Share the execution method of OT protocol, secure multi-party computing method and device

Abstract

A method for executing a shared OT protocol, a secure multi-party computing method and device based on the shared OT protocol, involving a first party and a second party. The second party holds N privacy values ​​and N random numbers, and the first party holds the first serial number of the target privacy value in the N privacy values, the target random number, and its second serial number in the N random numbers. The method for executing the shared OT protocol includes: the second party receives a third serial number calculated by the first party based on the first serial number and the second serial number from the first party, and then calculates the intermediate data corresponding to the remaining N-1 privacy values ​​except the serial number with the third serial number based on the third serial number, the N privacy values, and the N random numbers, and calculates the second fragment of the target privacy value based on the random number with the third serial number and the privacy value ranked first; in addition, the second party can also send the intermediate data corresponding to the remaining N-1 privacy values ​​to the first party, so that the first party calculates the first fragment of the target privacy value.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the computer field, and in particular, to a method for executing a shared OT protocol, and a secure multi-party computing method and device based on the shared OT protocol. Background Art

[0002] The oblivious transfer (OT) protocol is a typical two-party protocol in cryptography, which is often used to support the execution of secure multi-party computation. When the OT protocol is used to support secure multi-party computation (SMPC), a large amount of data usually needs to be transmitted between different participants in the secure multi-party computation, and even multiple rounds of communication may be required between different participants.

[0003] We hope to have a new solution that will help complete secure multi-party computing more efficiently. Summary of the invention

[0004] One or more embodiments of the present specification provide a method for executing a shared OT protocol, and a secure multi-party computing method and device based on a shared OT protocol.

[0005] In the first aspect, a method for executing a shared OT protocol is provided, involving a first party and a second party, wherein the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, and the first party holds the first serial number of a target privacy value in the N privacy values, the target random number, and its second serial number in the N random numbers, and the method is applied to the second party. The method includes: receiving a third serial number calculated by the first party based on the first serial number and the second serial number; based on the third serial number, the N privacy values, and the N random numbers, calculating the intermediate data corresponding to each of the remaining N-1 privacy values ​​except for the serial number of the third serial number; sending the intermediate data corresponding to each of the N-1 privacy values ​​to the first party, so that the first party calculates the first shard of the target privacy value; based on the random number with the serial number of the third serial number and the privacy value arranged in the first place, calculating the second shard of the target privacy value, wherein the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0006] In a possible implementation, the method further includes: receiving the N random numbers from a third party; wherein the target random number and the second serial number are sent by the third party to the first party.

[0007] In a possible implementation, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and a result of summing the first shard and the second shard is equal to the target privacy value.

[0008] In a possible implementation, the third serial number is obtained by performing an XOR operation on the first serial number and the second serial number, and a result of performing an XOR operation on the first shard and the second shard is equal to the target privacy value.

[0009] In a possible implementation, based on the third serial number, the N privacy values ​​and the N random numbers, the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the serial number of the third serial number is calculated, including: for any privacy value with serial number j except the serial number of the third serial number, the random number with serial number j is processed according to a second preset operation rule to obtain the corresponding first data item, and based on the first data item, the second data item, the third data item and the privacy value ranked first, the intermediate data with serial number j corresponding to the privacy value with serial number j is calculated, wherein the second data item is obtained by processing the random number with serial number the third serial number using the second preset operation rule, and the third data item is a privacy value with serial number y, and the value of y is the same as the result obtained by performing a modulo operation on the difference between the third serial number and j using N.

[0010] In a possible implementation, calculating the second slice of the target privacy value based on the random number with the third serial number and the privacy value ranked first includes: calculating the second slice of the target privacy value according to the second data item and the privacy value ranked first.

[0011] In one possible implementation, the lengths of the N privacy values ​​are all t bits; and the processing of the random number with serial number j according to the second preset operation rule to obtain the corresponding first data item includes: calculating a hash value of the random number with serial number j with a length of t bits as the corresponding first data item; or, for the random number with serial number j whose length is greater than t bits, extracting a bit sequence with a length of t bits starting from a predetermined position, and using the data represented by the bit sequence as the first data item corresponding to the random number with serial number j.

[0012] In the second aspect, a method for executing a shared OT protocol is provided, involving a first party and a second party, wherein the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, and the first party holds a target random number with the first sequence number of a target privacy value among the N privacy values ​​and its second sequence number among the N random numbers, and the method is applied to the first party. The method includes: sending a third sequence number calculated based on the first sequence number and the second sequence number to the second party, so that the second party calculates the second shard of the target privacy value based on the random number with the sequence number of the third sequence number and the privacy value arranged in the first place, and returns the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the sequence number of the third sequence number; at least calculating the first shard of the target privacy value based on the first sequence number and the target random number, wherein the result obtained by processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0013] In a possible implementation, the N random numbers are sent to the second party by a third party; the method further includes: receiving the target random number and the second serial number from the third party.

[0014] In a possible implementation, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and a result of summing the first shard and the second shard is equal to the target privacy value.

[0015] In a possible implementation, the third serial number is a result obtained by performing an XOR operation on the first serial number and the second serial number, and a result obtained by performing an XOR operation on the first shard and the second shard is equal to the target privacy value.

[0016] In one possible implementation, the first slice of the target privacy value is calculated based on at least the first serial number and the target random number, including: processing the target random number using a second preset operation rule to obtain a fourth data item; determining whether the target privacy value is the privacy value ranked first based on the first serial number, and if so, using the fourth data item as the first slice of the target privacy value; otherwise, calculating the first slice of the target privacy value based on the fourth data item and the intermediate data corresponding to the privacy value with the second serial number.

[0017] In one possible implementation, the lengths of the N privacy values ​​are all t bits; and the use of the second preset operation rule to process the target random number to obtain the fourth data item includes: calculating a hash value of the target random number with a length of t bits as the fourth data item; or, for the target random number having a length greater than t bits, extracting a bit sequence with a length of t bits starting from a predetermined position, and using the data represented by the bit sequence with a length of t bits as the fourth data item.

[0018] In a third aspect, a secure multi-party computing method based on a shared OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the method is applied to the second party. The method includes: generating N privacy values ​​arranged in sequence, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that the privacy value with serial number the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; for the N privacy values ​​and the third privacy value as the first serial number, using any method described in the first aspect to jointly execute the shared OT protocol with the first party, obtain a second shard of the target privacy value with serial number the third privacy value, and enable the first party to correspondingly obtain the first shard of the target privacy value with serial number the third privacy value.

[0019] In a possible implementation, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of an XOR operation on the second privacy value and the third privacy value is equal to the result of a sum operation on the first slice and the second slice.

[0020] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0021] In a possible implementation manner, the first preset operation rule includes a sum operation or a bitwise XOR operation.

[0022] In a possible implementation, the first party also holds a fourth privacy value, the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value, wherein the third shard is calculated by the first party based on the third privacy value, the fourth privacy value and the first shard.

[0023] In a possible implementation, the first party further holds a fourth privacy value, and the second party further holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of an eighth privacy value in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

[0024] In a fourth aspect, a secure multi-party computing method based on a shared OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the method is applied to the first party. The method includes: for the third privacy value and N privacy values ​​as the first serial number, jointly executing the shared OT protocol with the second party using any method in the second aspect, obtaining a first shard of the target privacy value with the serial number of the three privacy values, and enabling the second party to obtain a second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with the serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0025] In a possible implementation, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of an XOR operation on the second privacy value and the third privacy value is equal to the result of a sum operation on the first slice and the second slice.

[0026] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0027] In a possible implementation manner, the first preset operation rule includes a sum operation or a bitwise XOR operation.

[0028] In a possible implementation, the sum of the second privacy value and the fourth privacy value held by the first party is equal to the fifth privacy value. The method further includes: calculating a third shard based on the third privacy value, the fourth privacy value and the first shard, so that the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value.

[0029] In a possible implementation, the first party further holds a fourth privacy value, and the second party further holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of an eighth privacy value in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

[0030] In a fifth aspect, a secure multi-party computing method based on a shared OT protocol is provided, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a fifth private value and a sixth private value, wherein the third private value and the sixth private value are two XOR fragments of an eighth private value located in a modulo 2 space in a modulo 2 space, and the method is applied to the first party. The method includes: the second party generates N private values ​​arranged in sequence, wherein any private value with serial number j is equal to the result obtained by processing the XOR result of serial number j and the fifth private value using a target operation rule, and the XOR result of serial number j is obtained by performing an XOR operation on serial number j and the sixth private value, so that the target private value with serial number the third private value is equal to the result of processing the fifth private value and the eighth private value using the target operation rule; the first party and the second party jointly execute the shared OT protocol for the third private value as the first serial number and the N private values ​​using any method in the first aspect and the second aspect, and respectively obtain the first fragment and the second fragment of the target private value with serial number the three private values.

[0031] In a sixth aspect, a device for executing shared OT is provided, involving a first party and a second party, wherein the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, and the first party holds a first serial number of a target privacy value in the N privacy values, a target random number, and a second serial number in the N random numbers, and the device is deployed on the second party. The device includes: a communication processing unit configured to receive a third serial number calculated based on the first serial number and the second serial number from the first party; a first calculation unit configured to calculate the intermediate data corresponding to each of the remaining N-1 privacy values ​​other than the serial number having the third serial number based on the third serial number, the N privacy values, and the N random numbers; the communication processing unit is further configured to send the intermediate data corresponding to each of the N-1 privacy values ​​to the first party, so that the first party calculates the first fragment of the target privacy value; a second calculation unit configured to calculate the second fragment of the target privacy value based on the random number having the serial number having the third serial number and the privacy value arranged in the first place, wherein the result of processing the first fragment and the second fragment using the first preset operation rule is equal to the target privacy value.

[0032] In the seventh aspect, there is provided an execution device for sharing OT, involving a first party and a second party, wherein the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, and the first party holds the first serial number of the target privacy value among the N privacy values, the target random number and its second serial number among the N random numbers, and the device is deployed on the first party. The device comprises: a communication processing unit, configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second shard of the target privacy value based on the random number with the serial number of the third serial number and the privacy value arranged in the first place, and returns the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the serial number with the serial number of the third serial number; a calculation processing unit, configured to calculate the first shard of the target privacy value based on at least the first serial number and the target random number, wherein the result obtained by processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0033] In an eighth aspect, a secure multi-party computing device based on an OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, the second party holds a second privacy value, and the device is deployed on the second party. The device includes: a computing processing unit configured to generate N privacy values ​​arranged in sequence, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that the privacy value with serial number the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit configured to execute the sharing OT protocol jointly with the first party for the N privacy values ​​and the third privacy value as the first serial number through the execution device for sharing OT described in the sixth aspect, to obtain a second shard of the target privacy value with serial number the third privacy value, and to enable the first party to obtain a first shard of the target privacy value with serial number the third privacy value.

[0034] In the ninth aspect, a secure multi-party computing device based on a shared OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, the second party holds a second privacy value, and the device is deployed on the first party. The device is used to execute the shared OT protocol jointly with the second party for the third privacy value as the first serial number and N privacy values ​​through the shared OT execution device described in the seventh aspect, to obtain a first shard of the target privacy value with the serial number of the three privacy values, and to enable the second party to obtain a second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with the serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0035] In a tenth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computing device, the computing device executes the method described in any one of the first to fourth aspects.

[0036] In an eleventh aspect, a computing device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any one of the first to fourth aspects is implemented.

[0037] Through the method and apparatus provided in one or more embodiments of this specification, when the second party holds N privacy values ​​and the first party holds the serial number of the target privacy value in the N privacy values, the first party and the second party can execute the shared OT protocol to ensure the security of the target privacy value and its serial number, so that the first party and the second party can each obtain a slice of the target privacy value. In addition, the first party and the second party can implement secure multi-party computation of the privacy value based on the shared OT protocol. The first party and the second party need to transmit less data and fewer communication rounds when implementing secure multi-party computation, so that secure multi-party computation can be completed more efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A schematic diagram of a process of executing a method for sharing an OT protocol provided in an embodiment of this specification;

[0040] Figure 2 One of the process diagrams of the secure multi-party computing method based on the shared OT protocol provided as an example;

[0041] Figure 3 The second process diagram of the secure multi-party computing method based on the shared OT protocol is provided as an example;

[0042] Figure 4 The third process diagram of the secure multi-party computing method based on the shared OT protocol is provided as an example;

[0043] Figure 5 The fourth process diagram of the secure multi-party computing method based on the shared OT protocol is provided as an example;

[0044] Figure 6 This is one of the schematic diagrams of an execution device for sharing an OT protocol provided in an embodiment of this specification;

[0045] Figure 7 This is a second schematic diagram of an execution device for sharing an OT protocol provided in an embodiment of this specification;

[0046] Figure 8 Schematic diagram of a secure multi-party computing device based on a shared OT protocol. DETAILED DESCRIPTION

[0047] The following will describe in detail each non - restrictive embodiment provided in this specification with reference to the accompanying drawings.

[0048] The OT protocol is a relatively typical two - party protocol in cryptography. Taking the two parties executing this protocol, including Alice and Bob, as an example, the requirements of the OT protocol are as follows: Alice, as the OT receiver (or the first party), holds a private value p, where p is an integer and satisfies 0 ≤ p ≤ N - 1; Bob, as the OT sender (or the second party), holds N private values {x0, x1,..., x N-1} arranged in sequence, each of length t bits; after Alice and Bob jointly execute the OT protocol, Alice can obtain the private value xp with the serial number p among the N private values p and cannot learn the other private values held by Bob, and Bob cannot learn the p held by Alice. It should be particularly noted that, since the smallest non - negative integer when a computing device represents a value by a bit sequence is 0, for the serial number of any j - th data in a certain sequence data in this sequence data, in the embodiments of this specification, it is usually set to j - 1 rather than j. For example, for the aforementioned private value x0, as the private value ranked first among the aforementioned N private values, it can be expressed as the 1st private value among the N private values, however, its serial number among the aforementioned N private values is 0 rather than 1. Therefore, it is required that p is an integer and satisfies 0 ≤ p ≤ N - 1. It can be understood that in terms of technical implementation, other serial number setting rules can also be adopted. For example, the serial number of any j - th data in a certain sequence data can also be set to j rather than j - 1. Specifically, for example, the serial number of the aforementioned private value x0 among the aforementioned N private values can be set to 1, and correspondingly, it can be required that the serial number p is an integer and satisfies 1 ≤ p ≤ N. In addition, it should also be noted that Alice and Bob can each be implemented as any device, equipment, platform, or cluster of devices with computing / processing capabilities.

[0049] The Random Oblivious Transfer (Random OT) protocol is a variant of the above - mentioned OT protocol and can be used to construct the above - mentioned OT protocol. The Random OT protocol can be implemented through various cryptographic techniques. The requirements of the Random OT protocol are as follows: Bob can obtain N random numbers {r0, r1,..., r N-1} arranged in sequence; Alice can obtain the (i + 1) - th random number ri i among the N random numbers and its serial number i in the N random numbers. The method of constructing the OT protocol through the Random OT protocol can include but is not limited to the following steps S01 to S03:

[0050] Step S01, Alice calculates the intermediate sequence number e = (i + p)% N, and sends e to Bob;

[0051] Step S02: for N private values ​​{x0, x1, ..., x N-1} except the privacy value r of sequence number e e Each private value x with serial number j other than j , using N random numbers {r0, r1, ..., r N-1} The random number with sequence number (ej)%N is encrypted x j To obtain the ciphertext f with sequence number j j , and the ciphertext f j Send to Alice;

[0052] Step S03, Alice uses the random number r with serial number i that she holds i , for the privacy value x of the received sequence number i i The corresponding ciphertext f i Decrypt it to get the private value x with serial number p p .

[0053] Secure multi-party computation is a process in which multiple parties jointly calculate the result of a function. During the calculation process, the input data of the function held by each of the multiple parties is not disclosed. The input data held by each party is usually treated as private data and cannot be known by other parties, but the calculation result is allowed to be disclosed to designated objects. For example, there may be the following secure multi-party computation requirements: Alice holds a private value A, and Bob holds a private value B. After the secure multi-party computation, Alice obtains shard c0 and Bob obtains shard c1. The results of processing c0 and c1 using the preset operation rules are equal to the results of processing A and B using the target operation rules g. The aforementioned target operation rules g may include but are not limited to secure module conversion, sum operation, product operation, bitwise AND operation, bitwise OR operation or bitwise XOR operation, etc.; the aforementioned preset operation rules may include but are not limited to sum operation or XOR operation.

[0054] The aforementioned OT protocol can generally be used to support the aforementioned secure multi-party computing. The method for implementing the aforementioned secure multi-party computing through the aforementioned OT protocol may include but is not limited to the following steps S11 to S14:

[0055] Step S11, Bob generates a random value as shard c1;

[0056] Step S12: Bob calculates N privacy values ​​arranged in order, where any j+1th privacy value x j=g(j, B)-c1, the N privacy values ​​generated by Bob are the N privacy values ​​arranged in order in the aforementioned OT protocol;

[0057] Step S13, Alice uses A as p in the aforementioned OT protocol;

[0058] Step S14: Alice and Bob jointly execute the aforementioned OT protocol based on A, which is p in the OT protocol, and the N privacy values ​​calculated by them. The execution result is: Alice obtains x, which will be used as shard c0. A =g(A, B)-c1.

[0059] In the process of implementing the aforementioned secure multi-party computing based on the aforementioned OT protocol, Alice and Bob need to communicate multiple rounds and the amount of data required to be transmitted is relatively large. In view of the above problems, the embodiments of this specification provide a method for executing a shared OT protocol, a secure multi-party computing method and device based on a shared OT protocol, in order to reduce the amount of data required to be transmitted when implementing secure multi-party computing, thereby completing secure multi-party computing more efficiently.

[0060] Figure 1 Schematic diagram of a method for executing a shared OT protocol provided in an embodiment of this specification. In this method, Alice is the OT receiver (i.e., the first party) of the shared OT protocol, and Bob is the OT sender (i.e., the second party) of the shared OT protocol. Figure 1 Before the method shown, Alice and Bob can execute the RandomOT protocol or other methods described above to enable Bob to obtain N random numbers {r0, r1, ...r N-1}, and Alice obtains the target random number r i And its serial number i in the N random numbers. For example, Bob can specifically receive the aforementioned N random numbers {r0, r1, ..., r N-1}, Alice can receive r from the third party i And its serial number i in the aforementioned N random numbers. In addition, similar to the OT protocol described above, Bob can also hold N privacy values ​​{x0, x1, ..., x N-1}, Alice can also hold the target privacy value x p In the aforementioned N private values ​​{x0, x1, ..., x N-1}. On this basis, Alice and Bob can jointly execute Figure 1 The following method steps 100 to 110 are shown in FIG.

[0061] First, in step 100, Alice calculates a sequence number e according to sequence numbers p and i. For example, Alice may perform a modulo operation on the sum of sequence numbers p and i using N to obtain sequence number e, or may perform an XOR operation on sequence numbers p and i to obtain sequence number e, or may perform a modulo operation on the difference between sequence numbers p and i using N to obtain sequence number e.

[0062] Next, in step 102, Alice sends the sequence number e to Bob.

[0063] Next, in step 104, Bob calculates the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the sequence number e based on the sequence number e, the N privacy values ​​he holds, and the N random numbers.

[0064] For N private values ​​{x0, x1, ..., x N-1}, except for the private value x of any serial number j in the j , Bob can use the second preset operation rule h to process N random numbers {r0, r1, ..., r N-1}The random number r with sequence number j j , get the privacy value x j The corresponding first data item h(r j ); and then according to the first data item h(r j ), the second data item, the third data item and the privacy value x0 ranked first, calculate the privacy value x j The corresponding intermediate data f with sequence number j j The aforementioned second data item is a random number r with a sequence number e processed by the second preset operation rule h. e The obtained h(r e ), the third data item is the privacy value x with sequence number y among the N privacy values y , the value of y is the same as the result obtained by taking the difference between e and j modulo N.

[0065] N private values ​​{x0, x1, ..., x N-1} can be modulo 2 t In this case, it is necessary to ensure that after processing any random number held by Bob using the second preset operation rule h, data with a length of t bits can be output corresponding to the random number. For example, if N random numbers {r0, r1, ..., r N-1} any random number r with sequence number j j The length of the random number r is no more than t bits, and the random number r is processed by the second preset operation rule h j The first data item h(r j ) can be the random number r calculated by Bob jThe length of the hash value is t bits; if N random numbers {r0, r1, ..., r N-1} any random number r with sequence number j j The length of the random number r is greater than t bits, and the second preset operation rule h is used to process the random number r j The first data item h(r j ), then it can be obtained by characterizing the random number r j The data represented by the sub-bit sequence of length t bits extracted from the predetermined position in the bit sequence of . Bob uses the second preset operation rule to process the random number r with sequence number e e To obtain the second data item h(r e ) is the same as Bob using the second preset operation rule to process the random number r j And get its corresponding first data item h(r j ), so I will not go into details.

[0066] More specifically, Bob can calculate the privacy value x by the following formula 1: j The corresponding intermediate data f j :

[0067] f j =h(r j )+h(r e )-x0+x (e-j)％N (1)

[0068] It is understandable that the privacy value x can also be calculated by other methods j The corresponding intermediate data f j For example, a specific coefficient may be added before some or all of the data items in Formula 1 or some deformation may be performed on the aforementioned Formula 1. More specifically, for example, all the addition and subtraction operations involved in Formula 1 may be replaced by XOR operations.

[0069] Step 106: Bob sends Alice the intermediate data corresponding to the remaining N-1 privacy values. That is, Bob needs to send Alice each privacy value x calculated by him except for the one with sequence number e. j The corresponding intermediate data f j .

[0070] Step 108: Alice generates a random number based on the sequence number p and the target random number r. i Calculate the target privacy value x p The first fragment c0 of .

[0071] Alice can use the aforementioned second preset operation rule h to process the target random number r she holds. i To obtain the fourth data item h(r i), Alice obtains the fourth data item h(r i ) can be obtained in the same way as Bob obtains the second data item h(r e ) or privacy value x j The corresponding first data item h(r j Alice can determine the target privacy value x based on the sequence number p. p Is it the privacy value x0 ranked first? If so, the fourth data item h(r i ) as the target privacy value x p Otherwise, Alice can use the fourth data item h(r i ) and the privacy value x of sequence number i i The corresponding intermediate data f i Calculate the target privacy value x p The first fragment c0, for example c0 = f i -h(r i ), or c0 is the intermediate data f i and the fourth data item h(r i ) is the result of an XOR operation.

[0072] Step 110, Bob uses the random number r of sequence number e to generate e And the privacy value x0 ranked first, calculate the target privacy value x p The second shard c1. Bob can use the second operation rule h to process the random number r with sequence number e e The second data item h(r e ), and then in step 110, the second data item h(r e ) and the privacy value x0 to calculate the target privacy value x p The second slice c1, for example, c1 = x0-h(r e ), or the second shard c1 can also be the private value x0 and the second data item h(r e ) is the result of an XOR operation.

[0073] Referring to the process of Alice obtaining shard c0 and Bob obtaining shard c1, it can be seen that the result of processing shard c0 and shard c1 using the first preset operation rule is equal to the target privacy value x p , where the first preset operation rule can be a sum operation or a bitwise XOR operation. In other words, the result of the sum operation or bitwise XOR operation on shard c0 and shard c1 is equal to the target privacy value x p In addition, in the process of making Alice and Bob obtain shard c0 and shard c1 respectively, Alice cannot know the target privacy value x p, ensuring the target privacy value x p security.

[0074] The aforementioned shared OT protocol can be used to support Alice and Bob to implement secure multi-party computation on two private values ​​a and b. Secret sharing is widely used in secure multi-party computation. Its basic principle is to split the secret value into multiple shares and entrust them to different participants for safekeeping. Only participants exceeding a threshold number can merge their respective shares to restore the original secret value. The threshold number is usually the same as the number of participants participating in the secure multi-party computation. Therefore, in the actual execution of secure multi-party computation by Alice and Bob, for the private values ​​a and b that are expected to be processed by the target operation rules, the typical data holding situations of Alice and Bob may include the following situations 2 to 4 in addition to the following situation 1:

[0075] Case 1: Alice holds a and Bob holds b. Both a and b can be single-bit values ​​0 or 1 in the modulo 2 space; or both a and b can be modulo 2 t space; or a is a single-bit value 0 or 1 in modulo 2 space, and b is modulo 2 t An integer in space.

[0076] Case 2: a is a single-bit value 0 or 1 in modulo 2 space, and b is an integer in modulo 2 space. Alice holds a and b in modulo 2 space. t In the slice b0 in space, Bob holds b modulo 2 t A slice b1 in space where the sum of b0 and b1 equals b.

[0077] Case 3, a is a single-bit value 0 or 1 in modulo 2 space, b is an integer in modulo 2 space; Alice holds a slice a0 of a in modulo 2 space and b slice a1 in modulo 2 space. t In the space, Bob holds a slice a1 in the modulo 2 space and b in the modulo 2 space. t A slice b1 in the space where the result of the XOR operation on a0 and a1 is equal to a, and the result of the sum operation on b0 and b1 is equal to b.

[0078] Case 4, a is a single-bit value 0 or 1 in the modulo 2 space, b is an integer in the modulo 2 space; Alice holds a slice a0 of a in the modulo 2 space, Bob holds b and a slice a1 of a in the modulo 2 space, where the result of the XOR operation on a0 and a1 is equal to a.

[0079] For the aforementioned cases 1 to 4, the aforementioned shared OT protocol can be used to implement secure multi-party computation of private values ​​a and private values ​​b. However, for different data holding situations, the process of Alice and Bob implementing secure multi-party computation of a and b based on the aforementioned shared OT protocol may be different. The following describes in detail the process of Alice and Bob implementing secure multi-party computation of private values ​​a and private values ​​b based on the aforementioned shared OT protocol in the aforementioned four data holding situations.

[0080] Figure 2 This is one of the process diagrams of the secure multi-party computing method based on the shared OT protocol. Figure 2 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 2 Alice and Bob can implement secure multi-party computation of the private value a and the private value b through steps 200 and 202 in the aforementioned data holding situation 1.

[0081] First, in step 200, Bob generates N privacy values ​​arranged in order according to the privacy value b.

[0082] That is, generate N privacy values ​​{x0, x1, ..., x N-1 For any privacy value x with serial number j among the N privacy values, j For example, it can be obtained by processing the sequence number j and the privacy value b using the target operation rule g, so that the target privacy value x of the sequence number a can be a is equal to the result of processing the privacy value a and the privacy value b using the target operation rule g. When a and b are both integers or both are single-bit privacy values ​​in the modulo 2 space, the target operation rule g may include, but is not limited to, sum operation, product operation, bitwise AND operation, bitwise OR operation or bitwise XOR operation; when a is a single-bit value in the modulo 2 space and b is a modulo 2 t When the integer is in the space, the target operation rule may include, but is not limited to, a product operation. It should be noted that the value of N in step 200 should be greater than the privacy value a held by Alice.

[0083] Next, in step 202, Alice and Bob jointly execute the shared OT protocol based on the privacy value a as the sequence number p and the N privacy values ​​generated by them, so that Alice obtains the target privacy value x p The first shard c0 of , Bob obtains the target privacy value x p The second shard c1 of . Since a is equal to p, the target privacy value xp It is obtained by Bob using the target operation rule g to process the sequence number p and the privacy value b. Therefore, the target privacy value x is processed using the first preset operation rule. p The result of the first shard c0 and the second shard c1 is equal to the result of processing a and b using the target operation rule g, so that Alice and Bob complete the secure multi-party computation of a and b. It should be noted that when a and b are two XOR shards of a certain privacy value in the modulo 2 space, that is, when the result of the XOR operation on a and b is equal to a certain privacy value c in the modulo 2 space, due to the target privacy value x p The first slice c0 and the second slice c1 are both modulo 2 t Therefore, this method can also be used to achieve secure modular conversion of the two shards a and b of the privacy value c in the modulo 2 space.

[0084] Figure 3 This is the second process diagram of the secure multi-party computing method based on the shared OT protocol. Figure 3 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 3 As shown, Alice and Bob can implement secure multi-party computation of the privacy value a and the privacy value b through steps 300 to 306 under the aforementioned data holding situation 2.

[0085] First, in step 300, Bob generates N privacy values ​​arranged in sequence according to shard b1.

[0086] That is, generate N privacy values ​​{x0, x1, ..., x N-1 For any privacy value x with serial number j among the N privacy values, j , which can be obtained by processing the sequence number j and the slice b1 using the target operation rule g, for example, by performing a product operation on the sequence number j and the slice b1, so that the target privacy value x of the sequence number a can be obtained. a It is equivalent to the result of processing a and b1 using the target operation rule g.

[0087] Next, in step 302, Alice and Bob jointly execute the shared OT protocol based on the privacy value a as the serial number p and the N privacy values ​​generated by them, so that Alice obtains the target privacy value x p The first shard c0 of , Bob obtains the target privacy value x p The second slice c1 of . Since a is equal to p, x pis obtained by Bob using the target operation rule g to process the sequence number p and the fragment b1, so for x p The result of the sum operation or XOR operation of the first shard c0 and the second shard c1 is equal to the result of processing the sequence numbers a and b1 using the target operation rule g, thereby completing the secure multi-party computation of a and b1.

[0088] Next, in step 304, Alice p The third shard c0g is calculated by using the first shard c0, the privacy value a and the shard b0. For example, Alice can calculate shard c0g by c0g=a*b0+c0, so that the shard c0g and x p The result of the sum operation on the second slice of is equal to the result of processing a and b using the target operation rule. It should be noted that c0g can also be obtained by performing an XOR operation on a, b0 and c0.

[0089] Figure 4 This is the third process diagram of the secure multi-party computing method based on the shared OT protocol. Figure 4 The implementation shown includes execution process 1 and execution process 2: in execution process 1, Alice will be the receiver of the shared OT protocol (i.e., the first party), and Bob will be the sender of the shared OT protocol (i.e., the second party); in execution process 2, Alice will be the sender of the shared OT protocol, and Bob will be the receiver of the shared OT protocol. Figure 4 As shown, Alice and Bob can implement secure multi-party computation of privacy value a and privacy value b through steps 400 to 407 under the aforementioned data holding situation 3, wherein steps 400 to 402 belong to execution process 1, and steps 403 to 405 belong to execution process 2. Execution process 1 and execution process 2 can be executed independently of each other without any necessary sequential relationship.

[0090] In step 400, Bob calculates a privacy value L1 based on slice a1 and slice b1. The privacy value L1 can be calculated, for example, by using the formula L1=(b1-2a1*b1) or a variation of the formula.

[0091] In step 401, Bob generates N privacy values ​​arranged in order according to the privacy value L1.

[0092] That is, generate N privacy values ​​{x0, x1, ..., x N-1 For any privacy value x with serial number j among the N privacy values, jSpecifically, it can be obtained by processing the serial number j and the privacy value L1 using the target operation rule g, for example, by performing a product operation on the serial number j and L1, so that the target privacy value of the serial number a0 can be equal to the result of processing a0 and L1 using the target operation rule g.

[0093] In step 402, Alice jointly executes the shared OT protocol based on the privacy value a0 as the serial number p and Bob based on the N privacy values ​​generated by him, so that Alice obtains the first shard c00 of the target privacy value with the serial number a0 among the N privacy values ​​generated by Bob, and Bob obtains the second shard c01 of the target privacy value with the serial number a0 among the N privacy values ​​generated by Bob.

[0094] In step 403, Alice calculates a privacy value L0 based on slice a0 and slice b0. The privacy value L0 can be calculated, for example, by using the formula L0=(b0-2a0*b0) or a variation of the formula.

[0095] In step 404, Alice generates N privacy values ​​arranged in order according to the privacy value L0.

[0096] That is, generate N privacy values ​​{x0, x1, ..., x N-1 For any privacy value x with serial number j among the N privacy values, j , which can be obtained by processing the serial number j and the privacy value L0 using the target operation rule g, for example, by performing a product operation on the serial number j and L0, so that the privacy value of the serial number a1 can be equal to the result of processing a1 and L0 using the target operation rule g.

[0097] In step 405, Bob jointly executes the shared OT protocol based on the privacy value a1 as the serial number p and Alice based on the N privacy values ​​generated by her, so that Bob obtains the first shard c10 of the target privacy value with the serial number a1 among the N privacy values ​​generated by Alice, and Alice obtains the second shard c11 of the target privacy value with the serial number a1 among the N privacy values ​​generated by Alice.

[0098] In step 406, Alice calculates slice m0 according to slice a0, slice b0, slice c00 and slice c11. For example, Alice can calculate slice m0 by the formula m0=a0*b0+c00+c11 or its deformation.

[0099] In step 407, Bob calculates slice m1 according to slice a1, slice b1, slice c01 and slice c10. For example, Bob can calculate slice m1 by formula m1=a1*b1+c01+c10 or its deformation.

[0100] Referring to the calculation process of Alice and Bob calculating m0 and m1, it can be seen that the sum of m0 and m1 is equal to the result of processing a and b using the target operation rule, so that Alice and Bob complete the secure multi-party calculation of the private value a and the private value b through the above steps 400 to 407 based on the shared OT protocol. In addition, it can be understood that the addition and multiplication operations in the above formula for calculating the shards can also be replaced by XOR operations.

[0101] Figure 5 This is the fourth process diagram of the secure multi-party computing method based on the shared OT protocol. Figure 5 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 5 Alice and Bob can implement secure multi-party computation of the private value a and the private value b through steps 500 to 502 in the aforementioned data holding situation 4.

[0102] First, in step 500, Bob generates N privacy values ​​arranged in sequence according to the shard a1 and the privacy value b.

[0103] That is, generate N privacy values ​​{x0, x1, ..., x N-1}. Any private value x of sequence number j j It is equal to the result obtained by processing the XOR result of sequence number j and the privacy value b (i.e., the fifth privacy value) using the target operation rule g. The XOR result of sequence number j is obtained by performing an XOR operation on sequence number j and slice a1 (i.e., the sixth privacy value), so that the target privacy value of sequence number a0 (i.e., the third privacy value) among the N privacy values ​​is equal to the result of processing the privacy value b and the privacy value a using the target operation rule, for example, equal to the result of performing a product operation on the privacy value a and the privacy value b.

[0104] Next, in step 502, Alice and Bob jointly execute the shared OT protocol based on the shard a0 with the serial number p and the N privacy values ​​generated by them, so that Alice obtains the first shard c0 of the target privacy value with the serial number a0 among the N privacy values ​​generated by Bob, and Bob obtains the second shard c1 of the target privacy value with the serial number a0 among the N privacy values ​​generated by Bob. The result of the sum operation or XOR operation on the first shard c0 and the second shard c1 is equal to the result of processing a and b using the target operation rule.

[0105] Through the technical solution of the embodiments of this specification, when the second party holds N private values ​​and the first party holds the serial number of the target private value among the N private values, the first party and the second party can implement the shared OT protocol to ensure the security of the target private value and its serial number, so that the first party and the second party can each obtain a slice of the target private value. In addition, the first party and the second party can implement secure multi-party computation of the two private values ​​based on the shared OT protocol. The first party and the second party need to transmit less data and fewer communication rounds when implementing secure multi-party computation, so that secure multi-party computation can be completed more efficiently.

[0106] It should be noted that the above Figure 2 to Figure 5 In the various method embodiments shown, when the privacy value a is a single-bit value in the modulo 2 space, the value of N can generally be 2, which can more effectively reduce the amount of calculations that Alice and Bob need to perform when implementing secure multi-party computations on a and b.

[0107] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for sharing OT, involving a first party and a second party, the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, the first party holds the first sequence number of the target privacy value among the N privacy values, the target random number and its second sequence number among the N random numbers, and the device is deployed on the second party. Figure 6As shown, the device includes: a communication processing unit 61, configured to receive a third serial number calculated by the first party based on the first serial number and the second serial number; a first calculation unit 63, configured to calculate the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the serial number with the third serial number based on the third serial number, the N privacy values ​​and the N random numbers; the communication processing unit 61 is also configured to send the intermediate data corresponding to each of the N-1 privacy values ​​to the first party, so that the first party calculates the first slice of the target privacy value; a second calculation unit 65, configured to calculate the second slice of the target privacy value based on the random number with the serial number of the third serial number and the privacy value arranged in the first place, wherein the result of processing the first slice and the second slice using the first preset operation rule is equal to the target privacy value.

[0108] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for sharing OT, involving a first party and a second party, the second party holds N privacy values ​​arranged in sequence and N random numbers arranged in sequence, the first party holds the first sequence number of the target privacy value among the N privacy values, the target random number and its second sequence number among the N random numbers, and the device is deployed on the first party. Figure 7 As shown, the device includes: a communication processing unit 71, configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second slice of the target privacy value based on the random number with the serial number being the third serial number and the privacy value arranged in the first place, and returns the intermediate data corresponding to each of the remaining N-1 privacy values ​​except the serial number being the third serial number; a calculation processing unit 73, configured to calculate the first slice of the target privacy value based on at least the first serial number and the target random number, wherein the result obtained by processing the first slice and the second slice using a first preset operation rule is equal to the target privacy value.

[0109] Based on the same concept as the above method, the embodiments of this specification also provide a secure multi-party computing device based on the OT protocol, involving a first party and a second party, the first party holds a third private value to be used as a first serial number, the second party holds a second private value, and the device is deployed on the second party. Figure 8As shown, the device includes: a calculation processing unit 81, configured to generate N privacy values ​​arranged in sequence, wherein any privacy value with a sequence number of j is obtained by processing the sequence number of j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit 83, configured to perform the sharing OT protocol jointly with the first party for the N privacy values ​​and the third privacy value as the first sequence number through the execution device of the sharing OT deployed on the second party as described in the embodiment of this specification, to obtain the second shard of the target privacy value with the sequence number of the three privacy values, and enable the first party to obtain the first shard of the target privacy value with the sequence number of the third privacy value accordingly.

[0110] Based on the same concept as the aforementioned method embodiment, a secure multi-party computing device based on the shared OT protocol is also provided in the embodiment of this specification, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the device is deployed on the first party. The device is used to obtain the first shard of the target privacy value with the serial number of the three privacy values ​​through the shared OT execution device deployed on the first party as described in the embodiment of this specification and the second party jointly executing the shared OT protocol, and the second party obtains the second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with the serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0111] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, the computer programs corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions / codes on a computer-readable medium, so that when the computer programs corresponding to these functions are executed by a computer, the method described in any embodiment of this specification is implemented by the computer.

[0112] A computer-readable storage medium is also provided in an embodiment of the present specification, on which a computer program / instruction is stored. When the computer program / instruction is executed in a computing device, the computing device executes the execution method of shared OT implemented by the first party or the second party provided in any embodiment of the present specification, or executes the secure multi-party computing method based on the shared OT protocol implemented by the first party or the second party provided in any embodiment of the present specification.

[0113] A computing device is also provided in an embodiment of the present specification, including a memory and a processor, wherein the memory stores a computer program / instruction, and when the processor executes the computer program / instruction, it implements the execution method of the shared OT protocol implemented by the first party or the second party provided in any embodiment of the present specification, or implements the secure multi-party computing method based on the shared OT protocol implemented by the first party or the second party provided in any embodiment of the present specification.

[0114] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0115] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for executing a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N privacy values ​​and N random numbers, and the first party holds a first serial number of a target privacy value among the N privacy values, a target random number and its second serial number among the N random numbers, and the method is applied to the second party, and the method comprises: receiving from the first party a third sequence number calculated by the first party based on the first sequence number and the second sequence number; For any privacy value with a serial number j except the third serial number, process the random number with a serial number j according to the second preset operation rule to obtain the first data item corresponding to it, and calculate the intermediate data with a serial number j corresponding to the privacy value with a serial number j based on the first data item, the second data item, the third data item and the privacy value arranged in the first place, wherein the second data item is obtained by processing the random number with a serial number of the third serial number using the second preset operation rule, and the third data item is the privacy value with a serial number y, and the value of y is the same as the result obtained by performing a modulo operation on the difference between the third serial number and j using N; Sending the intermediate data corresponding to each of the N-1 privacy values ​​to the first party, so that the first party calculates a first shard of the target privacy value; Based on the random number with the third serial number and the privacy value ranked first, a second slice of the target privacy value is calculated, wherein a result obtained by processing the first slice and the second slice using a first preset operation rule is equal to the target privacy value.

2. The method according to claim 1, further comprising: Receiving the N random numbers from a third party; The target random number and the second serial number are sent by the third party to the first party.

3. According to the method of claim 1, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and the result of the sum operation on the first shard and the second shard is equal to the target privacy value.

4. According to the method of claim 1, the third serial number is obtained by performing an XOR operation on the first serial number and the second serial number, and the result of performing an XOR operation on the first shard and the second shard is equal to the target privacy value.

5. The method according to claim 1, calculating the second fragment of the target privacy value based on the random number whose serial number is the third serial number and the privacy value arranged in the first place, comprises: A second fragment of the target privacy value is calculated according to the second data item and the privacy value ranked first.

6. According to the method of claim 1, the lengths of the N privacy values ​​are all t bits; and the step of processing the random number with serial number j according to the second preset operation rule to obtain the first data item corresponding thereto comprises: Calculate a hash value of a random number with a length of t bits for serial number j as the corresponding first data item; or, for a random number with a serial number j whose length is greater than t bits, extract a bit sequence with a length of t bits starting from a predetermined position, and use the data represented by the bit sequence as the first data item corresponding to the random number with serial number j.

7. A method for executing a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N privacy values ​​and N random numbers, and the first party holds a first serial number of a target privacy value among the N privacy values, a target random number, and its second serial number among the N random numbers, the method being applied to the first party, and comprising: Sending a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second shard of the target privacy value based on the random number whose serial number is the third serial number and the privacy value arranged at the first position, and returns the intermediate data corresponding to the remaining N-1 privacy values ​​except the one whose serial number is the third serial number; The target random number is processed using a second preset operation rule to obtain a fourth data item, and based on the first serial number, it is determined whether the target privacy value is the privacy value ranked first; if so, the fourth data item is used as the first shard of the target privacy value; otherwise, the first shard of the target privacy value is calculated based on the fourth data item and the intermediate data corresponding to the privacy value with the second serial number, wherein a result obtained by processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

8. The method according to claim 7, wherein the N random numbers are sent by a third party to the second party; the method further comprising: The target random number and the second serial number are received from the third party.

9. According to the method of claim 7, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and the result of the sum operation on the first shard and the second shard is equal to the target privacy value.

10. According to the method of claim 7, the third serial number is a result obtained by performing an XOR operation on the first serial number and the second serial number, and a result obtained by performing an XOR operation on the first shard and the second shard is equal to the target privacy value.

11. According to the method of claim 7, the lengths of the N privacy values ​​are all t bits; and the step of processing the target random number using the second preset operation rule to obtain the fourth data item comprises: Calculate a hash value of the target random number with a length of t bits as a fourth data item; Alternatively, for the target random number having a length greater than t bits, a bit sequence having a length of t bits is extracted starting from a predetermined position, and data represented by the bit sequence having a length of t bits is used as the fourth data item.

12. A secure multi-party computing method based on a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the method is applied to the second party, and the method comprises: Generate N privacy values ​​arranged in order, wherein any privacy value with a sequence number of j is obtained by processing sequence number j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; For the N privacy values ​​and the third privacy value as the first serial number, the method described in any one of claims 1-6 is used to jointly execute the sharing OT protocol with the first party to obtain the second shard of the target privacy value with the serial number of the three privacy values, and the first party correspondingly obtains the first shard of the target privacy value with the serial number of the third privacy value.

13. According to the method of claim 12, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of the XOR operation on the second privacy value and the third privacy value is equal to the result of the sum operation on the first slice and the second slice. 14 . The method according to claim 12 , wherein the target operation rule comprises a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

15. According to the method of claim 12, the first party also holds a fourth privacy value, the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value, wherein the third shard is calculated by the first party based on the third privacy value, the fourth privacy value and the first shard.

16. According to the method of claim 12, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of the eighth privacy value in the modulo 2 space, the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

17. A secure multi-party computing method based on a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, the method is applied to the first party, and the method comprises: For the third privacy value and N privacy values ​​as the first serial number, the method described in any one of claims 7-11 is used to jointly execute the shared OT protocol with the second party to obtain the first shard of the target privacy value with the serial number of the three privacy values, and enable the second party to obtain the second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

18. According to the method of claim 17, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of the XOR operation on the second privacy value and the third privacy value is equal to the result of the sum operation on the first slice and the second slice.

19. The method according to claim 17, wherein the target operation rule comprises a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

20. The method according to claim 17, wherein a sum of the second privacy value and a fourth privacy value held by the first party is equal to a fifth privacy value; the method further comprising: A third shard is calculated based on the third privacy value, the fourth privacy value, and the first shard, so that a sum of the second shard and the third shard is equal to a product of the third privacy value and the fifth privacy value.

21. According to the method of claim 17, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of the eighth privacy value in the modulo 2 space, the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

22. A secure multi-party computing method based on a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first sequence number, and the second party holds a fifth private value and a sixth private value, wherein the third private value and the sixth private value are two XOR fragments of an eighth private value in a modulo 2 space in a modulo 2 space, and the method comprises: The second party generates N privacy values ​​arranged in sequence, wherein any privacy value with a sequence number j is equal to a result obtained by processing a sequence number j and the fifth privacy value using a target operation rule, and the exclusive OR result with a sequence number j is obtained by performing an exclusive OR operation on sequence number j and the sixth privacy value, so that the target privacy value with a sequence number of the third privacy value is equal to a result obtained by processing the fifth privacy value and the eighth privacy value using the target operation rule; The first party and the second party jointly execute the shared OT protocol for the third privacy value and the N privacy values ​​as the first serial number using the method described in any one of claims 1-11, and respectively obtain the first shard and the second shard of the target privacy value with serial numbers as the three privacy values.

23. An execution device for sharing an oblivious transfer protocol (OT), involving a first party and a second party, wherein the second party holds N privacy values ​​and N random numbers, and the first party holds a first sequence number of a target privacy value among the N privacy values, a target random number and its second sequence number among the N random numbers, and the device is deployed on the second party, and comprises: a communication processing unit, configured to receive, from the first party, a third sequence number calculated based on the first sequence number and the second sequence number; a first calculation unit, configured to, for any privacy value with a serial number j except the third serial number, process the random number with a serial number j according to a second preset operation rule to obtain a first data item corresponding thereto, and calculate intermediate data with a serial number j corresponding to the privacy value with a serial number j based on the first data item, the second data item, the third data item and the privacy value arranged in the first place, wherein the second data item is obtained by processing the random number with a serial number of the third serial number using the second preset operation rule, the third data item is a privacy value with a serial number y, and the value of y is the same as the result obtained by performing a modulo operation on the difference between the third serial number and j using N; The communication processing unit is further configured to send the intermediate data corresponding to each of the N-1 privacy values ​​to the first party, so that the first party calculates a first shard of the target privacy value; The second calculation unit is configured to calculate a second slice of the target privacy value based on a random number with a serial number equal to the third serial number and a privacy value ranked first, wherein a result obtained by processing the first slice and the second slice using a first preset operation rule is equal to the target privacy value.

24. An execution device for sharing an oblivious transfer protocol (OT), involving a first party and a second party, wherein the second party holds N privacy values ​​and N random numbers, and the first party holds a first sequence number of a target privacy value among the N privacy values, a target random number and its second sequence number among the N random numbers, wherein the device is deployed on the first party, and comprises: a communication processing unit configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates a second fragment of the target privacy value based on a random number whose serial number is the third serial number and a privacy value arranged at the first position, and returns intermediate data corresponding to each of the remaining N-1 privacy values ​​except the privacy value whose serial number is the third serial number; A computing and processing unit is configured to process the target random number using a second preset operation rule to obtain a fourth data item, determine whether the target privacy value is the privacy value ranked first based on the first serial number, and if so, use the fourth data item as the first shard of the target privacy value; otherwise, calculate the first shard of the target privacy value based on the fourth data item and the intermediate data corresponding to the privacy value with the second serial number, wherein a result obtained by processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

25. A secure multi-party computing device based on a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the device is deployed on the second party, and the device comprises: a computing processing unit configured to generate N privacy values ​​arranged in sequence, wherein any privacy value with a sequence number j is obtained by processing the sequence number j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; The calling processing unit is configured to jointly execute the shared OT protocol with the first party through the shared OT execution device described in claim 24 for the N privacy values ​​and the third privacy value as the first serial number, so as to obtain the second shard of the target privacy value with the serial number of the three privacy values, and enable the first party to obtain the first shard of the target privacy value with the serial number of the third privacy value.

26. A secure multi-party computing device based on a shared oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the device is deployed on the first party, and the device is used to execute the shared OT protocol jointly with the second party for the third private value as the first serial number and N private values ​​through the shared OT execution device described in claim 25, to obtain a first shard of a target private value with serial numbers of the three private values, and enable the second party to obtain a second shard of the target private value with serial number of the third private value, wherein any private value with serial number j is obtained by the second party using the target operation rule to process the serial number j and the second private value, so that the private value with serial number the third private value is equal to the result of processing the third private value and the second private value using the target operation rule.

27. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computing device, the computing device executes the method according to any one of claims 1 to 21.

28. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 21 is implemented.

Images