Privacy protection method and system for optimizing aes encryption under mpc

Abstract

A privacy protection method and system for optimizing AES encryption under MPC, under the mechanism of two-party additive secret sharing, first, the third party holding the original data performs AES fragmentation operation on the original data, then sends the fragments to the two parties for AES calculation as input; and a series of pre-processing random fragments are calculated, and the pre-processing fragments are sent to the two parties for AES calculation, so that the two parties communicate and each perform local calculation to obtain the S-box encrypted result. The application generates auxiliary operation fragments in the preprocessing stage, applies them to the online S-box interactive calculation process, improves the S-box operation polynomial in the AES encryption, and reduces the communication amount in the online stage at the cost of pre-processing fragment storage in the offline stage, and improves the privacy protection efficiency.

Description

Technical Field

[0001] This invention relates to a technology in the field of privacy protection, specifically a privacy protection method and system for optimizing AES encryption in the context of secure multi-party computation (MPC). Background Technology

[0002] Secure multiply computation is a theoretical framework proposed to solve the problem of collaborative computation among a group of distrustful participants while ensuring privacy and without a trusted third party. Secure multiply computation must satisfy two properties: privacy, i.e., the number of participants P... i You will not get x j Any information where i ≠ j; Correctness: Function value f(x1, x2, ..., x...) n The result should be calculated correctly. Currently, most secure multi-party computation models break down polynomial operations into certain addition and multiplication operations when calculating a polynomial. There are relatively mature algorithms for addition and multiplication in secure multi-party computation. After the polynomial is broken down, these basic algorithms are used to perform the polynomial result calculation. Summary of the Invention

[0003] This invention addresses the shortcomings of existing technologies in efficiently performing AES encryption computation in multi-party computation scenarios and in failing to consider the security of two-party AES encryption while protecting privacy. It proposes an optimized privacy-preserving method and system for AES encryption under MPC. By generating auxiliary computation fragments during the preprocessing stage and applying them to the online S-box interactive computation process, and by improving the polynomial of the cryptographic permutation box (S-box) operation in AES encryption, the invention reduces the amount of communication in the online stage at the cost of offline preprocessing fragment storage, thereby improving privacy protection efficiency.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to a privacy protection method for AES encryption under MPC. Under the mechanism of two-party addition secret sharing, the third party holding the original data first performs AES fragmentation operation on the original data, and then sends the fragments to the two parties performing AES calculation as input; and calculates a series of preprocessed random fragments, and sends the preprocessed fragments to the two parties performing AES calculation, so that the two parties communicate and each perform local calculation to obtain the S-box encryption result.

[0006] The AES sharding operations include: key expansion, round key addition, byte substitution, column mixing, and shiftrows.

[0007] The raw data refers to the encrypted plaintext and key provided by the party performing AES encryption.

[0008] The aforementioned two-party addition secret sharing refers to the following: for a secret shared value x, it is divided into x = x1 + x2. The two parties performing the calculation each hold x1 and x2 respectively, and are unaware of each other's fragment values, thus protecting the privacy of the secret value x. Under the addition secret sharing mechanism, all intermediate and final results satisfy addition sharing, that is, for any function f(x), by setting the corresponding operation method, f(x) = f(x1) + f(x2).

[0009] This invention relates to a system for implementing the above method, comprising: an offline fragment generation unit, an input unit, a communication broadcasting unit, and a local computing unit, wherein: the offline fragment generation unit, acting as a trusted third party, generates a series of preprocessed fragments used in the online S-box operation phase and distributes them to the two computing parties performing AES encryption; the input unit, being a client expecting an encryption result, locally fragments the original data (plaintext) and the key, and then transmits the fragments to the servers of the two computing parties performing AES encryption; the communication broadcasting unit, consisting of the two computing parties performing AES encryption, whose servers communicate and broadcast a series of fragment values; and the local computing unit performs all local direct additions and, after communication, calculates a polynomial using the fragments to obtain the S-box encryption result. Attached Figure Description

[0010] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0011] This embodiment relates to an optimized AES implementation method for secure multi-party computation scenarios. Under the mechanism of secret sharing in addition between the two parties, the third party holding the original data first performs AES fragmentation operation on the key and the encrypted data, and then sends the result of the fragmentation operation to the two parties performing the computation, so that each party can perform local computation to obtain the S-box encrypted result.

[0012] The AES sharding operation includes: sequential key expansion, round key addition, byte substitution, column obfuscation, and row transformation operations.

[0013] The key expansion specifically includes: expanding the 16-byte key into 44 * four 1-byte keys. First, the 16-byte key is arranged into a 4x4 matrix, with four columns forming the four 4-byte keys for the first round (w0, w1, w2, w3). This step only needs to be executed locally, assuming shared addition. Then, a left-loop shift is performed on the last 4-byte key, w3, followed by an S-box operation. Finally, the leftmost byte is added to RC, a constant ranging from 1 to 10 over the 10 rounds, to obtain w′. This step, being an addition of the secret value and a constant, can also be performed locally. Then w0 + w′ = w4, w4 + w1 = w5, w5 + w2 = w6, w6 + w3 = w7, thus obtaining the key for the next round of encryption (w4, w5, w6, w7). These four 4-byte keys then undergo the same process for 10 rounds, ultimately resulting in forty-four 4-byte keys used in the 11th round of key addition. All addition operations in the key expansion can be performed locally.

[0014] The key expansion described herein all include a cryptographic permutation, or S-box operation, specifically: S-box(x) = 0x63 + 0x8F*x^127 + 0xB5*x^191 + 0x01*x^223 + 0xF4*x^239 + 0x25*x^247 + 0xF9*x^253 + 0x05*x^254, which is a polynomial operation on the secret shared value. For this polynomial, x, x 2 x 4 x 8 x 16 x 32 x 64 x 128 Let x be x0, x1, x2, x3, x4, x5, x6, x7. That is, the original polynomial f(x) can be regarded as a seven-variable polynomial f′(x0, ..., x7), whose highest order is 7.

[0015] like Figure 1 As shown, this embodiment specifically includes:

[0016] Step ① The two parties involved in the operation secretly share the random value and generate seven secret shared values ​​{y1, y2, ..., y7}.

[0017] Step ② generates secret sharing groups of 1 to 7 degrees, where an i-th secret sharing group refers to the set of secret sharing of all i-th monomials formed by elements in a number of random secret sharing values ​​{y1, y2, ..., y7}.

[0018] Step ③: Each participant calculates x i -y i The fragment is divided and broadcast to obtain z.i =x i -y i Therefore, the original objective polynomial is f(x1, x2, ..., x7) = f(y1 + z1, y2 + z2, ..., y7 + z7). And z... i The value of has been broadcast publicly, so the original objective polynomial can be transformed into a polynomial g(y1, y2, ..., y7) with respect to the new secret shared {y1, y2, ..., y7}.

[0019] Step 4 involves bringing the previously generated secret sharing group into the polynomial g(y1, y2, ..., y7). Each participant then receives a slice of the final original polynomial result. When each participant broadcasts the slice of the final result they received, the final result is obtained.

[0020] When calculating the S-box operation in AES under MPC, the calculation is completed with pre-stored fragments. That is, a series of fragments are generated locally on the initial offline fragment unit and sent to both parties. At this time, the generated fragments are completely random, so the secret value information will not be exposed.

[0021] The aforementioned round key addition refers to the local addition of two secret shared values. For two secret shared values ​​x and y, both parties only need to perform local calculations: z1 = x1 + y1, z2 = x2 + y2. The final z1 and z2 satisfy the addition sharing mechanism, that is, the final result z = z1 + z2 = x + y = x1 + x2 + y1 + y2.

[0022] The byte replacement mentioned above is an S-box operation. The specific process is the same as the S-box operation in key expansion. It is a polynomial operation and can be completed using the above scheme.

[0023] The aforementioned column obfuscation is a multiplication of a secret shared value with a constant matrix, which can be performed locally by both parties: z1 = a*x1, z2 = a*x2, then the final z1 and z2 satisfy the addition sharing mechanism, that is, the final result z = z1 + z2 = a*x = a*(x1 + x2) = a*x1 + a*x2.

[0024] The row transformation described above is a shift operation for a secret shared value. For a secret shared value x = x1 + x2, the shift operation for x can be completed by both parties performing shift operations on x1 and x2 locally respectively.

[0025] Based on specific practical experiments, in a local inter-process communication environment, running the above method with a 2.3GHz CPU and a dual-core Intel Core i5 processor, the experimental data obtained is compared with the previously commonly used Beavertriple method as follows:

[0026] multiple methods Beavertriple method Total broadcast communication time (s) 0.434807 21.019375 Total Sbox processing time (s) 3.913841 21.508018 AES computation time (s) 3.922646 21.517029

[0027] The existing Beavertriple approach requires broadcasting xa and yb once per multiplication, while our method only requires one broadcast for the entire polynomial computation. The multiple approach to polynomial computation only requires broadcasting x and y, offering a significant advantage in communication. Its drawback is the need to compute and store fragments during preprocessing, shifting the workload from online to offline. Therefore, the overhead of the multiple approach is not in communication, but rather in preprocessing and storage, thus successfully transferring the computational load.

[0028] The test results in the experimental phase show that the time saved by using the multiple scheme to reduce communication is far greater than the additional overhead of computation required by this scheme, thus solving the communication bottleneck of AES in MPC operations and improving efficiency.

[0029] Compared to the original MPC protocol that splits the polynomial into addition and multiplication and then uses Beavertriple for multiplication, this method greatly shortens the time for AES encryption in the MPC scenario. Specifically, it reduces the communication time of S-box operation, reduces the amount of communication in the online broadcast phase, and improves the efficiency of the online computation phase.

[0030] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. An optimized AES implementation method for secure multi-party computation scenarios, characterized in that, Under the mechanism of secret sharing in addition between the two parties, the third party holding the original data first performs AES fragmentation on the original data, and then sends the resulting fragments to the two parties performing AES calculation, so that the two parties can communicate and perform local calculations to obtain the S-box encrypted result. The AES fragmentation process includes: sequential key expansion, round key addition, byte substitution, column obfuscation, and row transformation operations; After the two parties communicate, they each perform local calculations, specifically including: Step 1: Calculate the secret sharing of random values ​​between the two parties and generate seven secret shared values. ; Step ②: Generate 1 to 7 secret sharing groups, where, Sub-secret sharing groups refer to several randomly shared secret values. The set consisting of the secret sharing of all i-th degree monomials formed by the elements in the set; Step 3: Each participant calculates The fragments are then broadcast to obtain... Therefore, the original S-box polynomial ;and The value has already been broadcast, therefore the original S-box polynomial is transformed into a value about the secret shared value. polynomial ,in: The secret shared value corresponding to each power of the AES status byte x; Step 4: Substitute the previously generated secret sharing group into the polynomial In this process, each participant can obtain a slice of the final original S-box polynomial result. When each participant broadcasts the slice of the final result they obtained, the final result can be obtained. When calculating the S-box operation in AES in the aforementioned secure multi-party computation scenario, the calculation is completed with pre-stored fragments. That is, multiple fragments are generated locally on the initial offline fragment unit of the third party and sent to both parties.

2. The optimized AES implementation method for secure multi-party computation scenarios according to claim 1, characterized in that, The aforementioned two-party addition secret sharing refers to: for a secret shared value Divide it into The two parties performing the calculation each hold And they do not know the other party's fragment value, regarding the secret shared value. To protect privacy, under the secret-sharing mechanism of addition, all intermediate and final results satisfy addition sharing, meaning that for any function... By setting the corresponding calculation method, it is possible to .

3. The optimized AES implementation method for secure multi-party computation scenarios according to claim 1, characterized in that, The key expansion includes: expanding the 16-byte key into 44 * four 1-byte keys, specifically including: 1) Arrange the 16-byte key into a 4x4 matrix, with four columns forming the four 4-byte keys for the first round. ); 2) For the last 4-byte key, i.e. Perform a left loop shift, followed by an S-box operation, and then add the leftmost byte to the constant RC to obtain the result. , then calculate This allows us to obtain the key for the next round of encryption. ); 3) Continue the above operation with the four 4-byte keys obtained in step 2) for a total of 10 rounds, and finally obtain forty-four 4-byte keys to be used in the key addition process of the 11th round.

4. The optimized AES implementation method for secure multi-party computation scenarios according to claim 1, characterized in that, The aforementioned round key addition refers to the local addition of two secret shared values. Therefore, for two secret shared values... and Only local calculations are required between the two parties: Then the final result is The mechanism that satisfies addition sharing is the final result. .

5. The optimized AES implementation method for secure multi-party computation scenarios according to claim 1, characterized in that, The aforementioned column obfuscation is a multiplication of a secret shared value with a constant matrix, performed locally by both parties: Then the final result is The mechanism that satisfies addition sharing is the final result. .

6. The optimized AES implementation method for secure multi-party computation scenarios according to claim 1, characterized in that, The row transformation described above performs a shift operation on the secret shared value. For a secret shared value... ,for The shift operation is performed locally by both parties. This can be accomplished by performing a shift operation.

7. An optimized AES implementation system for secure multi-party computation scenarios that implements the method of any one of claims 1-6, characterized in that, include: The system includes an offline fragment generation unit, an input unit, a communication broadcast unit, and a local computing unit. The offline fragment generation unit, acting as a trusted third party, generates multiple preprocessed fragments for use in the online S-box computation phase and distributes them to the two computing parties performing AES encryption computation. The input unit is the client that expects to obtain the encryption result. It locally divides the original data (plaintext) and the key into fragments and then transmits the fragments to the servers of the two computing parties performing AES encryption computation. The communication broadcast unit is for the two computational parties performing AES encryption operations. Their servers communicate and broadcast multiple fragment values. The local computation unit performs all local direct additions and, after communication, uses the fragments to compute the polynomial to obtain the S-box encrypted result.

Images