Data processing method, system, device, electronic device and storage medium

Abstract

The present disclosure discloses a data processing method, system, device, electronic device and computer storage medium, which are used to solve the problem that the number of communication rounds required by the secret recovery method using the prior art is relatively high and consumes more processing resources. The method includes: the sender converts the first arithmetic secret slice of the secret owned by the sender into the first symbol position sub-secret slice and the Boolean sub-secret slice; the receiver converts the second arithmetic secret slice of the secret owned by the receiver into the second symbol position sub-secret slice and the second arithmetic sub-secret slice; the helper converts the second arithmetic secret slice of the secret owned by the helper into the second symbol position sub-secret slice and the second arithmetic sub-secret slice; the sender, the receiver and the helper respectively obtain their own symbol position sub-secret slice and the target Boolean sub-secret slice; according to the symbol position sub-secret slice and the target Boolean sub-secret slice obtained by at least one party, the secret is recovered.

Description

Technical Field

[0001] The present disclosure relates to the technical field of cryptography, and in particular to a data processing method, system, device, electronic device, and computer-readable storage medium. Background Art

[0002] At present, privacy computing, also known as privacy-preserving computing, can be divided into the following three main directions:

[0003] The first is privacy computing in which both data and computing are not centralized, also known as secure multi-party computing (MPC). The main technologies include obfuscated circuits, oblivious transfer (OT), and secret sharing (SS).

[0004] The second is privacy computing in which data is not centralized but computing is centralized. The main technologies include data desensitization, differential privacy protection, homomorphic encryption, etc.

[0005] The third is privacy computing in which both data and computing are centralized, with main technologies including trusted execution environment and data sandbox.

[0006] Among the above technical directions, MPC refers to a group of mutually distrustful participants who can perform collaborative computing while protecting personal privacy. It is an important branch of cryptography and has been established since 1982 when Academician Yao Qizhi proposed the famous "millionaire problem". MPC needs to ensure the independence of input data, the accuracy of transmitted data, and the correctness of the calculation process. At the same time, personal privacy data cannot be leaked to other participants. It plays an important role in scenarios such as digital signatures, electronic auctions, and secret sharing.

[0007] An important technology involved in MPC is secret sharing, which splits the secret (taking the millionaire problem as an example, the secret is the comparison result of which of two millionaires is richer). Each secret shard after the split is managed by a different participant. A single participant cannot recover the secret. It requires a certain threshold number of participants to collaborate and merge to recover the secret.

[0008] As for how to recover secrets based on secret fragments distributed among different participants, the current mainstream algorithms include Parallel Prefix Adder, etc. With this adder, if the data held by two or three parties for comparison are all represented in binary, they can all be represented as a l-bit bit string, so the number of communication rounds required to complete secret recovery is log(l)+1, and the communication volume (amount of data transmitted) is 2l﹒log(l)+l. Both the number of communication rounds and the communication volume are relatively high, which requires more processing resources. Summary of the invention

[0009] The disclosed embodiment provides a data processing method to solve the problem that a relatively high number of communication rounds is required to complete secret recovery using the secret recovery method in the prior art, which consumes a large number of processing resources.

[0010] The embodiments of the present disclosure also provide a data processing system, a device, an electronic device, and a computer storage medium.

[0011] The embodiments of the present disclosure adopt the following technical solutions:

[0012] A data processing method, the method comprising:

[0013] The sender converts the first arithmetic secret slice of the secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0014] The receiver converts the second arithmetic secret slice of the secret owned by the receiver into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0015] The helping party converts the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0016] Based on the first symbol bit sub-secret slice, the second symbol bit sub-secret slice and the first zero value slice, the sender, the receiver and the helper perform symbol bit sub-secret sharing in a three-party repeated secret slice sharing manner, so that the sender, the receiver and the helper respectively obtain their own symbol bit secret slices;

[0017] The Boolean sub-secret fragment is used as an input of the sender, and the second arithmetic sub-secret fragment is used as an input of the receiver and the helper respectively. The sender, the receiver and the helper execute an N-choose-1 oblivious transfer protocol, and the receiver obtains a Boolean sub-secret fragment selected from the Boolean sub-secret fragment.

[0018] Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively;

[0019] At least one of the sender, the receiver and the helper recovers the secret according to the symbol bit sub-secret fragment and the target Boolean sub-secret fragment obtained by the at least one party.

[0020] A data processing method, applied to a sender, comprising:

[0021] Converting a first arithmetic secret slice of the secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0022] Based on the first symbol position sub-secret slice and the first zero-value slice, the symbol position sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol position sub-secret slice; the participants include: a sender, a receiver and a helper;

[0023] Taking the Boolean sub-secret fragment as input, sending a Boolean operation result calculated based on the Boolean sub-secret and a random number to a receiver by executing an N-choose-1 oblivious transfer protocol;

[0024] Based on the second zero-valued slice and the Boolean sub-secret slice selected by the receiving party, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0025] The secret is recovered based on the sender's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0026] A data processing method, applied to a receiving party, comprising:

[0027] Converting the second arithmetic secret slice of the secret owned by the receiving party into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0028] Based on the second symbol bit sub-secret slice and the first zero-value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a helper;

[0029] Taking the second arithmetic sub-secret fragment as the input of the receiver, and obtaining the Boolean sub-secret fragment from the sender by executing the N-choose-1 oblivious transfer protocol;

[0030] Based on the second zero-valued slice and the Boolean sub-secret slice from the sender, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0031] The secret is recovered according to the receiver's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0032] A data processing method, applied to a helping party, comprising:

[0033] Converting the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0034] Using the second arithmetic sub-secret fragment as input of the helper, and sending a calculation result based on the second arithmetic sub-secret fragment and the generated random number to the receiver by executing the N-choose-1 oblivious transfer protocol;

[0035] Based on the second symbol bit sub-secret slice and the first zero-value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a helper;

[0036] Based on the second zero-valued slice and the Boolean sub-secret slice from the sender selected by the receiver, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0037] The secret is recovered based on the helper's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0038] A data processing system comprises a sender, a receiver and a helper; wherein:

[0039] A sender, configured to convert a first arithmetic secret slice of a secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0040] A receiver, configured to convert a second arithmetic secret slice of the secret possessed by the receiver into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0041] The helping party is used to convert the second arithmetic secret slice of the secret owned by the helping party into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0042] Sender, Receiver and Helper, also used for:

[0043] Based on the first sign bit sub-secret slice, the second sign bit sub-secret slice and the first zero value slice, the sender, the receiver and the helper perform sign bit sub-secret sharing in a three-party repeated secret slice sharing manner, so that the sender, the receiver and the helper obtain their own sign bit sub-secret slices respectively; using the Boolean sub-secret slice as the input of the sender and the second arithmetic sub-secret slice as the input of the receiver and the helper respectively, the sender, the receiver and the helper execute an N-choose-1 oblivious transfer protocol, and the receiver obtains a Boolean sub-secret slice selected from the Boolean sub-secret slice;

[0044] Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively;

[0045] At least one of the sender, the receiver and the helper recovers the secret according to the symbol bit sub-secret fragment and the target Boolean sub-secret fragment obtained by the at least one party.

[0046] A data processing device, comprising:

[0047] a conversion unit, configured to convert a first arithmetic secret slice of a secret owned by the data processing device into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0048] A first sharing unit is used to share the symbol bit sub-secret with other participants based on the first symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; each participant includes: a first data processing device, a receiving party, and a helping party;

[0049] A sending unit, configured to send a Boolean operation result calculated based on the Boolean sub-secret and a random number to a receiver by executing an N-choose-1 oblivious transfer protocol, taking the Boolean sub-secret fragment as input;

[0050] A second sharing unit is configured to share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner based on the second zero-value slice and the Boolean sub-secret slice selected by the receiving party, so that each participant obtains its own target Boolean sub-secret slice;

[0051] A recovery unit is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the first data processing device itself.

[0052] A data processing device, comprising:

[0053] a conversion unit, configured to convert a second arithmetic secret slice of a secret owned by the data processing device into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0054] A first sharing unit is used to share the symbol bit sub-secret with other participants based on the second symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a second data processing device and a helper;

[0055] A selection unit, configured to obtain a Boolean sub-secret fragment from a sender by using the second arithmetic sub-secret fragment as an input of a receiver and executing an N-choose-1 oblivious transfer protocol;

[0056] a second sharing unit, configured to share the Boolean sub-secret slice with other parties based on the second zero-value slice and the Boolean sub-secret slice from the sender in a three-party repeated secret slice sharing manner, so that each party obtains its own target Boolean sub-secret slice;

[0057] A recovery unit is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the second data processing device itself.

[0058] A data processing device, comprising:

[0059] a conversion unit, configured to convert a second arithmetic secret slice of a secret owned by the data processing device into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0060] a helping unit, configured to use the second arithmetic sub-secret fragment as an input of the helping party, and to send a calculation result based on the second arithmetic sub-secret fragment and the generated random number to a receiving party by executing an N-choose-1 oblivious transfer protocol;

[0061] A first sharing unit is used to share the symbol bit sub-secret with other participants based on the second symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a third data processing device;

[0062] a second sharing unit, configured to share the Boolean sub-secret slice with other parties in a three-party repeated secret slice sharing manner based on the second zero-value slice and the Boolean sub-secret slice from the sender selected by the receiver, so that each party obtains its own target Boolean sub-secret slice;

[0063] A recovery unit is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the third data processing device itself.

[0064] An electronic device comprises: a memory and a processor, wherein:

[0065] The memory is used to store programs;

[0066] The processor is coupled to the memory, and is used to execute the program stored in the memory to perform the method as described above.

[0067] A computer-readable storage medium storing a computer program, wherein the computer program can implement the method described above when executed by a computer.

[0068] At least one of the above technical solutions adopted in the embodiments of the present disclosure can achieve the following beneficial effects:

[0069] The communication complexity of MPC is mainly determined by the number of communication rounds and the amount of communication. The data processing method provided by the embodiment of the present disclosure has a communication round number of log(l / m)+1.

[0070] Compared with the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires fewer communication rounds.

[0071] In addition, the data processing method provided by the embodiment of the present disclosure has a communication volume determined by a three-party N-choose-1 oblivious transfer protocol and a Boolean AND operation, wherein the communication volume of the three-party N-choose-1 oblivious transfer protocol is ( / -1)·(2 m +1)·2+(2 m +1), the communication volume of all Boolean AND operations is ( / -1-log(l / m))·3·2)+log( / )·3. Compared with the communication volume of the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires less communication volume. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0073] Figure 1 A specific implementation flow chart of a data processing method provided in Embodiment 1 of the present disclosure;

[0074] Figure 2 A specific implementation flow chart of a data processing method provided in Embodiment 2 of the present disclosure;

[0075] Figure 3 is a schematic diagram of the structure of the comparison tree used in Embodiment 2 of the present disclosure;

[0076] Figure 4 A specific implementation flow chart of a data processing method provided in Embodiment 3 of the present disclosure;

[0077] Figure 5 A specific implementation flow chart of the second data processing method provided in Embodiment 3 of the present disclosure;

[0078] Figure 6 A specific implementation flow chart of the third data processing method provided in Embodiment 3 of the present disclosure;

[0079] Figure 7 A schematic diagram of the specific structure of the first data processing device provided in Embodiment 4 of the present disclosure;

[0080] Figure 8 A schematic diagram of the specific structure of a second data processing device provided in Embodiment 4 of the present disclosure;

[0081] Fig. 9 A schematic diagram of the specific structure of a third data processing device provided in Embodiment 4 of the present disclosure;

[0082] Fig.10 A schematic diagram of the structure of an electronic device provided in Example 5 of the present disclosure. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure will be clearly and completely described below in combination with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0084] Those skilled in the art may appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0085] The terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable when appropriate, which is merely a way of distinguishing objects of the same attributes when describing the embodiments of the present disclosure. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product, or device that includes a series of units is not necessarily limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0086] Example 1

[0087] In order to solve the problem that a relatively high number of communication rounds is required and a large amount of processing resources are consumed when using the secret recovery method in the prior art to complete secret recovery, the present disclosure provides a data processing method in Embodiment 1.

[0088] For the specific implementation process of this method, please refer to the appendix of the manual. Figure 1 , including the following steps:

[0089] Step 11: The sender converts the first arithmetic secret slice of the secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0090] Step 12: The receiving party and the helping party respectively convert the second arithmetic secret slice of the secret (the receiving party and the helping party respectively possess the second arithmetic secret slice) into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0091] For example, if P0 represents the sender, P1 represents the receiver, and P2 represents the helper. And assuming that before executing step 11, the secret shard of secret t is shared in a three-party repeated secret sharding manner, and the three participants each have a secret shard of secret t. Assume as follows:

[0092] The secret shards owned by P0 are x and z, which can be called arithmetic shard data (x, z), which is equivalent to the first arithmetic secret shard described in step 1;

[0093] The secret shards owned by P1 are y and x, which can be called arithmetic shard data (y, x);

[0094] The secret shards owned by P2 are z and y, which can be called arithmetic shard data (z,y).

[0095] The same secret shard owned by P1 and P2, namely the above-mentioned secret shard y, is equivalent to the second arithmetic secret shard described in step 1.

[0096] The relationships between each of the secret shares x, y, and z and t satisfy: t = (x + y + z) mod 2l. Here, l is the length of the bit string obtained when representing t in binary.

[0097] Based on the above-mentioned secret shares of the secret t respectively held by the three parties, in Embodiment 1 of the present disclosure, the secret to be restored is the sign of t.

[0098] It should be noted that for two numbers to be compared, such as a = a0||a1 and b = b0||b1 (the symbol || represents string concatenation), to determine whether a < b (or a = b, or a > b) holds, it can be transformed into a "segmented discrimination" judgment method, that is, to respectively judge the magnitude relationship between a0 and b0, and the magnitude relationship between a1 and b1. That is to say, the problem of comparing the original bits is now reduced to a sub-problem of shorter bits, which is based on the principle of the "divide and conquer" idea.

[0099] Based on the above idea, the arithmetic share data held by the three parties can also be compared separately. And since the comparison result can only be one of two results, such as a < b (or a = b, or a > b) "holds" or "does not hold", therefore, the size comparison result of the arithmetic share data can be represented by Boolean data.

[0100] Based on the above analysis, in Embodiment 1 of the present disclosure, for the arithmetic share data respectively held by the three parties, the "segmented discrimination" judgment method will be adopted to compare the magnitude relationship between the arithmetic share data held by different parties, and the comparison result will be represented by Boolean data.

[0101] In addition, since the secret to be restored is the sign of t, and the relationships between each of the secret shares x, y, and z and t satisfy: t = (x + y + z) mod 2l, therefore, in the embodiments of the present disclosure, the sign of t to be restored can specifically be the XOR result of three parts of data. These three parts of data are respectively: the sign bit of x + z (the sign bit, that is, the sign bit), the sign bit of y, and the carry bit generated on the sign bit by x + y + z.

[0102] It can be predicted therefrom that if the secret shares x and z held by P0, and the same secret share y held by P1 and P2 are respectively split into the sign bit and other bits (or referred to as other bit positions) except the sign bit, then, corresponding to the above three parts of data, after secret share sharing is performed in the form of three-party replicated secret shares, each of the three parties can have Boolean data in the following form:

[0103] The Boolean share data held by P0 is (δ0, δ2);

[0104] The Boolean share data held by P1 is (δ1, δ0);

[0105] The Boolean shard data owned by P2 is (δ2,δ1).

[0106] In δ0, δ1, δ2, for example:

[0107] δ0 may be Boolean data representing “the sign bit of x+z”;

[0108] δ1 may be Boolean data representing “the sign bit of y”;

[0109] δ2 may be Boolean data indicating “a carry bit on a sign bit generated by x+y+z”.

[0110] Then, there exists MSB(t)=δ0⊕δ1⊕δ2. δ0, δ1, δ2 are all 1 bit.

[0111] Among them, MSB refers to the most significant bit, that is, the most significant bit of the byte. MSB(t) refers to the most significant bit of the binary number used to represent t when t is represented in binary. The most significant bit represents the sign of t, thereby determining whether the sign of t is positive, 0 or negative.

[0112] From the above analysis, we can see that by adopting the above ideas, we can eventually recover the sign of the secret t and achieve the secret recovery goal.

[0113] For the specific implementation process of step 11 and step 12, P0 calculates msb0||u=(x+z)mod 2 based on the arithmetic shard data (x,z) of the secret t it owns. l .

[0114] P1 and P2 calculate msb1||v=ymod 2 based on the arithmetic shard data of the secret t they own l , so that P0 gets msb0 and u, and P1 and P2 get msb1 and v.

[0115] Among them, the operator || represents the concatenation of strings and can be called the cascade symbol.

[0116] P0 calculates (x+z) mod 2 l Then we can get l bits, for example l = 64, then according to msb0||u = (x + z) mod2 l , u is the lower 63 bits of l bits, and msb0 means (x+z) mod 2 l The most significant bit, that is, the high 1 bit in the 1 bits.

[0117] msb0 is the first symbol bit sub-secret slice described in step 11; msb1 is the second symbol bit sub-secret slice described in step 12.

[0118] Furthermore, P0 may obtain the Boolean sub-secret shard described in step 11 based on u in the following manner:

[0119] First, P0 calculates u'=2 based on u l-1 -1-u——In the embodiment of the present disclosure, the reason for calculating u'=2 l-1 -1-u, if adding u and v will produce a carry bit on the sign bit, then the following relationship holds: v+u>2 l-1 -1.

[0120] According to this relationship, we can get v>2 l-1 -1-u. It can be seen that by comparing v and 2 l-1 -1-u can determine whether the carry bit is 0 (indicating no carry) or 1 (indicating a carry). Therefore, in the embodiment of the present disclosure, according to u'=2 l-1 -1-u, calculate u', and then compare the size relationship between u' and v.

[0121] Then, P0 divides u' according to a preset division step (for example, m bits) to obtain multiple data slices of u'. The relationship between these data slices and u' can be expressed as u'||0=u' q-1 ||...||u'0; P1 and P2 respectively divide v according to the preset division step (also m bits) to obtain multiple data slices of v. The relationship between these data slices and v can be expressed as v||0=v q-1 ||...||v0.

[0122] Among them, q=l / m. For the convenience of calculation, a suitable size of m can be selected so that q is a power of 2, for example, q=4 or 8.

[0123] Each data fragment obtained by splitting v||0 (denoted as v j , j=[0,q-1]), which is the second arithmetic sub-secret shard described in step 12.

[0124] The reason why the form of "u'||0" and "v||0" is used is that, as mentioned above, u (or u') and v represent the other bits of x+z and y respectively, excluding the highest "sign bit". Therefore, in the above operation, a lowest bit "0" is spliced ​​to u' and v respectively, so that "u'||0" and "v||0" can be evenly divided into q parts of length m.

[0125] The following describes how to obtain the Boolean sub-secret shard described in step 11, but first an explanation of the oblivious transfer protocol is required.

[0126] The oblivious transfer protocol is a secret protocol that can protect privacy. It allows the sender and receiver to exchange information in an oblivious manner, thereby achieving the purpose of protecting privacy.

[0127] The traditional oblivious transfer protocol is a two-party secure computing protocol. The receiver selects part of the data sent by the sender. The protocol makes the receiver know nothing about the remaining data except the selected data, and the sender has no way of knowing the data selected by the receiver. The types of traditional oblivious transfer protocols can include the following three types:

[0128] 1. 2-choose-1 oblivious transfer protocol: For example, Alice sends two messages to Bob. Bob can know the content of one message without knowing the content of the other message, and Alice does not know which message Bob chooses.

[0129] 2. N-choose-1 oblivious transfer protocol: This protocol is a general extension of the 2-choose-1 oblivious transfer protocol. Using the above example, Bob gets the content of one message from the N messages sent by Alice without knowing the content of other messages, and Alice does not know which message Bob chooses.

[0130] 3. N-choose-Q oblivious transfer protocol: This protocol is a more generalized case of the 2-choose-1 oblivious transfer protocol. Using the above example, Bob gets the contents of Q messages from the N messages sent by Alice without knowing the contents of other messages, and Alice does not know which messages Bob chooses.

[0131] Based on the above-mentioned "2. N-choose-1 oblivious transfer protocol", Embodiment 1 of the present disclosure innovatively proposes a "three-party N-choose-1 oblivious transfer protocol". The three-party N-choose-1 oblivious transfer protocol can be applied to scenarios where the participants include a sender, a receiver, and a helper.

[0132] The three-party N-choose-1 oblivious transfer protocol provided in Embodiment 1 of the present disclosure, for three participants (participants may be, for example, a computing device) participating in secret recovery, namely, a sender, a receiver, and a helper, the data input by each participant and obtained from others are respectively defined as follows:

[0133] 1. The sender's input data is N secret data (m0, m1, ..., m N-1 ); The sender does not obtain data from other places during this oblivious transmission.

[0134] 2. The input data of the receiver is c; the receiver will receive the data sent by the sender and the helper respectively. Among them, c corresponds to m0, m1, ..., m N-1The number of a data in the , which means that the receiver wants to receive N data m0, m1, ..., m from the sender. N-1 The data selected from the c ) number.

[0135] 3. The input data of the helper is the same as the input data of the receiver, which is c. The helper does not obtain data from other parties during this oblivious transfer.

[0136] Based on the three-party N-choose-1 oblivious transfer protocol provided in Embodiment 1 of the present disclosure, the above three parties perform at least the following operations during the secret recovery process:

[0137] 1. The sender generates a set of random numbers by executing the three-party N-choose-1 oblivious transfer protocol, denoted as w=(w0, w1, ..., w N-1 ); Based on the group of random numbers and the sender's input data m0, m1, ..., m N-1 , the sender calculates w0⊕m0,w1⊕m1,...,w N-1 ⊕m N-1 , and send the calculation result to the receiver;

[0138] 2. The helper generates a random number w based on the input data c by executing the N-choose-1 oblivious transfer protocol c ; c Send to the receiver; w c Corresponding to m0,m1,...,m N-1 A certain data (the data can be recorded as m c ) number.

[0139] 3. The receiver receives w0⊕m0, w1⊕m1, ..., w from the sender. N-1 ⊕m N-1 , and receive data w sent from the helper c ; The receiver uses w0⊕m0, w1⊕m1, ..., w N-1 ⊕m N-1 and w c , using w c w sent by the sender c ⊕m c Perform XOR calculation to get m c .

[0140] The mathematical operation symbol ⊕ mentioned above means the exclusive OR operation.

[0141] In the embodiment of the present disclosure, the sender and the helper may pre-agree on the same random number generation method and the same seed for generating random numbers, so that the sender and the helper can generate the same random number w based on the same seed and the same random number generation method. c .

[0142] The specific example given in the embodiment of the present disclosure conforms to the semi-honest adversary model and the honest majority model, and adopts the above-mentioned three-party N-choose-1 oblivious transfer protocol. Therefore, if the security of this specific example is evaluated, it can be known that it meets the following security requirements:

[0143] 1. The sender cannot know which message the receiver has selected;

[0144] 2. The receiver can only obtain m c , can not get other messages;

[0145] 3. The helper cannot obtain the sender's message or the receiver's message.

[0146] Based on the above three-party N-choose-1 oblivious transfer protocol, P0 splits u'||0 into each data fragment (denoted as u' j , j = [0, q-1], u' j It can also be called the first arithmetic secret sub-shard), and performs the following operations:

[0147] First, P0 generates two 1-bit random numbers by executing the three-party N-choose-1 oblivious transfer protocol; according to the first arithmetic secret sub-shard u' j The number j, the two random numbers are recorded as l j and e j , and set and

[0148] Wherein: j represents the number of each first arithmetic secret sub-shard obtained by dividing u', and its value range is [0, q-1]; and They all represent Boolean data of P0 - the superscript B in the brackets <> indicates that the secret sharing method is Boolean sharing, and the subscript 0 indicates that the number of the participant to which the Boolean data belongs is 0.

[0149] In the embodiment 1 of the present disclosure, the reason why "0" is used is that j and e j Constructing Boolean data ( j ,0) and ( j,0), because in Embodiment 1 of the present disclosure, for the secret t, a three - party replicated secret - sharing method is used for secret - sharing. Therefore, the corresponding Boolean data can also be shared using the three - party replicated secret - sharing method. Thus, as described above, Embodiment 1 of the present disclosure is based on l j and e j to construct and such Boolean data that meets the formal requirements of the three - party replicated secret - sharing for secret - sharing.

[0150] Then, for each l j and e j (j = [0, q - 1]), P0 takes values of k in sequence from the range of k [0, M - 1] (where M = 2 m ), and executes the following specified operation in a loop until after executing the corresponding specified operation based on k with the value of M - 1, the loop ends.

[0151] Among them, the specified operation that P0 executes in a loop includes:

[0152] Based on the first arithmetic secret sub - share, calculate the data s j,k and t j,k to be sent according to the following calculation method. s j,k (j = [0, q - 1], k = [0, M - 1]) and t j,k (j = [0, q - 1], k = [0, M - 1]), that is, after P0 executes the three - party N - choose - 1 oblivious transfer protocol, the data to be sent to the receiver is equivalent to w0⊕m0, w1⊕m1,..., w N-1 ⊕m N-1 .

[0153] s j,k = l j ⊕{u’ j <k}

[0154] t j,k = e j ⊕{u’ j = k}

[0155] In the above formula, the symbol {} is a Boolean operator. Specifically: if u’ j <k is true, then {u’ j <k} is 1, otherwise it is 0; similarly, if u’ j = k is true, then {u’ j = k} is 1, otherwise it is 0. u’ j represents u’ obtained by splitting u’||0 q-1,..., u’0, (j = [0, q - 1]).

[0156] {u’ j <k}, {u’ j = k}, which is the Boolean sub - secret shard described in step 11.

[0157] Based on the above to obtain s j,k = l j ⊕ {u’ j <k}, t j,k = e j ⊕ {u’ j = k}, the process can be summarized as: The sender converts the size comparison results of two types (respectively {u’ j <k} and {u’ j = k}) into two groups of Boolean data, which are used as the Boolean sub - secret shards described in step 11.

[0158] Step 13: Based on the first sign - bit sub - secret shard, the second sign - bit sub - secret shard, and the first zero - value shard, the sender, the receiver, and the helper perform sign - bit sub - secret sharing in the way of three - party replicated secret sharing, so that the sender, the receiver, and the helper respectively obtain their own sign - bit sub - secret shards;

[0159] Continuing with the above example, P0, P1, and P2, based on the first sign - bit sub - secret shard msb0 and the second sign - bit sub - secret shard msb1 they respectively own, combined with the zero - value shard, obtain the corresponding sign - bit sub - secret shards according to the form requirements for secret sharing in the way of three - party replicated secret sharing. The specific implementation process is as follows:

[0160] First, the three participants can respectively generate random numbers. Specifically, P0 has random numbers (h0, h2), P1 has (h1, h0), and P2 has (h2, h1), satisfying h0 ⊕ h1 ⊕ h2 = 0. The random numbers h0, h1, and h2 that satisfy the condition h0 ⊕ h1 ⊕ h2 = 0 are the so - called zero - value shards.

[0161] Then, to meet the above form requirements, P0 calculates (Msb0 ⊕ h0, 0 ⊕ h2) for (Msb0, 0) it owns based on (h0, h2); P1 calculates (Msb1 ⊕ h1, 0 ⊕ h0) for (Msb1, 0) it owns based on (h1, h0); P2 calculates (0 ⊕ h2, Msb1 ⊕ h1) for (0, Msb1) it owns based on (h2, h1).

[0162] After that, P0 sends Msb0⊕h0 to P1. Based on the received Msb0⊕h0 and "0⊕h0" calculated by P1, P1 performs the operation of (Msb0⊕h0)⊕(0⊕h0) to obtain Msb0. At this point, (Msb1, 0) owned by P1 can be transformed into (Msb1, Msb0).

[0163] After the above processing, the secret shards of the sign bits owned by each participant are as follows: P0 owns (Msb0, 0); P1 owns (Msb1, Msb0); P2 owns (0, Msb1). Such a form meets the form requirements for secret sharding in the three-party replicated secret sharing method.

[0164] Step 14: Using the Boolean sub-secret shard as the input of the sender, and using the second arithmetic sub-secret shard as the input of the receiver and the helper respectively, the sender, the receiver, and the helper execute the N-out-of-1 oblivious transfer protocol, and the receiver obtains the Boolean sub-secret shard selected from the Boolean sub-secret shards.

[0165] Continuing with the previous example, the sender converts the size comparison results of the two types (which are {u’ j <k} and {u’ j =k}) into two sets of Boolean data s j,k and t j,k , as the aforementioned Boolean sub-secret shards.

[0166] In the example of the embodiment of the present disclosure, s j,k =l j ⊕{u’ j <k} and t j,k =e j ⊕{u’ j =k} are calculated for s j,k and t j,k for the following reasons:

[0167] For example, assume m = 4, then, M = 2 4 , and the value range of k is [0, 15].

[0168] On the one hand, when m = 4, u’ j is a number represented by a binary string of m = 4 bits, that is, u’ j has a total of 16 possible values, which are 0, 1, 2,..., 15.

[0169] On the other hand, when m = 4, for the receiver and the helper, if their input is v j ——v j represents v obtained by splitting v||0 q-1,..., v0 (j = [0, q - 1]) —— Then, v j is also a number represented by a binary string of m = 4 bits, and there are also 16 possible values in total, which are 0, 1, 2,..., 15.

[0170] Comparing with the three - party N - of - 1 oblivious transfer protocol introduced above, taking m = 4 as an example, u’ j has 16 possible values in total, and the corresponding {u’ j <k} and {u’ j = k} correspond to the input data m0, m1,..., m N-1 ; l j and e j are a set of random numbers generated by the sender P0 by executing the three - party N - of - 1 oblivious transfer protocol, corresponding to a set of random numbers w = (w0, w1,..., w N-1 ); s j,k (j = [0, q - 1], k = [0, M - 1]) and t j,k (j = [0, q - 1], k = [0, M - 1]), corresponding to w0⊕m0, w1⊕m1,..., w N-1 ⊕m N-1 .

[0171] For the helper P2, v j is equivalent to the input data c. The helper P2 can generate a random number by executing the three - party N - of - 1 oblivious transfer protocol and send to the receiver P1.

[0172] For the receiver P1, according to s j,k (j = [0, q - 1], k = [0, M - 1]) sent by P0 and w vj sent by P2, s j,vj can be calculated. In an example, if it is assumed that u’ j = k = 7, then obviously, when v j = 7, the s j,vj obtained by the receiver P1 is s j,7 = s j,k = l j ⊕{u’ j <7} —— That is to say, the "comparison result of the magnitudes of u’ j and k" obtained by the receiver P1 is exactly the "comparison result of the magnitudes of u’ j and the number v j=7". The comparison result is the Boolean sub-secret shard selected by P1 from the Boolean sub-secret shards from P0.

[0173] It can be seen that for the sender P0, it can send "u' j The result of the comparison with k is shared with the receiver P1.

[0174] Similarly, for the receiver P1, according to the t sent by P0 j,k (j=[0,q-1],k=[0,M-1]), the receiver P1 can calculate t j,vj .

[0175] Step 15: Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively;

[0176] Continuing with the above example, P1 obtains s j,vj After that, according to s j,vj , according to the form requirements of the secret sharding method for the three-party repeated secret sharing method, the Boolean sub-secret shard of P1 (also called Boolean shard data) can be obtained by setting: P2 then sets the Boolean sub-secret shard of P2:

[0177] Similarly, P1 obtains t j,vj After that, according to t j,vj , according to the form requirements of the secret sharding method for the three-party repeated secret sharing method, the Boolean sub-secret shard of P1 can be obtained by setting: P2 then sets the Boolean sub-secret shard of P2:

[0178] At this point, P0 has a Boolean sub-secret shard (which can be obtained according to l j and e j set up): as well as and

[0179] P1 has a Boolean sub-secret shard: as well as and

[0180] P2 has a Boolean sub-secret shard: as well as and (0,0).

[0181] For example, when l j =0,e j =1, if we assume at this time Thus:

[0182] and

[0183] and

[0184] and

[0185] In the disclosed embodiment, the three parties respectively own (b = 0, 1, 2), and (b=0,1,2), can be processed to meet the form requirements of the three-party repeated secret sharing method for secret sharding, so as to facilitate secret recovery. The specific processing method can be combined with the zero-value shard (herein referred to as the second zero-value shard, which can be the same as or different from the first zero-value shard) as follows:

[0186] by Taking (b=0,1,2) as an example, first, the three participants can generate random numbers respectively, namely: P0 has the random number (h0,h2), P1 has (h1,h0), P2 has (h2,h1), satisfying h0⊕h1⊕h2=0.

[0187] Then, to construct a three-party repeated secret shard that satisfies the above formal requirements, P0 targets Calculate (1⊕h0,0⊕h2); P1 for Calculate (1⊕h1,0⊕h0); P2 for Calculate (0⊕h2,0⊕h1).

[0188] P0 sends 1⊕h0 to P1, and P1 calculates (1⊕h0)⊕0⊕h0 and gets 1, that is, becomes (1,1); P1 sends 1⊕h1 to P2, and P2 calculates (1⊕h1)⊕0⊕h1 and gets 1, that is, becomes (0,1). So far, we get:

[0189] and

[0190] and

[0191] and

[0192] These Boolean sub-secret shards meet the formal requirements for the secret shards in the three-party replicated secret sharding.

[0193] These Boolean sub-secret shards that meet the said formal requirements are the respective target Boolean sub-secret shards of the sender, receiver, and helper described in step 15.

[0194] Step 16: At least one of the sender, receiver, and helper restores the secret according to the sign sub-secret shards and target Boolean sub-secret shards obtained by the at least one party.

[0195] As described above, for a = a0||a1 and b = b0||b1, determining whether a < b (or a = b) holds can be transformed into a "segmented discrimination" method, that is, respectively determining the magnitude relationship between a0 and b0, and determining the magnitude relationship between a1 and b1.

[0196] Thus, for Boolean sharing, the following relational expression holds:

[0197] {a < b} = {a1 < b1} ⊕ ({a1 = b1} ∧ {a0 < b0})

[0198] Based on the above relational expression, if P0, P1, P2 are denoted as P b , b ∈ {0, 1, 2}, then, P b can be calculated to obtain the Boolean operation result in the following manner:

[0199] In the way of successively taking the value of i from the value range of i [0, log2(q)], the following specified operation is cyclically executed until after executing the corresponding said specified operation based on i with the value of log2(q), the loop ends.

[0200] The specified operation includes: for each value of i, in the way of successively taking the value of r from the value range of r [0, (q / 2 i ) - 1], the following operation is cyclically executed until after executing the corresponding following operation based on r with the value of (q / 2 i ) - 1, the loop ends:

[0201] First, P b performs a "Boolean AND" operation on and to obtain Then, P b obtains by the following calculation method based on the calculated

[0202]

[0203] Calculated corresponding to ({a1 = b1} ∧ {a0 < b0}) in the above relationship; corresponding to {a < b} in the above relationship, while corresponds to {a1 < b1} in the above relationship.

[0204] In the embodiments of the present disclosure, P b can further and perform a "Boolean AND" operation to obtain

[0205] P b Through iterative calculation according to the above calculation method, the value of can be finally calculated. This value is a Boolean value, representing the sign of the "carry bit" that may be generated by the addition of u and v described above.

[0206] Based on the sign of the "carry bit", P b can calculate the numerical value representing the sign bit of the secret t in the following manner:

[0207]

[0208] After calculating the numerical value representing the sign bit of the secret t, the purpose of restoring the sign of t is achieved, and the process can end.

[0209] It should be noted that for the above calculation, in combination with the aforementioned step 13, it can be known from step 13 that after the processing of step 13, the situation of the Boolean shard data owned by each participant is: P0 has (Msb0, 0); P1 has (Msb1, Msb0); P2 has (0, Msb1). Thus:

[0210] If calculating Specifically:

[0211] If calculating Specifically:

[0212] If calculating Specifically:

[0213] The following combines the attached drawings of the specification Figure 3 to illustrate the physical meaning of the specific calculation process of step 13.

[0214] The attached drawings of the specification Figure 3 perform a "Boolean AND" operation on level by level and finally calculate to obtain Schematic diagram of the comparison tree structure.

[0215] Corresponding to this comparison tree structure, and the subscript i - 1 in it represents the level of the comparison tree, while 2r and 2r + 1 represent the sequence numbers of the nodes in the current layer.

[0216] For example, when i = 1 and r = 0, for and perform the "Boolean AND" operation, and that is, they respectively correspond to the two nodes x0 and x1 in the bottom layer (the 0th layer) of this comparison tree structure.

[0217] For and perform the "Boolean AND" operation to obtain This corresponds to ({a1 = b1} ∧ {a0 < b0}) in the foregoing relational expression, and can represent the size relationship (or comparison result) of the two nodes x0 and x1. In combination with the embodiments of the present disclosure, it also represents the size relationship (or comparison result) of u0 owned by P0 and v0 owned by P1.

[0218] Further, based on the calculated According to the above formula, can be calculated, where the calculated corresponds to the first node in the first layer of this comparison tree structure, that is, x0||x1.

[0219] In the embodiments of the present disclosure, P b can further perform the "Boolean AND" operation on and to obtain where the calculated is used to participate in the operation for the first layer (i.e., when i = 2) of this comparison tree structure.

[0220] And so on, when i = log2(q), can be calculated, and then

[0221] The above technical solutions adopted in the embodiments of the present disclosure can achieve the following beneficial effects:

[0222] The communication complexity of MPC is mainly determined by the number of communication rounds and the communication volume. For the data processing method provided in the embodiments of the present disclosure, the number of communication rounds is log(l / m) + 1.

[0223] Compared with the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires fewer communication rounds.

[0224] In addition, the data processing method provided by the embodiment of the present disclosure has a communication volume determined by a three-party N-choose-1 oblivious transfer protocol and a Boolean AND operation, wherein the communication volume of the three-party N-choose-1 oblivious transfer protocol is (l / m-1)·(2 m +1)·2+(2 m +1), the communication volume of all Boolean AND operations is (l / m-1-log(l / m))·3·2)+log(l / m)·3. Compared with the communication volume of the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires less communication volume.

[0225] Example 2

[0226] In Example 2, the data processing method provided in Example 1 is used in a privacy-protected data analysis scenario as an example, and how to use the method to share and recover secrets among three parties is introduced in combination with actual practice.

[0227] For this specific scenario, we first assume that it conforms to the behavior model of "Semi-Honest Adversaries' Security" and the security threshold of "Honest Majority Model".

[0228] Among them, the semi-honest adversary model assumes that each participant will strictly abide by the specific protocol requirements of MPC and follow every step of the protocol, but will try to mine the privacy of other participants from the obtained data as much as possible.

[0229] The honest majority model assumes that the number of participants who may collude to mine the privacy of other participants is less than n / 2, where n is the total number of all participants.

[0230] In addition, the transmission protocol adopted in the secret sharing process in Example 2 of the present disclosure is a three-party N-choose-1 oblivious transfer protocol expanded based on the oblivious transfer protocol, also known as the three-party N-choose-1 OT protocol.

[0231] The oblivious transfer protocol is a secret protocol that can protect privacy. It allows the sender and receiver to exchange information in an oblivious manner, thereby achieving the purpose of protecting privacy.

[0232] The traditional oblivious transfer protocol is a two-party secure computing protocol. The receiver selects part of the data sent by the sender. The protocol makes the receiver know nothing about the remaining data except the selected data, and the sender has no way of knowing the data selected by the receiver. The types of traditional oblivious transfer protocols can include the following three types:

[0233] 1. 2-choose-1 oblivious transfer protocol: For example, Alice sends two messages to Bob. Bob can know the content of one message without knowing the content of the other message, and Alice does not know which message Bob chooses.

[0234] 2. N-choose-1 oblivious transfer protocol: This protocol is a general extension of the 2-choose-1 oblivious transfer protocol. Using the above example, Bob gets the content of one message from the N messages sent by Alice without knowing the content of other messages, and Alice does not know which message Bob chooses.

[0235] 3. N-choose-Q oblivious transfer protocol: This protocol is a more generalized case of the 2-choose-1 oblivious transfer protocol. Using the above example, Bob gets the contents of Q messages from the N messages sent by Alice without knowing the contents of other messages, and Alice does not know which messages Bob chooses.

[0236] Based on the above “2. N-choose-1 oblivious transfer protocol”, Embodiment 2 of the present disclosure innovatively proposes a “three-party N-choose-1 oblivious transfer protocol”. The three-party N-choose-1 oblivious transfer protocol can be applied to scenarios where the participants include a sender, a receiver, and a helper.

[0237] The three-party N-choose-1 oblivious transfer protocol provided in Embodiment 2 of the present disclosure, for three parties (participants may be, for example, a computing device) participating in secret recovery, namely, a sender, a receiver, and a helper, the data input by each party and obtained from others are respectively defined as follows:

[0238] 1. The sender's input data is N secret data (m0, m1, ..., m N-1 ); The sender does not obtain data from other places during this oblivious transmission.

[0239] 2. The input data of the receiver is c; the receiver will receive the data sent by the sender and the helper respectively. Among them, c corresponds to m0, m1, ..., m N-1 The number of a data in the , which means that the receiver wants to receive N data m0, m1, ..., m from the sender. N-1 The data selected from the c ) number.

[0240] 3. The input data of the helper is the same as the input data of the receiver, which is c. The helper does not obtain data from other parties during this oblivious transfer.

[0241] Based on the three-party N-choose-1 oblivious transfer protocol provided in Embodiment 2 of the present disclosure, the above three parties perform at least the following operations during the secret recovery process:

[0242] 2. The sender generates a set of random numbers by executing the three-party N-choose-1 oblivious transfer protocol, denoted as w=(w0, w1, ..., w N-1 ); Based on the group of random numbers and the sender's input data m0, m1, ..., m N-1 , the sender calculates w0⊕m0,w1⊕m1,...,w N-1 ⊕m N-1 , and send the calculation result to the receiver;

[0243] 2. The helper generates a random number w based on the input data c by executing the N-choose-1 oblivious transfer protocol c ; c Send to the receiver; w c Corresponding to m0,m1,...,m N-1 A certain data (the data can be recorded as m c ) number.

[0244] 3. The receiver receives w0⊕m0, w1⊕m1, ..., w from the sender. N-1 ⊕m N-1 , and receive data w sent from the helper c ; The receiver uses w0⊕m0, w1⊕m1, ..., w N-1 ⊕m N-1 and w c , using w c w sent by the sender c ⊕m c Perform XOR calculation to get m c .

[0245] The mathematical operation symbol ⊕ mentioned above means the exclusive OR operation.

[0246] In the embodiment of the present disclosure, the sender and the helper may pre-agree on the same random number generation method and the same seed for generating random numbers, so that the sender and the helper can generate the same random number w based on the same seed and the same random number generation method. c .

[0247] Since this secret recovery process conforms to the semi-honest adversary model and the honest majority model, and adopts the above-mentioned three-party N-choose-1 oblivious transfer protocol, if the security of this secret recovery process is evaluated, it can be known that it meets the following security requirements:

[0248] 1. The sender cannot know which message the receiver has selected;

[0249] 2. The recipient can only obtain m c , and cannot obtain other messages;

[0250] 3. The helper cannot obtain the sender's message nor the recipient's message.

[0251] Taking the scenario of sharing the secret t and restoring the symbols of the secret t as an example, the following introduces the specific application process of the above three-party N-out-of-1 oblivious transfer protocol in this scenario.

[0252] This process involves three participants, namely P0, P1, and P2. Among them, P0 represents the sender, P1 represents the recipient, and P2 represents the helper.

[0253] Before transmitting the Boolean shards of the secret t, assuming that the secret shards of t are shared in the way of three-party repeated secret sharding, and the three participants respectively have the following assumed secret shards of the secret t:

[0254] The secret shards owned by P0 are x and z, which can be called arithmetic shard data (x, z);

[0255] The secret shards owned by P1 are y and x, which can be called arithmetic shard data (y, x);

[0256] The secret shards owned by P2 are z and y, which can be called arithmetic shard data (z, y).

[0257] The relationships between the respective secret shards x, y, and z and t satisfy: t = (x + y + z) mod 2l. Where l is the length of the bit string obtained when representing t in binary.

[0258] Based on the above secret shards of the secret t respectively owned by the three participants, in Embodiment 2 of the present disclosure, the secret to be restored is the symbol of t.

[0259] It should be noted that for two numbers to be compared, such as a = a0||a1 and b = b0||b1 (the symbol || represents string concatenation), to determine whether a < b (or a = b, or a > b) holds, it can be transformed into a "segmented discrimination" judgment method, that is, respectively judge the magnitude relationship between a0 and b0, and judge the magnitude relationship between a1 and b1. That is to say, the problem of comparing the original bits is now reduced to a sub-problem of shorter bits, which is the principle of applying the "divide and conquer" idea.

[0260] Based on the above idea, the arithmetic shard data owned by the three participating parties can also be compared separately. Moreover, since the comparison result can only be one of the two results, such as "a < b" (or "a = b", or "a > b") "holds" or "does not hold", the size comparison result of the arithmetic shard data can be represented by Boolean data.

[0261] Based on the above analysis, in the second embodiment of the present disclosure, for the arithmetic shard data owned by each of the three participating parties, a "segmented discrimination" judgment method will be adopted to separately compare the size relationship between the arithmetic shard data of each participating party and the corresponding arithmetic shard data of other participating parties, and represent some comparison results by Boolean data.

[0262] Then, for the arithmetic shard data owned by each of the three participating parties, a "segmented discrimination" judgment method will be adopted to compare the size relationship between the arithmetic shard data owned by different participating parties, and represent the comparison result by Boolean data.

[0263] In addition, since the secret to be restored is the sign of t, and the relationship between each secret shard x, y, and z and t satisfies: t = (x + y + z) mod 2l, therefore, in the embodiment of the present disclosure, the sign of t to be restored can specifically be the exclusive OR result of three parts of data. These three parts of data are respectively: the sign bit of x + z, the sign bit of y, and the carry bit on the sign bit generated by x + y + z.

[0264] It can be predicted from this that if the secret shards x and z owned by P0, and the same secret shard y owned by P1 and P2 are respectively split into the sign bit and other bits except the sign bit, then, corresponding to the above three parts of data, after the secret shard sharing is performed in the way of three-party replicated secret shards, each of the three participating parties can have Boolean data in the following form:

[0265] The Boolean shard data owned by P0 is (δ0, δ2);

[0266] The Boolean shard data owned by P1 is (δ1, δ0);

[0267] The Boolean shard data owned by P2 is (δ2, δ1).

[0268] Among δ0, δ1, and δ2, for example:

[0269] δ0 can be the Boolean data representing the "sign bit of x + z";

[0270] δ1 can be the Boolean data representing the "sign bit of y";

[0271] δ2 can be the Boolean data representing the "carry bit on the sign bit generated by x + y + z".

[0272] Then, there exists MSB(t)=δ0⊕δ1⊕δ2. δ0, δ1, δ2 are all 1 bit.

[0273] Among them, MSB refers to the most significant bit, that is, the most significant bit of the byte. MSB(t) refers to the most significant bit of the binary number used to represent t when t is represented in binary. The most significant bit represents the sign of t, thereby determining whether the sign of t is positive, 0 or negative.

[0274] From the above analysis, we can see that by adopting the above ideas, we can eventually recover the sign of the secret t and achieve the secret recovery goal.

[0275] The following is in conjunction with the instruction manual Figure 2 , how each participant in Embodiment 2 of the present disclosure recovers the symbol of the secret t based on the arithmetic sharding data is described in detail:

[0276] Step 21: P0 calculates msb0||u=(x+z)mod2 based on the arithmetic shard data (x,z) of the secret t it owns l , P1 and P2 calculate msb1||v=ymod2 based on the arithmetic sharding data of their own secret t l , so that P0 gets msb0 and u, P1 and P2 get msb1 and v;

[0277] Among them, the operator || represents the concatenation of strings and can be called the cascade symbol.

[0278] It should be noted that according to the above calculation method, P0 calculates (x+z) mod 2 l Then we can get l bits, for example l = 64, then according to msb0||u = (x + z) mod 2 l , u is the lower 63 bits of l bits, and msb0 means (x+z) mod 2 l The most significant bit, that is, the high 1 bit in the 1 bits.

[0279] Similarly, P1 and P2 calculate ymod 2 l After that, we can get l bits, for example, l = 64, then according to msb1||v = ymod2 l , v is the lower 63 bits of l bits, and msb1 means ymod 2 l The most significant bit, that is, the high 1 bit in the 1 bits.

[0280] From the above, we can see that msb0 and msb1 can represent the sign of x+z and the sign of y respectively; while u and v represent the other bits of x+z and y that do not include the sign bit respectively.

[0281] Since t = (x + y + z) mod 21, when restoring the sign bit of t, it is not enough to know only msb0 and msb1, because x + y + z also involves the addition of u and v, and the addition of u and v may generate a carry bit on the sign bit, which will affect whether the most significant bit of t is 0 or 1. Therefore, in the present disclosure, based on u and v, the corresponding carry bit is determined by executing the following steps: The value of .

[0282] Step 22: P0 calculates u'=2 based on u l-1 -1-u;

[0283] After that, the data owned by P0 becomes u' and msb0, while the data owned by P1 and P2 is still v and msb1.

[0284] In the embodiment of the present disclosure, the reason for calculating u'=2 l-1 -1-u, if adding u and v will produce a carry bit on the sign bit, the following relationship holds:

[0285] v+u>2 l-1 -1

[0286] According to this relationship, we can get v>2 l-1 -1-u. It can be seen that by comparing v and 2 l-1 -1-u can determine whether the carry bit is 0 (indicating no carry) or 1 (indicating a carry). Therefore, in the embodiment of the present disclosure, according to u'=2 l-1 -1-u, calculate u', and then compare the size relationship between u' and v.

[0287] Step 23: P0 divides u' according to a preset division step (e.g., m bits) to obtain multiple data slices of u'. The relationship between these data slices and u' can be expressed as u'||0=u' q-1 ||...||u'0; P1 and P2 respectively divide v according to the preset division step (also m bits) to obtain multiple data slices of v. The relationship between these data slices and v can be expressed as v||0=v q-1 ||...||v0;

[0288] Among them, q=l / m. For the convenience of calculation, a suitable size of m can be selected so that q is a power of 2, for example, q=4 or 8.

[0289] In step 23, the forms of "u'||0" and "v||0" are adopted because, as described above, u and v respectively represent the other bits of x+z and y excluding the highest "sign bit". Therefore, in step 23, a least significant bit "0" is concatenated to u' and v respectively, so that "u'||0" and "v||0" can be evenly divided into q parts of length m.

[0290] In the embodiments of the present disclosure, the splitting operation as in step 23 is performed because, as described above, for two numbers to be compared: a = a0||a1 and b = b0||b1, determining whether a < b (or a = b) holds can be transformed into a "segmented discrimination" method, that is, respectively determining the magnitude relationship between a0 and b0, and determining the magnitude relationship between a1 and b1.

[0291] Assume that the binary strings of the data to be compared are continuously split until each data shard obtained by splitting contains 1 bit, and a comparison tree can be obtained. Each leaf node of this tree corresponds to 1 bit (1 data shard) of the string. Thus, the comparison of each 1 bit of the string can be achieved through the 2-out-of-1 oblivious transfer protocol.

[0292] However, with such an operation, the communication volume is also very large. To reduce the communication volume, in the embodiments of the present disclosure, in step 23, a splitting strategy based on the parameter m is adopted - that is, according to the splitting step size of m, "u'||0" and "v||0" are split into q parts (which can be called data shards), and the size of each data shard is m. In this way, each leaf node of the above comparison tree corresponds to m bits of the string. Subsequently, for the comparison of the m bits corresponding to each leaf node, it can be achieved through the N-out-of-1 oblivious transfer protocol.

[0293] Step 24: P0 performs the following operations for each data shard (denoted as u' j , j = [0, q - 1]) obtained by splitting u'||0:

[0294] First, P0 generates two random numbers both of 1 bit by executing the three-party N-out-of-1 oblivious transfer protocol; according to the number j of this data shard u' j , the two random numbers are respectively denoted as l j and e j , and set and

[0295] where: j represents the number of each data shard obtained by splitting u', and its value range is [0, q - 1]; and They all represent Boolean data of P0 - the superscript B in the brackets <> indicates that the secret sharing method is Boolean sharing, and the subscript 0 indicates that the number of the participant to which the Boolean data belongs is 0.

[0296] In the embodiment 2 of the present disclosure, the reason why "0" is used is that j and e j Constructing Boolean data ( j ,0) and ( j ,0), because in the second embodiment of the present disclosure, the secret t is shared by three parties in a repeated secret sharding manner, so the corresponding Boolean data can also be shared by three parties in a repeated secret sharding manner. Thus, as mentioned above, the second embodiment of the present disclosure is based on l j and e j Construct and This is Boolean shard data that meets the form requirements of the three-party repeated secret shard for the secret shard.

[0297] Then, for each l j and e j (j=[0, q-1]), P0 is calculated from the range of k values ​​[0, M-1] (where M=2 m ) in a manner of taking the value of k in sequence, and cyclically executing the following specified operations until the corresponding specified operations are executed based on k with a value of M-1, and then the loop ends.

[0298] The specified operation executed in the P0 loop includes:

[0299] According to the data fragmentation, the data to be sent s is calculated according to the following calculation method: j,k and t j,k , and is sent by executing a three-party N-choose-1 oblivious transfer protocol. j,k (j=[0,q-1], k=[0,M-1]) and t j,k (j=[0, q-1], k=[0, M-1]), that is, the data to be sent to the receiver by P0 after executing the three-party N-choose-1 oblivious transfer protocol is equivalent to the above-mentioned w0⊕m0, w1⊕m1, ..., w N-1 ⊕m N-1 .

[0300] s j,k = l j ⊕{u' j <k}

[0301] t j,k =e j ⊕{u' j =k}

[0302] In the above formula, the symbol {} is a Boolean operator. According to this operator, specifically: if u’ j <k is true, then {u’ j <k} is 1, otherwise it is 0; similarly, if u’ j =k is true, then {u’ j =k} is 1, otherwise it is 0. u’ j represents u’ obtained by splitting u’||0 q-1 ,..., u’0, (j = [0, q - 1]).

[0303] The following introduces the reasons for calculating s j,k and t j,k as follows:

[0304] For example, assume m = 4, then, M = 2 4 , and the value range of k is [0, 15].

[0305] On the one hand, when m = 4, u’ j is a number represented by a binary string of m = 4 bits, that is, u’ j has a total of 16 possible values, which are 0, 1, 2,..., 15 respectively.

[0306] On the other hand, when m = 4, for the receiver and the helper, if their input is v j ——v j represents v obtained by splitting v||0 q-1 ,..., v0 (j = [0, q - 1])——then, v j is also a number represented by a binary string of m = 4 bits, and there are also 16 possible values, which are 0, 1, 2,..., 15 respectively.

[0307] Comparing with the three-party N - of - N oblivious transfer protocol introduced above, taking m = 4 as an example, u’ j has a total of 16 possible values, and the corresponding {u’ j <k} and {u’ j =k} correspond to the input data m0, m1,..., m N-1 ; l j and e j are a set of random numbers generated by the sender P0 by executing the three-party N - of - N oblivious transfer protocol, corresponding to a set of random numbers w = (w0, w1,..., w N-1 ); s j,k (j = [0, q - 1], k = [0, M - 1]) and t j,k(j=[0,q-1],k=[0,M-1]), corresponding to the calculated values ​​of w0⊕m0, w1⊕m1, ..., w obtained by the sender P0 by executing the three-party N-choose-1 oblivious transfer protocol. N-1 ⊕m N-1 .

[0308] For the helper P2, v j Equivalent to the input data c, the helper P2 can generate a random number by executing the three-party N-choose-1 oblivious transfer protocol and will Sent to the receiver P1.

[0309] For the receiver P1, according to the s sent by P0 j,k (j = [0, q-1], k = [0, M-1]), and P2 sends It can be calculated that s j,vj In one example, if we assume u' j = k = 7, then obviously, when v j =7, the receiver P1 obtains s j,vj =s j,7 =s j,k = l j ⊕{u' j <7}——That is, the "u' j The result of comparing the size with k is exactly "u' j The number v chosen by the receiver P1 j =7 size comparison result".

[0310] It can be seen that for the sender P0, it can send "u' j The result of the comparison with k is shared with the receiver P1.

[0311] Similarly, for the receiver P1, according to the t sent by P0 j,k (j=[0,q-1],k=[0,M-1]), the receiver P1 can calculate t j,vj .

[0312] As mentioned above, the three arithmetic data slices of t are shared among the three participants. Compared with the sharing of the arithmetic data slices, the sharing of the comparison results in Embodiment 2 of the present disclosure can be regarded as "secondary sharing" of the secret among the participants, or in other words, it is shared to restore the attributes of the secret t (the sign bit of t can also be regarded as a kind of secret).

[0313] Step 25: P1 acts as the receiver and the input is vj ;v j It represents the data fragment numbered j obtained by splitting v, and is also used to represent the number of the data that the receiver P1 hopes to obtain from the data sent by the sender P0; the value range of j is [0, q-1]; P2 is the helper, and the input is v j ; P2, as a helper, calls the three-party N-choose-1 oblivious transfer protocol to generate a random number and will Send to the recipient;

[0314] P1 receives the s sent by the sender j,k (j = [0, q-1], k = [0, M-1]) and then, according to the s j,k , and the random number sent by the helper According to the three-party N-choose-1 oblivious transfer protocol, we can j,k Get j,vj ;

[0315] Similarly, P1 receives t from the sender. j,k (j = [0, q-1], k = [0, M-1]) and then, according to the t j,k , and the random number sent by the helper According to the three-party N-choose-1 oblivious transfer protocol, we can j,k Get t j，vj ;

[0316] It should be noted that according to the three-party N-choose-1 oblivious transfer protocol provided in the embodiment of the present disclosure, when P0 sends s j,k (or t j,k ) is calculated based on u'1, and the input v of P1 and P2 j The corresponding value is v1; when P0 sends s to P1 j,k (or t j,k ) is calculated based on u'2, the input v of P1 and P2 j The corresponding one is v2; and so on. It can be seen that P1 can obtain q s by executing the three-party N-choose-1 oblivious transfer protocol. j,k , and q t j,k .

[0317] If the above steps 24 and 25 are expressed in a programming language, they can be expressed as follows:

[0318] “Let M = 2 m

[0319] for j={0,...,q-1}do

[0320] P0 randomly generates 1 bit lj and e j , and set and

[0321] for k={0,...,M-1}do

[0322] P0 Settings j,k = l j ⊕{u j <k}

[0323] P0 Setting t j,k =e j ⊕{u j =k}

[0324] end for

[0325] P0, P1, and P2 execute a three-party N-choose-1 oblivious transfer protocol. P0 is the sender, and the input is {s j,k} k∈{0,...,M-1} ; P1 is the receiver, and the input is v j ; P2 is the helper, and the input is v j By executing the three-party N-choose-1 oblivious transfer protocol, P1 obtains set up P2 Settings

[0326] P0, P1, and P2 execute a three-party N-choose-1 oblivious transfer protocol, with P0 as the sender and the input being {t j,k} k∈{0,...,M-1} ; P1 is the receiver, and the input is v j ; P2 is the helper, and the input is v j . Through the oblivious transfer protocol, P1 obtains set up P2 Settings

[0327] end for”

[0328] Step 26: P1 obtains j,vj After that, according to s j,vj , according to the requirements of the three-party repeated secret sharing method for the form of secret sharding, the Boolean sharding data of P1 can be obtained by setting: P2 sets the Boolean sharding data of P2:

[0329] Similarly, P1 obtains t j,vj After that, according to t j,vj, according to the requirements of the three-party repeated secret sharing method for the form of secret sharding, the Boolean sharding data of P1 can be obtained by setting: P2 sets the Boolean sharding data of P2:

[0330] At this point, P0 has the Boolean shard data: as well as and

[0331] P1 has Boolean shard data: as well as and

[0332] P2 has Boolean shard data: as well as and

[0333] For example, when l j =0,e j =1, if we assume at this time Thus:

[0334] and

[0335] and

[0336] and

[0337] In the disclosed embodiment, the three parties respectively own (b = 0, 1, 2), and (b=0,1,2) can be processed to meet the requirements of the three-party repeated secret sharing method for the form of secret sharding, so as to facilitate secret recovery. The specific processing method can be combined with zero-value sharding as follows:

[0338] by Taking (b=0,1,2) as an example, first, the three participants can generate random numbers respectively, namely: P0 has the random number (h0,h2), P1 has (h1,h0), P2 has (h2,h1), satisfying h0⊕h1⊕h2=0.

[0339] Then, to construct a three-party repeated secret shard that satisfies the above formal requirements, P0 targets Calculate (1⊕h0,0⊕h2); P1 for Calculate (1⊕h1,0⊕h0); P2 for Calculate (0⊕h2,0⊕h1).

[0340] P0 sends 1⊕h0 to P1, and P1 calculates (1⊕h0)⊕0⊕h0 and gets 1, that is, becomes (1,1); P1 sends 1⊕h1 to P2, and P2 calculates (1⊕h1)⊕0⊕h1 and gets 1, that is, becomes (0,1). So far, we get:

[0341] and

[0342] and

[0343] and

[0344] It complies with the formal requirements of three-party repeated secret sharding for secret sharding.

[0345] Step 27: P0, P1, and P2 construct corresponding Boolean shard data based on their respective msb0 and msb1, combined with zero-value shards, in accordance with the form requirements of the three-party repeated secret sharing method for secret shards;

[0346] The specific implementation process of step 27 is as follows:

[0347] First, the three parties can generate random numbers respectively, namely: P0 has random numbers (h0, h2), P1 has (h1, h0), and P2 has (h2, h1), satisfying h0⊕h1⊕h2=0;

[0348] Then, in order to construct a three-party repeated secret shard that meets the above formal requirements, P0 calculates (Msb0⊕h0, 0⊕h2) based on (h0, h2) for (Msb0, 0) owned by P0; P1 calculates (Msb1⊕h1, 0⊕h0) based on (h1, h0) for (Msb1, 0) owned by P1; P2 calculates (0⊕h2, Msb1⊕h1) based on (h2, h1) for (0, Msb1) owned by P1.

[0349] P0 sends Msb0⊕h0 to P1. Based on the received Msb0⊕h0 and “0⊕h0” calculated by P1, P1 performs the operation (Msb0⊕h0)⊕(0⊕h0) to obtain Msb0. At this point, (Msb1, 0) owned by P1 can be converted into (Msb1, Msb0).

[0350] After the processing in step 27, the Boolean shard data held by each participant is as follows:

[0351] P0 holds (Msb0, 0); P1 holds (Msb1, Msb0); P2 holds (0, Msb1).

[0352] These Boolean shard data meet the formal requirements for secret sharding in the three-party replicated secret sharing method.

[0353] Step 28: P0, P1, and P2 calculate the Boolean operation results corresponding to the sign bits representing the secret t based on the Boolean shard data they respectively hold by executing steps 26 and 27, as the recovered secret.

[0354] As described above, for a = a0||a1 and b = b0||b1, to determine whether a < b (or a = b) holds, it can be transformed into a "segmented discrimination" judgment method, that is, to respectively judge the magnitude relationship between a0 and b0, and the magnitude relationship between a1 and b1.

[0355] Thus, for Boolean sharing, the following relational expression holds:

[0356] {a < b} = {a1 < b1} ⊕ ({a1 = b1} ∧ {a0 < b0})

[0357] Therefore, based on the above relational expression, in step 28, if P0, P1, and P2 are denoted as P b , b ∈ {0, 1, 2}, then, P b can calculate the Boolean operation result in the following way:

[0358] In the way of successively taking the value of i from the value range [0, log2(q)] of i, the following specified operation is executed in a loop until after executing the corresponding specified operation based on i with the value of log2(q), the loop ends.

[0359] The specified operation includes: for each value of i, in the way of successively taking the value of r from the value range [0, (q / 2 i ) - 1] of r, the following operation is executed in a loop until after executing the following operation based on r with the value of (q / 2 i ) - 1, the loop ends:

[0360] First, P b performs a "Boolean AND" operation on and to obtain Then, P b obtains by using the following calculation method based on the calculated

[0361]

[0362] Calculated corresponding to ({a1 = b1} ∧ {a0 < b0}) in the above relation; corresponding to {a < b} in the above relation, while corresponds to {a1 < b1} in the above relation.

[0363] In the embodiments of the present disclosure, P b can further and perform a "Boolean AND" operation to obtain

[0364] P b According to the above calculation method, iterative calculation can be performed to calculate the value, which is a Boolean value representing the sign of the "carry bit" that may be generated by adding the aforementioned u and v.

[0365] Based on the sign of the "carry bit", P b can adopt the following method to calculate the value representing the sign bit of the secret t:

[0366]

[0367] After calculating the value representing the sign bit of the secret t, Embodiment 2 of the present disclosure achieves the purpose of restoring the sign of t, and the process can end.

[0368] It should be noted that for the above Combined with the aforementioned Step 27, it can be seen that after the processing of Step 27, the situation of the Boolean shard data owned by each participant is: P0 has (Msb0, 0); P1 has (Msb1, Msb0); P2 has (0, Msb1). Thus:

[0369] If calculating Specifically:

[0370] If calculating Specifically:

[0371] If calculating Specifically:

[0372] The following combines the specification appendix Figure 3 to illustrate the physical meaning of the specific calculation process of Step 29.

[0373] Specification appendix Figure 3 To perform a "Boolean AND" operation level by level on and and finally calculate to obtain the schematic diagram of the comparison tree structure.

[0374] Corresponding to this comparison tree structure, and the subscript i - 1 in represents the level of the comparison tree, while 2r and 2r + 1 represent the serial numbers of the nodes in the current layer.

[0375] For example, when i = 1 and r = 0, perform a "Boolean AND" operation on and That is, they respectively correspond to the two nodes x0 and x1 in the bottom layer (the 0th layer) of this comparison tree structure. and Perform a "Boolean AND" operation on

[0376] to obtain and This corresponds to ({a1 = b1} ∧ {a0 < b0}) in the foregoing relational expression, and can represent the size relationship (or comparison result) between the two nodes x0 and x1. Combining with the embodiments of the present disclosure, it also represents the size relationship (or comparison result) between u0 owned by P0 and v0 owned by P1.

[0377] Further, based on the calculated According to the above formula, can be calculated. Among them, the calculated this corresponds to the first node in the first layer of this comparison tree structure, that is, x0||x1.

[0378] In the embodiments of the present disclosure, P b can further perform a "Boolean AND" operation on and to obtain Among them, the calculated this is used to participate in the operation for the first layer (i.e., when i = 2) of this comparison tree structure.

[0379] And so on, when i = log2(q), can be calculated, and then

[0380] The security comparison algorithm based on the three - party N - out - of - 1 oblivious transfer protocol provided by the embodiments of the present disclosure includes core components such as the N - out - of - 1 oblivious transfer protocol and the Boolean AND operation.

[0381] According to the analysis of the security of the protocol in the previous article and the above steps, the security comparison algorithm is secure under the semi-honest adversary model and the honest majority assumption.

[0382] The communication complexity of MPC is mainly determined by the number of communication rounds and the communication volume. Obviously, the number of communication rounds of the security comparison algorithm provided by the embodiment of the present disclosure is log(l / m)+1. The communication volume is determined by the three-party N-choose-1 oblivious transfer protocol and the Boolean AND operation, where the communication volume of the three-party N-choose-1 oblivious transfer protocol is (l / m-1)·(2 m +1)·2+(2 m +1), the communication volume of all Boolean AND operations is (l / m-1-log(l / m))·3·2)+log(l / m)·3. When l is 64 bits, the number of communication rounds and the communication volume of the parallel prefix adder mentioned in the background technology are compared, and the comparison is shown in the following table:

[0383]

[0384]

[0385] In practical applications, the main problem faced by secret sharing-based MPC is that the communication complexity of the algorithm is relatively high, and the nonlinear operations in the algorithm have higher communication volume and number of communication rounds compared with linear operations. As the core operator of nonlinear operations, the secure comparison algorithm is very important for improving the performance of MPC.

[0386] The security comparison algorithm based on the three-party N-choose-1 oblivious transfer protocol provided by the embodiments of the present disclosure can effectively reduce the number of communication rounds and communication volume of the three-party security comparison, thereby effectively reducing the performance overhead of joint statistical analysis and joint modeling and prediction based on multi-party security computing, which is of great practical significance for the actual business implementation.

[0387] Example 3

[0388] In order to solve the problem that the number of communication rounds required to complete secret recovery using the secret recovery method of the prior art is relatively high and consumes a lot of processing resources, in embodiment 3 of the present disclosure, corresponding data processing methods are proposed from the perspectives of the sender, the receiver, and the helper.

[0389] Among them, the specific implementation process of the first data processing method is as follows Figure 4 As shown, when applied to the sender, the following steps are included:

[0390] Step 41: converting the first arithmetic secret fragment of the secret owned by the sender into a first symbol bit sub-secret fragment and a Boolean sub-secret fragment;

[0391] Step 42: Based on the first symbol bit sub-secret slice and the first zero value slice, share the symbol bit sub-secret with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a helper;

[0392] Step 43: using the Boolean sub-secret fragment as input, and sending a Boolean operation result calculated based on the Boolean sub-secret and the random number to a receiver by executing the N-choose-1 oblivious transfer protocol;

[0393] Step 44: Based on the second zero-valued slice and the Boolean sub-secret slice selected by the receiving party, the Boolean sub-secret slice is shared with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0394] Step 45: Recover the secret according to the sender's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0395] Optionally, step 41 may specifically include:

[0396] converting the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice;

[0397] The result of comparing the other bits of the first arithmetic secret fragment except the sign bit with the corresponding target value is converted into Boolean data as the Boolean sub-secret fragment.

[0398] The comparison result between the other bits and the corresponding target value (such as k mentioned above) includes: the comparison result between the first arithmetic secret sub-slice obtained by dividing the other bits according to the set division step (such as m mentioned above) and the corresponding target value;

[0399] The corresponding target value includes: each decimal value that can be represented by the number of bits of the segmentation step.

[0400] The specific implementation process of the second data processing method is as follows Figure 5 As shown, when applied to the receiving side, the following steps are included:

[0401] Step 51: converting the second arithmetic secret slice of the secret owned by the receiver into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0402] Step 52: Based on the second symbol bit sub-secret slice and the first zero value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver, and a helper;

[0403] Step 53: using the second arithmetic sub-secret fragment as the receiver's input, and executing the N-choose-1 oblivious transfer protocol to obtain the Boolean sub-secret fragment from the sender;

[0404] Step 54: Based on the second zero-valued slice and the Boolean sub-secret slice from the sender, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0405] Step 55: Recover the secret according to the receiver's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0406] Optionally, step 51 may specifically include:

[0407] converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice;

[0408] Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

[0409] The specific implementation process of the third data processing method is as follows Figure 6 As shown, applied to the helper, it includes the following steps:

[0410] Step 61: converting the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0411] Step 62: using the second arithmetic sub-secret fragment as input of the helper, and sending a calculation result based on the second arithmetic sub-secret fragment and the generated random number to the receiver by executing the N-choose-1 oblivious transfer protocol;

[0412] Step 63: Based on the second symbol bit sub-secret slice and the first zero value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver, and a helper;

[0413] Step 64: Based on the second zero-valued slice and the Boolean sub-secret slice from the sender selected by the receiver, the Boolean sub-secret slice is shared with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0414] Step 65: Recover the secret based on the helper's own sign bit sub-secret fragment and the target Boolean sub-secret fragment.

[0415] Optionally, step 61 may specifically include:

[0416] converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice;

[0417] Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

[0418] The detailed implementation process of each step of the above three methods can be found in the above-mentioned Example 1 or Example 2, which will not be repeated here.

[0419] The communication complexity of MPC is mainly determined by the number of communication rounds and the amount of communication. In the data processing method provided in the embodiment of the present disclosure, the number of communication rounds is log(l / m)+1.

[0420] Compared with the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires fewer communication rounds.

[0421] In addition, the data processing method provided by the embodiment of the present disclosure has a communication volume determined by a three-party N-choose-1 oblivious transfer protocol and a Boolean AND operation, wherein the communication volume of the three-party N-choose-1 oblivious transfer protocol is ( / -1)·(2 m +1)·2+(2 m +1), the communication volume of all Boolean AND operations is ( / -1-log(l / m))·3·2)+log( / )·3. Compared with the communication volume of the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires less communication volume.

[0422] Example 4

[0423] In order to solve the problem that the number of communication rounds required to complete secret recovery using the secret recovery method of the prior art is relatively high and consumes a lot of processing resources, the fourth embodiment of the present disclosure provides a data processing system, which includes a sender, a receiver and a helper. Among them:

[0424] The sender is used to convert a first arithmetic secret slice of a secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0425] The receiver is used to convert the second arithmetic secret slice of the secret owned by the receiver into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice;

[0426] The helping party is used to convert the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0427] Sender, Receiver and Helper, also used for:

[0428] Based on the first sign bit sub-secret slice, the second sign bit sub-secret slice and the first zero value slice, the sender, the receiver and the helper perform sign bit sub-secret sharing in a three-party repeated secret slice sharing manner, so that the sender, the receiver and the helper obtain their own sign bit sub-secret slices respectively; using the Boolean sub-secret slice as the input of the sender and the second arithmetic sub-secret slice as the input of the receiver and the helper respectively, the sender, the receiver and the helper execute an N-choose-1 oblivious transfer protocol, and the receiver obtains a Boolean sub-secret slice selected from the Boolean sub-secret slice;

[0429] Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively;

[0430] At least one of the sender, the receiver and the helper recovers the secret according to the symbol bit sub-secret fragment and the target Boolean sub-secret fragment obtained by the at least one party.

[0431] In an optional implementation manner, the sender may be specifically configured to:

[0432] converting the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice;

[0433] The result of comparing the other bits of the first arithmetic secret fragment except the sign bit with the corresponding target value is converted into Boolean data as the Boolean sub-secret fragment.

[0434] In an optional implementation manner, the sender may be specifically configured to:

[0435] According to the set segmentation step length, the bits other than the sign bit of the first arithmetic secret slice are segmented to obtain first arithmetic secret sub-slices;

[0436] Comparing the magnitudes of the first arithmetic secret sub-shards with the corresponding target values, and converting the results into corresponding Boolean data respectively;

[0437] The target value is determined based on a range of values ​​that can be represented by the bit length of the first arithmetic secret sub-slice.

[0438] In an optional implementation, the size comparison results are of two types; then,

[0439] The comparison results of the first arithmetic secret sub-shards with the corresponding target values ​​are converted into corresponding Boolean data, including:

[0440] The sender converts the two types of size comparison results into two groups of Boolean data as the Boolean sub-secret fragments.

[0441] In an optional implementation manner, at least one of the sender, the receiver and the helper may specifically perform a Boolean AND operation level by level according to the hierarchical structure of the comparison tree according to the target Boolean sub-secret fragments corresponding to the two groups of Boolean data obtained by the at least one party itself, until a Boolean AND operation result corresponding to the highest level of the comparison tree is obtained;

[0442] The at least one party performs an exclusive OR operation on the Boolean AND operation result and the sign bit sub-secret fragment obtained by the at least one party to obtain a corresponding operation result as a recovery result for the secret.

[0443] In an optional implementation, the receiver and the helper may be configured to:

[0444] The sign bit of the second arithmetic secret slice is respectively converted into the second sign bit sub-secret slice; and the other bits of the second arithmetic secret slice except the sign bit are converted into the second arithmetic sub-secret slice.

[0445] In an optional implementation manner, the receiving party and the helping party may be specifically configured to: divide the bits of the second arithmetic secret fragment except the sign bit according to a set division step length to obtain second arithmetic secret sub-fragments.

[0446] For more detailed other operations performed by the sender, receiver and helper, please refer to the relevant descriptions in the previous embodiments and will not be repeated here.

[0447] Corresponding to the three data processing methods in Example 3, Example 4 of the present disclosure also provides three data processing devices.

[0448] The structure of the first data processing device is as follows: Figure 7 As shown, including:

[0449] A conversion unit 71, configured to convert a first arithmetic secret slice of a secret owned by the first data processing device into a first symbol bit sub-secret slice and a Boolean sub-secret slice;

[0450] The first sharing unit 72 is used to share the symbol bit sub-secret with other participants based on the first symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: the first data processing device, the receiving party and the helping party;

[0451] A sending unit 73 is used to send a Boolean operation result calculated based on the Boolean sub-secret and the random number to a receiver by executing an N-choose-1 oblivious transfer protocol with the Boolean sub-secret fragment as input;

[0452] A second sharing unit 74 is configured to share the Boolean sub-secret slice with other participants based on the second zero-value slice and the Boolean sub-secret slice selected by the receiving party in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0453] The recovery unit 75 is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the first data processing device itself.

[0454] The structure of the second data processing device is as follows Figure 8 As shown, including:

[0455] A conversion unit 81, configured to convert a second arithmetic secret slice of a secret owned by the second data processing device into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0456] The first sharing unit 82 is used to share the symbol bit sub-secret with other participants in a three-party repeated secret slice sharing method based on the second symbol bit sub-secret slice and the first zero value slice, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a second data processing device and a helper;

[0457] A selection unit 83 is configured to obtain a Boolean sub-secret fragment from a sender by executing an N-choose-1 oblivious transfer protocol using the second arithmetic sub-secret fragment as an input of a receiver;

[0458] A second sharing unit 84 is configured to share the Boolean sub-secret slice with other participants based on the second zero-value slice and the Boolean sub-secret slice from the sender in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice;

[0459] The recovery unit 85 is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the second data processing device itself.

[0460] The structure of the third data processing device is as follows Fig. 9 As shown, including:

[0461] A conversion unit 91, configured to convert a second arithmetic secret slice of a secret owned by the third data processing device into a second symbol position sub-secret slice and a second arithmetic sub-secret slice;

[0462] A helping unit 92 is used to send a calculation result based on the second arithmetic sub-secret fragment and the generated random number to a receiving party by executing an N-choose-1 oblivious transfer protocol, using the second arithmetic sub-secret fragment as an input of the helping party;

[0463] The first sharing unit 93 is used to share the symbol bit sub-secret with other participants based on the second symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a third data processing device;

[0464] A second sharing unit 94 is configured to share the Boolean sub-secret slice with other parties based on the second zero-value slice and the Boolean sub-secret slice from the sender selected by the receiver in a three-party repeated secret slice sharing manner, so that each party obtains its own target Boolean sub-secret slice;

[0465] The recovery unit 95 is used to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the third data processing device itself.

[0466] The detailed implementation process of the functions of the above-mentioned units can be found in the above-mentioned Example 1 or Example 2, which will not be repeated here.

[0467] The communication complexity of MPC is mainly determined by the number of communication rounds and the amount of communication. The data processing solution provided by the embodiment of the present disclosure has a communication round number of log(l / m)+1.

[0468] Compared with the parallel prefix adder mentioned in the background technology, the data processing solution provided by the embodiment of the present disclosure requires fewer communication rounds.

[0469] In addition, the data processing solution provided by the embodiment of the present disclosure has a communication volume determined by a three-party N-choose-1 oblivious transfer protocol and a Boolean AND operation, wherein the communication volume of the three-party N-choose-1 oblivious transfer protocol is ( / -1)·(2 m+1)·2+(2 m +1), the communication volume of all Boolean AND operations is ( / -1-log(l / m))·3·2)+log( / )·3. Compared with the communication volume of the parallel prefix adder mentioned in the background technology, the data processing method provided by the embodiment of the present disclosure requires less communication volume.

[0470] Example 5

[0471] Based on the same inventive concept as the above-mentioned embodiments of the present disclosure, embodiment 5 of the present disclosure provides an electronic device to solve the problem that a relatively high number of communication rounds is required to complete secret recovery using the secret recovery method of the prior art, which consumes a large amount of processing resources.

[0472] like Fig.10 As shown, the electronic device includes: a memory 101 and a processor 102. The memory 101 can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method operating on the electronic device. The memory 101 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0473] The processor 102 is coupled to the memory 101 and is used to execute the program stored in the memory 101 to execute the data processing method described in the embodiment of the present disclosure.

[0474] When the processor 102 executes the program in the memory 101, in addition to the above functions, it can also realize other functions, and the details can be referred to the description of the above embodiments.

[0475] Further, such as Fig.10 As shown, the electronic device also includes: a display 104, a communication component 103, a power component 105, an audio component 106 and other components. Fig.10 Only some components are shown schematically, which does not mean that the electronic device only includes Fig.10 Components shown.

[0476] Accordingly, an embodiment of the present disclosure further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the steps or functions of the methods provided in the above embodiments can be implemented.

[0477] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0478] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0479] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A data processing method, characterized in that: The method comprises: The sender converts the first arithmetic secret slice of the secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice; The receiver converts the second arithmetic secret slice of the secret owned by the receiver into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; The helping party converts the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice; Based on the first symbol bit sub-secret slice, the second symbol bit sub-secret slice and the first zero value slice, the sender, the receiver and the helper perform symbol bit sub-secret sharing in a three-party repeated secret slice sharing manner, so that the sender, the receiver and the helper respectively obtain their own symbol bit secret slices; The Boolean sub-secret fragment is used as an input of the sender, and the second arithmetic sub-secret fragment is used as an input of the receiver and the helper respectively. The sender, the receiver and the helper execute an N-choose-1 oblivious transfer protocol, and the receiver obtains a Boolean sub-secret fragment selected from the Boolean sub-secret fragment. Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively; At least one of the sender, the receiver and the helper recovers the secret according to the symbol bit sub-secret slice and the target Boolean sub-secret slice obtained by the at least one party; The sender converts the first arithmetic secret fragment of the secret into the first symbol bit sub-secret fragment and the Boolean sub-secret fragment, including: The sender converts the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice; The sender compares the bits of the first arithmetic secret fragment except the sign bit with the corresponding target value, and converts the result into Boolean data as the Boolean sub-secret fragment; The comparison result between the other bits and the corresponding target value includes: a comparison result between the first arithmetic secret sub-slice obtained by dividing the other bits according to the set division step length and the corresponding target value; The corresponding target value includes: each decimal value that can be represented by the number of bits of the segmentation step.

2. The method according to claim 1, characterized in that The sender converts the comparison result of the other bits of the first arithmetic secret fragment except the sign bit with the corresponding target value into Boolean data, including: According to the set segmentation step length, the bits other than the sign bit of the first arithmetic secret segment are segmented to obtain first arithmetic secret sub-segments; The comparison results between the first arithmetic secret sub-segments and the corresponding target values ​​are converted into corresponding Boolean data respectively.

3. The method according to claim 2, characterized in that There are two types of size comparison results; then, The comparison results of the first arithmetic secret sub-shards with the corresponding target values ​​are converted into corresponding Boolean data, including: The sender converts the two types of size comparison results into two groups of Boolean data as the Boolean sub-secret fragments.

4. The method according to claim 3, characterized in that At least one of the sender, the receiver, and the helper recovers the secret according to the symbol bit sub-secret slice and the target Boolean sub-secret slice obtained by the at least one party, including: At least one of the sender, the receiver and the helper performs a Boolean AND operation on the target Boolean sub-secret fragments corresponding to the two groups of Boolean data obtained by the at least one party, layer by layer according to the hierarchical structure of the comparison tree, until a Boolean AND operation result corresponding to the highest level of the comparison tree is obtained; The at least one party performs an exclusive OR operation on the Boolean AND operation result and the sign bit sub-secret fragment obtained by the at least one party to obtain a corresponding operation result as a recovery result for the secret.

5. The method according to any one of claims 1 to 4, characterized in that: The receiving party and the helping party respectively convert the second arithmetic secret slice of the secret into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice, including: The receiving party and the helping party respectively convert the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice; The receiving party and the helping party convert the other bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

6. The method according to claim 5, characterized in that The receiving party and the helping party convert the bits other than the sign bit of the second arithmetic secret fragment into the second arithmetic sub-secret fragment, including: The bits of the second arithmetic secret slice except the sign bit are segmented according to the set segmentation step to obtain second arithmetic secret sub-segments.

7. A data processing method, applied to a sender, characterized in that: The method comprises: Converting a first arithmetic secret slice of the secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice; Based on the first symbol position sub-secret slice and the first zero-value slice, the symbol position sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol position sub-secret slice; the participants include: a sender, a receiver and a helper; Taking the Boolean sub-secret fragment as input, sending a Boolean operation result calculated based on the Boolean sub-secret and a random number to a receiver by executing an N-choose-1 oblivious transfer protocol; Based on the second zero-valued slice and the Boolean sub-secret slice selected by the receiving party, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice; Recovering the secret according to the sender's own sign bit sub-secret slice and the target Boolean sub-secret slice; Converting the first arithmetic secret slice of the secret into the first symbol bit sub-secret slice and the Boolean sub-secret slice comprises: converting the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice; The result of comparing the other bits of the first arithmetic secret fragment except the sign bit with the corresponding target value is converted into Boolean data as the Boolean sub-secret fragment.

8. A data processing method, applied to a receiving party, characterized in that: The method comprises: Converting the second arithmetic secret slice of the secret owned by the receiving party into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; Based on the second symbol bit sub-secret slice and the first zero-value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a helper; Taking the second arithmetic sub-secret fragment as the input of the receiver, and obtaining the Boolean sub-secret fragment from the sender by executing the N-choose-1 oblivious transfer protocol; Based on the second zero-valued slice and the Boolean sub-secret slice from the sender, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice; Recovering the secret according to the receiver's own sign bit sub-secret slice and the target Boolean sub-secret slice; Converting the second arithmetic secret slice of the secret into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice comprises: converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice; Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

9. A data processing method, applied to a helping party, characterized in that: The method comprises: Converting the second arithmetic secret slice of the secret owned by the helping party into a second symbol position sub-secret slice and a second arithmetic sub-secret slice; Using the second arithmetic sub-secret fragment as input of the helper, and sending a calculation result based on the second arithmetic sub-secret fragment and the generated random number to the receiver by executing the N-choose-1 oblivious transfer protocol; Based on the second symbol bit sub-secret slice and the first zero-value slice, the symbol bit sub-secret is shared with other participants in a three-party repeated secret slice sharing method, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a helper; Based on the second zero-valued slice and the Boolean sub-secret slice from the sender selected by the receiver, share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner, so that each participant obtains its own target Boolean sub-secret slice; Recovering the secret based on the helper's own sign bit sub-secret slice and the target Boolean sub-secret slice; Converting the second arithmetic secret slice of the secret into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice comprises: converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice; Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

10. A data processing system, characterized in that: Includes sender, receiver and helper; among them: A sender, configured to convert a first arithmetic secret slice of a secret owned by the sender into a first symbol bit sub-secret slice and a Boolean sub-secret slice; A receiver, configured to convert a second arithmetic secret slice of the secret possessed by the receiver into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; The helping party is used to convert the second arithmetic secret slice of the secret owned by the helping party into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; Sender, Receiver and Helper, also used for: Based on the first sign bit sub-secret slice, the second sign bit sub-secret slice and the first zero value slice, the sender, the receiver and the helper perform sign bit sub-secret sharing in a three-party repeated secret slice sharing manner, so that the sender, the receiver and the helper obtain their own sign bit sub-secret slices respectively; using the Boolean sub-secret slice as the input of the sender and the second arithmetic sub-secret slice as the input of the receiver and the helper respectively, the sender, the receiver and the helper execute an N-choose-1 oblivious transfer protocol, and the receiver obtains a Boolean sub-secret slice selected from the Boolean sub-secret slice; Based on the selected Boolean sub-secret slice and the second zero-value slice, the sender, the receiver and the helper share the Boolean sub-secret slice in a three-party repeated secret slice sharing manner to obtain the target Boolean sub-secret slices of the sender, the receiver and the helper respectively; At least one of the sender, the receiver and the helper recovers the secret according to the symbol bit sub-secret slice and the target Boolean sub-secret slice obtained by the at least one party; Sender, specifically used for: converting the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice; Comparing the bits of the first arithmetic secret fragment except the sign bit with the corresponding target value, converting the result into Boolean data as the Boolean sub-secret fragment; The comparison result between the other bits and the corresponding target value includes: a comparison result between the first arithmetic secret sub-slice obtained by dividing the other bits according to the set division step length and the corresponding target value; The corresponding target value includes: each decimal value that can be represented by the number of bits of the segmentation step.

11. A data processing device, characterized in that: include: a conversion unit, configured to convert a first arithmetic secret slice of a secret owned by the data processing device into a first symbol bit sub-secret slice and a Boolean sub-secret slice; A first sharing unit is used to share the symbol bit sub-secret with other participants based on the first symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; each participant includes: a first data processing device, a receiving party, and a helping party; A sending unit, configured to send a Boolean operation result calculated based on the Boolean sub-secret and a random number to a receiver by executing an N-choose-1 oblivious transfer protocol, taking the Boolean sub-secret fragment as input; A second sharing unit is configured to share the Boolean sub-secret slice with other participants in a three-party repeated secret slice sharing manner based on the second zero-value slice and the Boolean sub-secret slice selected by the receiving party, so that each participant obtains its own target Boolean sub-secret slice; a recovery unit, configured to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the first data processing device itself; Conversion unit, specifically used for: converting the sign bit of the first arithmetic secret slice into the first sign bit sub-secret slice; The result of comparing the other bits of the first arithmetic secret fragment except the sign bit with the corresponding target value is converted into Boolean data as the Boolean sub-secret fragment.

12. A data processing device, characterized in that: include: a conversion unit, configured to convert a second arithmetic secret slice of a secret owned by the data processing device into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; A first sharing unit is used to share the symbol bit sub-secret with other participants based on the second symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a second data processing device and a helper; A selection unit, configured to obtain a Boolean sub-secret fragment from a sender by using the second arithmetic sub-secret fragment as an input of a receiver and executing an N-choose-1 oblivious transfer protocol; a second sharing unit, configured to share the Boolean sub-secret slice with other parties based on the second zero-value slice and the Boolean sub-secret slice from the sender in a three-party repeated secret slice sharing manner, so that each party obtains its own target Boolean sub-secret slice; a recovery unit, configured to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the second data processing device itself; Conversion unit, specifically used for: converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice; Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

13. A data processing device, characterized in that: include: a conversion unit, configured to convert a second arithmetic secret slice of a secret owned by the data processing device into a second symbol bit sub-secret slice and a second arithmetic sub-secret slice; a helping unit, configured to use the second arithmetic sub-secret fragment as an input of the helping party, and to send a calculation result based on the second arithmetic sub-secret fragment and the generated random number to a receiving party by executing an N-choose-1 oblivious transfer protocol; A first sharing unit is used to share the symbol bit sub-secret with other participants based on the second symbol bit sub-secret slice and the first zero value slice in a three-party repeated secret slice sharing manner, so that each participant obtains its own symbol bit sub-secret slice; the participants include: a sender, a receiver and a third data processing device; a second sharing unit, configured to share the Boolean sub-secret slice with other parties in a three-party repeated secret slice sharing manner based on the second zero-value slice and the Boolean sub-secret slice from the sender selected by the receiver, so that each party obtains its own target Boolean sub-secret slice; a recovery unit, configured to recover the secret according to the sign bit sub-secret slice and the target Boolean sub-secret slice of the third data processing device itself; Conversion unit, specifically used for: converting the sign bit of the second arithmetic secret slice into the second sign bit sub-secret slice; Convert the bits of the second arithmetic secret fragment except the sign bit into the second arithmetic sub-secret fragment.

14. An electronic device, characterized in that: include: Memory and processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to execute the method described in any one of claims 1 to 9.

15. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer, can implement the method according to any one of claims 1 to 9.

Images