Method and device for inverting a power of 2 in multi-party secure computation

Abstract

The embodiment of the specification provides a method and device for inverse of power of 2 in multi-party secure calculation. In a service processing process based on multi-party secure calculation, arithmetic inverse is performed on power of 2 in a Boolean sharing form constituted by two data parties. By using the characteristics of power of 2 and Boolean sharing, and the corresponding relationship between power of 2 and inverse of power of 2 in the positions before and after the decimal point, the inverse of power of 2 in the Boolean sharing form is determined by inversely arranging the bit values in the Boolean slice. Then, the two parties perform a secure B2A protocol to obtain the arithmetic sharing form of the inverse of power of 2. In this way, the data communication amount of the arithmetic inverse can be greatly reduced, and the service processing efficiency of the secure calculation is improved.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of secure computation, and in particular, to a method and apparatus for inverse of power of 2 in multi-party secure computation. BACKGROUND

[0002] Secure multi-party computation, also known as multi-party secure computation, can compute the result of a function by multiple parties without leaking the input data of each party in the function, and the result of the computation is disclosed to one or more parties. Typical applications of secure multi-party computation include, for example, joint statistical analysis of multi-party data with privacy protection, machine learning, etc. The function here is a statistical operation function, a machine learning algorithm, etc.

[0003] In the process of multi-party secure computation, in order to not leak the data of each party and the intermediate calculation result, the data or intermediate result can be held in the form of sharing (share) by each party. A single party holds a data slice, and the slices held by each party are fused together to restore the corresponding data. Usually, the calculation is kept in the shared state. In this way, the number of data communications, the amount of communication, etc. in multi-party secure computation are important factors affecting the efficiency of secure computation. SUMMARY

[0004] One or more embodiments of the present specification describe a method and apparatus for inverse of power of 2 in multi-party secure computation to solve one or more problems mentioned in the background.

[0005] According to a first aspect, a method for inverse of power of 2 in multi-party secure computation is provided, for determining an arithmetic sharing form of an inverse of a power of 2 based on a Boolean sharing form of the power of 2 by two participants, the two participants including a first party and a second party, each holding a first Boolean slice and a second Boolean slice of the power of 2 in fixed-point number form represented by n bits, the method is executed by the first party, and includes: for the held first Boolean slice, determining a first reference slice corresponding to the first Boolean slice based on the reverse order of the values of each bit, the first reference slice and a second reference slice held by the second party constitute a Boolean sharing form of the inverse of the power of 2, the second reference slice is determined based on the reverse order of the values of each bit of the second Boolean slice; using the first reference slice, executing a secure B2A protocol with the second party to convert the inverse of the power of 2 from the Boolean sharing form to the arithmetic sharing form, thereby obtaining a first arithmetic slice of the inverse of the power of 2.

[0006] In one embodiment, the lowest bit of the first Boolean share is the 0th bit, corresponding to a decimal number f; the reverse order of the values of the bits is determined by one of the following: converting the lowest bit to the highest bit in order, and the decimal number after conversion is n-f-1; mirroring the bits between the f-1th bit and the fth bit, and the decimal number after mirroring is n-f-1; mirroring the bits other than the fth bit, and the decimal number after mirroring is n-f.

[0007] In one embodiment, the converting the inverse of the power of 2 from the Boolean shared form to the arithmetic shared form using the first reference share and the second party to perform the secure B2A protocol comprises: for each bit in the first reference share, performing an oblivious transfer protocol with a corresponding bit in a second reference share obtained by the second party, wherein the oblivious transfer protocol performed for a single bit i comprises: one of the first party and the second party as a sender, sending two strings s i0 and s i1 to the other party as a receiver, based on the corresponding bit locally, selecting one of the two strings s i0 and s i1 as a selected bit; based on the result of the oblivious transfer protocol, determining the first arithmetic share corresponding to the first reference share as the first arithmetic share of the inverse of the power of 2.

[0008] In a further embodiment, in the case that the first party is the sender, the first arithmetic share corresponding to the first reference share is an arithmetic form of the first reference share; in the case that the first party is the receiver, the first arithmetic share corresponding to the first reference share is an arithmetic form of a share obtained by multiplying each bit of the first reference share by a corresponding selected bit.

[0009] In one embodiment, the converting the inverse of the power of 2 from the Boolean shared form to the arithmetic shared form using the first reference share and the second party to perform the secure B2A protocol comprises: determining two first reference values corresponding to odd bits and even bits respectively, a single first reference value being determined by a binary number composed of the values of the bits on the corresponding odd bit or even bit; based on the two first reference values, performing secure computation with the second party to obtain the first arithmetic share of the inverse of the power of 2, wherein in the performed secure computation, the second party provides two second reference values corresponding to odd bits and even bits respectively based on a second Boolean share.

[0010] In a further embodiment, in the case that the single first reference value corresponds to a binary number of odd bits or even bits in the first Boolean slice modulo 2 n , the single second reference value corresponds to the inverse of the binary number of odd bits or even bits in the second Boolean slice modulo 2 n ; in the case that the single first reference value corresponds to the inverse of the binary number of odd bits or even bits in the first Boolean slice modulo 2 n , the single second reference value corresponds to the binary number of odd bits or even bits in the second Boolean slice modulo 2 n .

[0011] In a still further embodiment, the performing secure computation with the second party based on the two first reference values to obtain the first arithmetic slice of the inverse of the power of 2 comprises: locally computing a first product of the square root of 2 and the first reference value corresponding to the odd bits, and a second product locally computed by the second party to form a sum sharing of the odd item balanced difference, wherein the second product corresponds to a product of the square root of 2 and a second reference value corresponding to the odd bits in the second Boolean slice; summing the first product and the first reference value corresponding to the even bits to obtain a first comprehensive slice of the even-odd item comprehensive difference, which is a sum of the balanced differences between the respective first reference value and the corresponding second reference value; performing a secure squaring protocol with the second party using the first comprehensive slice to compute a square value of the even-odd item comprehensive difference to obtain a first slice of the square value as the first arithmetic slice of the inverse of the power of 2, wherein the even-odd item comprehensive difference forms a sum sharing with a second comprehensive slice of the second party, which is determined by a sum of the second reference value corresponding to the even bits in the second Boolean slice and the second product.

[0012] In another still further embodiment, the performing secure computation with the second party based on the two first reference values to obtain the first arithmetic slice of the inverse of the power of 2 comprises: performing a secure squaring protocol with the second party to compute squares of sums of the two first reference values and the second reference values respectively held by the second party to obtain two first square slices respectively corresponding to the two square values, and a single second square slice obtained by the second party corresponding to a single first square slice to form a sum sharing of the respective square; performing polynomial summation on the respective first square slice to obtain the first arithmetic slice of the inverse of the power of 2, wherein a summation coefficient of a single first square slice term corresponding to the even bits is 1 and a summation coefficient of a single first square slice term corresponding to the odd bits is 2, and the first arithmetic slice forms an arithmetic form of the inverse of the power of 2 with a second arithmetic slice obtained by the second party by performing polynomial summation on the respective second square slice.

[0013] In another further embodiment, the performing, with the second party, the secure computation based on the two first reference values to obtain the first arithmetic share of the inverse of the power of two comprises: performing, with the second party, the secure multiplication protocol to obtain two products each corresponding to a multiplication of a respective one of the two first reference values and a respective one of second reference values held by the second party, to obtain two first product shares each corresponding to a respective one of the two products, and each first product share and a respective one of second product shares obtained by the second party form a respective one of the products in a sum sharing form; and performing the polynomial summation on the two first product shares and two square values each corresponding to a respective one of the two first reference values held by the local party, to obtain the first arithmetic share of the inverse of the power of two, wherein each of the two square values has a summation coefficient of 1, each first product share term corresponding to an even bit has a summation coefficient of 2, and each first product share term corresponding to an odd bit has a summation coefficient of 4.

[0014] In one embodiment, the first Boolean share is obtained by sequentially performing the XOR operation on respective Boolean shares held by the second party and a plurality of participating parties other than the second party.

[0015] According to a second aspect, there is provided an apparatus for determining an arithmetic sharing form of an inverse of a power of two based on a Boolean sharing form of the power of two held by two participating parties, the two participating parties including a first party and a second party, the first party and the second party holding a first Boolean share and a second Boolean share of the power of two in a fixed-point number form represented by n bits respectively, the apparatus being arranged at the first party and comprising:

[0016] an inverse determining unit configured to determine, for the first Boolean share held by the first party, a first reference share based on a reverse order of values of respective bits of the first Boolean share, the first reference share and a second reference share held by the second party forming a Boolean sharing form of the inverse of the power of two, the second reference share being determined based on a reverse order of values of respective bits of the second Boolean share;

[0017] a conversion unit configured to convert, with the second party, the inverse of the power of two from the Boolean sharing form to an arithmetic sharing form by performing a secure B2A protocol using the first reference share, to obtain a first arithmetic share of the inverse of the power of two.

[0018] According to a third aspect, there is provided a computer readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0019] According to a fourth aspect, there is provided a computing device comprising a memory and a processor, wherein the memory has stored thereon executable code that, when executed by the processor, implements the method of the first aspect.

[0020] The method and device provided by the embodiments of the present specification can solve the problem of the arithmetic inverse of the power of 2 in the two-party secure calculation scenario, considering the complexity of the inverse operation and the particularity of the power of 2 in the Boolean sharing form, a new inverse scheme for the power of 2 is proposed, which can reduce the inverse complexity and improve the data processing efficiency of multi-party secure calculation. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A flow chart of a method for inverse of the power of 2 in multi-party secure calculation performed by a single participant according to an embodiment is shown;

[0023] Figure 2 A data communication schematic diagram for performing two-party secure multiplication is shown;

[0024] Figure 3 A data communication schematic diagram for performing two-party secure square protocol is shown;

[0025] Figure 4 A schematic block diagram of an apparatus for inverse of the power of 2 in multi-party secure calculation performed by a single participant according to an embodiment is shown. DETAILED DESCRIPTION

[0026] The technical solutions provided by the present specification will be described below in conjunction with the drawings.

[0027] Secret sharing, also known as secret splitting or secret sharing, is a basic principle of splitting a secret (such as a key, private data, etc.) into multiple shares, and giving them to different data parties. Only more than the threshold number of parties can combine their shares to recover the secret; the shares obtained from less than the threshold number of parties cannot recover any information about the secret. In multi-party secure calculation, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called shards.

[0028] Secret sharing is an important means in the process of multi-party secure calculation. Several secret sharing forms commonly used in multi-party secure calculation, such as arithmetic sharing (Arithmetic Sharing), Boolean sharing (Boolean Sharing), and Yao's sharing (Yao's Sharing). The following describes various sharing methods by taking shared secret data x as an example.

[0029] Among them, arithmetic sharing is also called sum sharing. In two-party secure computation, an integer x is distributed in two shards x=x L +x R in the form of modulo 2 N sharing (shifted to the [0, 2 N -1] interval) in two parties, so that one party does not know x R , the other party does not know x L , and either party cannot get the complete form of x. Further, two parties can be extended to multiple parties, such as x=x1+x2+…+x d . Assuming N=64, a single shard of x at a single participant can be represented by a 64-byte binary number. For example, the way to split a data x into a sum sharing form is to randomly generate d-1 2 64 values (such as randomly generating 64-byte binary numbers) as d-1 shards, such as x1, x2, …, x d-1 , and take modulo 2 64 (shifted to the [0, 2 64 -1] interval) as another shard, denoted as x d =x-x1-x2-…-x d-1 .

[0030] Boolean sharing is a secret sharing method that performs XOR operation on bit positions. For example, still taking two participants as an example, assuming x is a bit of data (taking value 0 or 1), and x0⊕x1 is used to form a Boolean sharing form in two participants, x0, x1 are two Boolean sharing shards of x in two participants, and take value 0 or 1, and ⊕ represents XOR operation. A single participant does not know the shard held by the other participant, so it cannot guess the data x. For data x' composed of n bits, n bits of binary numbers can be randomly generated as a Boolean sharing shard (such as x0') of one party. The Boolean sharing shard (such as x1') of the other party can be determined by the XOR result (x0'⊕x') of x' and the Boolean sharing shard of the party.

[0031] Yao sharing is a sharing method related to garbled circuits (GC), and this specification does not involve this sharing method, which will not be described here.

[0032] The above three Sharing methods each have their own advantages and disadvantages. In the process of business processing of multi-party secure computation, the sharing form of business data can be converted for the convenience of processing.

[0033] Boolean to Arithmetic Sharing (B2A) is a common sharing form conversion operation. B2A can be realized by subtraction on Boolean circuit, but this method is too expensive. In order to improve performance, two parties can use the method based on OT (oblivious transfer) protocol. In the i-th OT process for the i-th bit, one party (such as party A) as the sender sends two strings s i,0 , s i,1 to the other party (such as party B) and makes them satisfy: The other party as the receiver inputs the value of the i-th bit in the local Boolean slice As the selection bit gets Further, the sender calculates The receiver calculates Thus, the Boolean sharing form is converted to the sum sharing form.

[0034] In practice, it may also involve sharing form conversion between Boolean sharing and Yao sharing (such as B2Y, Y2B, etc.), sharing form conversion between Yao sharing and arithmetic sharing (such as A2Y, Y2A, etc.), arithmetic sharing to Boolean sharing (A2B), etc. The conversion between various sharing methods is not listed one by one here.

[0035] In the process of business processing based on multi-party secure computation, a target data x is usually in Boolean sharing form with two participants in the form of floating point or fixed point number, and the inverse x -1 of x needs to be calculated, and the result is in arithmetic sharing form with two participants. This scenario can be referred to as arithmetic inversion in this specification.

[0036] Among them, the concept of fixed point number is as follows: for decimal, the sum sharing form of Z module 2 r is used, and a fixed point position (description of decimal point position) is used as common knowledge of both parties, that is, fixed point number representation. A data a can be represented as a fixed point number d×e -f , d is an integer. Among them, f represents the fixed point position, that is, the number of decimal places in binary. As an example, assuming that a number value a = 0.125, the fixed point number f = 14, then the integer d = 0.125×e f = 2048 in the corresponding fixed point number, and the fixed point number corresponding to a is 2048×e -14In the Boolean sharing form, the data a can be represented by the integer part 2048 of the split pieces (e.g., a0=987 and a1=1061). In the case of a being a power of 2, d is usually also a power of 2, and the inverse of a can also be represented by a fixed-point number, and the integer part thereof is also a power of 2. The position of the decimal point in the fixed-point number is usually fixed, and the difference between the floating-point number and the fixed-point number is that the position of the decimal point in the floating-point number is variable. The floating-point number is similar to the fixed-point number in representing the data at a current decimal position.

[0037] In the conventional technique, the inverse of x can be calculated by two participants through a division circuit and a GMW (Goldreich-Micali-Wigderson) protocol, and the result constitutes a Boolean sharing form. Then, the B2A protocol is executed to convert the inverse of x from the Boolean sharing form to the arithmetic sharing form. The GMW protocol is a semi-honest secure computation protocol based on a garbled circuit, and the target function of the GMW protocol is composed of an XOR gate, an AND gate, and a NOT gate. In the secure computation process, the GMW protocol consumes a large amount of data communication.

[0038] In the case of the target data x being a power of 2, the arithmetic inverse is still performed by the above conventional technique, which consumes a large amount of calculation and data communication cost. Considering that the binary representation of the power of 2 (such as 2 t ) has a certain speciality, the present specification provides a new technical idea for performing the arithmetic inverse of the power of 2 to reduce the communication amount and improve the business processing efficiency.

[0039] Those skilled in the art can understand that the power of 2 has the following properties in the binary form:

[0040] (1) The power of 2 and its inverse are both only one bit (e.g., the tth bit from the lowest bit, which is the 0th bit) being 1, and the remaining bits being 0. In the case of the power of 2 being in the Boolean sharing form constituted by two participants, the two Boolean pieces only have one different bit;

[0041] (2) The integer power of 2 has one bit being 1 before the decimal point and the remaining bits being 0, while the inverse of the integer power of 2 has one bit being 1 after the decimal point and the remaining bits being 0;

[0042] (3) The lowest bit before the decimal point is recorded as the 0th bit, and the inverse of the power of 2 and the power of 2 have the following relationship: 2 t The (t+1)th bit (the tth bit) before the decimal point is 1, and the inverse of 2 t is 1 after the decimal point.

[0043] Based on the above properties, the present specification provides a technical concept that can determine the inverse of the power of 2 corresponding to the Boolean sharing form by arranging the Boolean shares of the power of 2 in reverse order, thereby arranging the bits with a value of 1 to the right of the decimal point, and then converting the shares of each party into arithmetic shares according to the conversion protocol (such as the B2A protocol described above) from the Boolean sharing form to the arithmetic sharing form.

[0044] Specifically, in binary form, the principle of inverting the power of 2 is as follows: assuming a number 8 = 2 3 , and the number of decimal digits f is 4, then its binary form is 1000 0000, and 1 is in the 7th bit, i.e. 8 = 2 7 × 2 -4 = 2 3 , and the low 4 bits of 0 represent the decimal part after the decimal point, and the bit value 1 is located in the 3rd bit before the decimal point. Arranging the binary data 1000 0000 in reverse order, the highest bit becomes the lowest bit, and 0000 0001 is obtained, then if the decimal point position is kept unchanged, there is: 2 0 × 2 -4 = 2 -4 = 8 -1 × 2 -1 . If you want to get 8 -1 , you can modify the number of decimal digits to f = 3 (floating point), then 0000 0001 corresponds to 2 0 × 2 -3 = 8 -1 , or, by adding 0 to the lowest bit and truncating the highest bit, 0000 0010 is obtained, which corresponds to the number of decimal digits f = 4 (fixed point), and 2 1 × 2 -4 = 8 -1 .

[0045] In the Boolean sharing form, the first party and the second party can respectively obtain a Boolean share of the inverse of the power of 2 by performing the same processing on the local Boolean share, such as a reference share. The first party and the second party can obtain the arithmetic sharing form of the inverse of the power of 2 by performing the secure B2A protocol on the two reference shares.

[0046] In this way, the communication volume in the arithmetic inversion process of the power of 2 is consistent with the communication volume of the B2A protocol. In a possible design, when performing B2A conversion for the power of 2, a method different from the B2A method in the foregoing general technology can be used according to the special properties of the power of 2, to further reduce the communication volume and improve the business processing efficiency.

[0047] The technical concept of the present specification is described in detail below.

[0048] Figure 1A flow of a single participant in a multi-party secure computation for inverse of power of 2 is shown according to an embodiment.

[0049] Suppose the participants in the current secure computation are the first party and the second party, and the target data for determining the arithmetic inverse is x = 2 t , that is, the arithmetic inverse of x, x is stored in the form of fixed-point number or floating-point number. Specifically, suppose the number of decimal places is f, x is expressed as x = d x 2 -f , d is the integer part of the fixed-point number or floating-point number representation of x, described by n bits, and the integer d is in a shared form constituted by the first party and the second party, used to describe x. Then, in binary form, The first party holds the first Boolean slice d L , for example, in turn from the lowest bit to the highest bit d0 L , d1 L ……d n-1 L , and the second party holds the second Boolean slice d R , for example, in turn from the lowest bit to the highest bit d0 R , d1 R ……d n-1 R . And for a single bit i of the binary form of d, there is: d i = d i L + d i R mod 2, or d i = d i L ⊕ d i R .

[0050] Suppose the current single participant is the first party, as Figure 1 shown, in the process of inverse of power of 2 in the multi-party secure computation scenario, the flow executed by the first party can include: step 101, for the first Boolean slice held, based on the reverse order arrangement of the values of each bit, determine the first reference slice corresponding to the first Boolean slice, the first reference slice and the second reference slice held by the second party constitute the Boolean shared form of the inverse of the power of 2, the second reference slice is determined based on the reverse order arrangement of the values of each bit of the second Boolean slice; step 102, using the first reference slice, execute the secure B2A protocol with the second party to convert the inverse of the power of 2 from the Boolean shared form to the arithmetic shared form, thereby obtaining the first arithmetic slice of the inverse of the power of 2. The inverse of the power of 2 can also be referred to as the reciprocal of the power of 2.

[0051] Firstly, in step 101, for the held first Boolean slice, a first reference slice corresponding to the first Boolean slice is determined based on reverse ordering of values of respective bits.

[0052] The reverse ordering of values in the first Boolean slice aims to move the powers of 2 from positions before the decimal point to corresponding positions after the decimal point in the fixed-point number representation, so as to determine the inverse of the powers of 2. It can be understood that the powers of 2 and the inverse thereof have the following corresponding relationship: the powers of 2 have a value of 1 at the jth position before the decimal point and 0 at other positions, which represents 2 j-1 , and the inverse thereof has a value of 1 at the j-1th position after the decimal point and 0 at other positions, for example, 2 3 , the decimal point position f = 4, j = 4, the powers of 2 2 3 are represented as 00001000.0000, and the inverse thereof 2 -3 is represented as 00000 0000.001 0000 or 0000.0010 0000. Among them, the decimal point here is added only for ease of description. Actually, the first Boolean slice does not contain the decimal point, but falls into 2 n , the integer in the defined Abelian group represents the value of the integer at a predetermined number of decimal places. The predetermined number of decimal places f represents that the f bits of the low bits of the integer are binary numbers after the decimal point. For example, the value of n bits is 0000 1000 0000, which represents the product of the arithmetic value of the integer 0000 1000 0000 and 2 -4 , that is, 2 7 × 2 -4 = 8.

[0053] As can be seen from the above example, the fixed-point number of n bits, in the case of the initial number of decimal places f, the decimal point may be shifted in position on the basis of the reverse ordering of values, such as the number of decimal places being changed to n-f-1 and the like. In the reverse ordering process of values, only the integer of n bits can be processed, and then based on the positional relationship of the powers of 2 and the inverse of the powers of 2 before and after the decimal point, the new decimal point position can be described based on the adjustment of the position of the decimal point.

[0054] It can be understood that the reverse ordering of the powers of 2 can be split into consistent reverse ordering of the first Boolean slice and the second Boolean slice. The Boolean slice after the reverse ordering of the first Boolean slice can be recorded as the first reference slice, such as u L , then the respective bits of u L are recorded from low to high as u0 L , u1 L ,..., u n-1 LFor example, 0010 1101 0011 is reversed to 1100 1011 0100. The reverse order can be based on various reasonable ways.

[0055] According to one embodiment, the reverse order can arrange the highest bit to the lowest bit in turn to the lowest bit to the highest bit. For example, the n-1 bit becomes the lowest bit 0, the n-2 bit becomes the lowest bit 1, and so on, to obtain the reverse order result. That is, let u0 L = d n-1 L , u1 L = d n-2 L … u n-1 L = d0 L At this time, in the case of n = 12, assuming that the initial decimal place is f = 4, after reversing, in order to ensure the relationship between the power of 2 and its inverse after the reverse order, the decimal place can be n-f-1 = 7, that is, 0010 1101.0011 is reversed to 1100 1.011 0100.

[0056] According to another embodiment, the first Boolean slice can be mirrored and flipped to obtain the reverse order result. For example, in the case of f = 4, 0010 1101 0011 is flipped to 1100 1011 0100. In fact, it is mirrored and flipped around the decimal point, that is, 0010 1101.0011 is flipped around the decimal point to obtain 1100.1011 0100. At this time, in order to ensure the corresponding relationship between the power of 2 and its inverse about the decimal point, the decimal place can be adjusted to n-f-1, or a 0 is added to the low bit and truncated in the high bit, and the new decimal place is determined as n-f.

[0057] According to another embodiment, the first Boolean slice can be mirrored and flipped around the f bit (i.e., the bit before the decimal point indicated by the decimal place f) to obtain the reverse order result. This way keeps the relative position of the decimal point and the f bit unchanged (which can also be understood as the common body of the f bit and the decimal point as the axis), for example, 00101101 0011 is flipped around the f bit (the bold bit) to obtain 1100 1 011 0100. In this way, after mirroring and flipping, the original f bit becomes the n-f-1 bit, and the decimal point should be after the n-f-1 bit. The decimal place can be adjusted to n-f-1.

[0058] In more embodiments, there can be other reasonable ways to arrange the values in reverse order, which are not described here. The first reference slice after the reverse arrangement can correspond to the current decimal position. In the case of fixed-point number calculation, the first party and the second party can convert the current decimal position to f by decimal point conversion to maintain consistent decimal positions in subsequent calculations. The decimal point conversion method depends on the definition of the fixed-point number, which scales the integer part by a corresponding multiple. Typically, the decimal point moves one bit to the low bit, and the integer part is reduced to one half. For example, if the current decimal position is n-f-1 = 7 and f = 4, the representation corresponding to the current decimal position is k = d' x 2 -7 The integer part is d', and the fixed-point number representation with a decimal position of 4 is k = d' x 2 -4 3 ) x 2 -4 . That is, the decimal point moves 3 bits to the right, and the integer part d' is reduced to one half of d'. 3 In the case of floating-point number calculation, both parties can also record the current decimal position to determine the actual value of the data, i.e., the arithmetic value of the inverse of the power of 2 in various bases (such as decimal), such as 0.125. Alternatively, the conversion in the shared form can be performed only on the integer part.

[0059] It can be understood that, in the case where the second party determines the second reference slice based on the second Boolean slice in the same way, the first reference slice and the second reference slice constitute the inverse of the power of 2 in the Boolean shared form of the first party and the second party. The second reference slice is denoted as u R , and each bit is u0 R , u1 R ,..., u n-1 R .

[0060] Further, via step 102, the first reference slice is used to perform a secure B2A protocol with the second party to determine the arithmetic shared form of the inverse of the power of 2, thereby obtaining the first arithmetic slice of the inverse of the power of 2.

[0061] The B2A protocol is an operation protocol for converting the Boolean shared form to the arithmetic shared form. Based on the B2A protocol, the first party and the second party can securely operate the first parameter slice and the second parameter slice and securely communicate data, so that the first arithmetic slice is obtained by the first party and the second arithmetic slice is obtained by the second party, constituting the arithmetic shared form of the inverse of the power of 2, without leaking local private data.

[0062] ​According to one possible design, the B2A protocol of the conventional technique described above can be employed, i.e., for each bit of the first reference shard, the second reference shard, the OT protocol can be employed to obtain the arithmetic sharing form at the two parties. For a single bit i, one of the first party, the second party acts as the sender, and the other acts as the receiver, the sender sends two strings s i0 and s i1 to the other party, which respectively represent 0 and 1 using the value of the single bit, and the other party acts as the receiver and selects one of the two strings s i0 and s i1 as the selected bit based on the corresponding bit locally; then, based on the execution result of the OT protocol, the first party, the second party respectively determines the first arithmetic shard, the second arithmetic shard corresponding to the first reference shard, the second reference shard, to form the arithmetic sharing form of the inverse of the power of 2.

[0063] Specifically, the sender takes the arithmetic form corresponding to the local reference shard as the arithmetic shard corresponding to the corresponding reference shard, and the receiver determines the arithmetic form of the shard obtained by multiplying the corresponding selected bit on each bit of the local reference shard as the arithmetic shard corresponding to the corresponding reference shard.

[0064] In this way, the Boolean shared shard has n bits, and n OT protocols need to be executed, and the communication amount is n(n+1) / 2 bits offline and 2n bits online.

[0065] According to another possible design, since the integer part of the inverse of the power of 2 in fixed-point numbers or floating-point numbers is still the power of 2, considering the particularity of the power of 2, the B2A protocol with less communication amount can be employed to determine the arithmetic sharing form of the inverse of the power of 2.

[0066] First, the principle of sharing form conversion based on the particularity of the power of 2 is described. For a data u = 2 t , the first party, the second party forms a Boolean sharing form, and the two Boolean shared shards are denoted as u L and u R , and the two Boolean shards u L , u R are both n-bit strings, and each bit takes a value of 0 or 1. Since u is 1 in only one bit and 0 in the rest, only one bit of u L , u R is different. For example, u = 0010 (at this time t = 1), and u L , u R only have the second bit from the last digit different.

[0067] Thus, for n bits, the set (u0 L , u1L …u t L …u n-1 L ) represents the first reference slice u L , and n bits can be represented by the set (u0 R , u1 R …u t R …u n-1 R ) of u R , the tth bit is the bits different between x t L and x t R , other bits are the same, but the two participants do not know which bit is different from the local Boolean slice. Further, if the two Boolean shared slices are regarded as binary number representation, then a single Boolean slice can correspond to a number value in any radix, such as octal, decimal, hexadecimal, etc. For example, 1011 can correspond to the decimal number value 11 = 1 x 2 0 + 1 x 2 1 + 0 x 2 2 + 1 x 2 3 . The respective corresponding number values of the two Boolean slices are:

[0068] y L = u0 L x 2 0 + u1 L x 2 1 …u t L x 2 t …u n-1 L x 2 n-1 ;

[0069] y R = u0 R x 2 0 + u1 R x 2 1 …u t R x 2 t …u n-1 R x 2 n-1 .

[0070] Then, y L - y R = u t L x 2 t - u t R x 2 t=(u t L -u t R )×2 t =±2 t Both parties adjust y. L y R The symbol, such as y L and -y R , or -y L and y R This makes the preceding sign positive (i.e., determines y). L -y R absolute value |y L -y R |), and modulo 2 using the adjusted value. n Then, we can obtain the sum and shared shards of u in the two participating parties.

[0071] However, neither of the two participants can know which participant needs to adjust the sign of the value locally. If y is determined through a secure comparison... L and y R The size of might reveal the possible values ​​of t. For example, if the comparison result is y... L Less than y R Then, it can be determined that t is one of the bits with a value of 0 in the Boolean partition of the first party, or one of the bits with a value of 1 in the Boolean partition of the second party. Therefore, based on a certain number (less than n) of assumptions, one party may deduce the data privacy of the other party. Thus, to protect data privacy, this specification is based on the aforementioned y L -y R =±2 t The principle is to split the bits of Boolean segments and introduce calculations of even powers (such as squares), thereby protecting data privacy and solving the inability to convert caused by the sign problem.

[0072] Taking the introduction of square calculation as an example, both the first and second sides can split the local first and second reference segments into odd-numbered bits and even-numbered bits respectively. Therefore, the binary number formed by the even-numbered bits in the first side can, for example, correspond to the reference value: y L1 =u0 L ×2 0 / 2 +u2 L ×2 2 / 2 ...u n-2 L ×2 (n-2) / 2 A binary number consisting of an odd number of bits, for example, corresponds to the reference value: y L2 =u1 L ×2 0 / 2 +u3 L ×2 2 / 2…u n-1 L x2 (n-2) / 2 . Similarly, the binary number composed of even bits of the second party can correspond to the reference value y R1 = u0 R x2 0 / 2 + u2 R x2 2 / 2 …u n-2 R x2 (n-2) / 2 ; and the binary number composed of odd bits of the second party can correspond to the reference value y R2 = u1 R x2 0 / 2 + u3 R x2 2 / 2 …u n-1 R x2 (n-2) / 2 .

[0073] According to the binary number representation rule, the value corresponding to the even bits is the value of the bits in the Boolean slice of the target data, and the value of the bits in the Boolean slice of the target data can be obtained by squaring each addend. The value corresponding to the odd bits is the value of the bits in the Boolean slice of the target data multiplied by 2, and the value of the bits in the Boolean slice of the target data can be obtained by squaring each addend and then multiplying by 2.

[0074] Thus, 2 t = |y L -y R | = (y L1 -y R1 ) 2 + 2 (y L2 -y R2 ) 2 . In this way, the first party and the second party can perform secure computation by using y L1 , -y R1 , y L2 , -y R2 , and (y L1 -y R1 ) 2 + 2 (y L2 -y R2 ) 2 , to obtain the first arithmetic slice and the second arithmetic slice of the inverse of the power of 2, respectively.

[0075] Since y L1 -y R1 and y L2 -y R2There is only one non-zero value, so further we have: where (y L1 -y R1 ) can be called even parameter difference, (y L2 -y R2 ) can be called odd parameter difference, can be called balance coefficient, can be called balance difference of odd bits, can be called parity item comprehensive difference. Both of the two calculation methods can convert the difference of data on the first party and the second party into square form, thereby solving the sign problem involved in the foregoing.

[0076] In some optional implementations, according to |y L -y R | = (y L1 -y R1 ) 2 + 2 (y L2 -y R2 ) 2 , it can be calculated via two secure square protocols or converted into secure multiplication.

[0077] Specifically, in one embodiment, y L1 , -y R1 can be regarded as y L1 -y R1 in the form of modulo 2 n to constitute two arithmetic sharing fragments in the form of arithmetic sharing between the first party and the second party, y L2 , -y R2 can be regarded as y L2 -y R2 in the form of modulo 2 n to constitute two arithmetic sharing fragments in the form of arithmetic sharing between the first party and the second party, and two secure square protocols are respectively executed, to obtain square value (y L1 -y R1 ) 2 and square value (y L2 -y R2 ) 2 in the form of arithmetic sharing on the first party and the second party respectively. Then, the first party calculates the polynomial sum of the two square values, and the sum coefficients of even bits and odd bits are 1 and 2 respectively, that is, [(y L1 -y R1 ) 2 ] L + 2 [(y L2 -y R2 ) 2 ] LThe second side calculates the polynomial sum of the second squared pieces of the two squared values, i.e., [(y L2 -y R2 ) 2 ] R +2[(y L2 -y R2 ) 2 ] R This yields the arithmetic sharing form of the inverse of a power of 2. The communication volume at this point is the same as that of the quadratic secure protocol.

[0078] In another embodiment, (y) can also be utilized L1 -y R1 ) 2 +2(y L2 -y R2 ) 2 =y L1 2 +y R1 2 -2 y L1 ×y R1 +2y L2 2 +2y R2 2 -4y L2 ×y R2 The first party calculates the two square values ​​y corresponding to the even-numbered bits and the odd-numbered bits locally. L1 2 2y L2 2 The second party calculates the y values ​​corresponding to even bits and odd bits locally. R1 2 2y R2 2 The first and second parties perform safe multiplication calculations y. L1 ×(-y R1 ), y L2 ×(-y R2 The first and second sides each yield two multiplicative integral slices. Then, the first side uses the two squared values ​​corresponding to the two locally calculated first reference values ​​to perform a polynomial summation with the two first multiplicative integral slices, such as y... L1 2 +2y L2 2 +2[-y L1 ×y R1 ] L +4[-y L2 ×y R2 ] LSimilarly, the second party performs polynomial summation of the two second reference values corresponding to the two square values calculated locally by the second party and the two second product slices, i.e., y R1 2 + 2y R2 2 + [-2y L1 × y R1 ] R + [-4y L2 × y R2 ] R At this time, the communication amount is twice the communication amount of the secure multiplication calculation.

[0079] In another embodiment, according to The first party can calculate one slice of the odd item balance difference locally The second party calculates another slice of the odd item balance difference locally Then, the secure square protocol is calculated (w0+w1) 2 The first party and the second party obtain two arithmetic sharing slices of the secure square protocol result, i.e., two sum sharing slices of the inverse of the power of 2 converted from the Boolean sharing to the arithmetic sharing. At this time, the communication amount is once the communication amount of the secure square protocol.

[0080] Where, since is an infinitesimal, an approximate value can be taken for calculation, for example, 1.414 is taken Therefore, the converted calculation result can be considered as an approximate calculation of the inverse of the power of 2. In the business processing process, if the calculation result of the inverse of the power of 2 is not very accurate and does not affect the business processing result, the technical solution provided by the implementation manner can be used. Alternatively, in the process of calculating or , the approximate value (such as 1.414) of can be multiplied by y L2 or -y R2 , and then an integer is taken according to the agreed manner (such as rounding), as the integer part of the inverse of the power of 2 represented by the fixed-point number or the floating-point number. At this time, the decimal places of the multiplication result are consistent with the decimal places of y L2 , -y R2 . On the other hand, alternatively, the can be represented by a fixed-point number, and the integer part of the fixed-point number is multiplied by the integer part of y L2 , -y R2 and is taken modulo 2 n . At this time, the decimal places of the multiplication result are the sum of the decimal places of and the decimal places of y L2 , -y R2 .

[0081] Figure 2 A communication diagram of secure multiplication of one specific example is shown.

[0082] As shown in Figure 2 , in the process of secure multiplication of the data a held by the first party and the data b held by the second party, the random number s, p, and the two shards z1, z2 stored in the form of arithmetic sharing of sp=z can be generated by a trusted third party (such as a pseudo-random number generation server in Figure 2 ). The third party can generate various auxiliary parameters according to the constraint sp=z0+z1. The first party can obtain s and z1 from the trusted third party or generate them locally, and the second party can obtain one of z1 and z2 from the trusted third party and obtain the other from the third party or generate it locally. For example, s and z1 are generated by the first party in a pseudo-random number manner consistent with the trusted third party, p is generated by the second party in a pseudo-random number manner consistent with the trusted third party, and z2 is obtained by the second party from the trusted third party, so that the offline communication volume can be only the communication volume of one data shard (such as z1).

[0083] where s and p can be regarded as perturbation terms for a and b respectively, and e and f represent the perturbation results after adding noise to a and b respectively. Then the first party calculates the perturbation result e=a-s and sends it to the second party, and the second party calculates the perturbation result f=b-p and sends it to the first party. At this time, the online communication volume generated is the bit number (such as 2n) of two data shards. Further, the first party can calculate one sum sharing shard c0=sf+z0 of a×b, and the second party can calculate the other sum sharing shard c1=ep+z1 of a×b. Substituting the expressions of e and f, we have: c0+c1=uf+z0+eb+z1=ub-uv+z0+ab-ub+z1=ab. That is, c0 and c1 constitute the sum sharing form of the product of a and b.

[0084] Figure 3 A communication diagram of a secure square protocol of one specific example is shown. Figure 3 The calculation principle of the secure square protocol shown is as follows: for a data x, in the case of introducing perturbation a, there is: x 2 =(x-a) 2 +2(x-a)a+a 2 . Assuming that the data x is in the form of sum sharing between the first party and the second party, the first party holds the first shard x0, and the second party holds the second shard x1. Let x-a be the perturbation value dx, and let the constant term a 2 =b be regarded as a balancing term to eliminate perturbation, then the trusted third party (such as Figure 3The diagram shows a random number generator (a server) generating fragments a0, a1, b0, and b1 for each of the numbers a and b. a0 and b0 are provided to the first party, and a1 and b1 are provided to the second party. Here, a0, a1, b0, and b1 can be generated according to the constraint (a0 + a1). 2 = (b0 + b1), where three of these are randomly generated, and the fourth is calculated from the other three. For example, the first party generates random numbers a0 and b0, the second party generates random number a1, and a trusted third party generates random numbers a0, b0, and a1, calculates b1, and provides it to the second party. In this way, offline communication can be limited to the communication of a single data fragment (such as b1).

[0085] Then, the first party can calculate one fragment of the perturbation value dx, dx0 = x0 - a0, and provide it to the second party. Similarly, the second party can calculate another fragment of the perturbation value dx, dx1 = x1 - a1, and provide it to the first party. Thus, both the first and second parties can each calculate the perturbation value dx = dx0 + dx1. In this case, the generated online traffic is the number of bits for two data fragments (e.g., 2^n). In practice, one party can also calculate one fragment of the perturbation value dx and provide it to the other party, while the other party calculates the other fragment of dx locally and provides the resulting perturbation value dx to the other party. In this method, the generated data traffic is the number of bits for one data fragment and the traffic for one data dx, consistent with the number of bits for two data fragments.

[0086] Furthermore, both the first and second parties calculate x locally. 2 The corresponding fragments. For example... Figure 3 As shown, in a specific example, the first party can compute a fragment s0 = (x 2 0 = (xa) 2 +2(xa)a0+(a 2 )0=dx×dx+2dx×a0+b0, the second side can be used to calculate another piece s1=(x 2 )1=2(xa)a1+(a 2 )1=2dx×a1+b1. In practice, the first and second parties can also use local data to calculate the corresponding fragments in other ways, such as the second party calculating s1=dx×dx+2dx×a1+b1, the first party calculating s0=2dx×a0+b0, etc., which are not limited here.

[0087] from Figure 2 and Figure 3It can be seen that in both a single secure multiplication and a single secure square calculation, the communication volume generated is n bits of offline communication and 2n bits of online communication. Compared with conventional conversion methods, the B2A shared form conversion method for secure multiplication or secure square calculation significantly reduces the communication volume, thereby improving business processing efficiency.

[0088] It is worth noting that the second-party execution process and the first-party execution process cooperate with each other, as described in the preceding principle description, and Figure 2 The operations performed by the second party involved in the description of the illustrated process also apply. Figure 3 The illustrated process will not be repeated here. It is understood that "first party" and "second party" are used only to distinguish the two participants in the secure computation. The terms "first" and "second" in the above names, such as first reference value, second reference value, first Boolean fragment, second Boolean fragment, first product, second product, etc., are all qualifiers added to the descriptions corresponding to the respective participants. In other words, these "first" and "second" qualifiers describe the correspondence with the corresponding participants. In practice, the operations performed by the first party and the second party can be interchanged, while maintaining the correspondence described above. That is, the "first" and "second" in the names can also be interchanged for correspondence, but this specification does not impose any restrictions on this.

[0089] In more possible designs, the first party can also execute other secure B2A protocols with the second party, converting the inverse of a power of 2 into an arithmetic shared form using the Boolean shared form consisting of the first reference slice and the second reference slice. For example, splitting the n bits in the Boolean slice into m groups (m is an even number) of binary numbers, constructing secure square calculations corresponding to the m reference values, and so on, will not be elaborated here.

[0090] It is understood that the above process only describes the conversion process of the shared form of the integer part in fixed-point or floating-point form. In practice, the embodiments described above can also be applied to other related calculation processes in cases where data is represented by binary integers and decimal point positions / decimal places, which will not be elaborated here. Among them, the fragmentation in the arithmetic shared form of the inverse of powers of 2 can be stored in fixed-point or floating-point form, or it can be converted into arithmetic form (such as decimal values) for storage, which is not limited here.

[0091] In addition, in the multi-party secure computation process of more than 2 participants in a possible design, in order to facilitate the arithmetic inverse, the Boolean slices of one or more participants can be sequentially XORed to belong to one participant, and finally the power of 2 is constituted in the form of Boolean sharing distributed in 2 participants. In this way, the arithmetic inverse of the target data can be performed by 2 participants without revealing the target data. The arithmetic sharing slices obtained after conversion in the 2 participants can be randomly split and distributed to other participants, so that the inverse of the power of 2 is constituted and shared in multiple participants.

[0092] In view of the above process, the technical concept provided by the present specification is that in the process of performing arithmetic inverse on the power of 2 in the form of Boolean sharing constituted by two data parties, the characteristics of the power of 2 and the Boolean sharing, and the corresponding relationship between the power of 2 and the inverse of the power of 2 based on the decimal point are utilized, the inverse of the power of 2 in the form of Boolean sharing is determined by reversing the bit values in the Boolean slice and considering the change of the number of decimal places. Then, the two parties perform the secure B2A protocol to obtain the arithmetic sharing form of the inverse of the power of 2. In this way, the complex calculation of using the GMW circuit to inverse the data can be avoided, thereby greatly reducing the data communication amount, providing a more efficient arithmetic inverse method for the power of 2, and improving the business processing efficiency of secure computation.

[0093] According to another aspect, an apparatus for inverting the power of 2 in multi-party secure computation of a computing party is also provided. Figure 4 An apparatus 400 for inverting the power of 2 in multi-party secure computation according to an embodiment is shown. The apparatus 400 can be provided in any of the participants in the multi-party secure computation.

[0094] In two-party secure computation, the target data is in the form of Boolean sharing constituted by the first Boolean slice and the second Boolean slice of n bits corresponding to the first party and the second party respectively. The apparatus 400 is used for arithmetic inverse of the power of 2.

[0095] As shown in Figure 4 The apparatus 400 provided in the first party of the multiple participants includes:

[0096] The inverse unit 401 is configured to determine, for the first Boolean slice held, a first reference slice corresponding to the first Boolean slice based on the reverse arrangement of the numerical values of each bit, and the first reference slice and the second reference slice determined by the second party based on the reverse arrangement of the numerical values of each bit of the second Boolean slice constitute the Boolean sharing form of the inverse of the power of 2.

[0097] The conversion unit 402 is configured to convert the inverse of the power of 2 from the Boolean sharing form into the arithmetic sharing form by the first reference share, and perform the secure B2A protocol with the second party to obtain the first arithmetic share of the inverse of the power of 2.

[0098] It is worth mentioning that, Figure 4 The apparatus 400 shown is configured to perform the method described, Figure 1 The method described corresponds to, Figure 1 The corresponding description in the method embodiments also applies to the apparatus 400, which will not be repeated here.

[0099] According to an embodiment of another aspect, a computer readable storage medium is also provided, which stores a computer program. When the computer program is executed in a computer, the computer is caused to perform the method described in combination with Figure 1 and the like.

[0100] According to an embodiment of still another aspect, a computing device is also provided, which includes a memory and a processor. The memory stores executable code, and the processor executes the executable code to implement the method described in combination with Figure 1 and the like.

[0101] Those skilled in the art should be aware that, in one or more examples described above, the functions described in the embodiments of the present specification can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, these functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0102] The above detailed description of the specific implementation is further detailed for the purpose, technical solutions and beneficial effects of the technical concept of the present specification. It should be understood that the above is only a specific implementation of the technical concept of the present specification, and is not used to limit the protection scope of the technical concept of the present specification. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the embodiments of the present specification shall be included in the protection scope of the technical concept of the present specification.

Claims

1. A method for inverting a power of 2 in secure multi-party computation, for determining an arithmetic share of an inverse of the power of 2 based on a Boolean share of the power of 2 held by two parties including a first party and a second party, the Boolean share being represented by n bits, the method being performed by the first party and comprising: determining, for the first Boolean share held, a first reference share corresponding to the first Boolean share based on a reverse order of values of respective bits, the first reference share and a second reference share held by the second party forming a Boolean share of the inverse of the power of 2, the second reference share being determined based on a reverse order of values of respective bits of a second Boolean share held by the second party; and converting the inverse of the power of 2 from the Boolean share to an arithmetic share by performing a secure B2A protocol with the second party using the first reference share, thereby obtaining a first arithmetic share of the inverse of the power of 2. The lowest bit of the first Boolean share is the 0th bit and corresponds to a fractional digit f;The reverse order of values of respective bits is performed in one of the following ways: The lowest bit to the highest bit is converted in order to the highest bit to the lowest bit, and the number of fractional digits after conversion is n-f-1; 2. The method of claim 1, wherein, Each bit is mirrored and flipped with the fractional point position between the f-1th bit and the fth bit as an axis, and the number of fractional digits after flipping is n-f-1; Each bit is mirrored and flipped with the fth bit as an axis, and the number of fractional digits after flipping is n-f. The conversion of the inverse of the power of 2 from the Boolean share to the arithmetic share by performing the secure B2A protocol with the second party using the first reference share, thereby obtaining the first arithmetic share of the inverse of the power of 2, comprises: Based on the execution result of the oblivious transfer protocol, the first arithmetic share corresponding to the first reference share is determined as the first arithmetic share of the inverse of the power of 2.

3. The method of claim 1, wherein, 4.The method of claim 3, wherein: For each bit in the first reference slice, an oblivious transfer protocol is performed with the corresponding bit in the second reference slice obtained by the second party, respectively, wherein the oblivious transfer protocol performed for a single bit i is that one of the first party and the second party as a sender sends two strings s i0 and s i1 to the other party as a receiver, such that they respectively represent 0 and 1 using the value of the single bit i, and the other party selects one of the two strings s i0 and s i1 as a selected bit based on the corresponding bit locally. In the case that the first party is a sender, the first arithmetic share corresponding to the first reference share is an arithmetic form of the first reference share; In the case that the first party is a receiver, the first arithmetic share corresponding to the first reference share is an arithmetic form of a share obtained by multiplying corresponding selection bits on respective bits of the first reference share. The conversion of the inverse of the power of 2 from the Boolean share to the arithmetic share by performing the secure B2A protocol with the second party using the first reference share, thereby obtaining the first arithmetic share of the inverse of the power of 2, comprises: Two first reference values corresponding to odd bits and even bits respectively are determined, and a single first reference value is determined by a binary number formed by respective bit values on the corresponding odd bits or even bits; 5. The method of claim 1, wherein, Based on the two first reference values, a secure computation is performed with the second party, thereby obtaining the first arithmetic share of the inverse of the power of 2, wherein in the performed secure computation, the second party provides two second reference values corresponding to odd bits and even bits of the second Boolean share respectively. 6.The method of claim 5, wherein, ​ ​ In the case where a single first reference value corresponds to a binary number consisting of odd bits or even bits in the first Boolean slice, a single second reference value corresponds to the opposite of the binary number consisting of odd bits or even bits in the second Boolean slice modulo 2 n the result of n In the case where a single first reference value corresponds to a binary number consisting of odd bits or even bits in the first Boolean slice, a single second reference value corresponds to the opposite of the binary number consisting of odd bits or even bits in the second Boolean slice modulo 2 n the result of n In the case where a single first reference value corresponds to a binary number consisting of odd bits or even bits in the first Boolean slice, a single second reference value corresponds to In the case where a single first reference value corresponds to the binary number of odd bits or even bits in the first Boolean slice, the opposite number modulo 2 n In the case where a single second reference value corresponds to the binary number of odd bits or even bits in the second Boolean slice, the result modulo 2 n In the case where a single second reference value corresponds to the binary number of odd bits or even bits in the second Boolean slice, the result modulo 2 7. The method of claim 6, wherein, The first arithmetic share of the inverse of the power of 2 is obtained by performing secure computation with the second party based on the two first reference values, and the first arithmetic share of the inverse of the power of 2 comprises: a first product of the square root of 2 and a first reference value corresponding to an odd bit is calculated locally, and the first product and a second product calculated locally by the second party constitute a sum sharing form of an odd item balance difference, wherein the second product corresponds to a product of the square root of 2 and a second reference value corresponding to an odd bit in a second Boolean share; a sum of the first product and a first reference value corresponding to an even bit is calculated, thereby obtaining a first comprehensive share of an odd-even item comprehensive difference, and the odd-even item comprehensive difference is a sum of balance differences between respective first reference values and corresponding second reference values; a square value of the odd-even item comprehensive difference is calculated by performing a secure square protocol with the second party using the first comprehensive share, thereby obtaining a first share of the square value, as the first arithmetic share of the inverse of the power of 2, wherein the odd-even item comprehensive difference constitutes a sum sharing form through the first comprehensive share and a second comprehensive share of the second party, and the second comprehensive share is determined by a sum of a second reference value corresponding to an even bit in the second Boolean share and the second product.

8. The method of claim 6, wherein, The first arithmetic share of the inverse of the power of 2 is obtained by performing secure computation with the second party based on the two first reference values, and the first arithmetic share of the inverse of the power of 2 comprises: two first reference values are each multiplied with a second reference value corresponding to the second party to obtain two first product shares corresponding to two products respectively, and a single first product share and a single second product share obtained by the second party constitute a sum sharing form of the corresponding product; a polynomial sum of two square values corresponding to the two first reference values respectively calculated locally is performed with the two first product shares, thereby obtaining the first arithmetic share of the inverse of the power of 2, wherein a sum coefficient of a single first product share term corresponding to an even bit is 2, and a sum coefficient of a single first product share term corresponding to an odd bit is 4.

9. The method of claim 6, wherein, The first Boolean share is obtained by performing an exclusive OR operation on respective Boolean shares on a plurality of participants other than the second party in sequence. The first arithmetic share of the inverse of the power of 2 is obtained by performing secure computation with the second party based on the two first reference values, and the first arithmetic share of the inverse of the power of 2 comprises: two first reference values are each multiplied with a second reference value corresponding to the second party to obtain two first product shares corresponding to two products respectively, and a single first product share and a single second product share obtained by the second party constitute a sum sharing form of the corresponding product; 10. The method of claim 1, wherein, a polynomial sum of two square values corresponding to the two first reference values respectively calculated locally is performed with the two first product shares, thereby obtaining the first arithmetic share of the inverse of the power of 2, wherein a sum coefficient of a single first product share term corresponding to an even bit is 2, and a sum coefficient of a single first product share term corresponding to an odd bit is 4. The first Boolean share is obtained by performing an exclusive OR operation on respective Boolean shares on a plurality of participants other than the second party in sequence.

11. An apparatus for inverting a power of two in secure multi-party computation, configured to determine an arithmetic share of an inverse of a power of two based on a Boolean share of the power of two held by two parties including a first party and a second party, each holding a first Boolean share and a second Boolean share of the power of two in fixed-point number form represented by n bits, the apparatus being located at the first party and comprising: an inversion unit configured to determine, for the first Boolean share held, a first reference share corresponding to the first Boolean share based on reversing the order of the values of the bits, the first reference share and a second reference share held by the second party forming a Boolean share of the inverse of the power of two, the second reference share being determined based on reversing the order of the values of the bits of the second Boolean share; a conversion unit configured to convert the inverse of the power of two from the Boolean share to an arithmetic share by performing a secure B2A protocol with the second party using the first reference share, thereby obtaining a first arithmetic share of the inverse of the power of two.

12. A computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any one of claims 1-10.

13. A computing device comprising a memory and a processor, wherein: The memory has stored thereon executable code which, when executed by the processor, implements the method of any one of claims 1-10. The memory has stored thereon executable code which, when executed by the processor, implements the method of any one of claims 1-10.

Images