Method and system for two-party secure computation

Abstract

The embodiment of the present specification provides a two-party secure computing method and system. In the two-party secure computing method, a first party sends a computing request to a second party. The second party generates a Boolean circuit and a corresponding garbled table for computing two data, the Boolean circuit including L first input lines and L second input lines, wherein the L first input lines correspond to first data. The second party obtains n second data corresponding to n identifiers, and determines n string groups corresponding to the n second data according to a label string of the L second input lines. The second party encrypts the n string groups by using a target OT protocol of n-of-1, and sends the n encrypted results and the garbled table to the first party. The first party decrypts the n encrypted results by using the target OT protocol, and obtains a target string group corresponding to second data corresponding to a target identifier. The first party decrypts the garbled table by using the target string group, and obtains a computing result of the second data corresponding to the target identifier and the first data.

Description

Technical Field

[0001] This specification relates to the field of security technology, and more particularly to a method and system for two-party secure computation. Background Technology

[0002] Secure Multi-Party Computation (MPC) allows multiple data owners to collaborate on computations without trusting each other, outputting results while ensuring that no party receives any information other than the computational results they are entitled to. In other words, MPC can extract the value of data without revealing the original data content.

[0003] MPC can be implemented based on Garbled Circuits (GC). GC is a two-party secure multi-party computation protocol that uses cryptographic functions to generate a garbling table for a Boolean circuit implementing a computation function, computes the result from the inputs of both parties, and ensures that one party's input is not leaked to the other during the computation process. In traditional GC schemes, the participants in secure multi-party computation need to perform complex interactions, which leads to excessively high network costs for GC schemes, severely limiting the widespread application of MPC. Summary of the Invention

[0004] This specification describes one or more embodiments of a method and system for secure two-party computation, enabling secure computation of data between two parties through fewer rounds of communication.

[0005] Firstly, a method for secure two-party computation is provided, including:

[0006] A first party sends a computation request to a second party, which includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; the first party holds first data corresponding to the target identifier;

[0007] The second party generates a Boolean circuit for performing calculations on the two data points, and generates a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points;

[0008] The second party obtains n second data corresponding to the n identifiers, and determines n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data;

[0009] The second party encrypts the n string groups using the n-choose-1 target OT protocol and sends the n encryption results and the obfuscation table to the first party;

[0010] The first party uses the target OT protocol to decrypt the n encryption results to obtain the target string group corresponding to the second data corresponding to the target identifier;

[0011] The first party at least uses the target string group to decrypt the obfuscation table, and determines the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

[0012] Secondly, a method for secure two-party computation is provided, including:

[0013] Receive a computation request from a first party; this request includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; the first party holds first data corresponding to the target identifier;

[0014] Generate a Boolean circuit for performing calculations on two data points, and generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points;

[0015] Obtain the n second data corresponding to the n identifiers, and determine the n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data;

[0016] The n string groups are encrypted using the target OT protocol (select one out of n), and the n encrypted results and the obfuscation table are sent to the first party so that the first party can decrypt the n encrypted results and the obfuscation table using the target OT protocol to obtain the calculation result of the second data corresponding to the target identifier and the first data.

[0017] Thirdly, a system for secure two-party computation is provided, including:

[0018] A first party is used to send a computation request to a second party; this includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; the first party holds first data corresponding to the target identifier;

[0019] The second party is used to generate a Boolean circuit for performing calculations on two data points, and to generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points;

[0020] The second party is further configured to obtain n second data corresponding to the n identifiers, and determine n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data;

[0021] The second party is further configured to encrypt the n string groups using an n-choose-1 target OT protocol, and send the obtained n encryption results and the obfuscation table to the first party;

[0022] The first party is further configured to decrypt the n encrypted results using the target OT protocol to obtain the target string group corresponding to the second data corresponding to the target identifier;

[0023] The first party is further configured to at least decrypt the obfuscation table using the target string group, and to determine the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

[0024] Fourthly, a device for secure two-party computation is provided, comprising:

[0025] A receiving unit is configured to receive a computation request from a first party; this request includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; the first party holds first data corresponding to the target identifier;

[0026] A generation unit is used to generate a Boolean circuit for performing calculations on two data points, and to generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points;

[0027] The acquisition unit is used to acquire n second data corresponding to the n identifiers, and determine n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data.

[0028] The sending unit is configured to encrypt the n string groups using a target OT protocol with n-choose-1, and send the obtained n encryption results and the obfuscation table to the first party, so that the first party can decrypt the n encryption results and the obfuscation table using the target OT protocol to obtain the calculation result of the second data corresponding to the target identifier and the first data.

[0029] Fifthly, a computer storage medium is provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform the methods of the first and second aspects.

[0030] In a sixth aspect, a computing device is provided, including a memory and a processor, wherein executable code is stored in the memory, and the processor executes the executable code to implement the methods of the first and second aspects.

[0031] The method and system for secure two-party computation provided in one or more embodiments of this specification enable anonymous computation by sending n identifiers simultaneously from the first party to the second party. This means the second party cannot know not only the first party's data but also which data from the first party intends to be computed with, further ensuring data security. Furthermore, the second party generates only two computation circuits for the data, but simultaneously sends n string groups corresponding to the n data to be computed and an obfuscation table to the first party. The first party selects one string group based on an n-to-1 target OT protocol and decrypts the obfuscation table. This combines the n-to-1 target OT protocol with the obfuscation circuit, thereby reducing the number of communication rounds between the two parties. Therefore, this solution can perform secure computation on data from both parties while reducing the number of communication rounds, thus reducing network communication costs. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1a This diagram illustrates a 1-out-of-2 type OT protocol.

[0034] Figure 1b This diagram illustrates a 1-out-of-n type OT protocol.

[0035] Figure 2 A schematic diagram of the ROT protocol is shown;

[0036] Figure 3 This is a schematic diagram illustrating an implementation scenario provided by one embodiment of this specification;

[0037] Figure 4 This diagram illustrates an interaction method for two-party secure computation according to one embodiment.

[0038] Figure 5 This diagram illustrates a local selection label update method according to one embodiment.

[0039] Figure 6 A schematic diagram of a system for two-party secure computation according to one embodiment is shown;

[0040] Figure 7 A schematic diagram of an apparatus for two-party secure computation according to one embodiment is shown. Detailed Implementation

[0041] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0042] Before describing the solutions provided in the embodiments of this specification, the inventive concept of this solution will be explained as follows.

[0043] First, to further enhance the privacy protection of the first party (also known as the data requester), the inventors of this application propose that the first party simultaneously send n identifiers to the second party. These n identifiers include a target identifier and n-1 obfuscation identifiers. This prevents the second party (also known as the data holder) from knowing the data requested for computation by the first party. After the computation is completed, the first party can only obtain the computation result corresponding to the data with the target identifier, and cannot obtain the computation results corresponding to the data with the other identifiers.

[0044] Furthermore, to address the issue of excessively high network costs in traditional GC schemes, the inventors of this application propose combining an n-choose-1 target OT protocol with obfuscation circuits to achieve secure computation on data from both parties. The target OT protocol here specifically refers to the Random OT protocol (ROT), a type of OT protocol. It is called a random OT protocol because it incorporates random numbers. The OT protocol will be explained below.

[0045] OT (Oblivious Transfer) protocol is a fundamental technology for secure multi-party computation and is a two-party protocol. Specifically, it is the interaction protocol between the receiver and the sender. Because OT protocol can guarantee the security of data between the two parties, it is widely used in various fields.

[0046] According to their functions, OT protocols can be divided into two types: 1-out-of-2 and 1-out-of-n. Figure 1a This diagram illustrates a 1-out-of-2 type OT protocol. Figure 1b This diagram illustrates a 1-out-of-n type OT protocol.

[0047] Figure 1a In this protocol, the Receiver's input is a selection bit c ∈ {0,1}, and the Sender's input is a pair of messages (M0, M1), where M0 and M1 are the plaintext messages to be sent (e.g., 128-bit strings). Through the OT protocol, the Receiver can ultimately obtain Mc.

[0048] Obviously, the following two aspects of security can be satisfied through the OT protocol: (1) the confidentiality of the receiver's selected bit c, that is, through the OT protocol, the sender cannot know which message the receiver has selected. (2) the confidentiality of the message not selected by the sender, that is, through the OT protocol, the receiver can only obtain one message Mc from (M0, M1) and cannot obtain information about the other message.

[0049] exist Figure 1b In a 1-out-of-n type OT protocol, the Receiver can obtain one message Mc from the Sender's message tuple (M1, M2, ..., Mn) based on its own selection c ∈ {1, 2, ..., n}, but cannot know the information of the other n-1 messages. The Sender cannot know which message the Receiver has selected, that is, it cannot know the information of the Receiver's selection c.

[0050] The ROT protocol will be explained below.

[0051] Figure 2 A schematic diagram of the ROT protocol is shown. Figure 2 In this process, the Sender first holds 'a' and 'A', where A = aG. Here, G, also called the base point, is selected from an elliptic curve and agreed upon by both parties. 'a' is a random number, and a ∈ Zp. The Sender then sends A to the Receiver. After the Receiver caches A, both parties can generate their respective OT tags through interaction.

[0052] Specifically, the Receiver first selects a random number b, b∈Zp, calculates B=bG+cA, and calculates the target label keyc=H(bA). Here, H() is a hash function agreed upon by both parties. Then, the Receiver sends B to the Sender. Finally, the Sender performs n iterations of calculation based on B, obtaining n labels {key0, key1, …, keyn-1}. Any m-th label is: keym=H(aB-maA).

[0053] A simple derivation shows that the target tag `keyc` always matches the tag value with index `c` in the set {key0, key1, ..., keyn-1}. For example, when `c = 0`, `keyc = key0`, and when `c = 1`, `keyc = key1`. Furthermore, the sender cannot know the receiver's choice of `c`; the receiver only receives one tag `keyc` from the sender's set of tags, thus satisfying the OT protocol. Therefore, the target tag calculated by the receiver can also be called the target OT tag, and the n tags calculated by the sender can also be called the n OT tags. Together, they constitute a set of ROT tags.

[0054] It should be noted that the ROT protocol can be executed repeatedly between the Sender and Receiver. In each execution, A remains the same, but the value of the random number b can be different. Thus, the Receiver can generate several different target tags, and the Sender can obtain several sets of OT tags, each set including n OT tags.

[0055] The combination of the n-to-1 target OT protocol and obfuscation circuitry described in this specification can specifically include: the Garbler of the GC (i.e., the second party) acts as the sender of the OT protocol, generating a set of OT tags. Based on the n OT tags in this set, the Garbler encrypts the n string groups corresponding to the n second data obtained by the Evaluator of the GC (i.e., the first party). Then, the first party uses this as a target OT tag generated by the receiver of the OT protocol to decrypt the encrypted n string groups, obtaining the target string group. Each selected string in this target string group is used as a label string corresponding to the L input lines of the data to be computed, and this is used to decrypt the obfuscation table generated by the second party corresponding to the two data computation circuits. Since in this method, the first party does not need to separately execute the OT protocol with the second party to select the data to be computed, the number of communication rounds between the two parties can be reduced, thereby reducing communication costs.

[0056] The above is the inventive concept of the solution provided in the embodiments of this specification. The solution will be described in detail below.

[0057] Figure 3 This is a schematic diagram illustrating an implementation scenario provided for one embodiment of this specification. Figure 3 In this context, the first and second parties can be any device, platform, server, or device cluster with computing and processing capabilities.

[0058] Specifically, the first party can send a computation request to the second party, which includes n identifiers: ID0, ID1, ..., IDn-1. These n identifiers include the target identifier IDx and n-1 obfuscation identifiers, where x∈{0, 2, ..., n-1}. The first party holds the first data recx. After receiving the computation request, the second party can obtain n second data corresponding to the n identifiers: inf0, inf1, ..., infn-1. A Boolean circuit for computation on the two data sets and its corresponding obfuscation table are generated, along with n string groups that can determine the n second data groups, where any string group i can be represented as Arrayi = {label}. i0 label i1 ,...,label i,L-1}, where L is the number of bits contained in the second data.

[0059] Next, the second party encrypts n string groups using the n-choose-1 target OT protocol and sends the resulting n encryption results and obfuscation table to the first party. The first party decrypts the n encryption results using the target OT protocol to obtain the target string group Arrayx corresponding to the second data corresponding to the target identifier IDx, and uses it to decrypt the obfuscation table. Based on the decryption results, the first party determines the calculation result of the second data infx corresponding to the target identifier IDx and the first data recx.

[0060] The Boolean circuit described in this specification is a collection of logic gates connected by interconnecting lines, capable of performing function calculations on a set of inputs and outputting the result. Logic gates include AND gates, XOR gates, NOT gates, etc., which implement Boolean functions. Generally, a function can be compiled into a set of AND gates, XOR gates, and NOT gates to complete the calculation. In one example, this Boolean circuit can employ a mixed-signal execution method.

[0061] Regarding the XOR gate in Boolean circuits, an optimized implementation can be a free-XOR gate. It's important to note that when this XOR gate is implemented as a free-XOR gate, the Garbler in the garbage collector (GC) does not need to generate a corresponding obfuscation table, thus reducing communication costs between the two parties. However, each line of the free-XOR gate (including input and output lines) must meet the following requirement: the annotation string corresponding to a truth value of 1 for each line is equal to the XOR offset value of the annotation string corresponding to a truth value of 0. In one example, the pre-position of this offset value is 1. Taking the pre-position as the least significant bit as an example, this offset value can be 1001, 0001, or 0101.

[0062] from Figure 3As can be seen, in the calculation scheme provided in the embodiments of this specification, the second party cannot obtain either the first party's first data recx or the second data infx that the first party wants to calculate, thereby further improving data security. Furthermore, the first party also cannot obtain the second data infx that it wants to calculate, but can only obtain the calculation result of the first data recx and the second data infx. Therefore, this scheme can strengthen data privacy protection. Finally, in this scheme, the first and second parties only need to perform one round of communication (i.e., first party -> second party, second party -> first party) to achieve secure calculation of their data, thereby reducing the number of communication rounds between the two parties and thus reducing communication costs.

[0063] Figure 4 This diagram illustrates an interaction method for two-party secure computation according to one embodiment. Figure 4 As shown, the method may include at least the following steps.

[0064] Step 402: The first party sends a calculation request to the second party.

[0065] This calculation request can be used to request comparison operations, summation operations, multiplication operations, or exponentiation operations, etc.

[0066] The above calculation request may include n identifiers: ID0, ID1, ..., IDn-1. These n identifiers include the target identifier IDx and n-1 obfuscation identifiers. Where x∈{0, 1, ..., n-1}.

[0067] The sequential numbers corresponding to the above n identifiers are: 0, 1, ..., n-1, etc.

[0068] In addition, the above calculation request may also include a first base value S. x This first base value is determined based on the sequential number x of the target identifier IDx and a conventional random number. For example, it could be based on... Figure 2 The formula for calculating B is used to obtain S. x =s x G+xA, where s x s is the selected random number. x Let G be a base point pre-agreed upon by the first and second parties, x be the sequential number of the target identifier ID x among n identifiers, and A be a random number agreed upon by both parties, where A = aG. This random number can be obtained by the first party from a local file or it can be pre-set.

[0069] Of course, in practical applications, the above calculation request may also include L second base values: S1, S2, ..., S LThe L second base values ​​are determined by the first party based at least on the L bits of the first data it holds. In one example, this L bits could be obtained by the first party with the minimum computational precision. For instance, assuming a precision of 10, recx / 2 could be calculated first. 10 Then, round the result up, and then take L bits in little-endian order to obtain an L-bit binary number, represented as: p1, p2, ..., p L .

[0070] In one example, the i-th second base value S i It can be determined based on the i-th binary digit of the first data and a conventional random number. For example, it can be based on... Figure 2 The formula for calculating B is used to obtain S. i =s i G+p i A, where s i s is the random number selected when calculating the i-th second base value. i ∈Zp, G is the pre-agreed base point between the first and second parties, p i Let A be the i-th binary number of the first data, and let A be a random number agreed upon by both parties, and A = aG.

[0071] Step 404: The second party generates a Boolean circuit for calculating the two data points and generates a corresponding confusion table.

[0072] In one example, the generated Boolean circuit includes L first input lines and L second input lines, where the L first input lines correspond to the first data held by the first party. In other words, the L first input lines are used to input the L-bit binary number of the first data. That is, one of the two data values ​​calculated by the Boolean circuit is the first data value.

[0073] It should be understood that the above can be used to generate corresponding obfuscation tables for all or some gates in a Boolean circuit. In one example, each line in the Boolean circuit (including L first input lines, L second input lines, and output lines) can be labeled first. Then, for each gate for which an obfuscation table needs to be generated, a corresponding truth table can be generated first. Then, the label string of each line can be used to replace the real value in the truth table. After two symmetric encryptions and out-of-order obfuscations, the corresponding obfuscation table is obtained.

[0074] The following explains the labeling method for each line in a Boolean circuit:

[0075] First, regarding the L second input lines and output lines mentioned above, any known annotation method can be used for annotation. It should be understood that when the XOR gate in the Boolean circuit is implemented as a free-XOR gate, the annotation string corresponding to the truth value 1 of each line is required to be equal to the XOR offset value of the annotation string corresponding to its truth value 0.

[0076] Secondly, regarding the aforementioned L first input lines, in one embodiment, the second party can annotate them using any existing annotation method, thereby enabling the first party to obtain the annotation string corresponding to the truth value of the L first input lines held by the first party by executing the OT protocol with the second party.

[0077] In another embodiment, OT tags that satisfy the ROT protocol can also be used for labeling to reduce the number of communication rounds between the two parties. Specifically, the second party can generate L pairs of OT tags based on L second base values. Based on the L pairs of OT tags, the label strings for the L first input lines are determined.

[0078] Specifically, the process of generating the L-pair OT tags can be as follows: First, a first tag is determined based on the i-th base value and using a hash function agreed upon with the first party. Second, a second tag is determined based on the difference between the i-th base value and an agreed-upon random number, using the agreed-upon hash function. The first and second tags constitute the i-th pair of OT tags. Similarly, other pairs of OT tags can be generated.

[0079] In one example, the formula for generating the first label can be: L0 i =H(aS) i The formula for generating the second tag can be: L1 i =H(aS) i -aA). Where a is a random number pre-selected by the second party, satisfying the following condition: A = aG. Here, A (the agreed-upon random number between the two parties), G (the agreed-upon base point between the two parties, selected from an elliptic curve), and S... i The definition of (the i-th second basic value) can be the same as described above.

[0080] It should be understood that L0 here i and L1 i The calculation formula is actually Figure 2 The formula for calculating keym, i.e., L0 i For the case where m = 0, L1 i This is the case where m = 1.

[0081] It should be noted that, during or before the second party generates L pairs of OT tags, the first party can use an agreed hash function to generate L second selection tags associated with L second base values, where the i-th second selection tag is one of the tags contained in the i-th pair of OT tags.

[0082] In one example, the formula for generating the i-th second choice label can be: Li = H(s) i A), where s i A is the random number selected by the first party when calculating the i-th second base value, and A is the agreed-upon random number between the two parties. It should be understood that the formula for calculating Li here is actually... Figure 2 The formula for calculating keyc.

[0083] It should be understood that, based on Figure 2 The formula for calculating keym is used to calculate L0. i and L1 i And when calculating Li based on the keyc calculation formula, it can be ensured that in p i When = 0, Li = L0 i , and p i When = 1, Li = L1 i .

[0084] After obtaining the L pairs of OT tags, the first tag in the i-th pair of OT tags (i.e., L0) can be... i ), as the label string corresponding to the truth value 0 of the i-th first input line. The second label (i.e., L1) in the i-th pair of OT labels. i This is the label string corresponding to the truth value 1 of the i-th first input line. Similarly, the two label strings for each of the other first input lines can be determined.

[0085] It should be understood that when determining the annotation strings for the L first input lines in this way, the second party needs to generate a corresponding obfuscation table for the XOR gate, but does not need to send the corresponding annotation strings to the first party for the L first input lines. That is, it does not need to perform L separate 2-to-1 OT protocols with the first party to determine the annotation strings corresponding to the truth values ​​of the L first input lines held by the first party. The reasons are as follows:

[0086] First, p is given above. i When = 0, Li = L0 i , where p i =0 indicates that the first party holds the truth value 0 for the i-th first input line, L0 i This is the annotation string used by the second party to annotate the truth value 0 of the i-th first input line, and since Li = L0 i Therefore, the i-th second selection label held by the first party is the label string that the second party annotates for the truth value 0 of the i-th first input line, so the second party does not need to send L0 to the first party. i .

[0087] Secondly, p is given above i When = 1, Li = L1 i, where p i =1 indicates that the first party holds the truth value 1 for the i-th first input line, L1 i This is the annotation string used by the second party to annotate the truth value 1 of the i-th first input line, and since Li = L1 i Therefore, the i-th second selection label held by the first party is the label string that the second party annotates for the truth value 1 of the i-th first input line, so the second party does not need to send L1 to the first party. i .

[0088] In summary, in this other embodiment, the i-th second selection label is always the label string corresponding to the truth value of the i-th first input line held by the first party.

[0089] In another embodiment, after obtaining the L pairs of OT tags according to the calculation method of the other embodiment described above, the label string corresponding to the L first input lines is determined through the following steps:

[0090] First, perform an XOR operation between the first tag in the i-th pair of OT tags and the offset value to obtain the third tag. Then, use the first tag in the i-th pair of OT tags as the annotation string corresponding to the truth value 0 of the i-th first input line. Finally, use the calculated third tag as the annotation string corresponding to the truth value 1 of the i-th first input line.

[0091] It should be understood that when determining the annotation strings of the L first input lines through the above embodiment, the second party does not need to generate a corresponding obfuscation table for the XOR gate. The reason is that the annotation string corresponding to the truth value 1 of the i-th first input line is equal to the XOR offset value of the annotation string corresponding to its truth value 0. That is, it satisfies the requirements of the free-XOR gate for the input lines.

[0092] However, in another embodiment, it is necessary to update the L second selection labels of the first party. For example, when the i-th second selection label is the second label in the i-th pair of OT labels, the i-th second selection label needs to be updated to the third label to ensure that the i-th second selection label is always the label string corresponding to the truth value of the i-th first input line held by the first party. The specific update method will be explained later.

[0093] At this point, the second party has completed the labeling of each line in the Boolean circuit.

[0094] Step 406: The second party obtains the n second data corresponding to the n identifiers, and determines the n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of the binary number of each of the n second data.

[0095] Here, for each of the n second data, we can round and truncate it to the minimum precision of calculation to obtain the L-bit binary number of each of the n second data.

[0096] In one example, determining the n string groups corresponding to the n second data can include: for any second data, if the i-th binary number is 0, then the label string of the true value 0 of the i-th second input line is taken as the i-th selected string; if the i-th binary number is 1, then the label string of the true value 1 of the i-th second input line is taken as the i-th selected string, and the L selected strings corresponding to the L binary numbers of any second data form its corresponding string group.

[0097] It should be noted that the string group corresponding to any of the above-mentioned second data can be understood as the combination formed by the actual label strings of the L second input lines corresponding to that second data. Alternatively, it can be understood as the combination formed by the actual label strings of the L second input lines when the L-ary number of any second data is input into the L second input lines.

[0098] It should be understood that since the second party does not know which of the n second data points the first party wants to calculate with, the second party forms n string groups for each of the n second data points.

[0099] Step 408: The second party encrypts n groups of strings using the n-choose-1 target OT protocol and sends the resulting n encryption results and obfuscation table to the first party.

[0100] In one embodiment, the target OT protocol is a traditional OT protocol, so the second party can use any known OT tag generation method to generate n OT tags, and use the n OT tags to encrypt n string groups to obtain the above n encryption results.

[0101] In another embodiment, the target OT protocol is the ROT protocol, and the second party can base its calculation on the first base value S in the request. x Generate n OT tags corresponding to n identifiers, and use these n OT tags to encrypt n string groups to obtain n encryption results.

[0102] The generation of n OT tags corresponding to n identifiers can include iteratively performing n rounds of tag generation corresponding to the n identifiers. Each j-th round of tag generation includes taking the difference between the product of a first base value and the sequential number of the j-th identifier and a pre-agreed random number, and determining the OT tag generated in this round based on the difference using a hash function agreed upon with the first party.

[0103] In one implementation, the above tag generation formula can be expressed as: Lj = H(aS) x -jaA), where j is the sequential number of the j-th identifier, j∈{0,1,…,n-1}. a is a random number pre-selected by the second party, which satisfies the following condition: A=aG. Here, A (the random number agreed upon by both parties), G (the base point agreed upon by both parties, selected from an elliptic curve) and S x This is the first base value.

[0104] After the above n rounds of iterations, n OT tags can be obtained.

[0105] It should be understood that the formula for calculating Lj here is actually... Figure 2 The formula for calculating keym.

[0106] It should be noted that, during or before the second party generates n OT tags corresponding to n identifiers, the first party may use an agreed hash function to generate a first selection tag associated with a first base value. This first selection tag is one of the n OT tags.

[0107] The formula for generating the first selection tag mentioned above can be: Lx = H(s) x A), where s x Calculate the aforementioned first base value S for the first party. x The random number selected at that time, A is the random number agreed upon by both parties. It should be understood that the formula for calculating Lx here is actually... Figure 2 The formula for calculating keyc.

[0108] It should be understood that, based on Figure 2 When calculating Lj using the formula based on keym, and Lx using the formula based on keyc, it can be ensured that Lx = L0 when x = 0, and Lx = L1 when x = 1, and so on. Therefore, the first party can use Lx to decrypt the target string group encrypted using the same tag among n OT tags.

[0109] It should also be noted that when the label strings of the L first input lines of the Boolean circuit are determined based on the first and third tags mentioned above, that is, based on another embodiment in step 404 above, the second party can also send L encrypted strings of the L first input lines at the same time as sending the obfuscation table to the first party, so that the first party can update the L second selection tags according to the L encrypted strings. The encrypted string of any i-th first input line is obtained by XORing the first tag, the second tag, and the offset value in the i-th pair of OT tags.

[0110] The process of the first party updating the L second-selection tags can be specifically described as follows:

[0111] For the i-th second selection label, if its associated i-th second base value is determined based on the binary number 0, that is, the true value of the i-th first input line held by the first party is 0, then the first party uses the i-th second selection label as the updated i-th second selection label. Otherwise, if the true value of the i-th first input line held by the first party is 1, then the first party performs an XOR operation on the i-th second selection label and the i-th encrypted string, and uses the XOR result as the updated i-th second selection label.

[0112] The following is passed Figure 5 This will explain the correctness of the above update method.

[0113] Figure 5 A schematic diagram of a local selection label update method according to one embodiment is shown. Figure 5 In this scenario, assume the Garbler (the second party) has generated a pair of OT labels: L0 and L1, and the Evaluator (the first party) has generated a local selection label Lc, with choice c. When c = 0, Lc = L0; when c = 1, Lc = L1. Furthermore, assume the Garbler sets the input line k0 of the Evaluator to L0 and k1 to L0^R, where R is the offset value. Setting k0 to L0 means setting the label string corresponding to the truth value 0 of the Evaluator's input line to L0, and setting k1 to L0^R means setting the label string corresponding to the truth value 1 of the Evaluator's input line to L0^R. Then, the Garbler can send the ciphertext y = L0^L1^R to the Evaluator. Afterwards, if the Evaluator holds the truth value 0 for the aforementioned input line (i.e., input == 0), it will use Lc as the label string it obtains for that input line, i.e., k = Lc. If the Evaluator holds a true value of 1 for the above input line, that is, input == 1, then Lc^y will be used as the label string it obtains for that input line, i.e., k = Lc^y.

[0114] Of course, the above method for updating the local selection label (i.e., the second selection label) has a prerequisite: the Evaluator has the same truth value for the input line as selection c, that is, input = c. If this condition is met, then when input == 0, c = 0, and thus k = L0. When input == 1, c = 1, and thus k = L1^y = L1^L0^L1^R = L0^R. In other words, based on the ciphertext y, the Evaluator can always obtain the string annotated by the Garbler for the input value held by the Evaluator.

[0115] Back Figure 4 middle, Figure 4It may also include the following steps:

[0116] Step 410: The first party uses the target OT protocol to decrypt n encrypted results to obtain the target string group corresponding to the second data of the target identifier.

[0117] The decryption of the aforementioned n encryption results may include: the first party using a first selection tag generated in association with the first base value to decrypt the n encryption results and obtain the target string group. The method by which the first party obtains the target string group is described above and will not be repeated here.

[0118] It should be understood that each selected string in the above target string group is the second data selected by the first party (i.e., the second data corresponding to the target identifier) ​​corresponding to the L actual label strings of the L second input lines. When the first party decrypts the obfuscation table based on the first data and the L second selected labels, it can obtain the calculation result of the first data and the second data corresponding to the target identifier based on the decryption result.

[0119] The above method of using L second-choice tags to decrypt the obfuscation table is because these L second-choice tags are used as the actual annotation strings for the L first input lines. Of course, if the first party updates the L second-choice tags, the obfuscation table can be decrypted based on the updated L second-choice tags.

[0120] Step 412: The first party at least decrypts the obfuscation table using the target string group, and determines the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

[0121] The decryption result may include the target string of the output line of the Boolean circuit calculated by the first party.

[0122] In one example, when the Boolean circuit is implemented as a half-gates circuit (with the following characteristics: the label string corresponding to the truth value 1 of each line is equal to the XOR offset value of the label string corresponding to its truth value 0), the calculation results of the second data and the first data corresponding to the target identifier mentioned above include:

[0123] The first party uses the least significant bit of the target string as the first result segment sbx of the calculation result, and performs an XOR operation between the first result segment sbx and the second result segment pbx of the calculation result received from the second party to obtain the above calculation result. Here, the second result segment pbx is the least significant bit of the annotation string marked by the second party for the truth value 0 of the output line.

[0124] In this case, the second result fragment pbx is sent by the second party to the first party along with the obfuscation table.

[0125] In another example, the first party can also send the calculated target string to the second party, which will then translate it into the corresponding calculation result and provide it to the first party.

[0126] This concludes the description of the method for secure computation between the two parties.

[0127] In summary, the two-party secure computation method provided in this specification allows the first party to simultaneously send n identifiers to the second party, enabling anonymous data computation. This means the second party cannot know not only the first party's data but also which data the first party intends to compute with, further ensuring data security. Furthermore, the second party generates only two data computation circuits but simultaneously sends n string groups corresponding to the n data to be computed and an obfuscation table to the first party. The first party then selects one string group based on the n-to-1 target OT protocol and decrypts the obfuscation table. This combines the n-to-1 target OT protocol with the obfuscation circuit, thereby reducing the number of communication rounds between the two parties.

[0128] Finally, in this scheme, the first party and the second party only need to communicate in one round (i.e., first party -> second party, second party -> first party) to achieve secure computation of data between the two parties. Thus, this scheme can perform secure computation of data between the two parties while reducing the number of communication rounds, which means that this scheme can reduce the cost of network communication.

[0129] Corresponding to the above-described method for secure two-party computation, one embodiment of this specification also provides a system for secure two-party computation, such as... Figure 6 As shown, the system may include:

[0130] The first party 602 is configured to send a computation request to the second party 604, which includes n identifiers, including a target identifier and n-1 obfuscation identifiers. The first party 602 holds first data corresponding to the target identifier.

[0131] The second party 604 is used to generate a Boolean circuit for calculating two data points and to generate a corresponding confusion table. The Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points.

[0132] The second party 604 is also used to obtain n second data corresponding to n identifiers, and to determine n string groups corresponding to the n second data based on the label strings of L second input lines and the L-bit binary numbers of each of the n second data.

[0133] Specifically, the second-party 604 is used for:

[0134] For any second data, depending on whether its i-th binary number is 0 or 1, the label string corresponding to the true value 0 or true value 1 of the i-th second input line is taken as the i-th selected string, and the L selected strings corresponding to the L-bit binary number of any second data form its corresponding string group.

[0135] The second party 604 is also used to encrypt n groups of strings using the n-choose-1 target OT protocol, and send the obtained n encryption results and obfuscation table to the first party 602.

[0136] The first party 602 is also used to decrypt n encrypted results using the target OT protocol to obtain the target string group corresponding to the second data of the target identifier.

[0137] The first party 602 is also used to decrypt the obfuscation table using at least the target string group, and to determine the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

[0138] The decryption results mentioned above include the target string of the Boolean circuit output line calculated by the first party 602;

[0139] First-party 602 is specifically used for:

[0140] The least significant bit of the target string is used as the first result fragment of the calculation result, and the first result fragment is XORed with the second result fragment of the calculation result received from the second party 604 to obtain the calculation result.

[0141] The second result slice is the least significant bit of the label string corresponding to the true value 0 of the output line.

[0142] In some embodiments, the above calculation request further includes a first base value, which is determined based on the sequential number of the target identifier and a conventional random number;

[0143] The second-party 604 is also specifically used for:

[0144] Based on the first base value, n OT tags corresponding to n identifiers are generated, and these n OT tags are used to encrypt n string groups to obtain n encryption results;

[0145] The first-party 602 is also specifically used for:

[0146] Using a first selection tag generated in association with the first base value, decrypt n encrypted results to obtain the target string group, where the first selection tag is one of the n OT tags.

[0147] In some embodiments, the second party 604 is further specifically used for:

[0148] Iteratively execute n rounds of tag generation corresponding to n identifiers. Each j-th round of tag generation includes: taking the difference between the product of the first base value and the sequential number of the j-th identifier and a pre-agreed random number; and determining the generated OT tag for this round based on the difference using a hash function agreed upon with the first party 602.

[0149] The first-party 602 is also specifically used for:

[0150] Based on the first base value, the first selection label is determined using a hash function.

[0151] In some embodiments, the above calculation request further includes L second base values, which are determined at least based on the L bits of the first data; the second party 604 is further specifically used for:

[0152] Based on L second base values, generate L pairs of OT labels, and determine the label strings for L first input lines based on the L pairs of OT labels;

[0153] The first-party 602 is also specifically used for:

[0154] L second selection tags are generated in association with L second base values ​​to decrypt the obfuscation table, wherein the i-th second selection tag is one of the tags contained in the i-th pair of OT tags.

[0155] In some embodiments, the i-th second base value among the L second base values ​​is determined based on the i-th binary number of the first data and a conventional random number;

[0156] The second-party 604 is also specifically used for:

[0157] The first tag is determined based on the i-th base value and using the hash function agreed upon with the first party 602;

[0158] The second label is determined based on the difference between the i-th base value and the agreed random number, and using a hash function; the first label and the second label constitute the i-th pair of OT labels.

[0159] In some embodiments, any i-th pair of OT tags includes a first tag and a second tag;

[0160] The second-party 604 is also specifically used for:

[0161] Use the first label as the label string corresponding to the truth value 0 of the i-th first input line;

[0162] The second label is used as the label string corresponding to the truth value 1 of the i-th first input line.

[0163] The functions of each functional module of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.

[0164] This specification provides a system for secure two-party computation in one embodiment, which can perform secure computation on data from both parties while reducing the number of communication rounds.

[0165] Corresponding to the above-described two-party secure computation method, one embodiment of this specification also provides a two-party secure computation apparatus, disposed on the second party. For example... Figure 7 As shown, the device may include:

[0166] The receiving unit 702 is configured to receive a computation request from the first party, which includes n identifiers, including a target identifier and n-1 obfuscation identifiers. The first party holds first data corresponding to the target identifier.

[0167] The generation unit 704 is used to generate a Boolean circuit for calculating two data points and to generate a corresponding confusion table. The Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points.

[0168] The acquisition unit 706 is used to acquire n second data corresponding to n identifiers, and determine n string groups corresponding to the n second data based on the label strings of L second input lines and the L-bit binary numbers of each of the n second data.

[0169] The sending unit 708 is used to encrypt n groups of strings using the n-choose-1 target OT protocol, and send the obtained n encryption results and obfuscation table to the first party, so that the first party can decrypt the n encryption results and the obfuscation table using the target OT protocol to obtain the calculation result of the second data and the first data corresponding to the target identifier.

[0170] This specification provides an embodiment of a two-party secure computation apparatus that can perform secure computation on data from both parties while reducing the number of communication rounds.

[0171] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 4 The method described.

[0172] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 4 The method described.

[0173] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0174] The steps of the methods or algorithms described in conjunction with the disclosure in this specification can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, external hard disk, CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a server. Of course, the processor and storage medium can also exist as discrete components in the server.

[0175] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0176] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0177] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this specification. It should be understood that the above description is only a specific embodiment of this specification and is not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this specification should be included within the scope of protection of this specification.

Claims

1. A method for two-party secure computation, comprising: The first party sends a computation request to the second party; This includes n identifiers; the n identifiers include the target identifier and n-1 obfuscation identifiers; The first party holds the first data corresponding to the target identifier; The second party generates a Boolean circuit for performing calculations on the two data points, and generates a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points; The second party obtains n second data corresponding to the n identifiers, and determines n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data; The second party encrypts the n string groups using the n-choose-1 target OT protocol and sends the n encryption results and the obfuscation table to the first party; The first party uses the target OT protocol to decrypt the n encryption results to obtain the target string group corresponding to the second data corresponding to the target identifier; The first party at least uses the target string group to decrypt the obfuscation table, and determines the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

2. The method according to claim 1, wherein, Determining the n string groups corresponding to the n second data includes: For any second data, based on whether its i-th binary number is 0 or 1, the label string corresponding to the true value 0 or true value 1 of the i-th second input line is taken as the i-th selected string; the L selected strings corresponding to the L-bit binary number of any second data form its corresponding string group.

3. The method according to claim 1, wherein, The calculation request also includes a first base value, which is determined based on the sequential number of the target identifier and a conventional random number; The second party encrypts the n string groups using an n-choose-1 target OT protocol, including: The second party generates n OT tags corresponding to the n identifiers based on the first base value, and uses the n OT tags to encrypt the n string groups to obtain the n encryption results; The first party decrypts the n encrypted results using the target OT protocol, including: The first party uses a first selection tag generated in association with the first base value to decrypt the n encryption results to obtain the target string group; the first selection tag is one of the n OT tags.

4. The method according to claim 3, wherein, The generation of n OT tags corresponding to the n identifiers includes: Iteratively execute n rounds of tag generation corresponding to the n identifiers; wherein, any j-th round of tag generation includes taking the difference between the product of the first base value and the sequential number of the j-th identifier and the agreed random number, and determining the OT tag generated in this round based on the difference using a hash function agreed with the first party; The method further includes: The first party determines the first selection label based on the first base value and using the hash function.

5. The method according to claim 1, wherein, The calculation request further includes L second base values; the L second base values ​​are determined based at least on the L bits of the first data; generating the corresponding obfuscation table includes: Based on the L second base values, generate L pairs of OT labels; determine the label strings for the L first input lines according to the L pairs of OT labels; The method further includes: The first party generates L second selection tags in association with the L second base values ​​to decrypt the obfuscation table; wherein the i-th second selection tag is one of the tags contained in the i-th pair of OT tags.

6. The method according to claim 5, wherein, The i-th second base value among the L second base values ​​is determined based on the i-th binary number of the first data and a conventional random number; The generation of L-to-OT tags includes: Based on the i-th base value and using the hash function agreed upon with the first party, determine the first tag; Based on the difference between the i-th base value and the agreed random number, and using the hash function, the second label is determined; the first label and the second label constitute the i-th pair of OT labels.

7. The method according to claim 5, wherein, Any i-th pair of OT tags includes the first tag and the second tag; The determination of the label string for the L first input lines includes: Use the first label as the label string corresponding to the truth value 0 of the i-th first input line; The second label is used as the annotation string corresponding to the truth value 1 of the i-th first input line.

8. The method according to claim 1, wherein, The decryption result includes the target string of the output line of the Boolean circuit calculated by the first party; The step of determining the calculation result of the second data corresponding to the target identifier and the first data includes: The first party takes the least bit of the target string as the first result fragment of the calculation result, and performs an XOR operation on the first result fragment and the second result fragment of the calculation result received from the second party to obtain the calculation result; The second result segment is the least significant bit of the label string corresponding to the true value 0 of the output line.

9. A method for two-party secure computation, performed by a second party, comprising: Receive a computation request from a first party; this request includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; The first party holds the first data corresponding to the target identifier; Generate a Boolean circuit for performing calculations on two data points, and generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points; Obtain the n second data corresponding to the n identifiers, and determine the n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data; The n string groups are encrypted using the target OT protocol (select one out of n), and the n encrypted results and the obfuscation table are sent to the first party so that the first party can decrypt the n encrypted results and the obfuscation table using the target OT protocol to obtain the calculation result of the second data corresponding to the target identifier and the first data.

10. A system for secure two-party computation, comprising: The first party is used to send a computation request to the second party; it includes n identifiers; the n identifiers include a target identifier and n-1 obfuscation identifiers; The first party holds the first data corresponding to the target identifier; The second party is used to generate a Boolean circuit for performing calculations on two data points, and to generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points; The second party is further configured to obtain n second data corresponding to the n identifiers, and determine n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data; The second party is further configured to encrypt the n string groups using an n-choose-1 target OT protocol, and send the obtained n encryption results and the obfuscation table to the first party; The first party is further configured to decrypt the n encrypted results using the target OT protocol to obtain the target string group corresponding to the second data corresponding to the target identifier; The first party is further configured to at least decrypt the obfuscation table using the target string group, and to determine the calculation result of the second data corresponding to the target identifier and the first data based on the decryption result.

11. The system according to claim 10, wherein, The second party is specifically used for: For any second data, based on whether its i-th binary number is 0 or 1, the label string corresponding to the true value 0 or true value 1 of the i-th second input line is taken as the i-th selected string; the L selected strings corresponding to the L-bit binary number of any second data form its corresponding string group.

12. The system according to claim 10, wherein, The calculation request also includes a first base value, which is determined based on the sequential number of the target identifier and a conventional random number; The second party is also specifically used for: Based on the first base value, n OT tags corresponding to the n identifiers are generated, and the n OT tags are used to encrypt the n string groups to obtain the n encryption results; The first party is specifically used for: Using a first selection tag generated in association with the first base value, the n encryption results are decrypted to obtain the target string group; the first selection tag is one of the n OT tags.

13. The system according to claim 12, wherein, The second party is also specifically used for: Iteratively execute n rounds of tag generation corresponding to the n identifiers; wherein, any j-th round of tag generation includes taking the difference between the product of the first base value and the sequential number of the j-th identifier and the agreed random number, and determining the OT tag generated in this round based on the difference using a hash function agreed with the first party; The first party is also specifically used for: Based on the first base value, the first selection label is determined using the hash function.

14. The system according to claim 10, wherein, The calculation request further includes L second base values; the L second base values ​​are determined based at least on the L bits of the first data; the second method is further specifically used for: Based on the L second base values, generate L pairs of OT labels; determine the label strings for the L first input lines according to the L pairs of OT labels; The first party is also specifically used for: L second selection tags are generated in association with the L second base values ​​for decrypting the obfuscation table; wherein the i-th second selection tag is one of the tags contained in the i-th pair of OT tags.

15. The system according to claim 14, wherein, The i-th second base value among the L second base values ​​is determined based on the i-th binary number of the first data and a conventional random number; The second party is also specifically used for: Based on the i-th base value and using the hash function agreed upon with the first party, determine the first tag; Based on the difference between the i-th base value and the agreed random number, and using the hash function, the second label is determined; the first label and the second label constitute the i-th pair of OT labels.

16. The system according to claim 14, wherein, Any i-th pair of OT tags includes the first tag and the second tag; The second party is also specifically used for: Use the first label as the label string corresponding to the truth value 0 of the i-th first input line; The second label is used as the annotation string corresponding to the truth value 1 of the i-th first input line.

17. The system according to claim 10, wherein, The decryption result includes the target string of the output line of the Boolean circuit calculated by the first party; The first party is also specifically used for: The least significant bit of the target string is used as the first result fragment of the calculation result, and the first result fragment is XORed with the second result fragment of the calculation result received from the second party to obtain the calculation result. The second result segment is the least significant bit of the label string corresponding to the true value 0 of the output line.

18. A two-party secure computing device, disposed on a second party, comprising: A receiving unit is configured to receive a computation request from a first party; this request includes n identifiers, wherein the n identifiers include a target identifier and n-1 obfuscation identifiers. The first party holds the first data corresponding to the target identifier; A generation unit is used to generate a Boolean circuit for performing calculations on two data points, and to generate a corresponding confusion table; the Boolean circuit includes L first input lines and L second input lines, wherein the L first input lines correspond to the first data points; The acquisition unit is used to acquire n second data corresponding to the n identifiers, and determine n string groups corresponding to the n second data based on the label strings of the L second input lines and the L bits of each of the n second data. The sending unit is configured to encrypt the n string groups using a target OT protocol with n-choose-1, and send the obtained n encryption results and the obfuscation table to the first party, so that the first party can decrypt the n encryption results and the obfuscation table using the target OT protocol to obtain the calculation result of the second data corresponding to the target identifier and the first data.

19. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed in the computer, it causes the computer to perform the method of any one of claims 1-9.

20. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-9.

Images