(a) = 1 / (1+e^(a-a)). -a Therefore, each party can base its local fragmentation on a third preset value (equal to 1) [1] and the intermediate sum 1+e. -a Local fragments [1+e -a In collaboration with the remaining n-1 parties, a local slice of the Sigmoid function value of the first number a is obtained [Sigmoid(a)] through a multi-party secure division protocol.

[0242] In some embodiments, step 1240 can be performed as follows: Figure 6 The multi-party safe division is shown.

[0243] In some embodiments, step 1240 can be performed as follows: Figure 11 The multi-party secure unsigned number division implementation is shown.

[0244] Figure 13 This is an exemplary flowchart illustrating a method for calculating a multi-party secure Tanh function according to some embodiments of this specification. Each party holds a slice [a] of a first number a, which is the input to the Tanh function.

[0245] Process 1300 can be executed by any of the n parties, such as Figure 13 As shown, process 1300 may include the following steps.

[0246] Step 1310: Calculate the difference between the local fragment of the first preset value and the local fragment [a] of the first number a, to obtain the local fragment [-a] of the first opposite number -a.

[0247] Wherein, the first preset value is equal to 0, and step 1310 can be expressed as [-a] = [0] - [a].

[0248] Step 1320, obtain the local slice of the natural exponential function value of the first number a [e a ].

[0249] The natural exponential function value of the first number refers to the output value of the natural exponential function when the first number is used as the input. Each party can, based on its local slice [a] of the first number a, collaborate with the other n-1 parties to obtain the natural exponential function value e with the first number a as input through a multi-party secure natural exponential function calculation method. a Local fragments [e a ].

[0250] In some embodiments, step 1320 can be performed as follows: Figure 4 The multi-party secure natural exponential function calculation method shown is implemented.

[0251] Step 1330, obtaining the local share [e -a ] of the natural exponential function value of the first opposite number -a.

[0252] The natural exponential function value of the first opposite number refers to the output value of the natural exponential function when the first opposite number is input. Each party can obtain the local share [e -a ] of the natural exponential function value e -a ] of the first opposite number -a based on the local share [-a] of the first opposite number -a, and collaborates with the remaining n-1 parties to obtain the natural exponential function value e a ] of the first number a through the multi-party secure natural exponential function calculation method.

[0253] In some embodiments, step 1330 can be implemented through the multi-party secure natural exponential function calculation method as shown in Figure 4 .

[0254] Step 1340, calculating the difference between the local share [e a ] of the natural exponential function value of the first number a and the local share [e -a ] of the natural exponential function value of the first opposite number, to obtain the local share [e a -e -a ] of the intermediate difference value e a -e -a ]. That is, [e a -e -a ] = [e a ] - [e -a ].

[0255] Step 1350, calculating the sum of the local share [e a ] of the natural exponential function value of the first number a and the local share [e -a ] of the natural exponential function value of the first opposite number, to obtain the local share [e a +e -a ] of the intermediate sum value e a +e -a ]. That is, [e a +e -a ] = [e a ] + [e -a ].

[0256] Step 1360, the local share [Tanh(a)] of the Tanh function value of the first number a.

[0257] The Tanh function value of the first number refers to the output value of the Tanh function when the first number is input. The Tanh function can be defined as Tanh(a) = (e a -e -a ) / (e a +e-a Therefore, each side can be based on the intermediate difference e. a -e -a Local fragments [e a -e -a ] and the intermediate value e a +e -a Local fragments [e a +e -a In collaboration with the remaining n-1 parties, the local slice [Tanh(a)] of the Tanh function value of the first number a is obtained through a multi-party secure division protocol.

[0258] In some embodiments, step 1360 can be performed as follows: Figure 6 The multi-party safe division is shown.

[0259] In some embodiments, step 1360 can be performed as follows: Figure 11 The multi-party secure unsigned number division implementation is shown.

[0260] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0261] Figure 14 This is an exemplary block diagram of a multi-party secure multiplication system according to some embodiments of this specification. Each party holds a slice of a first number and a slice of a second number.

[0262] System 1400 can be implemented in any of the n sides, such as Figure 14 As shown, system 1400 may include multiplier fragment sending module 1410, multiplier fragment receiving module 1420, local product term calculation module 1430, first cross term calculation module 1440, second cross term calculation module 1450 and multiplier fragment calculation module 1460.

[0263] The multiplier fragment sending module 1410 can be used to send local fragments of the first multiplier and local fragments of the second multiplier to the other party or the other multiple parties.

[0264] The multiplier fragment receiving module 1420 can be used to receive other fragments of the first multiplier and other fragments of the second multiplier from the other party or the other multiple parties. The number of the other multiple parties is no greater than n-2.

[0265] The local product term calculation module 1430 can be used to multiply the local fragments of the first multiplier and the local fragments of the second multiplier to obtain the local product term.

[0266] The first cross term computation module 1440 can be configured to multiply the local share of the first multiplicand with the other shares of the second multiplicand, respectively, to obtain one or more first cross terms.

[0267] The second cross term computation module 1450 can be configured to multiply the local share of the second multiplicand with the other shares of the first multiplicand, respectively, to obtain one or more second cross terms.

[0268] The product share computation module 1460 can be configured to obtain a local share of a product of the first multiplicand and the second multiplicand based on the local product term, the one or more first cross terms, and the one or more second cross terms.

[0269] Further details regarding the system 1400 and its modules can be found in Figure 2 and related descriptions.

[0270] Figure 15 is an exemplary module diagram of a multi-party secure comparison system according to some embodiments of the present specification. Each party holds a share of a first number and a share of a second number.

[0271] The system 1500 can be implemented at any of the n parties, as Figure 15 The system 1500 can include a random number share obtaining module 1510, a first comparison function share obtaining module 1520, a second comparison function share obtaining module 1530, a first product computation module 1540, a second product computation module 1550, a target difference computation module 1560, an intermediate product computation module 1570, an intermediate product revealing module 1580, and a result identification computation module 1590, as shown.

[0272] The random number share obtaining module 1510 can be configured to obtain a local share of a first selected random number, a local share of a second selected random number, and a local share of a masking random number, the first selected random number being related to the second selected random number.

[0273] The first comparison function share obtaining module 1520 can be configured to obtain a local share of a first comparison function, the first comparison function reflecting a difference of the first number minus the second number.

[0274] The second comparison function share obtaining module 1530 can be configured to obtain a local share of a second comparison function, the second comparison function reflecting a difference of the second number minus the first number.

[0275] The first product computation module 1540 can be configured to obtain, in collaboration with the remaining n-1 parties, a local share of a first product of the first selected random number and the first comparison function, by a multi-party secure multiplication as described in any embodiment of the present specification, based on the local share of the first selected random number and the local share of the first comparison function.

[0276] The second product calculation module 1550 can be configured to obtain, based on the local share of the second selected random number and the local share of the second comparison function, the local share of the second product of the second selected random number and the second comparison function, in collaboration with the remaining n-1 parties, by the multiparty secure multiplication as described in any embodiment of the present specification.

[0277] The target difference calculation module 1560 can be configured to obtain, based on the local share of the first product and the local share of the second product, the local share of the target difference.

[0278] The intermediate product calculation module 1570 can be configured to obtain, based on the local share of the target difference and the local share of the masking random number, the local share of the intermediate product, in collaboration with the remaining n-1 parties, by the multiparty secure multiplication as described in any embodiment of the present specification, the intermediate product being equal to the product of the target difference and the masking random number.

[0279] The intermediate product disclosure module 1580 can be configured to disclose, based on the local share of the intermediate product, the intermediate product, in collaboration with the remaining n-1 parties.

[0280] The result identifier calculation module 1590 can be configured to: when the intermediate product is greater than 0, obtain, based on the local share of the first selected random number and the local share of the second preset value, the local share of the exclusive or result of the first selected random number and the second preset value, in collaboration with the remaining n-1 parties, and take the local share as the local share of the result identifier; otherwise, obtain, based on the local share of the first selected random number and the local share of the first preset value, the local share of the exclusive or result of the first selected random number and the first preset value, in collaboration with the remaining n-1 parties, and take the local share as the local share of the result identifier. The first preset value is equal to 1, the second preset value is equal to 0, the result identifier being equal to 1 indicates that the first number is not less than the second number, and the result identifier being equal to 0 indicates that the first number is less than the second number.

[0281] For more details about the system 1500 and its modules, reference can be made to Figure 3 and related descriptions.

[0282] Figure 16 is an exemplary module diagram of a multiparty secure natural exponential function calculation system according to some embodiments of the present specification. Each party holds a share of the first number.

[0283] The system 1600 can be implemented at a party among the n parties, such as Figure 16As shown, system 1600 may include a first data segmentation acquisition module 1610, a first recombination module 1620, a first natural exponential function calculation module 1630, a first secret sharing module 1640, a second natural exponential function value segmentation acquisition module 1650, and a second natural exponential function calculation module 1660.

[0284] The first number slice acquisition module 1610 can be used to acquire other slices of the first number from the remaining k squares, where k is no greater than n-2.

[0285] The first recombination module 1620 is used to sum the local fragments of the first number and k other fragments to obtain the first recombined fragment of the first number.

[0286] The first natural exponential function calculation module 1630 can be used to calculate the natural exponential function value of the first recombined piece of the first number, and obtain the first natural exponential function value. The natural exponential function value of the number is the output value of the natural exponential function when the number is used as the input value.

[0287] The first secret sharing module 1640 can be used to split the first natural exponential function value into n parts, distribute n-1 of them to the remaining n-1 parties, and use the remaining 1 part as a local fragment of the first natural exponential function value.

[0288] The second natural exponential function value slice acquisition module 1650 can be used to obtain slices of the second natural exponential function value from the rest, as local slices of the second natural exponential function value. The second natural exponential function value is equal to the natural exponential function value of the second recombined slice of the first number. The second recombined slice of the first number is equal to the sum of the other slices of the first number in the remaining n-(1+k) squares.

[0289] The second natural exponential function calculation module 1660 can be used to obtain the local slice of the natural exponential function value of the first number by cooperating with the other n-1 parties through multi-party secure multiplication as described in any embodiment of this specification.

[0290] For more details about System 1600 and its modules, please refer to [link / reference]. Figure 4 And its related descriptions.

[0291] Figure 17 This is an exemplary block diagram of a computational system for a multi-party secure linear rectified function, as shown in some embodiments of this specification. Each party holds a first number of slices.

[0292] System 1700 can be implemented in any of the n sides, such as Figure 17 As shown, system 1700 may include a first secure comparison module 1710 and a first secure multiplication module 1720.

[0293] The first secure comparison module 1710 can be configured to obtain, based on the local share of the first number and the local share of the second preset value, the local share of the comparison result in collaboration with the remaining n-1 parties by the multi-party secure comparison method as described in any embodiment of the present specification, wherein the second preset value is equal to 0.

[0294] The first secure multiplication module 1720 can be configured to obtain, based on the local share of the first number and the local share of the comparison result, the local share of the product result of the first number and the comparison result in collaboration with the remaining n-1 parties by the multi-party secure multiplication as described in any embodiment of the present specification, and take the local share of the product result as the local share of the function value, wherein the function value is the output value of the linear rectifier function when the first number is the input value.

[0295] For more details about the system 1700 and its modules, please refer to Figure 5 and the related descriptions.

[0296] Figure 18 is an exemplary module diagram of a multi-party secure division system according to some embodiments of the present specification. Each party holds a share of the dividend and a share of the divisor.

[0297] The system 1800 can be implemented in any of the n parties, as Figure 18 The system 1800 can include a sign determination module 1810, an absolute value determination module 1820, a quotient absolute value calculation module 1830, and a quotient restoration module 1840, as

[0298] The sign determination module 1810 can be configured to determine, based on the local share of the dividend and the local share of the divisor respectively, the local share of the dividend sign identifier and the local share of the divisor sign identifier in collaboration with the remaining n-1 parties by the multi-party secure sign protocol.

[0299] The absolute value determination module 1820 can be configured to determine, based on the local share of the dividend and the local share of the divisor respectively, the local share of the dividend absolute value and the local share of the divisor absolute value in collaboration with the remaining n-1 parties by the multi-party secure absolute value protocol.

[0300] The quotient absolute value calculation module 1830 can be configured to obtain, based on the local share of the dividend absolute value and the local share of the divisor absolute value, the local share of the quotient absolute value in collaboration with the remaining n-1 parties by one or more rounds of processing.

[0301] The quotient restoration module 1840 can be configured to obtain, based on the local share of the quotient absolute value, the local share of the dividend sign identifier and the local share of the divisor sign identifier, the local share of the quotient in collaboration with the remaining n-1 parties.

[0302] Further details about system 1800 and its modules can be found in Figure 6 and related descriptions.

[0303] Figure 19 is an exemplary module diagram of a system for multi-party secure computation of absolute value according to some embodiments of the present specification. Each party holds a share of a target number.

[0304] System 1900 can be implemented at any of the n parties, such as Figure 19 System 1900 can include a result identity computation module 1910 and an absolute value computation module 1920, as shown.

[0305] Result identity computation module 1910 can be configured to, based on the local share of the target number and the local share of the first preset value, collaborate with the remaining n-1 parties to obtain a local share of a result identity by a multi-party secure comparison protocol, the result identity indicating whether the target number is negative.

[0306] Absolute value computation module 1920 can be configured to, based on the local share of the target number and the local share of the result identity, collaborate with the remaining n-1 parties to obtain a local share of an absolute value of the target number by a multi-party secure multiplication protocol.

[0307] Further details about system 1900 and its modules can be found in Figure 7 and related descriptions.

[0308] Figure 20 is an exemplary module diagram of a system for multi-party secure decomposition according to some embodiments of the present specification. Each party holds a share of a first number and a share of a second number.

[0309] System 2000 can be implemented at any of the n parties, such as Figure 20 System 2000 can include a decomposition module 2010, as shown.

[0310] The decomposition module 2010 can be configured to perform m+1 rounds of iterations, m being a positive integer, wherein one round of iteration comprises: determining a local share of a current multiple of a current round; based on the local share of the current multiple and the local share of the second number, collaboratively with the remaining n-1 parties, obtaining a local share of an intermediate product by a multi-party secure multiplication protocol, the intermediate product being equal to the current multiple multiplied by the second number; based on the local share of the intermediate product and the local share of the first number, collaboratively with the remaining n-1 parties, obtaining a local share of a result indicator by a multi-party secure comparison protocol, the result indicator indicating whether the intermediate product is less than the first number; based on the local share of the result indicator, collaboratively with the remaining n-1 parties, revealing the result indicator; when the result indicator indicates that the intermediate product is less than the first number, accumulating the local share of the current multiple into a local share of a target multiple; and subtracting the local share of the intermediate product from the local share of the first number, thereby updating the local share of the first number. The local share of the target multiple of the last round of iteration and the updated local share of the first number are taken as the local share of the multiple and the local share of the remainder respectively, wherein the multiple multiplied by the second number plus the remainder is equal to the first number.

[0311] Further details regarding the system 2000 and its modules can be found in Figure 9 and related descriptions.

[0312] Figure 21 is an exemplary module diagram of a multi-party secure unsigned number division system according to some embodiments of the present specification. Each party holds a share of a dividend and a share of a divisor, both of which are unsigned numbers.

[0313] The system 2100 can be implemented at any of the n parties, such as Figure 21 The system 2100 can include a quotient calculation module 2110, as shown.

[0314] The quotient calculation module 2110 can be configured to obtain the local share of the quotient through one or more rounds of processing. In one round of processing, the following steps are performed when the precision number meets a preset condition, otherwise the round of processing is ended: based on the local share of the dividend and the local share of the divisor, in collaboration with the remaining n-1 parties, the multi-party secure comparison protocol is used to determine whether the dividend is less than the divisor; when the dividend is not less than the divisor, the local share of the dividend and the local share of the quotient are not updated, otherwise one or more of the following updates are performed until the dividend is not less than the divisor or the precision number no longer meets the preset condition: the local share of the dividend is updated to make the dividend multiplied by a certain multiple, the local share of the quotient is updated to make the quotient multiplied by the same multiple, and the precision number is updated; based on the local share of the dividend and the local share of the divisor, in collaboration with the remaining n-1 parties, the multi-party secure decomposition protocol is used to obtain the local share of the multiple and the local share of the remainder, wherein the multiple multiplied by the divisor plus the remainder is equal to the dividend; the local share of the multiple is added to the local share of the quotient, thereby updating the local share of the quotient again; and the local share of the remainder is used as the local share of the dividend after the update.

[0315] For more details of the system 2100 and its modules, please refer to Figure 11 and the related descriptions.

[0316] Figure 22 is an exemplary module diagram of a multi-party secure Sigmoid function calculation system according to some embodiments of the present specification. Each party holds a share of a first number.

[0317] The system 2200 can be implemented on any of the n parties, as Figure 22 shown, the system 2200 can include a first opposite number calculation module 2210, a third natural exponential function calculation module 2220, an intermediate sum value calculation module 2230, and a Sigmoid function value calculation module 2240.

[0318] The first opposite number calculation module 2210 can be configured to calculate the difference between the local share of a first preset value and the local share of the first number, to obtain the local share of the first opposite number, and the first preset value is equal to 0.

[0319] The third natural exponential function calculation module 2220 can be configured to obtain the local share of the natural exponential function value of the first opposite number based on the local share of the first opposite number, in collaboration with the remaining n-1 parties, through a multi-party secure natural exponential function calculation method.

[0320] The intermediate sum value calculation module 2230 can be configured to calculate the sum of the local share of a third preset value and the local share of the natural exponential function value of the first opposite number, to obtain the local share of the intermediate sum value.

[0321] The sigmoid function value calculation module 2240 can be configured to, based on the local share of the third preset value and the local share of the intermediate sum, obtain, in collaboration with the remaining n-1 parties, the local share of the sigmoid function value of the first number by the multi-party secure division as described in any embodiment of the present specification, the sigmoid function value of the first number being the output value of the sigmoid function when the first number is inputted, which is equal to the third preset value divided by the intermediate sum, and the third preset value being equal to 1.

[0322] For more details about the system 2200 and its modules, please refer to Figure 12 and the related descriptions.

[0323] Figure 23 is an exemplary module diagram of a multi-party secure Tanh function calculation system according to some embodiments of the present specification. Each party holds a share of the first number.

[0324] The system 2300 can be implemented in any of the n parties, such as Figure 23 As shown, the system 2300 can include a first opposite number calculation module 2310, a fourth natural exponential function calculation module 2320, a third natural exponential function calculation module 2330, an intermediate difference calculation module 2340, an intermediate sum calculation module 2350, and a Tanh function calculation module 2360.

[0325] The first opposite number calculation module 2310 is configured to calculate the difference between the local share of the first preset value and the local share of the first number, to obtain the local share of the first opposite number, and the first preset value being equal to 0.

[0326] The fourth natural exponential function calculation module 2320 can be configured to, based on the local share of the first number, obtain, in collaboration with the remaining n-1 parties, the local share of the natural exponential function value of the first number by the multi-party secure natural exponential function calculation method.

[0327] The third natural exponential function calculation module 2330 can be configured to, based on the local share of the first opposite number, obtain, in collaboration with the remaining n-1 parties, the local share of the natural exponential function value of the first opposite number by the multi-party secure natural exponential function calculation method.

[0328] The intermediate difference calculation module 2340 can be configured to calculate the difference between the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number, to obtain the local share of the intermediate difference.

[0329] The intermediate sum calculation module 2350 can be configured to calculate the sum of the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number, to obtain the local share of the intermediate sum.

[0330] The Tanh function calculation module 2360 can be configured to, based on the local share of the intermediate difference value and the local share of the intermediate sum value, obtain, in collaboration with the remaining n-1 parties, a local share of the Tanh function value of the first number by the multi-party secure division as described in any embodiment of the present specification, where the Tanh function value of the first number is the output value when the first number is taken as the input value of the Tanh function, and is equal to the intermediate difference value divided by the intermediate sum value.

[0331] Further details of the system 2300 and its modules can be found in Figure 13 and related descriptions.

[0332] It should be understood that Figures 14-23 The system and its modules shown can be implemented in various ways. For example, in some embodiments, the system and its modules can be implemented in hardware, software, or a combination of software and hardware. The hardware portion can be implemented with special logic, while the software portion can be stored in a memory and executed by a suitable instruction execution system, such as a microprocessor or a specially designed hardware. Those skilled in the art can understand that the above-mentioned method and system can be implemented using computer executable instructions and / or included in processor control code, such as provided on a carrier medium, such as a magnetic disk, CD or DVD-ROM, programmable memory, such as read-only memory (firmware), or data carrier, such as optical or electronic signal carrier. The system and its modules of the present specification can not only be implemented in hardware circuitry, such as very large scale integrated circuits or gate arrays, semiconductors, such as logic chips, transistors, or programmable hardware devices, such as field programmable gate arrays, programmable logic devices, etc., but also in software, for example, executed by various types of processors, and also by a combination of the above-mentioned hardware circuitry and software (e.g., firmware).

[0333] It should be noted that the above description of the system and its modules is for the convenience of description only, and cannot limit the scope of the present specification to the embodiments described. It can be understood that, for those skilled in the art, after understanding the principle of the system, the modules can be combined arbitrarily or connected to other modules to form a subsystem without departing from the principle. For example, in some embodiments, the fourth natural exponential function calculation module 2320 and the third natural exponential function calculation module 2330 can be two modules, or can be combined into one module. Variations such as this are within the scope of protection of the present specification.

[0334] The beneficial effects that the embodiments of the present specification can bring include but are not limited to: (1) some basic multi-party secure computation protocols are provided, such as multiplication, division, comparison, absolute value calculation, natural exponential function calculation, etc. Based on one or more of these basic protocols, solutions suitable for various privacy protection scenarios can be proposed, such as secure MPNN for drug property prediction; (2) the multi-party secure computation protocols provided support three or more computing participants, and the number of participants can be flexibly set; (3) the dependence on auxiliary third parties (such as third-party servers that generate random numbers and secret share them) in the multi-party secure computation process can be removed, thereby reducing the interaction frequency and improving the computing efficiency; (4) the conventional multi-party secure comparison protocol is only suitable for the comparison of binary numerical values. For input values of other bases (such as decimal), they need to be converted to binary before comparison. The multi-party secure comparison protocol provided by some embodiments of the present specification supports various bases (such as binary, octal, hexadecimal), without the need for base conversion, which can improve the efficiency of multi-party secure comparison. The multi-party secure comparison protocol has a high frequency of invocation, so it can also improve the execution efficiency of other multi-party secure comparison protocols; (5) the multi-party secure division protocol provided has good calculation accuracy, and related parameters such as precision number p and encryption length m can be flexibly set. It should be noted that different embodiments can have different beneficial effects. In different embodiments, the beneficial effects that can be produced can be any one or a combination of the above, or any other beneficial effects that can be obtained.

[0335] The above has described the basic concepts. Obviously, the above detailed disclosure is only used as an example and does not limit the embodiments of the present specification for those skilled in the art. Although it is not explicitly stated here, those skilled in the art can make various modifications, improvements and corrections to the embodiments of the present specification. Such modifications, improvements and corrections are suggested in the embodiments of the present specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of the present specification.

[0336] At the same time, specific words are used in the present specification to describe the embodiments of the present specification. For example, "one embodiment", "an embodiment" and / or "some embodiments" means a certain feature, structure or characteristic related to at least one embodiment of the present specification. Therefore, it should be emphasized and noted that the "an embodiment" or "one embodiment" or "one alternative embodiment" mentioned in different places in the present specification does not necessarily refer to the same embodiment. In addition, some features, structures or characteristics in one or more embodiments of the present specification can be properly combined.

[0337] Moreover, those skilled in the art will appreciate that the various aspects of the disclosure can be illustrated and described in connection with a number of various kinds of systems and / or methods, including any new and useful improvements thereto, and can be implemented by a number of different kinds of electronic devices and systems configured to perform the stages of the methods. Accordingly, although the various aspects of the disclosure can be described in connection with one or more exemplary embodiments, it should be understood that the application can be practiced in other ways than those specifically shown and described. It is therefore desired that what is claimed should be understood to be within the broad scope of the claims appended hereto, and / or within the equivalents thereof.

[0338] Computer storage media can include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program code, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, solid state drives (SSDs) that are based on RAM, flash memory or other solid state memory, hard disks, magnetic tape, or other magnetic media, optical media, or any other hardware storage devices specified by the manufacturer of the computer system or device. Computer storage media can be used to store data that is accessible by a computer, such as computer readable instructions, data structures, program code, and / or other data.

[0339] The computer program code for carrying out the operations of the aspects of the disclosure can be written or programmed in any variety of languages or combinations of languages, including object oriented programming languages, such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, and / or conventional procedural programming languages, such as the "C" programming language, Visual Basic, Fortran 2003, Perl, COBOL 2002, PHP, ABAP, dynamic programming languages, such as Python, Ruby and Groovy, or other programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic program code can be downloaded from an on-demand computing platform, such as Amazon Web Services, Microsoft Azure, or Google Cloud, or other on-demand computing platforms.

[0340] Furthermore, the order of the processing elements and sequence of the described embodiments, unless specifically stated by the claim, does not otherwise limit the scope of the described embodiments. One having ordinary skill in the art will recognize that the processing elements and sequences can be performed by specific hardware components or can be interchanged with ones of different construction, as can be desired in any given implementation. Also, it will be appreciated that the various features described herein can be implemented in hardware, software or a combination thereof. Similarly, the various methodologies and processes described herein can be embodied as or by machine, for example, computer executable instructions, such as program code, software modules, firmware, hardware, etc. Furthermore, none of the citations of patent documents, articles, books, publications, documents, etc. is intended as

[0341] Similarly, it is to be noticed that the term "comprising", used in the description, is not intended to exclude other elements or steps. It is to be understood that the description and the examples are intended to be illustrative, but not limiting, of the scope of the application. Thus, the scope of the application should be determined by the appended claims, along with the full text of the patent to which the claims refer.

[0342] Each patent, patent application, publication, document, article, book, specification, and other material cited in this specification is hereby incorporated by reference in its entirety for all purposes to the same extent as if each individual publication, document, article, book, specification or other material were specifically and individually indicated to be incorporated by reference in its entirety for its cited purposes. Except in the Examples, all patents, patent applications, publications, documents, articles, books, specifications, and other materials cited herein are hereby incorporated by reference in their entirety for all purposes. To the extent that any meaning or definition of a term in this document conflicts with the meaning or definition of the same term in a document incorporated by reference, the meaning or definition assigned to that term in this document shall control.

[0343] Finally, the described embodiments are to be considered in all respects as illustrative and not restrictive, since the scope of the described embodiments is indicated not by the foregoing description but by the appended claims, and all changes which come within the meaning and range of equivalency of the claims are intended to be embraced therein.

Claims

1. A multi-party secure division involving n parties, n being a positive integer not less than 3, each party holding a local share of a dividend and a local share of a divisor, the division being performed by one of the parties, comprising: determining, in cooperation with the remaining n-1 parties, a local share of a sign of the dividend and a local share of a sign of the divisor based on the local share of the dividend and the local share of the divisor respectively, by a multi-party secure sign protocol; determining, in cooperation with the remaining n-1 parties, a local share of an absolute value of the dividend and a local share of an absolute value of the divisor based on the local share of the dividend and the local share of the divisor respectively, by a multi-party secure absolute value protocol; obtaining, in cooperation with the remaining n-1 parties, a local share of an absolute value of a quotient based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor by one or more rounds of processing; obtaining, in cooperation with the remaining n-1 parties, a local share of the quotient based on the local share of the absolute value of the quotient, the local share of the sign of the dividend and the local share of the sign of the divisor; wherein one round of processing comprises the following steps when a precision number meets a preset condition, otherwise the round of processing is ended: determining, in cooperation with the remaining n-1 parties, whether the absolute value of the dividend is less than the absolute value of the divisor based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor by a multi-party secure comparison protocol; when the absolute value of the dividend is not less than the absolute value of the divisor, the local share of the absolute value of the dividend and the local share of the absolute value of the quotient are not updated, otherwise one or more of the following updates are performed until the absolute value of the dividend is not less than the absolute value of the divisor or the precision number no longer meets the preset condition: updating the local share of the absolute value of the dividend so that the absolute value of the dividend is expanded by a factor; updating the local share of the absolute value of the quotient so that the absolute value of the quotient is expanded by the same factor; updating the precision number; obtaining, in cooperation with the remaining n-1 parties, a local share of a factor and a local share of a remainder based on the local share of the absolute value of the dividend and the local share of the absolute value of the divisor by a multi-party secure decomposition protocol; wherein the factor multiplied by the absolute value of the divisor plus the remainder equals the absolute value of the dividend; accumulating the local share of the factor into the local share of the absolute value of the quotient, thereby updating the local share of the absolute value of the quotient again; and basing the local share of the remainder on the local share of the absolute value of the dividend as updated again. The multi-party secure absolute value protocol comprises: obtaining, in cooperation with the remaining n-1 parties, a local share of a result identifier based on a local share of a target number and a local share of a first preset value by a multi-party secure comparison protocol; the result identifier indicating whether the target number is negative; obtaining, in cooperation with the remaining n-1 parties, a local share of an absolute value of the target number based on the local share of the target number and the local share of the result identifier by a multi-party secure multiplication protocol; when the local share of the absolute value of the dividend is determined, the local share of the target number is the local share of the dividend; when the local share of the absolute value of the divisor is determined, the local share of the target number is the local share of the divisor. The first preset value is equal to 0, and the result identifier is equal to 1 when the target number is not less than the first preset value, otherwise the result identifier is equal to 0. ​ ​ ​ ​ ​ ​ ​ 2. The multi-party secure division of claim 1, wherein, ​ ​ ​ ​ 3. The multi-party secure division of claim 2, wherein, ​ The local shard of the target number and the local shard of the result identifier, in cooperation with the remaining n-1 parties, obtain the local shard of the absolute value of the target number through a multi-party secure multiplication protocol, including: The local shard of the result identifier obtains the local shard of a third product; the third product is equal to the result identifier multiplied by a second preset value, and the second preset value is equal to 2; The local shard of the third product is subtracted by the local shard of a third preset value to obtain the local shard of an updated third product; the third preset value is equal to 1; The local shard of the updated third product and the local shard of the target number, in cooperation with the remaining n-1 parties, obtain the local shard of the absolute value of the target number through a multi-party secure multiplication protocol; the absolute value of the target number is equal to the updated third product multiplied by the target number.

4. The multi-party secure division of claim 1, wherein, When the one round of processing is the first round, the precision number is a preset positive integer, and the absolute value of the quotient is equal to 0; the precision number satisfying the preset condition includes that the precision number is greater than 0; and the updated precision number includes that the precision number is reduced by 1.

5. The multi-party secure division of claim 1 or 4, wherein, The absolute value of the dividend is amplified by a factor of 10.

6. The multi-party secure division of claim 1, wherein, The multi-party secure decomposition protocol includes m+1 rounds of cycles, m being a positive integer, wherein one round of cycle includes: determining the local shard of the current multiple of the current round; based on the local shard of the current multiple and the local shard of the second number, in cooperation with the remaining n-1 parties, obtaining the local shard of an intermediate product through a multi-party secure multiplication protocol; the intermediate product is equal to the current multiple multiplied by the second number; based on the local shard of the intermediate product and the local shard of the first number, in cooperation with the remaining n-1 parties, obtaining the local shard of the result identifier through a multi-party secure comparison protocol; the result identifier indicates whether the intermediate product is less than the first number; based on the local shard of the result identifier, in cooperation with the remaining n-1 parties, the result identifier is revealed; when the result identifier indicates that the intermediate product is less than the first number, the local shard of the current multiple is added to the local shard of the target multiple; and the local shard of the first number is subtracted by the local shard of the intermediate product, and then the local shard of the first number is updated; when the local shard of the absolute value of the dividend and the local shard of the absolute value of the divisor, in cooperation with the remaining n-1 parties, obtain the local shard of the multiple and the local shard of the remainder through the multi-party secure decomposition protocol, the local shard of the absolute value of the dividend is taken as the local shard of the first number, the local shard of the absolute value of the divisor is taken as the local shard of the second number, and the local shard of the target multiple and the updated local shard of the first data obtained in the last round of cycle of the multi-party secure decomposition protocol are taken as the local shard of the multiple and the local shard of the remainder respectively.

7. The multi-party secure division of claim 6, wherein, Current multiple equals 2 m+1-i i is the ordinal number of the current round of iteration; When the one round of cycle is the first round, the target multiple is equal to 0.

8. The multi-party secure division of claim 6, wherein, The local shard of the current multiple is obtained in advance.

9. The multi-party secure division of claim 1, wherein, The multi-party secure symbol protocol includes a multi-party secure comparison protocol.

10. The multi-party secure division of claim 9, wherein, When the dividend is not a negative number, the dividend sign identifier is equal to 1, otherwise it is equal to 0; when the divisor is not a negative number, the divisor sign identifier is equal to 1, otherwise it is equal to 0; the local shard of the absolute value of the quotient, the local shard of the dividend sign identifier and the local shard of the divisor sign identifier, in cooperation with the remaining n-1 parties, obtain the local shard of the quotient, including: obtaining the local share of quotient based on the local share of the divisor sign and the local share of the divisor, and in cooperation with the other n-1 parties through a multi-party secure multiplication protocol; the quotient sign is equal to the difference between the dividend sign and twice the product of the dividend sign and the divisor sign; obtaining the local share of the fourth product based on the local share of the second preset value; the fourth product is equal to the second preset value multiplied by the quotient sign; the second preset value is equal to 2; subtracting the local share of the fourth product from the local share of the third preset value to obtain the local share of the updated fourth product; the third preset value is equal to 1; obtaining the local share of the quotient based on the local share of the updated fourth product and the local share of the quotient absolute value, and in cooperation with the other n-1 parties through a multi-party secure multiplication protocol; the quotient is equal to the fourth product multiplied by the quotient absolute value. 11.A multi-party secure division system involving n parties, n being a positive integer not less than 3, each party holding a share of a dividend and a share of a divisor, the system being implemented at one of the parties and comprising a sign determination module, an absolute value determination module, a quotient absolute value calculation module and a quotient restoration module; the sign determination module is configured to determine the local share of the dividend sign and the local share of the divisor sign based on the local share of the dividend and the local share of the divisor respectively, and in cooperation with the other n-1 parties through a multi-party secure sign protocol; the absolute value determination module is configured to determine the local share of the dividend absolute value and the local share of the divisor absolute value based on the local share of the dividend and the local share of the divisor respectively, and in cooperation with the other n-1 parties through a multi-party secure absolute value protocol; the quotient absolute value calculation module is configured to obtain the local share of the quotient absolute value based on the local share of the dividend absolute value and the local share of the divisor absolute value, and in cooperation with the other n-1 parties through one or more rounds of processing; the quotient restoration module is configured to obtain the local share of the quotient based on the local share of the quotient absolute value, the local share of the dividend sign and the local share of the divisor sign, and in cooperation with the other n-1 parties; wherein one round of processing includes the following steps when the number of accuracy satisfies a preset condition, otherwise the round of processing is ended: determining whether the dividend absolute value is less than the divisor absolute value based on the local share of the dividend absolute value and the local share of the divisor absolute value, and in cooperation with the other n-1 parties through a multi-party secure comparison protocol; when the dividend absolute value is not less than the divisor absolute value, the local share of the dividend absolute value and the local share of the quotient absolute value are not updated, otherwise one or more of the following updates are performed until the dividend absolute value is not less than the divisor absolute value or the number of accuracy no longer satisfies the preset condition: updating the local share of the dividend absolute value so that the dividend absolute value is expanded by a certain multiple; updating the local share of the quotient absolute value so that the quotient absolute value is expanded by the same multiple; updating the number of accuracy; obtaining, by the processor, a local shard of a quotient and a local shard of a remainder based on the local shard of the dividend and the local shard of the divisor, in cooperation with the other n-1 parties via a multi-party secure division protocol, wherein the quotient multiplied by the absolute value of the divisor plus the remainder equals the absolute value of the dividend; accumulating the local shard of the quotient into the local shard of the quotient, thereby updating the local shard of the quotient again; updating the local shard of the remainder as the local shard of the dividend again.

12. A multi-party secure division apparatus comprising a processor and a storage device for storing instructions, wherein, When the processor executes the instructions, the multi-party secure division of any one of claims 1-10 is implemented. 13.A multi-party secure Sigmoid function calculation method involving n parties, n being a positive integer not less than 3, each party holding a shard of a first number, the method being executed by one of the parties, comprising: calculating a difference between a local shard of a first preset value and a local shard of the first number to obtain a local shard of a first opposite number; the first preset value being equal to 0; obtaining, by the processor, a local shard of a quotient and a local shard of a remainder based on the local shard of the dividend and the local shard of the divisor, in cooperation with the other n-1 parties via a multi-party secure division protocol, wherein the quotient multiplied by the absolute value of the divisor plus the remainder equals the absolute value of the dividend; calculating a sum between a local shard of a third preset value and a local shard of a natural exponential function value of the first opposite number to obtain a local shard of an intermediate sum value; obtaining, by the processor, a local shard of a Sigmoid function value of the first number based on the local shard of the third preset value and the local shard of the intermediate sum value, in cooperation with the other n-1 parties via the multi-party secure division of any one of claims 1-10; the Sigmoid function value of the first number being an output value of a Sigmoid function when the Sigmoid function takes the first number as an input value, and being equal to the third preset value divided by the intermediate sum value, the third preset value being equal to 1. 14.A multi-party secure Sigmoid function calculation system involving n parties, n being a positive integer not less than 3, each party holding a shard of a first number, the system being implemented by one of the parties, comprising a first opposite number calculation module, a third natural exponential function calculation module, an intermediate sum value calculation module and a Sigmoid function value calculation module; The first opposite number calculation module is configured to calculate a difference between the local shard of the first preset value and the local shard of the first number, to obtain the local shard of the first opposite number. the first preset value being equal to 0; the third natural exponential function calculation module being configured to obtain, by the processor, a local shard of a natural exponential function value of the first opposite number based on the local shard of the first opposite number, in cooperation with the other n-1 parties via a multi-party secure natural exponential function calculation method; the intermediate sum value calculation module being configured to calculate, by the processor, a sum between a local shard of a third preset value and a local shard of a natural exponential function value of the first opposite number to obtain a local shard of an intermediate sum value; the Sigmoid function value calculation module being configured to obtain, by the processor, a local shard of a Sigmoid function value of the first number based on the local shard of the third preset value and the local shard of the intermediate sum value, in cooperation with the other n-1 parties via the multi-party secure division of any one of claims 1-10; the Sigmoid function value of the first number being an output value of a Sigmoid function when the Sigmoid function takes the first number as an input value, and being equal to the third preset value divided by the intermediate sum value, the third preset value being equal to 1.

15. A multi-party secure sigmoid function computation apparatus comprising a processor and a storage device for storing instructions, wherein, The Sigmoid function calculation method is realized when the processor executes the instructions. 16.A multi-party secure Tanh function calculation method, involving n parties, n being a positive integer not less than 3, each party holding a share of a first number, the method being executed by one of the parties, comprising: calculating a difference between a local share of a first preset value and a local share of the first number to obtain a local share of a first opposite number; the first preset value being equal to 0; based on the local share of the first number, cooperating with the remaining n-1 parties, and obtaining a local share of a natural exponential function value of the first number by means of the multi-party secure natural exponential function calculation method; based on the local share of the first opposite number, cooperating with the remaining n-1 parties, and obtaining a local share of a natural exponential function value of the first opposite number by means of the multi-party secure natural exponential function calculation method; calculating a difference between the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number to obtain a local share of an intermediate difference value; calculating a sum of the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number to obtain a local share of an intermediate sum value; based on the local share of the intermediate difference value and the local share of the intermediate sum value, cooperating with the remaining n-1 parties, and obtaining a local share of a Tanh function value of the first number by means of the multi-party secure division according to any one of claims 1-10; the Tanh function value of the first number being an output value when the first number is taken as an input value of a Tanh function, and being equal to the intermediate difference value divided by the intermediate sum value. 17.A multi-party secure Tanh function calculation system, involving n parties, n being a positive integer not less than 3, each party holding a share of a first number, the system being implemented in one of the parties, comprising a first opposite number calculation module, a fourth natural exponential function calculation module, a third natural exponential function calculation module, an intermediate difference value calculation module, an intermediate sum value calculation module, and a Tanh function calculation module; The first opposite number calculation module is configured to calculate a difference between a local segment of a first preset value and a local segment of the first number, to obtain a local segment of the first opposite number. the first preset value being equal to 0; the fourth natural exponential function calculation module is configured to, based on a local share of a first number, cooperate with the remaining n-1 parties, and obtain a local share of a natural exponential function value of the first number by means of the multi-party secure natural exponential function calculation method; the third natural exponential function calculation module is configured to, based on a local share of a first opposite number, cooperate with the remaining n-1 parties, and obtain a local share of a natural exponential function value of the first opposite number by means of the multi-party secure natural exponential function calculation method; the intermediate difference value calculation module is configured to calculate a difference between the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number to obtain a local share of an intermediate difference value; the intermediate sum value calculation module is configured to calculate a sum of the local share of the natural exponential function value of the first number and the local share of the natural exponential function value of the first opposite number to obtain a local share of an intermediate sum value; and The Tanh function calculation module is configured to, based on the local shard of the intermediate difference value and the local shard of the intermediate sum value, in cooperation with the other n-1 parties, obtain the local shard of the Tanh function value of the first number by the multi-party secure division according to any one of claims 1-10; the Tanh function value of the first number is an output value when the first number is taken as an input value of a Tanh function, and is equal to the intermediate difference value divided by the intermediate sum value.

18. A multi-party secure Tanh function computation apparatus comprising a processor and a storage device for storing instructions, wherein, When the processor executes the instructions, the Tanh function calculation method according to claim 16 is implemented. 19.A multi-party secure unsigned number division involving n parties, n being a positive integer not less than 3, each party holding a shard of a dividend and a shard of a divisor, the dividend and the divisor being unsigned numbers, the division being performed by one of the parties and comprising obtaining a local shard of a quotient by one or more rounds of processing, wherein one round of processing comprises, when a precision number meets a preset condition, performing the following steps, otherwise ending the round of processing: based on the local shard of the dividend and the local shard of the divisor, in cooperation with the other n-1 parties, determining whether the dividend is less than the divisor by a multi-party secure comparison protocol; when the dividend is not less than the divisor, the local shard of the dividend and the local shard of the quotient are not updated, otherwise one or more of the following updates are performed until the dividend is not less than the divisor or the precision number no longer meets the preset condition: updating the local shard of the dividend to make the dividend expand by a multiple; updating the local shard of the quotient to make the quotient expand by the same multiple; updating the precision number; based on the local shard of the dividend and the local shard of the divisor, in cooperation with the other n-1 parties, obtaining a local shard of a multiple and a local shard of a remainder by a multi-party secure decomposition protocol, wherein the multiple multiplied by the divisor plus the remainder is equal to the dividend; adding the local shard of the multiple to the local shard of the quotient to update the local shard of the quotient again; based on the local shard of the remainder as the updated local shard of the dividend. 20.A multi-party secure unsigned number division system involving n parties, n being a positive integer not less than 3, each party holding a shard of a dividend and a shard of a divisor, the dividend and the divisor being unsigned numbers, the system being implemented by one of the parties and comprising a quotient calculation module configured to obtain a local shard of a quotient by one or more rounds of processing, wherein one round of processing comprises, when a precision number meets a preset condition, performing the following steps, otherwise ending the round of processing: based on the local shard of the dividend and the local shard of the divisor, in cooperation with the other n-1 parties, determining whether the dividend is less than the divisor by a multi-party secure comparison protocol; when the dividend is not less than the divisor, the local shard of the dividend and the local shard of the quotient are not updated, otherwise one or more of the following updates are performed until the dividend is not less than the divisor or the precision number no longer meets the preset condition: updating the local shard of the dividend to make the dividend expand by a multiple; updating the local shard of the quotient to make the quotient expand by the same multiple; updating the precision number; Based on the local shard of the dividend and the local shard of the divisor, in cooperation with the remaining n-1 parties, the local shard of the quotient and the local shard of the remainder are obtained through a multi-party secure decomposition protocol; wherein the quotient multiplied by the divisor and added with the remainder is equal to the dividend; The local shard of the quotient is updated again by accumulating the local shard of the quotient and the local shard of the quotient; Based on the local shard of the remainder as the local shard of the dividend updated again.

21. A multi-party secure unsigned number division apparatus comprising a processor and a storage device for storing instructions, wherein, When the processor executes the instructions, the multi-party secure unsigned number division as claimed in claim 19 is implemented.

Images