Share the execution method of OT protocol, secure multi-party computing method and device

Abstract

A method for executing a shared OT protocol, a secure multi-party computing method and device, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds the first serial number of a target privacy value among the two privacy values, a target random number, and its second serial number among the two random numbers. The 2-choice-1 shared OT execution method includes: the second party receives a third serial number calculated from the first party based on the first serial number and the second serial number, and calculates a second shard based on the random number with the third serial number and the privacy value arranged in the first place; the second party calculates intermediate data based on the two privacy values ​​and the two random numbers, and sends the intermediate data to the first party, so that the first party calculates the first shard, wherein the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the computer field, and in particular, to a method for executing a 2-to-1 sharing OT protocol, a method for executing an N-to-1 sharing OT protocol, a secure multi-party computing method based on the 2-to-1 sharing OT protocol, and a secure multi-party computing method and device based on the N-to-1 sharing OT protocol. Background Art

[0002] The oblivious transfer (OT) protocol is a typical two-party protocol in cryptography, which is often used to support the execution of secure multi-party computation. When the OT protocol is used to support secure multi-party computation (SMPC), a large amount of data usually needs to be transmitted between different participants in the secure multi-party computation, and even multiple rounds of communication may be required between different participants.

[0003] We hope to have a new solution that will help complete secure multi-party computing more efficiently. Summary of the invention

[0004] One or more embodiments of the present specification provide a method for executing a 2-to-1 sharing OT protocol, a method for executing an N-to-1 sharing OT protocol, a secure multi-party computing method based on the 2-to-1 sharing OT protocol, and a secure multi-party computing method and device based on the N-to-1 sharing OT protocol.

[0005] In the first aspect, a method for executing a 2-choice-1 sharing OT protocol is provided, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds the first serial number of the target privacy value in the two privacy values, the target random number, and its second serial number in the two random numbers, and the method is applied to the second party. The method includes: receiving a third serial number calculated based on the first serial number and the second serial number from the first party; calculating intermediate data according to the two privacy values ​​and the two random numbers; sending the intermediate data to the first party so that the first party calculates the first shard; calculating the second shard according to the random number with the serial number of the third serial number and the privacy value arranged in the first place, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0006] In a possible implementation, the method further includes: receiving the two random numbers from a third party; wherein the target random number and the second serial number are sent by the third party to the first party.

[0007] In one possible implementation, the third serial number is equal to the result of an XOR operation on the first serial number and the second serial number; and / or, the result of a sum operation or an XOR operation on the first shard and the second shard is equal to the target privacy data.

[0008] In one possible implementation, calculating intermediate data based on the two privacy values ​​and the two random numbers includes: processing the two random numbers separately according to a second preset operation rule to obtain a first data item and a second data item, and calculating intermediate data based on the first data item, the second data item and the two privacy values.

[0009] In a possible implementation, the second shard is calculated based on the random number with the third serial number and the privacy value ranked first, including: processing the random number with the third serial number according to the second preset operation rule to obtain a third data item, and calculating the second shard of the target privacy value based on the third data item and the privacy value ranked first.

[0010] In one possible implementation, the lengths of the two privacy values ​​are both t bits; and the processing of the two random numbers according to the second preset operation rule to obtain the first data item and the second data item includes: calculating in sequence the hash values ​​of the two random numbers with a length of t bits each as the first data item and the second data item; or, for the two random numbers with a length greater than t bits, extracting bit sequences with a length of t bits starting from predetermined positions in sequence, and using the data represented by the two extracted bit sequences as the first data item and the second data item.

[0011] In the second aspect, a method for executing a 2-choice-1 sharing OT protocol is provided, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in order and two random numbers arranged in order, and the first party holds the first serial number of the target privacy value in the two privacy values, the target random number, and its second serial number in the two random numbers, and the method is applied to the first party. The method includes: sending a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second shard according to the random number with the serial number of the third serial number and the privacy value arranged in the first place, and returns the intermediate data calculated according to the two privacy values ​​and the two random numbers; calculating the first shard according to the first serial number and the target random number, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0012] In a possible implementation, the method further includes: receiving the target random number and the second serial number from a third party; and sending the two random numbers to the second party by the third party.

[0013] In one possible implementation, the third serial number is equal to the result of an XOR operation on the first serial number and the second serial number; and / or, the result of a sum operation or an XOR operation on the first shard and the second shard is equal to the target privacy data.

[0014] In a possible implementation, calculating the first shard based on the first serial number and the target random number includes: processing the target random number using a second preset operation rule to obtain a fourth data item; if the target privacy value with the serial number of the first serial number is the first privacy value, then using the fourth data item as the first shard, otherwise calculating the first shard based on the fourth data item and the intermediate data.

[0015] In one possible implementation, the target random number is processed using a second preset operation rule to obtain a fourth data item, including: calculating a hash value of the target random number with a length of t bits as the fourth data item; or, for the target random number having a length greater than t bits, extracting a bit sequence with a length of t bits starting from a predetermined position and using the data represented by the bit sequence as the fourth data item.

[0016] In a third aspect, a secure multi-party computing method based on a 2-to-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the method is applied to the second party. The method includes: generating two privacy values ​​arranged in sequence, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that the privacy value with serial number the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; for the two privacy values ​​and the third privacy value as the first serial number, using any method in the first aspect to jointly execute the 2-to-1 sharing OT protocol with the first party, obtain a second shard of the target privacy value with serial number the three privacy values, and enable the first party to correspondingly obtain the first shard of the target privacy value with serial number the third privacy value.

[0017] In a possible implementation, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of an XOR operation on the second privacy value and the third privacy value is equal to the result of a sum operation on the first slice and the second slice.

[0018] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0019] In a possible implementation, the first party also holds a fourth privacy value, the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value, wherein the third shard is calculated by the first party based on the third privacy value, the fourth privacy value and the first shard.

[0020] In a possible implementation, the first party further holds a fourth privacy value, and the second party further holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of an eighth privacy value in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

[0021] In a fourth aspect, a secure multi-party computing method based on a 2-to-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the method is applied to the first party. The method includes: for the third privacy value and two privacy values ​​as the first serial number, using any method in the second aspect to jointly execute the 2-to-1 sharing OT protocol with the second party, obtaining a first shard of the target privacy value with the serial number of the three privacy values, and enabling the second party to obtain a second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with the serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0022] In a possible implementation, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of an XOR operation on the second privacy value and the third privacy value is equal to the result of a sum operation on the first slice and the second slice.

[0023] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0024] In a possible implementation, the sum of the second privacy value and a fourth privacy value held by the first party is equal to a fifth privacy value; the method further includes: calculating a third shard based on the third privacy value, the fourth privacy value and the first shard, so that the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value.

[0025] In a possible implementation, the first party further holds a fourth privacy value, and the second party further holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of an eighth privacy value in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

[0026] In a fifth aspect, a secure multi-party computing method based on a 2-to-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a fifth private value and a sixth private value, wherein the third private value and the sixth private value are two XOR fragments of an eighth private value located in a modulo 2 space in a modulo 2 space. The method comprises: the second party generates two private values ​​arranged in sequence, wherein any private value with serial number j is equal to the result obtained by processing the XOR result of serial number j and the fifth private value using a target operation rule, and the XOR result of serial number j is obtained by performing an XOR operation on serial number j and the sixth private value, so that the target private value with serial number the third private value is equal to the result of processing the fifth private value and the eighth private value using the target operation rule; the first party and the second party jointly execute the 2-to-1 sharing OT protocol for the third private value as the first serial number and the two private values ​​using the method described in any one of claims 1-11, and obtain the first fragment and the second fragment of the target private value with serial number the three private values ​​respectively.

[0027] In the sixth aspect, a method for executing an N-choose-1 sharing oblivious transfer (OT) protocol is provided, involving a first party and a second party, wherein the second party holds N ninth privacy values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth privacy value among the N privacy values, wherein N is greater than 2, and the method is applied to the second party. The method comprises: generating N-1 data packets arranged in sequence, a single data packet containing two privacy values ​​arranged in sequence, wherein for any j-th data packet, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; based on the N-1 data packets, adopting any one of the methods in the first aspect, and communicating with the first party based on the N-1th A sequence number is a sequence number, and N-1 rounds of 2-choose-1 sharing OT protocol are jointly executed to obtain N-1 second shards, so that the result of processing the j-th second shard and the j-th first shard obtained by the first party using the first preset operation rule is equal to the target privacy value of the j-th first sequence number in the j-th data group, and the j-th first sequence number is determined based on round j and the fourth sequence number; the fifth shard is calculated based on the N-1 second shards, so that the result of processing the fifth shard and the fourth shard calculated by the first party using the first preset operation rule is equal to the tenth privacy value.

[0028] In a possible implementation, the first privacy value in the first data group is the first ninth privacy value, and the second privacy value in the first data group is the second ninth privacy value; when j is greater than 1, the second privacy value in the jth data group is the difference between the j+1th ninth privacy value and the first ninth privacy value.

[0029] In one possible implementation, for any j-th round of 2-out-1 sharing OT protocol, when the fourth sequence number is equal to j, the target privacy value is the second privacy value in the j-th data group; when the fourth sequence number is not equal to j, the target data is the first privacy value in the j-th data group.

[0030] In the seventh aspect, a method for executing an N-choose-1 sharing OT protocol is provided, involving a first party and a second party, wherein the second party holds N ninth privacy values ​​arranged in order, and the first party holds the fourth sequence number of the tenth privacy value among the N ninth privacy values, wherein N is greater than 2, and the method is applied to the first party. The method includes: determining N-1 first sequence numbers corresponding to N-1 execution rounds, wherein any j-th first sequence number is determined based on its corresponding execution round j and the fourth sequence number; based on the N-1 first sequence numbers, using the method described in any one of claims 7-11, jointly executing N-1 rounds of 2-choose-1 sharing OT protocol with the second party based on N-1 data groups, to obtain N-1 first shards, so that the result of processing the j-th first shard and the j-th second shard obtained by the second party using the first preset operation rule is equal to the target number with the j-th first sequence number in the j-th data group. Marking privacy values, wherein a single data group contains two privacy values ​​arranged in sequence, for any j-th data group, when j is 1, the two privacy values ​​therein are determined according to the first ninth privacy value and the second ninth privacy value respectively, and when j is greater than 1, the first privacy value is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; calculating the fourth shard based on the N-1 first shards, so that the result of processing the fourth shard and the corresponding fifth shard calculated by the second party using the first preset operation rule is equal to the tenth privacy value.

[0031] In a possible implementation, the first privacy value in the first data group is the first ninth privacy value, and the second privacy value in the first data group is the second ninth privacy value; when j is greater than 1, the second privacy value in the jth data group is the difference between the j+1th ninth privacy value and the first ninth privacy value.

[0032] In one possible implementation, for any j-th round of 2-out-of-1 sharing OT protocol, when the fourth sequence number is equal to j, the target privacy value is the second privacy value in the j-th data group; when the fourth sequence number is not equal to j, the target privacy value is the second privacy value in the j-th data group.

[0033] In an eighth aspect, a secure multi-party computing method based on an N-choose-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a fourth serial number, and the second party holds a second privacy value, and the method is applied to the second party. The method includes: generating N ninth privacy values ​​arranged in sequence, wherein any current privacy value among the N ninth privacy values ​​is obtained by processing the serial number of the current privacy value in the N ninth privacy values ​​and the second privacy value using a target operation rule, so that the ninth privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; for the N ninth privacy values ​​and the third privacy value as the fourth serial number, using any method in the sixth aspect to jointly execute the N-choose-1 sharing OT protocol with the first party, obtain the fifth shard of the ninth privacy value with the serial number of the third privacy value, and enable the first party to obtain the fourth shard of the ninth privacy value with the serial number of the third privacy value.

[0034] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0035] In a possible implementation manner, the first preset operation rule includes a sum operation or a bitwise XOR operation.

[0036] In the ninth aspect, a secure multi-party computing method based on an N-choose-1 sharing OT protocol is provided, involving a first party and a second party, the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value. The method is applied to the first party, and the method includes: for the third private value as the fourth serial number and N ninth private values, using any method in the seventh aspect to jointly execute the sharing N-choose-1 sharing OT protocol with the second party, to obtain a fourth shard of the ninth private value with a serial number of the third private value, and to enable the second party to obtain a fifth shard of the ninth private value with a serial number of the third private value, wherein any ninth private value with a serial number of j is obtained by processing the serial number j and the second private value using the target operation rule, so that the ninth private value with a serial number of the third private value is equal to the result of processing the third private value and the second private value using the target operation rule.

[0037] In a possible implementation, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

[0038] In a possible implementation manner, the first preset operation rule includes a sum operation or a bitwise XOR operation.

[0039] In the tenth aspect, a device for executing a 2-choice-1 sharing OT protocol is provided, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds the first serial number of the target privacy value among the two privacy values, the target random number and its second serial number among the two random numbers, and the device is deployed on the second party. The device includes: a communication processing unit configured to receive a third serial number calculated based on the first serial number and the second serial number from the first party; a first calculation unit configured to calculate intermediate data based on the two privacy values ​​and the two random numbers; the communication processing unit is further configured to send the intermediate data to the first party so that the first party calculates the first shard; a second calculation unit configured to calculate the second shard based on the random number with the serial number of the third serial number and the privacy value arranged in the first place, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0040] In the eleventh aspect, a device for executing a 2-choice-1 sharing OT protocol is provided, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds the first serial number of the target privacy value among the two privacy values, the target random number, and its second serial number among the two random numbers, and the device is deployed on the first party. The device includes: a communication processing unit, configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second shard according to the random number with the serial number of the third serial number and the privacy value arranged in the first place, and returns the intermediate data calculated according to the two privacy values ​​and the two random numbers; a calculation processing unit, configured to calculate the first shard according to the first serial number and the target random number, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0041] In the twelfth aspect, a secure multi-party computing device based on a 2-to-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the device is deployed on the second party. The device includes: a computing processing unit configured to generate two privacy values ​​arranged in sequence, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that the privacy value with serial number the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit configured to perform the 2-to-1 sharing OT protocol jointly with the first party through the execution device of the 2-to-1 sharing OT protocol described in the tenth aspect for the two privacy values ​​and the third privacy value as the first serial number, to obtain a second shard of the target privacy value with serial number the three privacy values, and to enable the first party to obtain a first shard of the target privacy value with serial number the third privacy value.

[0042] In the thirteenth aspect, a secure multi-party computing device based on a 2-to-1 sharing oblivious transfer OT protocol is provided, involving a first party and a second party, the first party holds a third privacy value to be used as a first serial number, the second party holds a second privacy value, the device is deployed on the first party, and the device is used to perform the 2-to-1 sharing OT protocol on the third privacy value as the first serial number and two privacy values ​​through the 2-to-1 sharing OT protocol execution device described in the eleventh aspect and the second party to jointly execute the 2-to-1 sharing OT protocol to obtain a first fragment of the target privacy value with the serial number of the three privacy values, and enable the second party to obtain a second fragment of the target privacy value with the serial number of the third privacy value, wherein any privacy value with serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with serial number the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0043] In the fourteenth aspect, there is provided an execution device for an N-choose-1 sharing OT protocol, involving a first party and a second party, wherein the second party holds N ninth privacy values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth privacy value among the N privacy values, wherein N is greater than 2, and the device is deployed on the second party. The device comprises: a packet processing unit, configured to generate N-1 data packets arranged in sequence, a single data packet containing two privacy values ​​arranged in sequence, wherein for any j-th data packet, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; a calling processing unit, configured to, based on the N-1 data packets, communicate with the 2-choose-1 sharing OT protocol execution device described in the twelfth aspect. The first party jointly executes N-1 rounds of 2-out-1 sharing OT protocol based on N-1 first serial numbers to obtain N-1 second shards, so that the result of processing the j-th second shard and the j-th first shard obtained by the first party using the first preset operation rule is equal to the target privacy value of the j-th first serial number in the j-th data group, and the j-th first serial number is determined based on round j and the fourth serial number; the computing processing unit is configured to calculate the fifth shard based on the N-1 second shards, so that the result of processing the fifth shard and the fourth shard calculated by the first party using the first preset operation rule is equal to the tenth privacy value.

[0044] In the fifteenth aspect, there is provided an execution device for an N-choose-1 sharing OT protocol, involving a first party and a second party, wherein the second party holds N ninth privacy values ​​arranged in order, and the first party holds the fourth sequence number of the tenth privacy value among the N ninth privacy values, wherein N is greater than 2, and the device is deployed on the first party. The device comprises: a sequence number determination unit, configured to determine N-1 first sequence numbers corresponding to N-1 execution rounds, wherein any j-th first sequence number is determined based on its corresponding execution round j and the fourth sequence number; a calling processing unit, configured to, based on the N-1 first sequence numbers, jointly execute N-1 rounds of the 2-choose-1 sharing OT protocol with the second party based on N-1 data groups through the execution device for the 2-choose-1 sharing OT protocol described in the thirteenth aspect, to obtain N-1 first fragments, so that the result of processing the j-th first fragment and the j-th second fragment obtained by the second party correspondingly using the first preset operation rule is equal to the j-th first fragment in the j-th data group with the sequence number of the j-th first fragment. j first-order target privacy values, wherein a single data group contains two privacy values ​​arranged in sequence, and for any j-th data group, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; a computing processing unit is configured to calculate a fourth shard based on the N-1 first shards, so that a result of processing the fourth shard and the corresponding fifth shard calculated by the second party using the first preset operation rule is equal to the tenth privacy value.

[0045] In the sixteenth aspect, a secure multi-party computing device based on an N-choose-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a fourth serial number, the second party holds a second privacy value, and the device is deployed on the second party. The device includes: a computing processing unit configured to generate N ninth privacy values ​​arranged in sequence, wherein any current privacy value among the N ninth privacy values ​​is obtained by processing the serial number of the current privacy value in the N ninth privacy values ​​and the second privacy value using a target operation rule, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit configured to execute the N-choose-1 sharing OT protocol jointly with the first party through the N-choose-1 sharing OT protocol execution device described in the fourteenth aspect for the N ninth privacy values ​​and the third privacy value as the fourth serial number, to obtain the fifth shard of the ninth privacy value with the serial number of the third privacy value, and enable the first party to obtain the fourth shard of the ninth privacy value with the serial number of the third privacy value.

[0046] In the seventeenth aspect, a secure multi-party computing method based on an N-choose-1 sharing OT protocol is provided, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, and the device is deployed on the first party, and the device is used to execute the N-choose-1 sharing OT protocol with the second party for the third private value as the fourth serial number and N ninth private values, through the N-choose-1 sharing OT protocol execution device described in the fifteenth aspect, to obtain a fourth shard of the ninth private value with the serial number of the third private value, and enable the second party to obtain a fifth shard of the ninth private value with the serial number of the third private value, wherein any ninth private value with the serial number j is obtained by processing the serial number j and the second private value using the target operation rule, so that the ninth private value with the serial number of the third private value is equal to the result of processing the third private value and the second private value using the target operation rule.

[0047] In the eighteenth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computing device, the computing device implements any one of the methods in the first aspect, the second aspect, the third aspect, the fourth aspect, the sixth aspect, the seventh aspect, the eighth aspect, and the ninth aspect.

[0048] In the nineteenth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any one of the first aspect, the second aspect, the third aspect, the fourth aspect, the sixth aspect, the seventh aspect, the eighth aspect, and the ninth aspect is implemented.

[0049] Through the method and apparatus provided in one or more embodiments of this specification, when the second party holds multiple privacy values ​​and the first party holds the serial number of a specific privacy value in the multiple privacy values, the first party and the second party can implement the 2-to-1 sharing OT protocol or the N-to-1 sharing OT protocol to ensure the security of the specific privacy value and its serial number, so that the first party and the second party can each obtain a slice of the specific privacy value. In addition, the first party and the second party can implement secure multi-party computing of the privacy value based on the 2-to-1 sharing OT protocol or the N-to-1 sharing OT protocol. When implementing secure multi-party computing, the first party and the second party need to transmit less data and fewer communication rounds, so that secure multi-party computing can be completed more efficiently. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A process diagram of a method for executing a 2-choose-1 sharing OT protocol provided in an embodiment of this specification;

[0052] Figure 2 One of the process diagrams of the secure multi-party computing method based on the 2-choose-1 sharing OT protocol provided as an example;

[0053] Figure 3 The second process diagram of the secure multi-party computing method based on the 2-choice-1 sharing OT protocol is provided as an example;

[0054] Figure 4 The third process diagram of the secure multi-party computing method based on the 2-choice-1 sharing OT protocol is provided as an example;

[0055] Figure 5 The fourth process diagram of the secure multi-party computing method based on the 2-choice-1 sharing OT protocol is provided as an example;

[0056] Figure 6 A schematic diagram of a process of executing a method of N-choose-1 sharing OT protocol provided in an embodiment of this specification;

[0057] Figure 7 A schematic diagram of a process of a secure multi-party computing method based on an N-choose-1 sharing OT protocol is provided as an example;

[0058] Figure 8 One of the schematic diagrams of an exemplary execution device of a 2-choose-1 sharing OT protocol;

[0059] Fig. 9 The second schematic diagram of the execution device of the exemplary 2-choice-1 sharing OT protocol;

[0060] Fig.10 A schematic diagram of a secure multi-party computing device based on a 2-out-of-1 sharing OT protocol is provided as an example;

[0061] Fig.11 One of the schematic diagrams of an exemplary N-choose-1 sharing OT protocol execution device;

[0062] Fig.12 The second schematic diagram of the execution device of the N-choose-1 sharing OT protocol provided as an example;

[0063] Fig.13 Schematic diagram of a secure multi-party computing device based on an N-out-of-1 sharing OT protocol provided by way of example. Specific embodiments

[0064] The following will describe in detail each non-limiting embodiment provided in this specification with reference to the accompanying drawings.

[0065] The OT protocol is a relatively typical two-party protocol in cryptography. Taking the two parties executing this protocol, including Alice and Bob, as an example, the requirements of the OT protocol are as follows: Alice, as the OT receiver (or the first party), holds a private value p, where p is an integer and satisfies 0 ≤ p ≤ N - 1; Bob, as the OT sender (or the second party), holds N private values {x0, x1,..., x N-1}; after Alice and Bob jointly execute the OT protocol, Alice can obtain the private value x with the serial number p among the N private values, p but cannot learn the other private values held by Bob, and Bob cannot learn the p held by Alice. It should be particularly noted that, considering that the smallest non-negative integer when a computing device represents a value through a bit sequence is 0, for the serial number of any j-th data in a certain sequence data in the sequence data, in the embodiments of this specification, it is usually set to j - 1 rather than j. For example, the aforementioned private value x0, as the private value arranged at the head among the aforementioned N private values, can be expressed as the 1st private value among the N private values. However, its serial number among the aforementioned N private values is 0 rather than 1. Therefore, it is required that p is an integer and satisfies 0 ≤ p ≤ N - 1. It can be understood that in terms of technical implementation, other serial number setting rules can also be adopted. For example, the serial number of any j-th data in any sequence data in the sequence data can also be set to j rather than j - 1. Specifically, for example, the serial number of the aforementioned private value x0 among the aforementioned N private values can be set to 1, and correspondingly, it can be required that the serial number p is an integer and satisfies 1 ≤ p ≤ N. In addition, it should also be noted that Alice and Bob can each be implemented as any device, equipment, platform, or cluster of devices with computing / processing capabilities.

[0066] The Random OT (Random Oblivious Transfer) protocol is a variant of the above OT protocol and can be used to construct the above OT protocol. The Random OT protocol can be implemented through various cryptographic techniques. The requirements of the Random OT protocol are as follows: Bob can obtain N random numbers {r0, r1,..., r N-1} arranged in sequence; Alice can obtain the (i + 1)-th random number r among the N random numbers, iAnd its serial number i in the N random numbers. The method of constructing the OT protocol through the Random OT protocol may include but is not limited to the following steps S01 to S03:

[0067] Step S01, Alice calculates the intermediate sequence number e = (i + p)% N, and sends e to Bob;

[0068] Step S02: for N private values ​​{x0, x1, ..., x N-1} except the privacy value r of sequence number e e Each private value x with serial number j other than j , using N random numbers {r0, r1, ..., r N-1} The random number with sequence number (ej)%N is encrypted x j To obtain the ciphertext f with sequence number j j , and the ciphertext f j Send to Alice;

[0069] Step S03, Alice uses the random number r with serial number i that she holds i , for the privacy value x of the received sequence number i i The corresponding ciphertext f i Decrypt it to get the private value x with serial number p p .

[0070] Secure multi-party computation is a process in which multiple parties jointly calculate the result of a function. During the calculation process, the input data of the function held by each of the multiple parties is not disclosed. The input data held by each party is usually treated as private data and cannot be known by other parties, but the calculation result is allowed to be disclosed to designated objects. For example, there may be the following secure multi-party computation requirements: Alice holds a private value A, and Bob holds a private value B. After the secure multi-party computation, Alice obtains shard c0 and Bob obtains shard c1. The results of processing c0 and c1 using the preset operation rules are equal to the results of processing A and B using the target operation rules g. The aforementioned target operation rules g may include but are not limited to secure module conversion, sum operation, product operation, bitwise AND operation, bitwise OR operation or bitwise XOR operation, etc.; the aforementioned preset operation rules may include but are not limited to sum operation or XOR operation.

[0071] The aforementioned OT protocol can generally be used to support the aforementioned secure multi-party computing. The method for implementing the aforementioned secure multi-party computing through the aforementioned OT protocol may include but is not limited to the following steps S11 to S14:

[0072] Step S11, Bob generates a random value as shard c1;

[0073] Step S12: Bob calculates N privacy values ​​arranged in order, where any j+1th privacy value x j =g(j, B)-c1, the N privacy values ​​generated by Bob are the N privacy values ​​arranged in order in the aforementioned OT protocol;

[0074] Step S13, Alice uses A as p in the aforementioned OT protocol;

[0075] Step S14: Alice and Bob jointly execute the aforementioned OT protocol based on A, which is p in the OT protocol, and the N privacy values ​​calculated by them. The execution result is: Alice obtains x, which will be used as shard c0. A =g(A, B)-c1.

[0076] In the process of implementing the aforementioned secure multi-party computing based on the aforementioned OT protocol, Alice and Bob need to communicate for multiple rounds and the amount of data required to be transmitted is relatively large. In view of the above problems, the embodiments of this specification provide a method for executing a 2-choose-1 sharing OT protocol, a method for executing an N-choose-1 sharing OT protocol, a secure multi-party computing method based on a 2-choose-1 sharing OT protocol, and a secure multi-party computing method and device based on an N-choose-1 sharing OT protocol, in order to reduce the amount of data required to be transmitted when implementing secure multi-party computing, thereby completing secure multi-party computing more efficiently.

[0077] Figure 1 Schematic diagram of a process of executing a 2-choice-1 sharing OT protocol provided in an embodiment of this specification. In this method, Alice is the OT receiver (i.e., the first party) of the sharing OT protocol, and Bob is the OT sender (i.e., the second party) of the sharing OT protocol. Figure 1 Before the method shown, Alice and Bob can execute the RandomOT protocol or other methods described above, so that Bob obtains two random numbers {r0, r1} arranged in sequence, and Alice obtains the target random number r i And its serial number i in the two random numbers. For example, Bob can specifically receive the two random numbers {r0, r1} mentioned above from a third party, and Alice can receive r i And its serial number i in the two random numbers mentioned above. In addition, similar to the OT protocol described above, Bob can also hold two privacy values ​​{x0, x1} arranged in sequence, and Alice can also hold the target privacy value x p The first sequence number p in the two private values ​​{x0, x1} mentioned above. On this basis, Alice and Bob can jointly execute Figure 1 The following method steps 100 to 110 are shown.

[0078] First, in step 100, Alice calculates a sequence number e according to sequence numbers p and i. For example, Alice may perform a modulo operation on the sum of sequence numbers p and i using N to obtain sequence number e, or may perform an XOR operation on sequence numbers p and i to obtain sequence number e, or may perform a modulo operation on the difference between sequence numbers p and i using N to obtain sequence number e.

[0079] Next, in step 102, Alice sends the sequence number e to Bob.

[0080] Next, in step 104, Bob calculates the intermediate data f according to the two privacy values ​​and the two random numbers.

[0081] For two privacy values ​​{x0, x1} arranged in sequence, Bob can use the second preset operation rule h to process x0 and x1 respectively to obtain the first data item h(r0) and the second data item h(r1), and then calculate the intermediate data f according to the first data item h(r0), the second data item h(r1), the privacy value x0 and the privacy value x1. The privacy value x0 and the privacy value x1 can both be modulo 2 t Integers in the space, at this time, it is necessary to ensure that after using the second preset operation rule h to process any random number held by Bob, data with a length of t bits can be output corresponding to the random number. Taking the random number r0 as an example, if the length of the random number r0 is not greater than t bits, the first data item h(r0) obtained by processing the random number r0 using the second preset operation rule h can be the hash value of the random number r0 calculated by Bob with a length of t bits; if the length of the random number r0 is greater than t bits, the first data item h(r0) obtained by processing the random number r0 using the second preset operation rule h can be data represented by a bit sequence with a length of t bits extracted from a predetermined position. The process of Bob using the second preset operation rule to process the random number r1 to obtain the second data item h(r1) is the same as the process of Bob using the second preset operation rule to process the random number r0 to obtain its corresponding first data item h(r0), so it will not be repeated.

[0082] More specifically, Bob can calculate the intermediate data f by the following formula 1:

[0083] f=h(r0)+h(r1)-x0+x1 (1)

[0084] It is understandable that the intermediate data f can also be calculated by other methods, such as adding specific coefficients before some or all of the data items in formula 1 or making certain deformations to the aforementioned formula 1. More specifically, for example, all the addition and subtraction operations involved in formula 1 can be replaced by bitwise XOR operations.

[0085] Step 106, Bob sends the intermediate data f to Alice.

[0086] Step 108, Alice at least based on the sequence number p and the target random number r i Calculate the target privacy value x p The first fragment c0 of .

[0087] Alice can use the aforementioned second preset operation rule h to process the target random number r she holds. i To obtain the fourth data item h(r i ), Alice obtains the fourth data item h(r i ) can be the same as Bob to obtain the first data item h(r0) and the second data item h(r1), so it is not repeated here. Alice can specifically determine the target privacy value x according to the sequence number p. p Is it the privacy value x0 ranked first? If so, the fourth data item h(r i ) as the target privacy value x p Otherwise, Alice can use the fourth data item h(r i ) and the intermediate data f to calculate the target privacy value x p The first slice c0, for example, c0 = fh (r i ), or c0 is the sum of the intermediate data f and the fourth data item h(r i ) is the result of an XOR operation.

[0088] Step 110, Bob uses the random number r of sequence number e e And the privacy value x0 ranked first, calculate the target privacy value x p The second shard c1 of the random number. Bob can use the second operation rule h to process the random number r0 and the random number r1 with the serial number e. e And get the third data item h(r e ), and then in step 110, the third data item h(r e ) and the privacy value x0 to calculate the target privacy value x p The second slice c1, for example, c1 = x0-h(r e ), or the second shard c1 can also be a pair of private value x0 and the third data item h(r e ) is the result of an XOR operation.

[0089] Referring to the process of Alice obtaining shard c0 and Bob obtaining shard c1, it can be seen that the result of processing shard c0 and shard c1 using the first preset operation rule is equal to the target privacy value x p, where the first preset operation rule can be a sum operation or an XOR operation. In other words, the result of the sum operation or bitwise XOR operation on shard c0 and shard c1 is equal to the target privacy value x p In addition, in the process of making Alice and Bob obtain shard c0 and shard c1 respectively, Alice cannot know the target privacy value x p , ensuring the target privacy value x p security.

[0090] The aforementioned 2-choose-1 sharing OT protocol can be used to support Alice and Bob to implement secure multi-party computation on two private values ​​a and b, where a can be a single-bit value 0 or 1 in the modulo 2 space, and b can be either a single-bit value 0 or 1 in the modulo 2 space, or a modulo 2 t Integers in the space. Secret sharing is widely used in secure multi-party computing. Its basic principle is to split the secret value into multiple shares and give them to different participants for safekeeping. Only participants exceeding a threshold number can merge their respective shares to restore the original secret value. The threshold number is usually the same as the number of participants participating in the secure multi-party computing. Therefore, when Alice and Bob actually perform secure multi-party computing, they need to know the single-bit privacy value a in the modulo 2 space and the single-bit privacy value a in the modulo 2 space that they want to process through the target operation rule. t For the privacy value b in the space, the typical data holding situations include situation 1 shown below, and the data holding situations of Alice and Bob may also include situation 2 to situation 4 as follows:

[0091] Case 1, Alice holds a and Bob holds b.

[0092] Case 2, lice holds a and b modulo 2 t Slice b0 in space, Bob holds b modulo 2 t A slice b1 in space where the sum of b0 and b1 equals b.

[0093] Case 3, Alice holds a0 of a in modulo 2 space and b in modulo 2 t In the space, Bob holds a slice a1 in the modulo 2 space and b in the modulo 2 space. t A slice b1 in the space where the result of the XOR operation on a0 and a1 is equal to a, and the result of the sum operation on b0 and b1 is equal to b.

[0094] Case 4: Alice holds a0, a slice of a in modulo 2 space, and Bob holds b and a1, a slice of a in modulo 2 space, where the result of XOR operation on a0 and a1 is equal to a.

[0095] For the above cases 1 to 4, the above 2-choose-1 sharing OT protocol can be used to implement the single-bit privacy value a in the modulo 2 space and the single-bit privacy value a in the modulo 2 space. t However, for different data holding situations, the process of Alice and Bob implementing secure multi-party computation of a and b based on the aforementioned 2-choice-1 sharing OT protocol may be different. The following describes in detail the process of Alice and Bob implementing secure multi-party computation of private values ​​a and private values ​​b based on the 2-choice-1 sharing OT protocol in the above four data holding situations.

[0096] Figure 2 This is one of the process diagrams of the secure multi-party computing method based on the 2-choose-1 sharing OT protocol. Figure 2 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 2 Alice and Bob can implement secure multi-party computation of the private value a and the private value b through steps 200 and 202 in the aforementioned data holding situation 1.

[0097] First, in step 200, Bob generates two privacy values ​​arranged in sequence according to the privacy value b.

[0098] That is, two privacy values ​​{x0, x1} are generated in the order of the 2-choice-1 sharing OT protocol. For any privacy value x with sequence number j among the two privacy values, j Specifically, it can be obtained by processing the sequence number j and the privacy value b using the target operation rule g, so that the target privacy value x of the sequence number a can be a It is equivalent to the result of processing the privacy value a and the privacy value b using the target operation rule g. When a and b are both modulo 2 t When b is a single-bit value in the space, the target operation rule g may include, but is not limited to, a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation; when b is modulo 2 t When the integer is in the space, the target operation rule may include, but is not limited to, a product operation.

[0099] Next, in step 202, Alice and Bob jointly execute the 2-choose-1 sharing OT protocol based on the privacy value a as the sequence number p and the two privacy values ​​generated by them, so that Alice obtains the target privacy value xp The first shard c0 of , Bob obtains the target privacy value x p The second shard c1 of . Since a is equal to p, the target privacy value x p It is obtained by Bob using the target operation rule g to process the sequence number p and the privacy value b. Therefore, the target privacy value x is processed using the first preset operation rule. p The result of the first shard c0 and the second shard c1 is equal to the result of processing a and b using the target operation rule g, so that Alice and Bob complete the secure multi-party computation of a and b. It should be noted that when a and b are two XOR shards of a certain privacy value in the modulo 2 space, that is, when the result of the XOR operation on a and b is equal to a certain privacy value c in the modulo 2 space, due to the target privacy value x p The first slice c0 and the second slice c1 are both modulo 2 t Therefore, this method can also be used to achieve secure modular conversion of the two shards a and b of the privacy value c in the modulo 2 space.

[0100] Figure 3 This is the second process diagram of the secure multi-party computing method based on the 2-choose-1 sharing OT protocol. Figure 3 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 3 As shown, Alice and Bob can implement secure multi-party computation of the privacy value a and the privacy value b through steps 300 to 306 under the aforementioned data holding situation 2.

[0101] First, in step 300, Bob generates two privacy values ​​arranged in sequence according to shard b1.

[0102] That is, generate two secret values ​​{x0, x1} in the order of the two-choice-1 sharing OT protocol. For any secret value x with sequence number j among the two secret values, j , which can be obtained by processing the sequence number j and the slice b1 using the target operation rule g, for example, by performing a product operation on the sequence number j and the slice b1, so that the target privacy value x of the sequence number a can be obtained. a It is equivalent to the result of processing a and b1 using the target operation rule g.

[0103] Next, in step 302, Alice and Bob jointly execute the 2-choose-1 sharing OT protocol based on the privacy value a as the sequence number p and the two privacy values ​​generated by them, so that Alice obtains the target privacy value x p The first shard c0 of , Bob obtains the target privacy value xp The second shard c1 of . Since a is equal to p, the target privacy value x p It is obtained by Bob using the target operation rule g to process the sequence number p and the shard b1, so the target privacy value x p The result of the sum operation or XOR operation of the first shard c0 and the second shard c1 is equal to the result of processing the sequence numbers a and b1 using the target operation rule g, thereby completing the secure multi-party computation of a and b1.

[0104] Next, in step 304, Alice calculates the target privacy value x p The third shard c0g is calculated by using the first shard c0, the privacy value a and the shard b0. For example, Alice can calculate shard c0g by c0g=a*b0+c0, so that the shard c0g and x p The result of the sum operation on the second slice of is equal to the result of processing a and b using the target operation rule. It should be noted that c0g can also be obtained by performing an XOR operation on a, b0 and c0.

[0105] Figure 4 This is the third process diagram of the secure multi-party computing method based on the 2-choose-1 sharing OT protocol. Figure 4 The implementation shown includes execution process 1 and execution process 2: in execution process 1, Alice will be the receiver of the shared OT protocol (i.e., the first party), and Bob will be the sender of the shared OT protocol (i.e., the second party); in execution process 2, Alice will be the sender of the shared OT protocol, and Bob will be the receiver of the shared OT protocol. Figure 4 As shown, Alice and Bob can implement secure multi-party computation of privacy value a and privacy value b through steps 400 to 407 under the aforementioned data holding situation 3, wherein steps 400 to 402 belong to execution process 1, and steps 403 to 405 belong to execution process 2. Execution process 1 and execution process 2 can be executed independently of each other without any necessary sequential relationship.

[0106] In step 400, Bob calculates a privacy value L1 based on slice a1 and slice b1. The privacy value L1 can be calculated, for example, by using the formula L1=(b1-2a1*b1) or a variation of the formula.

[0107] In step 401, Bob generates two privacy values ​​arranged in sequence according to the privacy value L1.

[0108] That is, generate two secret values ​​{x0, x1} in the order of the two-choice-1 sharing OT protocol. For any secret value x with sequence number j among the two secret values, jSpecifically, it can be obtained by processing the serial number j and the privacy value L1 using the target operation rule g, for example, by performing a product operation on the serial number j and L1, so that the target privacy value of the serial number a0 can be equal to the result of processing a0 and L1 using the target operation rule g.

[0109] In step 402, Alice, based on the privacy value a0 as the serial number p, and Bob, based on the N privacy values ​​generated by him, jointly execute the 2-to-1 sharing OT protocol, so that Alice obtains the first shard c00 of the target privacy value with the serial number a0 among the two privacy values ​​generated by Bob, and Bob obtains the second shard c01 of the target privacy value with the serial number a0 among the two privacy values ​​generated by Bob.

[0110] In step 403, Alice calculates a privacy value L0 based on slice a0 and slice b0. The privacy value L0 can be calculated, for example, by using the formula L0=(b0-2a0*b0) or a variation of the formula.

[0111] In step 404, Alice generates two privacy values ​​arranged in sequence according to the privacy value L0.

[0112] That is, generate two secret values ​​{x0, x1} in the order of the two-choice-1 sharing OT protocol. For any secret value x with sequence number j among the two secret values, j , which can be obtained by processing the serial number j and the privacy value L0 using the target operation rule g, for example, by performing a product operation on the serial number j and L0, so that the privacy value of the serial number a1 can be equal to the result of processing a1 and L0 using the target operation rule g.

[0113] In step 405, Bob, based on the privacy value a1 as the serial number p, and Alice, based on the two privacy values ​​generated by her, jointly execute the 2-to-1 sharing OT protocol, so that Bob obtains the first fragment c10 of the target privacy value with the serial number a1 among the two privacy values ​​generated by Alice, and Alice obtains the second fragment c11 of the target privacy value with the serial number a1 among the two privacy values ​​generated by Alice.

[0114] In step 406, Alice calculates slice m0 according to slice a0, slice b0, slice c00 and slice c11. For example, Alice can calculate slice m0 by the formula m0=a0*b0+c00+c11 or its deformation.

[0115] In step 407, Bob calculates slice m1 according to slice a1, slice b1, slice c01 and slice c10. For example, Bob can calculate slice m1 by formula m1=a1*b1+c01+c10 or its deformation.

[0116] Referring to the calculation process of Alice and Bob calculating m0 and m1, it can be seen that the sum of m0 and m1 is equal to the result of processing a and b using the target operation rule, so that Alice and Bob complete the secure multi-party calculation of the private value a and the private value b through the above steps 400 to 407 based on the 2-choose-1 sharing OT protocol. In addition, it can be understood that the addition and multiplication operations in the above formula for calculating the shards can also be replaced by XOR operations.

[0117] Figure 5 This is the fourth process diagram of the secure multi-party computing method based on the 2-choose-1 sharing OT protocol. Figure 5 In the implementation shown, Alice will be the receiver (i.e., the first party) of the shared OT protocol, and Bob will be the sender (i.e., the second party) of the shared OT protocol. Figure 5 Alice and Bob can implement secure multi-party computation of the private value a and the private value b through steps 500 to 502 in the aforementioned data holding situation 4.

[0118] First, in step 500, Bob generates two privacy values ​​arranged in sequence according to the shard a1 and the privacy value b.

[0119] That is, two private values ​​{x0, x1} are generated in the order of the 2-choose-1 sharing OT protocol. j It is equal to the result obtained by processing the XOR result of sequence number j and the privacy value b (i.e., the fifth privacy value) using the target operation rule g. The XOR result of sequence number j is obtained by performing an XOR operation on sequence number j and slice a1 (i.e., the sixth privacy value), so that the target privacy value of sequence number a0 (i.e., the third privacy value) in the two privacy values ​​{x0, x1} is equal to the result of processing the privacy value b and the privacy value a using the target operation rule g, for example, equal to the result of performing a product operation on the privacy value a and the privacy value b.

[0120] Next, in step 502, Alice, based on the shard a0 with the serial number p, and Bob, based on the two privacy values ​​generated by them, jointly execute the 2-choose-1 sharing OT protocol, so that Alice obtains the first shard c0 of the target privacy value with the serial number a0 among the two privacy values ​​generated by Bob, and Bob obtains the second shard c1 of the target privacy value with the serial number a0 among the two privacy values ​​generated by Bob. The result of the sum operation or the XOR operation on the first shard c0 and the second shard c1 is equal to the result of processing a and b using the target operation rule.

[0121] The aforementioned 2-choose-1 sharing OT protocol can be used to support Alice and Bob to implement the N-choose-1 sharing OT protocol, where N is greater than 2. In other words, when Bob, as the OT sender, holds N private values ​​{y0, y1, …, y N-1} (i.e., N ninth private values), and Alice, as the OT receiver, holds a specific private value (i.e., the tenth private value) with sequence number A (i.e., the fourth sequence number) among the N private values, Alice and Bob can jointly execute the N-choose-1 sharing OT protocol based on the 2-choose-1 sharing OT protocol, so that Alice and Bob can obtain the N private values ​​{y0, y1, …, y N-1} The private value y of sequence number A A The third and fourth shards of the shards are processed using the first preset operation rule. a The results of the third and fourth shards are equal to the privacy value y a .

[0122] Figure 6 The following is a process diagram of a method for executing an N-choose-1 sharing OT protocol based on a 2-choose-1 sharing OT protocol provided in an embodiment of this specification. Figure 6 As shown, the method may include the following steps 600 to 608.

[0123] First, in step 600, Bob generates N-1 data groups arranged in sequence according to N privacy values.

[0124] A single data packet contains two privacy values ​​arranged in order, that is, a single data packet includes two privacy values ​​{x0, x1} arranged in order in the aforementioned 2-choice-1 sharing OT protocol. For any j-th data packet in N-1 data packets, when j is 1, the two privacy values ​​are determined according to the first privacy value y0 and the second privacy value y1 in the N privacy values; when j is greater than 1, the first privacy value x0 is 0, and the second privacy value x1 is based on the j+1th privacy value y in the N privacy values. j+1More specifically, the first privacy value x0 in the first data group can be, for example, the privacy value y0, and the second privacy value x1 in the first data group can be, for example, the privacy value y1; when j is greater than 1, the second privacy value x1 in the jth data group can be, for example, the privacy value y j+1 The difference from the privacy value y0, or x1 can be equal to the privacy value y j+1 The result of XOR budgeting with the privacy value y0.

[0125] In step 602, Alice determines N-1 first sequence numbers P corresponding to N-1 execution rounds, wherein any j-th first sequence number P is determined based on its corresponding execution round j and sequence number A. For any j-th first sequence number P, when sequence number A is equal to its corresponding execution round j, the target privacy value of the j-th first sequence number P in the j-th data group is the privacy value x1 in the j-th data group; when sequence number A is not equal to its corresponding execution round j, the target privacy value of the j-th first sequence number P in the j-th data group is the privacy value x0 in the j-th data group. In other words, for any j-th first sequence number, if A is equal to execution round j, the value of the j-th first sequence number p can be 1; if A is not equal to execution round j, the value of the j-th first sequence number p can be 0.

[0126] Next, in step 604, Alice and Bob jointly execute the 2-to-1 sharing OT protocol based on the N-1 first sequence numbers P arranged in sequence, and based on the N-1 data groups arranged in sequence, so that Alice obtains N-1 first fragments and Bob obtains N-1 second fragments. It can be understood that for any j-th round of the 2-to-1 sharing OT protocol, the specific data processed is the j-th first sequence number P held by Alice and the two privacy values ​​{x0, x1} arranged in sequence in the j-th data group held by Bob.

[0127] Next, in step 606, Alice calculates the fourth fragment based on the N-1 first fragments. For example, Alice may perform a sum operation or XOR operation on the N-1 first fragments to obtain the fourth fragment.

[0128] In step 608, Bob calculates the fifth slice based on the N-1 second slices. For example, Bob may perform a summation or XOR operation on the N-1 second slices to obtain the fifth slice.

[0129] Referring to the values ​​of x0 and x1 in the jth data group and the value of the jth first sequence number p described in the above example, it can be understood that the result of summing or XORing the first shard and the first second shard obtained by Alice and Bob in the first round of the 2-choose-1 sharing OT protocol is equal to the privacy value y0; for any jth round of 2-choose-1 sharing OT protocol from the second round of the 2-choose-1 sharing OT protocol to the N-1th round of the 2-choose-1 sharing OT protocol, when j is not equal to A, the result of summing or XORing the jth first shard and the jth second shard obtained by Alice and Bob in the mth round of the 2-choose-1 sharing OT protocol is 0, and when j is equal to A, the result of summing or XORing the jth first shard and the jth second shard obtained by Alice and Bob in the jth round of the 2-choose-1 sharing OT protocol is equal to the privacy value y j+1 The difference from the privacy value y0, or equal to the privacy value y j+1 The result of XORing the fourth shard obtained by Alice and the fifth shard obtained by Bob is equal to N privacy values ​​{y0, y1, ..., y N-1} is the private value y of A. A .

[0130] The aforementioned N-choose-1 sharing OT protocol can be used to support Alice and Bob to implement secure multi-party computation on private values ​​a and b. In a typical technical scenario, Alice can hold a private value a (i.e., the third private value), and Bob can hold a private value b, and both a and b are modulo 2. t space; or a and b can both be single-bit values ​​in the modulo 2 space; or a is a private value in the modulo 2 space and b is a private value in the modulo 2 space. t Integers in space. Figure 7 As shown, the secure multi-party computing method based on the N-choose-1 sharing OT protocol may include the following steps 700 to 704.

[0131] First, in step 700, Bob generates N privacy values ​​arranged in order according to the privacy value b.

[0132] That is, generate the N privacy values ​​{y0, y1, ..., y N-1}. Among them, N privacy values ​​{y0, y1, ..., y N-1 Any current privacy value y in j It uses the target operation rule g to process the current privacy value y j Among N private values ​​{y0, y1, ..., y N-1} and the privacy value b (i.e., the second privacy value), so that the ninth privacy value y a It is equivalent to the result of processing the sequence number a and the privacy value b using the target operation rule.

[0133] Step 702: Bob and Alice jointly execute the N-choose-1 sharing OT protocol based on the N privacy values ​​and the privacy value a as the serial number A, so that Alice obtains the privacy value y with the serial number of privacy value a. a The fourth shard, Bob obtains the private value y with serial number a. a The result of performing a sum operation or an XOR operation on the fourth slice and the fifth slice is equal to the result of processing a and b using the target operation rule.

[0134] Through the method and apparatus provided in one or more embodiments of this specification, when the second party holds multiple privacy values ​​and the first party holds the serial number of a specific privacy value in the multiple privacy values, the first party and the second party can implement the 2-to-1 sharing OT protocol or the N-to-1 sharing OT protocol to ensure the security of the specific privacy value and its serial number, so that the first party and the second party can each obtain a slice of the specific privacy value. In addition, the first party and the second party can implement secure multi-party computing of the privacy value based on the 2-to-1 sharing OT protocol or the N-to-1 sharing OT protocol. When implementing secure multi-party computing, the first party and the second party need to transmit less data and fewer communication rounds, so that secure multi-party computing can be completed more efficiently.

[0135] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for a 2-choice-1 sharing OT protocol, involving a first party and a second party, the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, the first party holds the first serial number of the target privacy value among the two privacy values, the target random number and its second serial number among the two random numbers, and the device is deployed on the second party. Figure 8 As shown, the device includes: a communication processing unit 81, configured to receive a third serial number calculated based on the first serial number and the second serial number from the first party; a first calculation unit 83, configured to calculate intermediate data based on the two privacy values ​​and the two random numbers; the communication processing unit 81 is also configured to send the intermediate data to the first party, so that the first party calculates the first shard; a second calculation unit 85, configured to calculate the second shard based on the random number with the third serial number and the privacy value ranked first, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0136] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for a 2-to-1 sharing OT protocol, involving a first party and a second party, the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, the first party holds the first serial number of the target privacy value among the two privacy values, the target random number and its second serial number among the two random numbers, and the device is deployed on the first party. Fig. 9 As shown, the device includes: a communication processing unit 91, configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates the second shard according to the random number with the third serial number and the privacy value arranged in the first place, and returns the intermediate data calculated according to the two privacy values ​​and the two random numbers; a calculation processing unit 93, configured to calculate the first shard according to the first serial number and the target random number, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

[0137] Based on the same concept as the aforementioned method embodiment, the present specification also provides a secure multi-party computing device based on a 2-to-1 sharing OT protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the device is deployed on the second party. Fig.10 As shown, the device includes: a calculation processing unit 1001, configured to generate two privacy values ​​arranged in sequence, wherein any privacy value with a sequence number of j is obtained by processing the sequence number of j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit 1003, configured to perform the following steps on the two privacy values ​​and the third privacy value as the first sequence number: Figure 8 The execution device of the 2-to-1 sharing OT protocol shown in the figure jointly executes the 2-to-1 sharing OT protocol with the first party to obtain the second shard of the target privacy value with the serial number of the three privacy values, and enables the first party to obtain the first shard of the target privacy value with the serial number of the third privacy value.

[0138] Based on the same concept as the aforementioned method embodiment, the present specification also provides a secure multi-party computing device based on a 2-choose-1 sharing oblivious transfer OT protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the device is deployed on the first party. The device is used to perform the third private value as the first serial number and the two private values, as follows: Fig. 9 The execution device of the 2-to-1 sharing OT protocol shown in the figure jointly executes the 2-to-1 sharing OT protocol with the second party to obtain the first shard of the target privacy value with the serial number of the three privacy values, and enables the second party to obtain the second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with the serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

[0139] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for N-choose-1 sharing OT protocol, involving a first party and a second party, the second party holds N ninth privacy values ​​arranged in sequence, the first party holds the fourth sequence number of the tenth privacy value among the N privacy values, where N is greater than 2, and the device is deployed on the second party. Fig.11 As shown, the device includes: a group processing unit 1101, configured to generate N-1 data groups arranged in sequence, a single data group contains two privacy values ​​arranged in sequence, wherein for any j-th data group, when j is 1, the two privacy values ​​are determined according to the first ninth privacy value and the second ninth privacy value, respectively, and when j is greater than 1, the first privacy value is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; a calling processing unit 1103, configured to, based on the N-1 data groups, by Figure 8 The execution device of the 2-to-1 sharing OT protocol shown in the figure jointly executes N-1 rounds of the 2-to-1 sharing OT protocol with the first party based on N-1 first sequence numbers to obtain N-1 second shards, so that the result of processing the j-th second shard and the j-th first shard obtained by the first party using the first preset operation rule is equal to the target privacy value of the j-th first sequence number in the j-th data group, and the j-th first sequence number is determined based on round j and the fourth sequence number; the calculation processing unit is configured to calculate the fifth shard based on the N-1 second shards, so that the result of processing the fifth shard and the fourth shard calculated by the first party using the first preset operation rule is equal to the tenth privacy value.

[0140] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides an execution device for N-choose-1 sharing OT protocol, involving a first party and a second party, the second party holds N ninth privacy values ​​arranged in sequence, the first party holds the fourth sequence number of the tenth privacy value among the N ninth privacy values, where N is greater than 2, and the device is deployed on the first party. Fig.12As shown, the apparatus comprises: a sequence number determination unit 1201, configured to determine N-1 first sequence numbers corresponding to N-1 execution rounds, wherein any j-th first sequence number is determined based on its corresponding execution round j and the fourth sequence number; a calling processing unit 1203, configured to, based on the N-1 first sequence numbers, Fig. 9 The execution device of the 2-choice-1 sharing OT protocol shown in the figure jointly executes N-1 rounds of the 2-choice-1 sharing OT protocol with the second party based on N-1 data groups to obtain N-1 first fragments, so that the result of processing the j-th first fragment and the j-th second fragment obtained by the second party using the first preset operation rule is equal to the target privacy value with the j-th first sequence number in the j-th data group, wherein a single data group contains two privacy values ​​arranged in sequence, and for any j-th data group, when j is 1, the two privacy values ​​therein are respectively determined according to the 1st ninth privacy value and the 2nd ninth privacy value, and when j is greater than 1, the 1st privacy value therein is 0, and the 2nd privacy value is determined based on the j+1th ninth privacy value and the 1st ninth privacy value; the calculation processing unit 1205 is configured to calculate the fourth fragment based on the N-1 first fragments, so that the result of processing the fourth fragment and the fifth fragment calculated by the second party using the first preset operation rule is equal to the tenth privacy value.

[0141] Based on the same concept as the aforementioned method embodiment, the present specification also provides a secure multi-party computing device based on the N-choose-1 sharing OT protocol, involving a first party and a second party, the first party holds a third private value to be used as the fourth serial number, the second party holds a second private value, and the device is deployed on the second party. Fig.13 As shown, the device includes: a first calculation unit 1301, configured to generate N ninth privacy values ​​arranged in sequence, wherein any current privacy value among the N ninth privacy values ​​is obtained by processing the sequence number of the current privacy value in the N ninth privacy values ​​and the second privacy value using a target operation rule, so that the privacy value with the sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; a calling processing unit 1303, configured to perform the following operations on the N ninth privacy values ​​and the third privacy value as the fourth sequence number: Fig.11 The N-choose-1 sharing OT protocol execution device shown in the figure jointly executes the N-choose-1 sharing OT protocol with the first party to obtain the fifth shard whose serial number is the ninth privacy value of the three privacy values, and enables the first party to obtain the fourth shard whose serial number is the ninth privacy value of the third privacy value.

[0142] Based on the same concept as the aforementioned method embodiment, the embodiment of this specification also provides a secure multi-party computing method based on the N-choose-1 sharing OT protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, and the device is deployed on the first party, and the device is used to perform the third private value as the fourth serial number and N ninth private values, as follows: Fig.12 The execution device of the N-choose-1 sharing OT protocol described in the foregoing jointly executes the sharing N-choose-1 sharing OT protocol with the second party to obtain the fourth shard of the ninth private value with the serial number of the three private values, and enables the second party to obtain the fifth shard of the ninth private value with the serial number of the third private value, wherein any ninth private value with the serial number j is obtained by processing the serial number j and the second private value using the target operation rule, so that the ninth private value with the serial number of the third private value is equal to the result of processing the third private value and the second private value using the target operation rule.

[0143] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, the computer programs corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions / codes on a computer-readable medium, so that when the computer programs corresponding to these functions are executed by a computer, the method described in any embodiment of this specification is implemented by the computer.

[0144] A computer-readable storage medium is also provided in an embodiment of the present specification, on which a computer program / instruction is stored. When the computer program / instruction is executed in a computing device, the computing device executes each method step of a 2-to-1 sharing OT protocol execution method, an N-to-1 sharing OT protocol execution method, a secure multi-party computing method based on a 2-to-1 sharing OT protocol, or a secure multi-party computing method based on an N-to-1 sharing OT protocol implemented by Alice / first party / Bob / second party in any embodiment of the present specification.

[0145] A computing device is also provided in an embodiment of the present specification, including a memory and a processor, wherein the memory stores a computer program / instruction, and when the processor executes the computer program / instruction, it implements the various method steps of the 2-to-1 sharing OT protocol execution method, the N-to-1 sharing OT protocol execution method, the 2-to-1 sharing OT protocol based secure multi-party computing method, or the N-to-1 sharing OT protocol based secure multi-party computing method provided in any embodiment of the present specification by Alice / first party / Bob / second party.

[0146] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0147] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0148] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for executing a 2-choice-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds a first sequence number of a target privacy value among the two privacy values, a target random number and its second sequence number among the two random numbers, and the method is applied to the second party, and the method comprises: receiving from the first party a third sequence number calculated by the first party based on the first sequence number and the second sequence number; Calculate intermediate data according to the two privacy values ​​and the two random numbers; Sending the intermediate data to the first party so that the first party calculates the first fragment; The second shard is calculated according to the random number whose serial number is the third serial number and the privacy value arranged in the first place, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

2. The method according to claim 1, further comprising: receiving the two random numbers from a third party; The target random number and the second serial number are sent by the third party to the first party.

3. According to the method of claim 1, the third serial number is equal to the result of an XOR operation on the first serial number and the second serial number; and / or, the result of a sum operation or an XOR operation on the first shard and the second shard is equal to the target privacy value.

4. The method according to any one of claims 1 to 3, calculating intermediate data according to the two privacy values ​​and the two random numbers, comprising: The two random numbers are processed respectively according to a second preset operation rule to obtain a first data item and a second data item, and intermediate data is calculated based on the first data item, the second data item and the two privacy values.

5. The method according to claim 4, calculating the second shard according to the random number whose serial number is the third serial number and the privacy value arranged in the first place, comprising: The random number with the third serial number is processed according to the second preset operation rule to obtain a third data item, and the second fragment of the target privacy value is calculated according to the third data item and the privacy value arranged in the first place.

6. According to the method of claim 4, the lengths of the two privacy values ​​are both t bits; and the step of processing the two random numbers according to the second preset operation rule to obtain the first data item and the second data item comprises: Calculate the hash values ​​of the two random numbers with a length of t bits respectively as the first data item and the second data item in sequence; or, for the two random numbers with a length greater than t bits, extract bit sequences with a length of t bits starting from predetermined positions in sequence, and use the data represented by the two extracted bit sequences as the first data item and the second data item.

7. A method for executing a 2-choice-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds a first sequence number of a target privacy value among the two privacy values, a target random number, and its second sequence number among the two random numbers, the method being applied to the first party, and comprising: Sending a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates a second shard according to a random number having the third serial number and the privacy value arranged at the first position, and returns intermediate data calculated according to the two privacy values ​​and the two random numbers; A first shard is calculated at least according to the first serial number and the target random number, so that a result of processing the first shard and the second shard using a first preset operation rule is equal to the target privacy value.

8. The method according to claim 7, further comprising: receiving the target random number and the second serial number from a third party; The two random numbers are sent by the third party to the second party.

9. According to the method of claim 7, the third serial number is equal to the result of an XOR operation on the first serial number and the second serial number; and / or, the result of a sum operation or an XOR operation on the first shard and the second shard is equal to the target privacy value.

10. The method according to claim 7, wherein calculating the first fragment according to at least the first sequence number and the target random number comprises: Processing the target random number using a second preset operation rule to obtain a fourth data item; If the target privacy value with the first serial number is the first privacy value, the fourth data item is used as the first shard; otherwise, the first shard is calculated based on the fourth data item and the intermediate data.

11. The method according to claim 10, wherein the target random number is processed by using a second preset operation rule to obtain a fourth data item, comprising: Calculate a hash value of the target random number with a length of t bits as a fourth data item; Alternatively, for the target random number having a length greater than t bits, a bit sequence having a length of t bits is extracted starting from a predetermined position and data represented by the bit sequence is used as the fourth data item.

12. A secure multi-party computing method based on a 2-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the method is applied to the second party, and the method comprises: Generate two privacy values ​​in order, wherein any privacy value with a sequence number of j is obtained by processing sequence number j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; For the two privacy values ​​and the third privacy value as the first serial number, the method described in any one of claims 1-6 is used to jointly execute the 2-to-1 sharing OT protocol with the first party to obtain the second shard of the target privacy value with the serial number of the three privacy values, and the first party correspondingly obtains the first shard of the target privacy value with the serial number of the third privacy value.

13. According to the method of claim 12, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of the XOR operation on the second privacy value and the third privacy value is equal to the result of the sum operation on the first slice and the second slice. 14 . The method according to claim 12 , wherein the target operation rule comprises a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

15. According to the method of claim 12, the first party also holds a fourth privacy value, the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the sum of the second shard and the third shard is equal to the product of the third privacy value and the fifth privacy value, wherein the third shard is calculated by the first party based on the third privacy value, the fourth privacy value and the first shard.

16. According to the method of claim 12, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of the eighth privacy value in the modulo 2 space, the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

17. A secure multi-party computing method based on a 2-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, the method is applied to the first party, and the method comprises: For the third privacy value and two privacy values ​​as the first serial number, the method described in any one of claims 7-11 is used to jointly execute the 2-to-1 sharing OT protocol with the second party to obtain the first shard of the target privacy value with the serial number of the three privacy values, and enable the second party to obtain the second shard of the target privacy value with the serial number of the third privacy value, wherein any privacy value with serial number j is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

18. According to the method of claim 17, the second privacy value and the third privacy value are two slices of the fourth privacy value in the modulo 2 space, and the lengths of the first slice and the second slice are both t bits greater than 1; the result of the XOR operation on the second privacy value and the third privacy value is equal to the result of the sum operation on the first slice and the second slice.

19. The method according to claim 17, wherein the target operation rule comprises a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation, or a bitwise XOR operation.

20. The method according to claim 17, wherein a sum of the second privacy value and a fourth privacy value held by the first party is equal to a fifth privacy value; the method further comprising: A third shard is calculated based on the third privacy value, the fourth privacy value, and the first shard, so that a sum of the second shard and the third shard is equal to a product of the third privacy value and the fifth privacy value.

21. According to the method of claim 17, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the sixth privacy value are two XOR shards of the eighth privacy value in the modulo 2 space, the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; the second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first shard is used to calculate the product of the fifth privacy value and the eighth privacy value.

22. A secure multi-party computing method based on a 2-out-of-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first sequence number, and the second party holds a fifth private value and a sixth private value, wherein the third private value and the sixth private value are two XOR fragments of an eighth private value in a modulo-2 space in a modulo-2 space, and the method comprises: The second party generates two privacy values ​​arranged in sequence, wherein the privacy value with any sequence number j is equal to the result obtained by processing the exclusive OR result of sequence number j and the fifth privacy value using the target operation rule, and the exclusive OR result of sequence number j is obtained by performing an exclusive OR operation on sequence number j and the sixth privacy value, so that the target privacy value with sequence number as the third privacy value is equal to the result of processing the fifth privacy value and the eighth privacy value using the target operation rule; The first party and the second party jointly execute the shared OT protocol for the third privacy value and the two privacy values ​​as the first serial number using the method described in any one of claims 1-11, and respectively obtain the first shard and the second shard of the target privacy value with serial numbers as the three privacy values.

23. A method for executing an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N ninth private values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth private value among the N ninth private values, wherein N is greater than 2, and the method is applied to the second party, and the method comprises: Generate N-1 data groups arranged in sequence, each data group contains two privacy values ​​arranged in sequence, wherein for any j-th data group, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value therein is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; Based on the N-1 data groups, adopt the method described in any one of claims 1-6, and jointly execute N-1 rounds of 2-choose-1 sharing OT protocol with the first party based on N-1 first sequence numbers to obtain N-1 second shards, so that the result of processing the j-th second shard and the j-th first shard obtained by the first party correspondingly using the first preset operation rule is equal to the target privacy value of the j-th first sequence number in the j-th data group, and the j-th first sequence number is determined based on round j and the fourth sequence number; A fifth shard is calculated based on the N-1 second shards, so that a result of processing the fifth shard and the corresponding fourth shard calculated by the first party using the first preset operation rule is equal to the tenth privacy value.

24. According to the method of claim 23, the first privacy value in the first data group is the first ninth privacy value, and the second privacy value in the first data group is the second ninth privacy value; when j is greater than 1, the second privacy value in the jth data group is the difference between the j+1th ninth privacy value and the first ninth privacy value.

25. According to the method of claim 23, for any j-th round of 2-out-1 sharing OT protocol, when the fourth sequence number is equal to j, the target privacy value is the second privacy value in the j-th data group; when the fourth sequence number is not equal to j, the target privacy value is the first privacy value in the j-th data group.

26. A method for executing an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N ninth private values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth private value among the N ninth private values, wherein N is greater than 2, and the method is applied to the first party, and the method comprises: Determine N-1 first sequence numbers corresponding to N-1 execution rounds, wherein any j-th first sequence number is determined based on its corresponding execution round j and the fourth sequence number; Based on the N-1 first serial numbers, the method described in any one of claims 7-11 is adopted to jointly execute N-1 rounds of 2-choose-1 sharing OT protocol with the second party based on N-1 data groups to obtain N-1 first shards, so that the result of processing the j-th first shard and the j-th second shard obtained by the second party correspondingly using the first preset operation rule is equal to the target privacy value with the serial number of the j-th first serial number in the j-th data group, wherein a single data group contains two privacy values ​​arranged in sequence, and for any j-th data group, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value therein is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; The fourth shard is calculated based on the N-1 first shards, so that the result of processing the fourth shard and the corresponding fifth shard calculated by the second party using the first preset operation rule is equal to the tenth privacy value.

27. According to the method of claim 26, the first privacy value in the first data group is the first ninth privacy value, and the second privacy value in the first data group is the second ninth privacy value; when j is greater than 1, the second privacy value in the jth data group is the difference between the j+1th ninth privacy value and the first ninth privacy value.

28. According to the method described in claim 26, for any j-th round of 2-out-1 sharing OT protocol, when the fourth sequence number is equal to j, the target privacy value is the second privacy value in the j-th data group; when the fourth sequence number is not equal to j, the target privacy value is the second privacy value in the j-th data group.

29. A secure multi-party computing method based on an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, and the method is applied to the second party, and the method comprises: Generate N ninth privacy values ​​arranged in sequence, wherein any current privacy value among the N ninth privacy values ​​is obtained by processing the sequence number of the current privacy value among the N ninth privacy values ​​and the second privacy value using the target operation rule, so that the ninth privacy value whose sequence number is the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; For the N ninth privacy values ​​and the third privacy value as the fourth serial number, the method described in any one of claims 23-25 ​​is used to jointly execute the N-to-1 sharing OT protocol with the first party to obtain the fifth shard of the ninth privacy value with the serial number of the three privacy values, and enable the first party to obtain the fourth shard of the ninth privacy value with the serial number of the third privacy value.

30. According to the method of claim 29, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation or a bitwise XOR operation; and / or, the first preset operation rule includes a sum operation or a bitwise XOR operation.

31. A secure multi-party computing method based on an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, the method is applied to the first party, and the method comprises: For the third privacy value as the fourth serial number and N ninth privacy values, the method described in any one of claims 26-28 is used to jointly execute the sharing N-choose-1 sharing OT protocol with the second party to obtain the fourth shard of the ninth privacy value with serial number as the three privacy values, and enable the second party to obtain the fifth shard of the ninth privacy value with serial number as the third privacy value, wherein any ninth privacy value with serial number j is obtained by processing serial number j and the second privacy value using the target operation rule, so that the ninth privacy value with serial number as the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

32. According to the method of claim 31, the target operation rule includes a sum operation, a product operation, a bitwise AND operation, a bitwise OR operation or a bitwise XOR operation; and / or, the first preset operation rule includes a sum operation or a bitwise XOR operation.

33. An execution device of a 2-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds a first sequence number of a target privacy value among the two privacy values, a target random number and its second sequence number among the two random numbers, and the device is deployed on the second party, and comprises: a communication processing unit, configured to receive, from the first party, a third sequence number calculated based on the first sequence number and the second sequence number; A first calculation unit, configured to calculate intermediate data according to the two privacy values ​​and the two random numbers; The communication processing unit is further configured to send the intermediate data to the first party so that the first party calculates the first fragment; The second calculation unit is configured to calculate the second shard according to the random number with the third serial number and the privacy value arranged in the first place, so that the result of processing the first shard and the second shard using the first preset operation rule is equal to the target privacy value.

34. An execution device of a 2-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds two privacy values ​​arranged in sequence and two random numbers arranged in sequence, and the first party holds a first sequence number of a target privacy value among the two privacy values, a target random number and its second sequence number among the two random numbers, wherein the device is deployed on the first party, and comprises: a communication processing unit configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party calculates a second shard according to a random number having the third serial number and a privacy value arranged at the first position, and returns intermediate data calculated according to the two privacy values ​​and the two random numbers; The calculation processing unit is configured to calculate the first shard according to the first serial number and the target random number, so that the result of processing the first shard and the second shard using a first preset operation rule is equal to the target privacy value.

35. A secure multi-party computing device based on a 2-to-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a first serial number, and the second party holds a second private value, and the device is deployed on the second party, and the device comprises: a calculation processing unit configured to generate two privacy values ​​arranged in sequence, wherein any privacy value with a sequence number j is obtained by processing the sequence number j and the second privacy value using the target operation rule, so that the privacy value with a sequence number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; The calling processing unit is configured to jointly execute the 2-to-1 sharing OT protocol with the first party through the execution device of the 2-to-1 sharing OT protocol as described in claim 33 for the two privacy values ​​and the third privacy value as the first serial number, so as to obtain the second shard of the target privacy value with the serial number of the three privacy values, and enable the first party to obtain the first shard of the target privacy value with the serial number of the third privacy value.

36. A secure multi-party computing device based on a 2-to-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third privacy value to be used as a first serial number, and the second party holds a second privacy value, and the device is deployed on the first party. The device is used to perform the 2-to-1 sharing OT protocol on the third privacy value as the first serial number and two privacy values ​​through the execution device of the 2-to-1 sharing OT protocol described in claim 34 and the second party, thereby obtaining a first fragment of a target privacy value with a serial number of the three privacy values, and enabling the second party to obtain a second fragment of a target privacy value with a serial number of the third privacy value, wherein any privacy value with a serial number of j is obtained by the second party using a target operation rule to process the serial number j and the second privacy value, so that the privacy value with a serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule.

37. An execution device of an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N ninth private values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth private value among the N ninth private values, wherein N is greater than 2, and the device is deployed on the second party, and the device comprises: A group processing unit is configured to generate N-1 data groups arranged in sequence, each data group contains two privacy values ​​arranged in sequence, wherein for any j-th data group, when j is 1, the two privacy values ​​therein are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value therein is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; A calling processing unit is configured to jointly execute N-1 rounds of 2-to-1 sharing OT protocol based on the N-1 data groups through the execution device of the 2-to-1 sharing OT protocol described in claim 33 with the first party based on N-1 first sequence numbers to obtain N-1 second shards, so that the result of processing the j-th second shard and the j-th first shard obtained by the first party correspondingly using the first preset operation rule is equal to the target privacy value of the j-th data group with the sequence number being the j-th first sequence number, and the j-th first sequence number is determined based on round j and the fourth sequence number; The calculation processing unit is configured to calculate the fifth shard based on the N-1 second shards, so that the result of processing the fifth shard and the corresponding fourth shard calculated by the first party using the first preset operation rule is equal to the tenth privacy value.

38. An execution device of an N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the second party holds N ninth privacy values ​​arranged in sequence, and the first party holds the fourth sequence number of the tenth privacy value among the N ninth privacy values, wherein N is greater than 2, and the device is deployed on the first party, and the device comprises: a sequence number determination unit configured to determine N-1 first sequence numbers corresponding to N-1 execution rounds, wherein any j-th first sequence number is determined based on its corresponding execution round j and the fourth sequence number; A calling processing unit is configured to jointly execute N-1 rounds of 2-to-1 sharing OT protocol based on the N-1 first serial numbers through the execution device of the 2-to-1 sharing OT protocol described in claim 34 with the second party based on N-1 data groups to obtain N-1 first shards, so that the result of processing the j-th first shard and the j-th second shard obtained by the second party correspondingly using the first preset operation rule is equal to the target privacy value with the serial number of the j-th first serial number in the j-th data group, wherein a single data group contains two privacy values ​​arranged in sequence, and for any j-th data group, when j is 1, the two privacy values ​​thereof are respectively determined according to the first ninth privacy value and the second ninth privacy value, and when j is greater than 1, the first privacy value thereof is 0, and the second privacy value is determined based on the j+1th ninth privacy value and the first ninth privacy value; The calculation processing unit is configured to calculate the fourth shard based on the N-1 first shards, so that the result of processing the fourth shard and the fifth shard calculated by the second party using the first preset operation rule is equal to the tenth privacy value.

39. A secure multi-party computing device based on N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, and the device is deployed on the second party, and the device comprises: a computing processing unit configured to generate N ninth privacy values ​​arranged in sequence, wherein any current privacy value among the N ninth privacy values ​​is obtained by processing the sequence number of the current privacy value among the N ninth privacy values ​​and the second privacy value using a target operation rule, so that the privacy value whose sequence number is the third privacy value is equal to a result of processing the third privacy value and the second privacy value using the target operation rule; The calling processing unit is configured to jointly execute the N-choose-1 sharing OT protocol with the first party through the N-choose-1 sharing OT protocol execution device described in claim 37 for the N ninth privacy values ​​and the third privacy value as the fourth serial number, so as to obtain the fifth shard of the ninth privacy value with the serial number of the three privacy values, and enable the first party to obtain the fourth shard of the ninth privacy value with the serial number of the third privacy value.

40. A secure multi-party computing device based on the N-choose-1 sharing oblivious transfer (OT) protocol, involving a first party and a second party, wherein the first party holds a third private value to be used as a fourth serial number, and the second party holds a second private value, and the device is deployed on the first party. The device is used to execute the N-choose-1 sharing OT protocol jointly with the second party for the third private value as the fourth serial number and N ninth private values ​​through the N-choose-1 sharing OT protocol execution device described in claim 38, to obtain the fourth shard of the ninth private value with the serial number of the third private value, and enable the second party to obtain the fifth shard of the ninth private value with the serial number of the third private value, wherein any ninth private value with the serial number j is obtained by processing the serial number j and the second private value using the target operation rule, so that the ninth private value with the serial number of the third private value is equal to the result of processing the third private value and the second private value using the target operation rule.

41. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computing device, the computing device executes the method of any one of claims 1-21 or 23-32.

42. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method of any one of claims 1-21 or 23-32 is implemented.

Images