Method and device for converting target data into a shared format

Abstract

The embodiments of this specification provide a method and device for converting the shared form of target data. In the process of converting the shared form of target data to a predetermined power with base 2 in a business processing process based on multi-party secure computing, the Boolean slices are split to obtain the numerical form under sharing, and then the numerical value obtained by the split is used to determine the interactive data between the two participants. The characteristics of the two participants converting binary numbers to other numerical values ​​are used to perform secure multiplication and polynomial combination operations, thereby avoiding large amounts of data communication, providing a more efficient B2A conversion method, and improving the business processing efficiency of secure computing.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of secure computing technology, and more particularly, to a method and device for converting the sharing format of target data in multi-party secure computing. Background Art

[0002] Secure multi-party computing is also called multi-party secure computing. Multiple parties can jointly calculate the result of a function without disclosing the input data of each party in the function. The result of the calculation is made public to one or more of the parties. Typical applications of secure multi-party computing include joint statistical analysis of multi-party data with privacy protection, machine learning, etc. The function here is a statistical operation function, a machine learning algorithm, etc.

[0003] In the process of multi-party secure computing, in order to prevent the disclosure of data and intermediate computing results of each party, the data or intermediate results can be held by each party in a shared form. A single party holds a data shard, and the shards held by each party are merged together to restore the corresponding data. Usually, the calculation is kept in a shared state. In this way, the number of data communications and the amount of communication in multi-party secure computing are important factors affecting the efficiency of secure computing. Summary of the invention

[0004] One or more embodiments of the present specification describe a method and device for converting a shared format of target data to solve one or more problems mentioned in the background technology.

[0005] According to a first aspect, a method for converting a shared form of target data is provided, which is used in a two-party secure calculation, and converts the Boolean shared form of the target data of the first party and the second party into a shared form, wherein the target data is a predetermined power of 2, and the first party and the second party respectively hold a first Boolean slice and a second Boolean slice of the target data, and the method is executed by the first party, comprising: for n bits in the first Boolean slice held, grouping according to a number of groups m agreed with the second party and determining m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by a binary number composed of the corresponding bits, and m is a non-zero even number; respectively calculating with the second party based on secure multiplication the m first reference values ​​and the m first reference values ​​corresponding to the second party. The method comprises the following steps: raising the difference between the first and second reference values ​​to the mth power to the mth power to obtain first power slices corresponding to the mth power respectively, and the single first power slice and the single second square slice obtained by the second party constitute the sum-sharing form of the corresponding mth power; performing polynomial summation on each first power slice to obtain a first sum-sharing slice of the target data, wherein the summation coefficient of the single first power slice item is determined based on the offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first sum-sharing slice and the second sum-sharing slice obtained by performing polynomial summation on each second power slice by the second party constitute the sum-sharing form of the target data.

[0006] In one embodiment, the bits corresponding to a single group are arranged from high to low to form a single binary number, and the single first reference value corresponding to the single binary number is the value of the single binary number converted into a decimal number or a hexadecimal number.

[0007] In one embodiment, a single first reference value and a single second reference value of a second party correspond to the same group, and the use of the m first reference values ​​to calculate the mth power of the difference between each first reference value and the corresponding second reference value held by the second party based on safe multiplication includes: determining a first multiplier related to the first expanded term in the first expanded term corresponding to the mth power of the difference between the single first reference value and the single second reference value, wherein the first multiplier is the power of the single first reference value; performing safe multiplication using the first multiplier and a second multiplier determined by the second party based on the power of the single second reference value to obtain a first slice of the first expanded term, the first slice and the second slice obtained by the second party constituting a sum-sharing form of the first expanded term; determining a first power slice of the mth power of the difference between the single first reference value and the single second reference value based on the sum of the single first reference value and the first slice of the first expanded term.

[0008] In one embodiment, the summation coefficient of a single first power slice term is 2 as the base, the corresponding offset is the power of the exponent, and the corresponding offset is the number of offset bits.

[0009] In one embodiment, the first Boolean slice and the second Boolean slice have at least one bit whose values ​​are different.

[0010] In one embodiment, the first Boolean slice is obtained by sequentially performing an XOR operation on each Boolean slice on a plurality of participants.

[0011] According to a second aspect, a device for converting a shared form of target data is provided, which is used in a two-party secure computation to convert a Boolean shared form of target data on a first party and a second party into a shared form, wherein the target data is a predetermined power of 2, and the first party and the second party respectively hold a first Boolean slice and a second Boolean slice of the target data, and the device is provided on the first party, and includes:

[0012] a grouping unit configured to group the n bits in the first Boolean slice held by the user according to the number of groups m agreed upon with the second party and determine m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by a binary number formed by the corresponding bits, and m is a non-zero even number;

[0013] A secure calculation unit is configured to respectively calculate, with the second party, the m-th power of the difference between the m first reference values ​​and the m second reference values ​​held by the second party based on secure multiplication, to obtain first power slices corresponding to the m-th power, and a single first power slice and a single second square slice obtained by the second party constitute a sum sharing form of the corresponding m-th power;

[0014] A summing unit is configured to perform polynomial summation on each first power slice to obtain a first sum shared slice of the target data, wherein the summation coefficient of a single first power slice item is determined based on an offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first sum shared slice and a second sum shared slice obtained by performing polynomial summation on each second power slice by the second party constitute a sum shared form of the target data.

[0015] In one embodiment, the single first reference value and the single second reference value of the second party correspond to the same group, and the security computing unit is further configured to:

[0016] Determine a first multiplier associated with a first expanded term corresponding to the mth power of the difference between the single first reference value and the single second reference value, wherein the first multiplier is a power of the single first reference value;

[0017] Performing secure multiplication using the first multiplier and a second multiplier determined by the second party based on the power of the single second reference value, thereby obtaining a first slice of the first expanded term, wherein the first slice and the second slice obtained by the second party constitute a sum-shared form of the first expanded term;

[0018] A first power slice of the mth power of a difference between the single first reference value and the single second reference value is determined based on a sum of the single first reference value and a first slice of the first expanded term.

[0019] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0020] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect is implemented.

[0021] Through the method and apparatus provided in the embodiments of this specification, in the scenario of conversion from Boolean sharing to shared form (B2A) involved in the two-party secure computing scenario, taking into account the complexity of the conventional conversion protocol and the particularity of the predetermined power of 2 in the Boolean sharing form, a new conversion scheme is proposed to reduce the conversion complexity and improve the data processing efficiency of multi-party secure computing. Among them, the particularity of the predetermined power of 2 in the Boolean sharing form is that only one bit of data is different between the two Boolean slices. In this way, the difference between the two Boolean shared slices after being converted into arithmetic slices can be considered, corresponding to the predetermined power of 2. In addition, the sign problem of the difference obtained by subtraction must also be considered.

[0022] Specifically, in order to protect data privacy, the bits in the Boolean shared slice can be split into multiple groups. Then, the values ​​of one bit in one and only one group of the two participants in each group are different, and the actual difference of the group is not 0, while the actual differences of other groups are all 0. Therefore, the addition operation based on the subtraction operation and the even power operation can be constructed through the values ​​of the two participants on the bit positions of these groups, so as to solve the aforementioned difference sign problem, so as to obtain two and shared slices in the two participants respectively, and constitute the shared form of the predetermined power of 2. This sharing form conversion method can reduce the communication volume of the two participants in the Boolean sharing and sharing form conversion, thereby improving the business processing efficiency of multi-party secure computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0024] Figure 1 A data communication diagram showing two-party secure multiplication;

[0025] Figure 2 A flow chart showing a method for converting a shared form of target data executed by a single participant according to an embodiment;

[0026] Figure 3 A schematic diagram showing an interactive process of a method for converting a shared form of target data executed by two participants according to an embodiment;

[0027] Figure 4 A schematic block diagram of a device for converting a shared format of target data disposed at a single participant according to another embodiment is shown. DETAILED DESCRIPTION

[0028] The technical solution provided in this specification is described below in conjunction with the accompanying drawings.

[0029] Secret sharing is also called secret splitting or secret sharing. Its basic principle is to split a secret (such as a key, private data, etc.) into multiple shares and give them to different people for safekeeping. Only when the parties exceeding the threshold number merge their shares can the secret be recovered; the shares obtained from multiple parties less than the threshold number cannot recover any information of the secret. In multi-party secure computing, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called shards.

[0030] Secret sharing is an important means in the process of multi-party secure computing. Several commonly used forms of secret sharing in multi-party secure computing include arithmetic sharing, Boolean sharing, and Yao's sharing. The following takes sharing secret data x as an example to describe various sharing methods.

[0031] Arithmetic sharing is also called sum sharing. In a two-party secure computation, an integer x is divided into two pieces x=x L +x R Modulo 2 N The shared form (translated to [0, 2 N -1] interval) distributed storage in two parties, so that one party does not know xR , the other party does not know x L , neither of the two parties can obtain the complete form of x. Further, the two parties can be expanded to multiple parties, such as x = x1 + x2 + ... + x d Assuming N = 64, a single shard of x in a single participant can be represented by a 64-byte binary number. The way to split a data x into and share forms is, for example, to randomly generate d-1 2 64 The values ​​in the d-1 fragments (such as randomly generated 64-byte binary numbers) are recorded as x1, x2, ..., x d-1 , and pair 2 64 (Translate to [0, 2 64 -1] interval) modulo as another slice, such as x d =x-x1-x2-…-x d-1 .

[0032] Boolean sharing is a secret sharing method that performs XOR operations on bits. For example, still taking two participants as an example, assuming that x is a bit of data (with a value of 0 or 1), and In the Boolean sharing form between two participants, x0 and x1 are the two Boolean sharing fragments of x in the two participants, both of which take values ​​of 0 or 1. Indicates XOR operation. A single participant does not know the shard held by another participant, so it cannot infer data x. For data x' consisting of n bits, an n-bit binary number can be randomly generated as the Boolean shared shard of one party (such as x0'). The Boolean shared shard of the other party (such as x1') can be obtained by the XOR result of x' and the Boolean shared shard of the party. Sure.

[0033] Yao's sharing is a sharing method related to garbled circuits (GC), which can be calculated through Boolean circuits. Taking the two participants (garbled party and calculation party) as an example, the garbled party can set a global string R, and the result of R acting on a string representing 0 (such as L0) is a string representing 1 (such as L1), such as the XOR result of R and L0 is L1. For example, a slice x0 of Yao's sharing of secret data x can be a randomly generated string k0, and another slice can be the XOR value k1 of k0 and the result of R acting on x (such as denoted as ).

[0034] The above three sharing methods each have their own advantages and disadvantages. The various sharing methods can also be converted to each other. For example:

[0035] Yao to Boolean Sharing (Yao to Boolean Sharing, abbreviated as Y2B), a single participant locally calculates the XOR result of the Yao shared shard and the string representing 0 as the corresponding Boolean shared shard;

[0036] Boolean to Yao Sharing (B2Y for short), the first party holding the Boolean shard x0 (such as the corresponding obfuscating party) randomly generates the Yao shard k0, and both parties execute the oblivious transfer protocol (OT), and the first party calculates The second party uses its Boolean shard x1 as the selection bit to obtain the Yao shard

[0037] Arithmetic to Yao Sharing (A2Y) is converted to Arithmetic to Yao Sharing. The two parties determine the corresponding Yao shared shards for the two shards x0 and x1 of x, respectively, and obtain the corresponding two sets of Yao shards (x0)0, (x0)1, (x1)0, (x1)1. Then, each party performs the addition operation of the Yao shards locally to obtain two Yao shards of x, such as x Y 0=(x0)0+(x1)0、x Y 1=(x0)1+(x1)1;

[0038] Arithmetic to Boolean Sharing (A2B) can be implemented with Boolean addition circuits (similar to A2Y) or with Arithmetic bit extraction circuits. Since Y2B is free and Yao's sharing is more efficient than Boolean circuits when doing addition, A2Y and Y2B can be used to process the corresponding arithmetic slices in sequence to obtain the corresponding Boolean slices. For example, the arithmetic slice x L Y2B(A2Y (x L )) is processed to obtain the Boolean slice x0;

[0039] Boolean to Arithmetic Sharing (B2A). B2A can be implemented by subtraction on Boolean circuits, but this method is too expensive. To improve performance, the two parties can use an OT-based method. In the i-th OT process for the i-th bit, one party (such as Party A) acts as the sender and sends two strings s to the other party (such as Party B). i,0 、s i,1 , and make them satisfy: The other party, as the receiver, inputs the value of the i-th bit in the local Boolean slice As the selection bit gets Then, the sender calculates Recipient Calculation Thus, the Boolean sharing form is converted to the and sharing form;

[0040] etc.

[0041] The conversions between various sharing modes are not listed here one by one.

[0042] In the business processing of multi-party secure computing, the sharing form of business data can be converted for the convenience of processing. In conventional technology, for a predetermined power of 2, the conversion is performed through the above conventional B2A conversion protocol. If the Boolean shared slice has n bits, n OTs need to be performed, and the communication volume is n(n+1) / 2 bits offline and 2n bits online.

[0043] Considering that the binary representation of the predetermined power of 2 has certain particularity, that is, only one bit (such as the tth bit) is 1, and the rest are 0. Further, in the Boolean sharing form of the two participants, the two Boolean slices only have different values ​​on the corresponding bit (such as the tth bit), and the values ​​of the other bits are the same. Based on this, this specification provides a new technical idea to convert the predetermined power of 2 from the Boolean sharing form to the sum sharing form.

[0044] The following describes the conversion principle under the technical concept of this specification. Assume that the two parties are respectively recorded as the first party and the second party. The predetermined power of 2 (recorded as the t power) is the target data x=2 t , the target data is in Boolean sharing form between the first party and the second party, such as x=x L +x R mod2, or in, Represents an XOR operation, two Boolean slices x L 、x R are all strings of n bits, each bit is 0 or 1. According to the binary representation of the predetermined power of 2, only one bit is 1, and the other bits are all 0. For example, the first power of 2 is 0010, the second power of 2 is 0100, etc., that is, x L 、x R Among the n bits, only one bit is different. For example, if x = 0010 (at this time t = 1), then x L 、x R Only the 2nd bit from the last digit is different.

[0045] Thus, assuming that the rightmost bit (the lowest bit) in the Boolean slice is the first bit, and the first bit is represented by the 0th bit, then x L It can be represented by a set as x L =(x0 L , x1 L …x t L …x n-1 L ), similarly, x R It can be represented by a set x R =(x0 R , x1 R …x t R …x n-1 R ), the tth bit is two Boolean slices x t L and x t R The two parties do not know which bit of the other party is different from the local Boolean slice. Furthermore, if the two Boolean slices are represented as binary numbers, a single Boolean slice can correspond to a value in any representation such as octal, decimal, or hexadecimal. For example, 1011 can correspond to the decimal value 11=1×2 0 +1×2 1 +0×2 2 +1 ×2 3 The corresponding values ​​of the two Boolean slices are: L =x0 L ×2 0 +x1 L ×2 1 …x t L ×2 t …x n-1 L ×2 n-1 ;y R =x0 R ×2 0 +x1 R ×2 1 …x t R ×2 t …x n-1 R ×2 n-1 Then, y L -y R =x t L ×2 t -x t R×2 t =(x t L -x t R )×2 t = ±2 t The two parties adjust y L ,y R The symbol, such as y L and -y R , or -y L and R , so that the preceding sign is positive (i.e., determine y L -y R The absolute value of |y L -y R |), and use the adjusted value modulo 2 n , we can get the shared shards of x on both parties.

[0046] However, the two participants cannot know which participant needs to adjust the sign of the value locally. L and R If the size of t is too large, the possible values ​​of t may be leaked. For example, the comparison result is y L Less than y R , it can be determined that t is one of the bits with a value of 0 on the first party's Boolean slice, or one of the bits with a value of 1 on the second party's Boolean slice. Therefore, in order to protect data privacy, this specification is based on the above y L -y R = ±2 t The principle of Boolean sharding is adopted to split the bits and introduce the calculation of even powers, so as to protect data privacy and solve the problem of non-conversion caused by the sign problem.

[0047] Under the technical concept of this specification, the bit values ​​of the Boolean slice can be divided into even groups, and the corresponding values ​​are calculated as reference values ​​respectively. Then, the even powers of the numerical difference of each group of reference values ​​in the two Boolean slices are safely calculated, and the even powers of the numerical difference are summed as terms of the polynomial to obtain each and shared slice. The following takes two participants dividing the bit values ​​of the Boolean slice into two groups according to the odd and even bits (2 groups) of the bits as an example to describe the technical concept of this specification.

[0048] Assume that the first party is identified by L and the second party is identified by R. A single Boolean slice consists of n bits, where the bits are identified from low to high by subscripts 0, 1, 2, ... n-1. Assume that n is an even number, then subscripts 0, 2, 4, ... n-2 are even numbers, and subscripts 1, 3, ... n-1 are odd numbers. Here, the bits with even subscripts are called even bits, and odd numbers correspond to odd bits.

[0049] Then, the binary number composed of the even number of bits of the L side can correspond to the value: y L1 =x0 L ×2 0 / 2 +x2 L ×2 2 / 2 ... x n-2 L ×2 (n-2) / 2 ; Binary numbers consisting of odd bits, for example, correspond to the value: y L2 =x0 L ×2 0 / 2 +x1 L ×2 2 / 2 ……x n-1 L × 2 (n-2) / 2 According to the binary numerical representation rule, the values ​​corresponding to the even bits are compared with the values ​​represented by the values ​​on these bits in the Boolean slice of the target data, and the values ​​corresponding to the odd bits are compared with the values ​​represented by the values ​​on these bits in the Boolean slice of the target data, and the values ​​represented by the values ​​on these bits in the Boolean slice of the target data are obtained by squaring each addend term and then multiplying by 2.

[0050] Similarly, the binary number composed of the even number of bits of the R side can correspond to the value: y R1 =x0 R ×2 0 / 2 +x2 R ×2 2 / 2 ... x n-2 R ×2 (n-2) / 2 ; A binary number consisting of an odd number of bits may correspond to the value: y R2 =x1 R ×2 0 / 2 +x3 R ×2 2 / 2 ... x n-1 R ×2 (n-2) / 2Similarly, the values ​​corresponding to the even bits of the R square are compared with the values ​​represented by the values ​​of these bits in the Boolean slice of the target data. By squaring each addend term, the values ​​represented by these bits in the Boolean slice of the target data can be obtained. The values ​​corresponding to the odd bits are compared with the values ​​represented by these bits in the Boolean slice of the target data. By squaring each addend term and then multiplying it by 2, the values ​​represented by these bits in the Boolean slice of the target data can be obtained.

[0051] In this specification, the value obtained by the L side or the R side through the grouped binary number may be referred to as a reference value.

[0052] It is worth noting that the two sets of data y corresponding to the two participants L1 and R1 ,y L2 and R2 In the above example, there is only one set of data that is equal (the difference is 0), and in the other set of data, the difference between the two is the item corresponding to the bit subscripted t. When t is an even number, the square of the difference is 2 t , when t is an even or odd number, twice the square of the difference is 2 t . In this way, we have: |y L -y R |=(y L1 -y R1 ) 2 +2(y L2 -y R2 ) 2 It can be understood that after converting to square calculation, the value of the corresponding square term can be ensured to be positive, effectively solving the sign problem mentioned above.

[0053] In order to perform secure computing without leaking data privacy, the formula can be expanded to obtain:

[0054] |y L -y R |=y L1 2 +y R1 2 -2 y L1 ×y R1 +2y L2 2 +2y R2 2 -4y L2 ×y R2

[0055] =(y L1 2 +2y L2 2 )+(yR1 2 +2y R2 2 )-2(y L1 ×y R1 )-4(y L2 ×y R2 )

[0056] Thus, the first term s1=(y L1 2 +2y L2 2 ), the second term s2=(y R1 2 +2y R2 2 ), and the secure multiplication calculation z1=(y L1 ×y R1 ) and z2= (y L2 ×y R2 ), so that the first fragment z of z1 and z2 is obtained on the L side 1L 、z 2L , and obtain the second fragment z of z1 and z2 respectively on the R side 1R 、z 2R . Then, L party calculates s1-2 z locally 1L -4z 2L Module 2 N , as a predetermined power of 2 t In module 2 n The first shard in the shared form is calculated locally by party R. 1L -4z 2L Module 2 n , as a predetermined power of 2 t In module 2 n The second shard in the form of and sharing.

[0057] In the above process, the interaction between the two parties involves two secure multiplication calculations, and the communication volume also depends on the amount of secure multiplication calculations. Figure 1 An example of secure multiplication is shown in Figure 1 where two parties hold a and b, respectively. Figure 1 In the example, the first party holds data a, the second party holds data b, and the two parties securely calculate a×b. The result c is distributed in a shared manner between the first party (such as holding shard c0) and the second party (such as holding shard c1), and one party does not know the shard stored by the other party. In conventional computing, a semi-trusted third party can also be introduced (the data of each data party cannot be obtained, so it is not completely trustworthy), such as a pseudo-random number generation server.

[0058] Specifically, first, the first party obtains a random number u, and the second party obtains a random number v. Among them, u and v can be obtained by a third party ( Figure 1 The third party generates u and v locally or obtains u and v from the first and second parties, calculates u×v and splits them into random shards z0 and z1 in a sum-sharing manner, then z0+z1=u×v=uv. The third party can provide z0 and z1 to the first and second parties respectively. Assume that the first party obtains z0 and the second party obtains z1. Among them, u and v can be regarded as perturbation terms or noise terms for a and b respectively, and e and f are used to represent the perturbation results after adding noise to a and b respectively. Then the first party calculates the perturbation result e=au and sends it to the second party, and the second party calculates the perturbation result f=bv and sends it to the first party. Further, the first party can calculate a sum-sharing shard c0=uf+z0 of a×b, and the second party can calculate another sum-sharing shard c1=eb+z1 of a×b. Substituting the expressions of e and f, we have: c0+c1=uf+z0+eb+z1=ub-uv+z0+ab-ub+z1=ab. In other words, c0 and c1 form the product of a and b in a shared form.

[0059] In the above process, for a single participant, receiving data from a third party can be done offline, so the number of values ​​received offline is 1, and when the value is represented by n bits, the communication volume is n. The offline communication volume of two secure multiplications is 2n bits in total. During a secure multiplication calculation online, the two data parties exchange a value with each other, and a total of 2 values ​​are exchanged, with a communication volume of 2n. The communication volume of two secure multiplications is 2×2n=4n bits. In this way, compared with the conversion method of conventional technology, the B2A conversion method proposed in this specification greatly reduces the total offline and online communication volume due to the significant reduction in offline communication volume.

[0060] By extension, other splitting methods can be used to split the n bits of a single Boolean slice into other groups. Take any non-zero even number m (m can be determined by negotiation between the two parties) as an example, assuming that the bits that are consistent with the multiples of m are taken as a group, then party L can split the local Boolean slice in the following way to obtain the numerical value corresponding to each group of bits. For example, one group may include bits with subscripts of 0, m, 2m, etc., and another group may include bits with subscripts of 1, m+1, 2m+1, etc. ... Thus, party L's Boolean slice is split into m groups, and the interval between adjacent bits of a single group is m. For example, the first group, starting from the lowest bit, may include the following bits: x0 L 、x m L 、x2m L Etc., the corresponding value is: y L1 '=x0 L ×2 0 +x m L ×2 1 +x 2m L ×2 2 +x 3m L ×2 3 +...; The second group starts from bit 1 and can include the following bits: x1 L 、x m+1 L 、x 2m+1 L Etc., the corresponding value is: y L2 '=x1 L ×2 0 +x m+1 L ×2 1 +x 2m+1 L ×2 2 +x 3m+1 L ×2 3 +...; The third group starts from the 2nd bit and can include the following bits: x2 L 、x m+2 L 、x 2m+2 L Etc., the corresponding value is: y L3 '=x2 L ×2 0 +x m+2 L ×2 1 +x 2m+2 L ×2 2 +x 3m+2 L ×2 3 +……. Similarly, R can get y R1 ',y R2 ',y R3 ' and so on. Among the data corresponding to each bit group of party L and party R, only one group of data is not equal. Then: |y L '-y R '|=(y L1 '-y R1 ') m +2(y L2 '-y R2 ') m +22 (y L2 '-y R2 ') m +2 3 (y L2 '-y R2 ') m +……. Similarly, by splitting each item, it can be transformed into local calculations of the L and R parties, as well as multiple secure multiplication calculations. Here, m is an even number to ensure the positive property of the power. However, according to the formula, the larger the m value, the more split items there are, the more complex the calculation, the more secure multiplication items involved in the secure calculation, and the increased communication volume. Therefore, the preferred embodiment of this specification can take m=2, after two secure multiplications, but does not rule out the possibility of taking other values ​​for m under the above conception.

[0061] The following combination Figure 2 The process of converting the target data into a shared form by a single participant in an embodiment shown in the figure further describes the technical concept of this specification. Here, the two participants in the multi-party secure computation are referred to as the first party and the second party, respectively. Here, the first party and the second party are only used to distinguish the two parties. The first party can be either of the two parties, and the second party represents the other party. The target data is in a Boolean shared form between the two parties, and the target data is a predetermined power of 2. The two parties respectively hold two Boolean slices of the target data, and a single Boolean slice corresponds to n bits. It can be understood that the binary form of the target data can be obtained by performing a bitwise XOR operation on the two slices of the Boolean share.

[0062] Since the first party and the second party can perform the same operation synchronously during the shared form conversion process, Figure 2 The process shown is described by taking the first party execution as an example. Figure 2As shown, the process may include: step 201, for the n bits in the first Boolean slice held, grouping according to the number of groups m agreed with the second party and determining m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by the binary number composed of the corresponding bits, and m is a non-zero even number; step 202, respectively calculating the mth power of the difference between the m first reference values ​​and the m second reference values ​​held by the second party based on secure multiplication, and obtaining each The first power slices corresponding to the m-th power respectively, a single first power slice and a single second square slice obtained by the second party constitute a sum sharing form of the corresponding m-th power; step 203, polynomial summation is performed on each first power slice to obtain a first sum sharing slice of the target data, wherein the summation coefficient of the single first power slice item is determined based on the offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first sum sharing slice and the second sum sharing slice obtained by performing polynomial summation on each second power slice by the second party constitute a sum sharing form of the target data.

[0063] First, in step 201, the n bits in the held first Boolean slice are grouped according to the number of groups m agreed upon with the second party, and m first reference values ​​corresponding to the m groups are determined.

[0064] Among them, the interval between the bits corresponding to a single group is m. Here, m can be an even number greater than 0. Taking m=2 as an example, the bits in one group are, for example, 0, m, 2m, 3m..., and the bits in another group are, for example, 1, m+1, 2m+1, 3m+1..., and so on. It can be understood that each bit of a single group can represent a certain value. Under the technical concept of this specification, in order not to disclose the value represented by each bit, a new binary number can be constructed based on the value on the bits of a single group according to the arrangement of the bits from high to low, and the value corresponding to the new binary number is determined as a single first reference value. Here, the first in the first reference value corresponds to the first party, rather than substantially limiting the reference value.

[0065] In one embodiment, the values ​​on the bits of a single group can be combined into a new binary number, so as to determine the reference value corresponding to the binary number. For example, the first Boolean slice is 10011011, m=2, and the bits are recorded from low to high as 0 to 7. The first group of bits are 0, 2, 4, 6 from low to high, and the values ​​on each bit are arranged from high to low as: 0101, which can correspond to the value 5 as the first reference value of the group. The second group of bits are 1, 3, 5, 7 from low to high, and the values ​​on each bit are arranged from high to low as: 1011, which can correspond to the value 11 as the first reference value of the group, and so on. When the number of groups is m, the first party can obtain m first reference values.

[0066] Similarly, the second party can process the local second Boolean slice in the same way to obtain m second reference values. The second Boolean slice is a slice that constitutes a Boolean shared form of the target data with the first Boolean slice. The m first reference values ​​correspond one-to-one to the m second reference values. Specifically, the groups and reference values ​​of the two parties at the same bit positions correspond to each other. For example, the groups and first reference values ​​obtained by the first party based on bits 0, 2, 4, and 6 of the first Boolean slice correspond to the groups and second reference values ​​obtained by the second party based on bits 0, 2, 4, and 6 of the second Boolean slice.

[0067] In step 202, the second party and the second party respectively calculate the mth power of the difference between the m first reference values ​​and the m second reference values ​​held by the second party based on the secure multiplication, and obtain the first power slices corresponding to the mth power.

[0068] It can be understood that, since m is an even number, the mth power of the difference between a single first reference value and its corresponding single second reference value is always a non-negative number. The mth power of the difference between two numbers can be expanded into a polynomial sum (the difference can be regarded as a negative term of the sum), so the mth power of the difference between a single first reference value and its corresponding single second reference value can be determined by safe summation and safe multiplication. In the case of m=2, the mth power is a square operation, and the following description takes square as an example.

[0069] In multi-party secure computation, there are two ways to calculate the square of the difference between a single first reference value and its corresponding single second reference value: one is to first calculate the difference between the first reference value and the second reference value, and then use secure multiplication to calculate the square of the difference between the two; the other is to decompose the square of the difference into the square term of the first reference value, the square term of the second reference value, and the product term of the first reference value and the second reference value as described above. Among them, the calculation process can be carried out using secure computing methods such as secret sharing and homomorphic encryption. This manual takes secret sharing as an example. Both methods require one secure multiplication, and the second method only involves communication in secure multiplication, which is more conducive to reducing the amount of communication.

[0070] After security calculation, the first party and the second party respectively obtain a sum-shared slice of the m-th power square of the difference between a single first reference value and a single second reference value, which may be referred to as a power slice in this specification. Further, the slice obtained by the first party is referred to as a first power slice, and the slice obtained by the second party may be referred to as a second power slice. In this way, for m groups of first reference values ​​and second reference values, the first party may obtain m first power slices, and the second party may obtain m second power slices. The single first power slice and the single second power slice constitute a sum-shared form of the m-th power square value of the difference between a single group of first reference values ​​and second reference values.

[0071] Step 203: Perform polynomial summation on each first power slice to obtain the first and shared slices of the target data.

[0072] According to the principle of the previous article, the target data is converted into the absolute value of the difference between the value corresponding to the first Boolean slice and the value corresponding to the second Boolean slice. Since there is only one bit difference between the first Boolean slice and the second Boolean slice, that is, only one of the m-th powers obtained in step 202 has a true value that is not 0. Therefore, the modulo 2 sum of the sums obtained by performing polynomial summation on the powers can be obtained. N The result of adding a non-zero power modulo 2 N That is, treat each power square as a term in a polynomial and sum them according to reasonable coefficients.

[0073] Here, in combination with the determination method of each reference value, a reasonable coefficient can be related to the offset of the lowest bit of the corresponding group compared with the lowest bit of the first Boolean slice. For example, when m=2, the lowest bit of the first Boolean slice is the 0th bit, the lowest bit of the first group is the 0th bit, and the offset between the two is 0, then the corresponding coefficient can be 2 to the power of 0, the lowest bit of the second group is the 1st bit, and the offset between the two is 1, then the corresponding coefficient can be 2 to the power of 1. If the obtained polynomial is: [(y L1 -y R1 ) 2 ] L +2[(y L2 -y R2 ) 2 ] L Among them, [(y L1 -y R1 ) 2 ] L and [(y L2 -y R2 ) 2 ] L The two first-power shards held by the first party.

[0074] Similarly, when m=4, the first group corresponds to an offset of 0, and the corresponding coefficient can be 2 to the power of 0, the second group has an offset of 1, and the corresponding coefficient can be 2 to the power of 1, the first group corresponds to an offset of 2, and the corresponding coefficient can be 2 to the power of 2, and the fourth group has an offset of 3, and the corresponding coefficient can be 2 to the power of 3. When m is a larger even value, the items corresponding to other power slices can be other powers of 2 that increase in sequence, which will not be repeated here.

[0075] The first party can obtain the first and shared slices of the target data by summing the above polynomials. Accordingly, the second party can synchronously determine the corresponding coefficients for each second power slice locally, thereby performing polynomial summing to obtain the second and shared slices. The first and shared slices and the second and shared slices can constitute the target data in the first and second party's shared form.

[0076] It is worth noting that the shared shards involved in the above steps can be the corresponding values ​​modulo 2 N (N is a preset integer, such as N=64).

[0077] In order to clarify the communication volume of the above process, Figure 3 The following is a schematic diagram showing an interactive process of a method for converting a shared form of target data executed by two participants in an embodiment of the present specification. Figure 3 As shown, the first party and the second party perform the calculations locally respectively, and do not communicate, in grouping, determining the reference value corresponding to each group, and performing the polynomial summation on each power slice. When the first party and the second party are the mth power of the difference between the first reference value and the second reference value, they undergo at least m times of secure multiplication communication interaction. Therefore, the communication volume in the above process can be reduced to the communication volume of at least m times of secure multiplication.

[0078] In addition, the above conversion process can also be extended to the secure computing process of more participants. In the multi-party secure computing process, Figure 2 The first party and the second party shown in the figure may each correspond to at least one participant. That is, the Boolean shared slices of some of the multiple participants are XORed in sequence to obtain a merged Boolean shared slice, which can be used as Figure 2 The first Boolean shared slice in is XOR-ed with the Boolean shared slices of another part of the participants in sequence to obtain another merged Boolean shared slice (such as the second Boolean shared slice), which is converted into a sum-shared form.

[0079] Reviewing the above process, the technical concept provided in this specification, in the process of converting the shared form of target data with a predetermined power of 2, splits the Boolean slices to obtain the numerical form under sharing, and then uses the split numerical values ​​to determine the interaction data between the two participants, so as to use the characteristics of the two parties to convert binary numbers to other numerical values, and perform secure multiplication and polynomial combination operations, thereby avoiding large amounts of data communication, providing a more efficient B2A conversion method, and improving the business processing efficiency of secure computing.

[0080] According to another embodiment, a sharing format conversion device for target data disposed on a computing side is also provided. Figure 4A device 400 for converting the shared form of target data according to an embodiment is shown respectively. The device 400 can be set in any of the multiple participants in the multi-party secure computation.

[0081] like Figure 4 As shown, the device 400 provided at the first party holding the predetermined data set and the first party sharing the shard among the multiple parties includes:

[0082] The grouping unit 401 is configured to group the n bits in the first Boolean slice held by the user according to the number of groups m agreed upon with the second party and determine m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by a binary number formed by the corresponding bits, and m is a non-zero even number;

[0083] The secure calculation unit 402 is configured to respectively calculate, with the second party, the m-th power of the difference between the m first reference values ​​and the m second reference values ​​held by the second party based on secure multiplication, to obtain first power slices corresponding to the m-th power, and a single first power slice and a single second square slice obtained by the second party constitute a sum sharing form of the corresponding m-th power;

[0084] The summing unit 403 is configured to perform a polynomial summation on each first power slice to obtain a first and shared slice of the target data, wherein the summation coefficient of a single first power slice item is determined based on an offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first and shared slice and the second and shared slice obtained by performing a polynomial summation on each second power slice by the second party constitute a shared form of the target data.

[0085] In one embodiment, the single first reference value and the single second reference value of the second party correspond to the same group, and the security calculation unit 402 can be further configured as follows:

[0086] Determining a first multiplier associated with the first expanded term in a first expanded term corresponding to the mth power of the difference between the single first reference value and the single second reference value, wherein the first multiplier is a power of the single first reference value;

[0087] Performing secure multiplication using the first multiplier and a second multiplier determined by the second party based on the power of the single second reference value, thereby obtaining a first slice of the first expanded term, the first slice and the second slice obtained by the second party forming a sum-shared form of the first expanded term;

[0088] A first power slice of the mth power of a difference between the single first reference value and the single second reference value is determined based on a sum of the single first reference value and the first slice of the first expanded term.

[0089] It is worth mentioning that Figure 4The device 400 shown is Figure 2 The method described corresponds to Figure 2 The corresponding description in the method embodiment is also applicable to the device 400 and will not be repeated here.

[0090] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described by et al.

[0091] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor. The memory stores executable code. When the processor executes the executable code, the Figure 2 The method described by et al.

[0092] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0093] The above specific implementation methods further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above are only specific implementation methods of the technical concept of this specification, and are not used to limit the protection scope of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the protection scope of the technical concept of this specification.

Claims

1. A method for converting a shared form of target data, used in two-party secure computing, converting a Boolean shared form of target data of a first party and a second party into a shared form, wherein the target data is a predetermined power of 2, and the first party and the second party respectively hold a first Boolean slice and a second Boolean slice of the target data, and the method is executed by the first party, comprising: For the n bits in the first Boolean slice held, group the bits according to the number m of groups agreed upon with the second party and determine m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by a binary number formed by the corresponding bits, and m is a non-zero even number; Calculate the mth power of the difference between the m first reference values ​​and the m second reference values ​​held by the second party based on secure multiplication respectively with the second party, and obtain first power slices corresponding to the mth power respectively, and a single first power slice and a single second power slice obtained by the second party constitute a sum sharing form of the corresponding mth power; A polynomial sum is performed on each first power slice to obtain a first and shared slice of the target data, wherein the sum coefficient of a single first power slice item is determined based on an offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first and shared slice and the second and shared slice obtained by performing a polynomial sum of each second power slice by the second party constitute a shared form of the target data.

2. The method of claim 1, wherein: The bits corresponding to a single group are arranged from high to low to form a single binary number, and the single first reference value corresponding to the single binary number is the value of the single binary number converted into a decimal number or a hexadecimal number.

3. The method of claim 1, wherein: The single first reference value and the single second reference value of the second party correspond to the same group, and the method of using the m first reference values ​​to respectively calculate the mth power of the difference between each first reference value and the second reference value corresponding to the second party based on the secure multiplication with the second party includes: Determine a first multiplier associated with a first expanded term corresponding to the mth power of the difference between the single first reference value and the single second reference value, wherein the first multiplier is a power of the single first reference value; Performing secure multiplication using the first multiplier and a second multiplier determined by the second party based on the power of the single second reference value, thereby obtaining a first slice of the first expanded term, wherein the first slice and the second slice obtained by the second party constitute a sum-shared form of the first expanded term; A first power slice of the mth power of a difference between the single first reference value and the single second reference value is determined based on a sum of the single first reference value and a first slice of the first expanded term.

4. The method of claim 1, wherein: The summation coefficient of a single first power slice item is 2 as the base, the corresponding offset is the power of the exponent, and the corresponding offset is the number of offset bits.

5. The method of claim 1, wherein: The first Boolean slice and the second Boolean slice have values ​​that are different in at least one bit.

6. The method of claim 1, wherein: The first Boolean slice is obtained by sequentially performing an XOR operation on each Boolean slice on a plurality of participants.

7. A device for converting the shared form of target data, used in two-party secure computing, converting the Boolean shared form of the target data of the first party and the second party into a shared form, wherein the target data is a predetermined power of 2, and the first party and the second party respectively hold a first Boolean slice and a second Boolean slice of the target data, wherein the device is disposed on the first party, and comprises: a grouping unit configured to group the n bits in the first Boolean slice held by the group according to the number m of groups agreed upon with the second party and determine m first reference values ​​corresponding to the m groups, wherein the interval between the bits corresponding to a single group is m, and the first reference value corresponding to a single group is determined by a binary number formed by the corresponding bits, and m is a non-zero even number; a secure calculation unit configured to respectively calculate, with the second party, the mth power of the difference between the m first reference values ​​and the m second reference values ​​corresponding to the second party based on secure multiplication, to obtain first power slices corresponding to the mth power, wherein a single first power slice and a single second power slice obtained by the second party constitute a sum sharing form of the corresponding mth power; A summing unit is configured to perform polynomial summation on each first power slice to obtain a first sum shared slice of the target data, wherein the summation coefficient of a single first power slice item is determined based on an offset between the lowest bit of the corresponding group and the lowest bit of the first Boolean slice, and the first sum shared slice and a second sum shared slice obtained by performing polynomial summation on each second power slice by the second party constitute a sum shared form of the target data.

8. The device according to claim 7, wherein: The single first reference value and the single second reference value of the second party correspond to the same group, and the security calculation unit is further configured to: Determine a first multiplier associated with a first expanded term corresponding to the mth power of the difference between the single first reference value and the single second reference value, wherein the first multiplier is a power of the single first reference value; Performing secure multiplication using the first multiplier and a second multiplier determined by the second party based on the power of the single second reference value, thereby obtaining a first slice of the first expanded term, wherein the first slice and the second slice obtained by the second party constitute a sum-shared form of the first expanded term; A first power slice of the mth power of a difference between the single first reference value and the single second reference value is determined based on a sum of the single first reference value and a first slice of the first expanded term.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

10. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 6 is implemented.

Images