Method and apparatus for data processing in multi-party secure computation

Abstract

The embodiment of the present specification provides a method and device for data processing in multi-party secure calculation. In the process of business processing based on multi-party secure calculation, for any non-negative number x, a small increment is added in the inverse square root process to avoid the situation that x is small and is truncated to 0, thereby causing calculation errors. On the other hand, in the process of taking the square root of x, the inverse square root calculation of the power of 2 is converted, and the scaling is performed through secure multiplication based on the inverse of the power of 2 and the inverse square root calculation, so that the secure calculation of the power of 2 can be used to reduce the communication amount.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of secure computing technology, and more particularly to methods and apparatus for data processing in multi-party secure computing. Background Technology

[0002] Secure multi-party computation, also known as secure multi-party computation, allows multiple parties to collaboratively compute the result of a function without disclosing the input data of each party. The result is then made public to one or more of the parties. Typical applications of secure multi-party computation include joint statistical analysis of privacy-preserving multi-party data and machine learning. Here, the function is a statistical operation function, a machine learning algorithm, etc.

[0003] In multi-party secure computation, to prevent the leakage of data and intermediate computation results, data or intermediate results can be held by each party in a shared manner. Each party holds a data shard, and the shards held by all parties are merged to reconstruct the corresponding data. Typically, computation is performed in a shared state. However, division is frequently used in business processes based on multi-party secure computation. During these processes, due to factors such as data storage methods, the divisor may be the result of other intermediate computations, which could be 0 or truncated to 0 due to being too close to 0. This situation can severely affect the accuracy of the business processing results. Summary of the Invention

[0004] This specification describes one or more embodiments of a data processing method and apparatus in multi-party secure computation, which is used to solve one or more problems mentioned in the background art.

[0005] According to a first aspect, a data processing method for multi-party secure computation is provided, used to determine the arithmetic shared form of the square root inverse of target data x, which is shared between a first party and a second party. The first party and the second party respectively hold a first slice and a second slice of the target data x, represented by n bits. The method is executed by the first party and includes: adding a first slice of x to the first slice of x by the square of a predetermined additional term ε, to obtain a first slice of an approximate value x', wherein the modulus of the predetermined additional term ε is less than a predetermined value; and comparing the approximate value with the second party. x' executes a secure decision protocol to obtain the first fragment of reference data a, where reference data a is the smallest power of 2 greater than the approximate value x'. Using the first fragment of reference data a, a power of 2 inversion protocol is securely executed with the second party to obtain the first fragment of the inverse 1 / a of reference data a. Using the first fragment of the inverse 1 / a of reference data a and the first fragment of x', the first product x' / a is determined with the second party via secure multiplication, thus obtaining the first fragment of the first product x' / a. Finally, the second party securely uses Newton's iteration method to invert the product using the square root of 2. As the initial value for the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, resulting in the first piece of the inverse square root y' of x' / a. Using the first piece of the inverse square root y' of x' / a, and the square root inverse of a obtained by performing a power-of-2 square root inverse with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second slice to determine the inverse square root of the target value x. Obtain the first slice of y.

[0006] In one embodiment, the security determination protocol is one of the following: the most significant bit determination protocol in Boolean sharing form, the most non-zero bit determination protocol in arithmetic sharing form, and the power of 2 interval determination protocol.

[0007] In a further embodiment, the step of performing a security determination protocol with the second party on the approximate value x' to obtain a first slice of reference data a includes: determining, via the security determination protocol, the largest power of 2 b not greater than the approximate value x', to obtain a first slice of b; and multiplying the first slice of b by 2 to obtain a first slice of reference data a.

[0008] In one embodiment, in Newton's iteration method, the iteration value of the (t+1)th iteration is: 1.5 times the iteration value of the tth iteration, minus 0.5 times the first product x' / a and the cube of the iteration value of the tth iteration.

[0009] In one embodiment, the first slice of a corresponds to n bits and has f decimal places. The secure execution of the power-of-2 inversion protocol with the second party includes: reversing the first slice of a to obtain a first reference slice; determining that the first reference slice has nf-1 decimal places, or, if the decimal places are nf, padding the low bits of the first reference slice with a 0 and truncating the highest bit to obtain the first slice of the inversion of a.

[0010] In a further embodiment, the square root inverse of a obtained by performing a power-of-2 inverse square root protocol with the second party is... The first segmentation includes: splitting each bit of the inverse of a into a predetermined number of equally spaced bits, and determining a one-to-one corresponding first reference value according to the binary number formed by each group of equally spaced bits; and calculating the sum of the squares of the differences between each first reference value and the corresponding second reference value under a predetermined balance coefficient, thereby obtaining the square root inverse of a. The first slice, wherein a single second reference value is determined by a binary number consisting of corresponding groups of equally spaced bits in the second slice, which is the inverse of a.

[0011] According to the second aspect, a data processing method for multi-party secure computation is provided, used to determine the arithmetic shared form of the square root inverse of target data x, which is shared by a first party and a second party. The first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits. The method is executed by the first party and includes: determining the largest power of 2 b not greater than x via a secure determination protocol to obtain a first slice of b; obtaining a first slice of a determination result s based on the first slice of b and whether x is zero by the second party, wherein the first slice of the determination result s is a single bit of 0 or 1; and the second party securely selects one of the candidate values ​​y and the inverse of a predetermined additional term ε as the calculation result of the square root inverse of the target data x based on the determination result s, for subsequent business processing, wherein if s is 1, the candidate value y is selected, and if s is 0, the inverse of the predetermined additional term ε, 1 / ε, is selected.

[0012] The candidate value y is determined as follows: The first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a safe power-of-2 inverse protocol is executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a safe multiplication is performed with the second party to determine the first product x / a, thus obtaining the first piece of the first product x / a; and a safe multiplication is performed with the second party using Newton's iteration method to obtain the inverse of the square root of 2. As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse of a obtained by performing a power-of-2 square root inversion protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0013] In one embodiment, b is formed by the first segment of b held by the first party and the second segment of b held by the second party in a Boolean shared form, and the first segment of the judgment result s is the result of continuously summing each bit of the first segment of b modulo 2.

[0014] In one embodiment, the second party securely selects between the candidate value y and the inverse of the predetermined additional term ε based on the judgment result s by: securely calculating a second product of s with the difference between y and 1 / ε, adding the sum of 1 / ε, as the selection result.

[0015] In one embodiment, the security determination protocol is one of the following: the most significant bit determination protocol in Boolean sharing form, the most non-zero bit determination protocol in arithmetic sharing form, and the power of 2 interval determination protocol.

[0016] In one embodiment, in Newton's iteration method, the iteration value of the (t+1)th iteration is: 1.5 times the iteration value of the tth iteration, minus 0.5 times the first product x' / a and the cube of the iteration value of the tth iteration.

[0017] According to a third aspect, a data processing apparatus for multi-party secure computation is provided, used to determine the arithmetic sharing form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, and the apparatus is located on the first party, comprising:

[0018] The preprocessing unit is configured to add a first piece of the square of a predetermined additional term ε to the first piece of x to obtain a first piece of the approximate value x', wherein the modulus of the predetermined additional term ε is less than a predetermined value;

[0019] The reference value determination unit is configured to perform a security determination protocol with the second party on the approximate value x' to obtain the first slice of reference data a, wherein the reference data a is the smallest power of 2 greater than the approximate value x'.

[0020] The secure inversion unit is configured to use the first slice of reference data a to securely execute a power-of-2 inversion protocol with the second party to obtain the first slice of the inverse 1 / a of reference data a;

[0021] The secure multiplication unit is configured to use the first slice of the inverse 1 / a of the reference data a, the first slice of x', and the second party to determine the first product x' / a through secure multiplication, thereby obtaining the first slice of the first product x' / a;

[0022] The iterative unit is configured to work with the second party using Newton's iteration method, with the inverse of the square root of 2. As the initial value of the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, and the first piece of the inverse square root y' of x / a is obtained;

[0023] The secure multiplication unit is further configured to utilize the first slice of the inverse square root y' of x' / a, and the inverse square root of a obtained by performing a power-of-2 inverse square root protocol with the second party. The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0024] According to the fourth aspect, a data processing apparatus for multi-party secure computation is provided, used to determine the arithmetic sharing form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, and the apparatus is located on the first party, comprising:

[0025] The decision unit is configured to determine, via a security decision protocol, the largest power of 2 b not greater than the target data x, and obtain the first fragment of b; and

[0026] Based on the first slice of b and the second-party security determination of whether x is zero, the first slice of the judgment result s is obtained, wherein the first slice of the judgment result s is a single bit of 0 or 1;

[0027] The selection unit is configured to safely select the inverse of the square root of the target data x between the candidate value y and the inverse of the predetermined additional term ε through the judgment result s, and to perform subsequent business processing. Wherein, if s is 1, the candidate value y is selected, and if s is 0, the inverse of the predetermined additional term ε, 1 / ε, is selected.

[0028] The secure computing unit is configured to securely determine the candidate value y with a second party in the following manner: First, the first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a power-of-2 inverse protocol is securely executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a first product x / a is determined with the second party via secure multiplication, thus obtaining the first piece of the first product x / a; finally, a power-of-2 inverse is securely executed with the second party using Newton's iteration method to obtain the first piece of the inverse x / a. As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse of a obtained by performing a power-of-2 square root inversion protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0029] According to a fifth aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first or second aspect.

[0030] According to a sixth aspect, a computing device is provided, including a memory and a processor, characterized in that the memory stores executable code, and when the processor executes the executable code, it implements the method of the first aspect or the second aspect.

[0031] The method and apparatus provided in the embodiments of this specification, in the scenario of performing the inverse arithmetic and square root extraction on any non-negative number x in a two-party secure computation scenario, utilize non-zero reference data a, which is a power of 2, and select a constant term via Newton's iteration method. As the initial value for iteration, the inverse square root of x / a is calculated to avoid non-negative x appearing in the denominator. After the iteration is complete, the inverse square root of a is used... Restore the inverse square root of x / a to the inverse square root of x.

[0032] For non-negative numbers x, a technique of adding a predetermined additional term ε can be adopted to make the inverse square root of x bounded by an upper limit. Based on this technique, one implementation can add the predetermined additional term ε to the square root of x, and use the inverse square root determined by Newton's iteration method using an approximate value x' as the inverse square root of x, thus avoiding the calculation of the inverse square root of x when it is 0. Another implementation can determine whether x is 0, and based on the determination result, select an upper limit of 1 / ε when x = 0, and determine the inverse square root of x according to the above Newton's iteration method when x is non-0. The technique in this specification can provide a new way to calculate the inverse square root of non-negative numbers in multi-party secure computation scenarios, solve the problem of invalid calculation results when non-negative numbers are 0, and improve the data processing effectiveness of multi-party secure computation. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This diagram illustrates the interaction flow of data processing in a multi-party secure computation performed by two parties according to one embodiment.

[0035] Figure 2 This diagram illustrates the data flow for performing a two-way safe multiplication.

[0036] Figure 3 This diagram illustrates the data flow for executing a two-party security squared agreement.

[0037] Figure 4 A flowchart illustrating a method for data processing in a multi-party secure computation with a single participant, according to one embodiment;

[0038] Figure 5 This diagram illustrates the interaction flow of data processing in a multi-party secure computation performed by two parties according to another embodiment;

[0039] Figure 6 A flowchart illustrating a method for data processing in a multi-party secure computation with a single participant, according to another embodiment;

[0040] Figure 7 A schematic block diagram of an apparatus for data processing in a multi-party secure computation with a single participant, according to one embodiment;

[0041] Figure 8 A schematic block diagram of an apparatus for data processing in a multi-party secure computation with a single participant, according to another embodiment, is shown. Detailed Implementation

[0042] The technical solutions provided in this specification are described below with reference to the accompanying drawings.

[0043] Secret sharing, also known as secret splitting or secret sharing, works by dividing a secret (such as a key or private data) into multiple shares, each held by a different data party. The secret can only be recovered when more than a certain number of parties combine their shares; shares obtained from fewer than the threshold cannot recover any information from the secret. In multi-party secure computation, the threshold number is usually the same as the number of participating parties, and the shares into which the secret is split can also be called fragments.

[0044] Secret sharing is a crucial technique in secure multi-party computation. Common forms of secret sharing in secure multi-party computation include arithmetic sharing, Boolean sharing, and Yao's Sharing. The following description uses the sharing of secret data x as an example to illustrate these various sharing methods.

[0045] Arithmetic sharing, also known as sum sharing, involves dividing an integer x into two slices, x = x... L +x R Mod 2 N The shared form (translated to [0, 2) N The interval (-1] is distributed and stored between the two parties, so that one party does not know x. R The other party is unaware of x L Neither of the two sides can yield the complete form of x. Furthermore, the two sides can be extended to multiple sides, as denoted as x = x1 + x2 + ... + x d Assuming N = 64, then x can be represented as a single fragment of a data set in a single participant using a 64-byte (bit) binary number. One way to split a piece of data x into shared fragments is, for example, by randomly generating d-1 binary shards. 64The values ​​within the range (such as randomly generated 64-byte binary numbers) are used as d-1 slices, denoted as x1, x2, ..., x... d-1 , and use against 2 64 (translate to [0, 2) 64 The interval [-1] is used as another partition by taking the modulo of the interval (x). d = x - x1 - x2 - ... - x d-1 .

[0046] Boolean sharing is a secret sharing method that uses an XOR operation on bits. For example, considering two participants, suppose x is a one-bit data (with a value of 0 or 1), and... In a Boolean shared form between two participants, x0 and x1 are two Boolean shared partitions of x in the two participants, each taking a value of 0 or 1. This represents the XOR operation. A single participant is unaware of the other participant's share and therefore cannot deduce the data x. For data x' consisting of n bits, an n-bit binary number can be randomly generated as one party's Boolean shared share (e.g., x0'). The other party's Boolean shared share (e.g., x1') can be obtained by XORing x' with that party's Boolean shared share. Sure.

[0047] Yao's sharing is a sharing method related to garbled circuits (GC). This specification does not cover this sharing method and will not elaborate on it here.

[0048] Each of the three sharing methods described above has its own advantages and disadvantages. In multi-party secure computation business processes, the sharing format of business data can be transformed for ease of processing. The transformation between various sharing methods can be achieved through conventional technologies, which will not be listed here. This specification will not emphasize that the transformation between sharing formats can be performed according to requirements and computational convenience.

[0049] In business processing based on multi-party computation, division or inverse calculations are commonly encountered, such as 1 / x. The dividend x can be a pre-defined value, a value extracted from business data, or an intermediate calculation result. For a non-negative number x, inverse square root calculations may also be required, such as denoted as... In computer calculations, numerical forms such as fixed-point numbers and floating-point numbers are typically used. When x approaches 0, It is unbounded, and may be truncated to 0 during the calculation process. In this case, errors in the calculation may lead to incorrect business processing results.

[0050] In view of this, this specification proposes to address the dividend. Adding a tiny positive number ε (hereinafter referred to as a pre-defined addition, such as 0.1) makes the inverse calculation of the square root of x become: Thus, when x is close to 0, its square root inverse has an upper bound of 1 / ε. In actual business processing, adding a small additional term ε makes the process meaningful for most cases of x, while for the few extreme cases where x approaches 0, the impact of adding the small additional term ε on the business processing result is within a controllable range.

[0051] Based on the above technical concepts, this specification provides two similar approaches to solve the corresponding technical problems. In one approach, the predetermined additional term ε can be added to the square root of x, and the inverse square root of x, determined using Newton's iteration method with an approximate value x', can be used as the inverse square root of x, thus avoiding the calculation of the inverse square root when x is 0. In the other approach, it is possible to determine whether x is 0, and based on the determination result, an upper bound of 1 / ε can be selected when x = 0, and the inverse square root of x can be determined using the aforementioned Newton's iteration method when x is not 0.

[0052] The technical concept of this specification is described in detail below with reference to the examples shown in the accompanying drawings.

[0053] To make the description clearer, Figure 1 , Figure 5 Each illustrates an interactive process for data processing under multi-party secure computation involving two participants, the first and the second. First, x can be stored in both the first and second parties using a shared method of fixed-point or floating-point numbers (such as arithmetic sharing or Boolean sharing). ε and / or ε 2 The data can be held by both the first and second parties in the same sharing manner. For ease of description, the share held by the first party in this data sharing method will be referred to as the first share, and the share held by the second party will be referred to as the second share. According to the sharing method conversion rules, it is assumed that the data space for arithmetic sharing is limited to 0 to 2 bits by the number n. n -1, then the number of bits per Boolean shared segment is also n. Where ε and / or ε 2 The fragments can be randomly determined by a trusted third party and distributed to the first and second parties. In an optional embodiment, to conserve communication bandwidth, ε and / or ε... 2 One party's fragments can be generated by the relevant participating party in a manner consistent with that of a trusted third party, while the other party's fragments are generated by the third party based on ε and / or ε. 2 The value is generated and then distributed.

[0054] refer to Figure 1The example shown employs the approach of adding the predetermined term ε to the square root of x, and using the inverse of the square root of the approximate value x' determined by Newton's iteration method as the inverse of the square root of x. Furthermore, to facilitate secure computation using shared partitions in multi-party secure computation, it can be... Rewritten The differences between the two are negligible in business processing.

[0055] First, referring to step 101, in order to calculate the inverse of the square root of x, we can let x' = x + ε. 2 And replace the inverse square root of x with the result of calculating the inverse square root of x'. Thus, the first side can combine the first slice of x with ε. 2 The first piecewise summation, the second piecewise summation, can be achieved by combining the second piecewise summation of x with ε. 2 The second piecewise summation is performed to obtain the shared form of x' in the first and second parties.

[0056] Next, referring to step 102, the first and second parties run the security determination protocol to obtain a reference value 'a'. Here, 'a' is the smallest power of 2 greater than x', and it is shared between the first and second parties. It can be understood that the security determination protocol here is used to determine the most significant bit of x' in binary, and then multiply it by 2 to obtain 'a'.

[0057] In a shared configuration, the secure computation protocol here could be, for example, a protocol for determining the first non-zero bit. For instance, the first and second parties could use a compiler to create a Boolean circuit that identifies the first non-zero bit to determine this first non-zero bit.

[0058] As a concrete example, for a data m, its most significant bit is the highest bit with a value of 1. In the binary representation of the most significant bit, only the e-th bit of data m is 1, and all other bits are zero. Therefore, the largest power of 2 not greater than m is 2. e If the participants in m form a Boolean shared structure, according to the characteristics of the XOR and OR operations, if the XOR result of all the values ​​of a bit is 1, then the OR result is also 1. Therefore, each participant can perform a series of safe OR operations on each Boolean shared segment of m until a bit with a 1 is obtained, which is the most significant bit.

[0059] In Boolean sharing, a safe OR operation can be implemented using the XOR and AND operations. For example, for two partitions A and B, A OR B can be implemented using (A AND B) XOR (A XOR B). Where A and B consist of multiple bits, A XOR B can be implemented using a bit-by-bit XOR operation; for example, at the i-th bit, A XOR B can be implemented using A XOR B. i xor Bi A and B can be implemented. Security or operation can be achieved using conventional techniques, such as those described in the paper "ABY – A Framework for EfficientMixed-Protocol Secure Two-Party Computation" (https: / / encrypto.de / papers / DSZ15.pdf), which will not be elaborated here.

[0060] Thus, by performing a security or operation, the first and second parties can determine the most significant bit of x', thereby obtaining a reference value b = 2 among all participants. e Each shared shard.

[0061] In other embodiments, the reference value b can also be determined by a security determination protocol such as 2-power interval determination, which will not be elaborated here.

[0062] The execution result of the above protocol can describe the most significant bit of x', and constitutes a shared form between the two participants. Since a is the least power of 2 greater than x', multiplying it by 2 yields the reference value a = 2b. In the Boolean shared form, b = 2b can be obtained. e After the two fragments are processed, the first and second parties each shift their local fragment one bit to the higher bit (left) and pad it with 0s in the lower bits, which is equivalent to amplifying the data by 2 times. This gives us the reference value a = 2. e+1 These constitute two partitions for Boolean sharing. In arithmetic sharing, the first and second parties can each allocate their local partitions modulo 2. n Multiplying the result by 2, we get a = 2b, which constitutes two arithmetic-shared partitions.

[0063] Then, referring to step 103, the first party and the second party can safely execute the power of 2 inverse protocol to obtain the arithmetic shared form of the inverse 1 / a of the reference data a, wherein the first party and the second party obtain the first and second fragments of 1 / a, respectively.

[0064] Since 'a' is a power of 2, its inverse can be determined using the conventional method, or its inverse can be determined by utilizing the special properties of powers of 2, thus reducing communication between the two parties. The following describes the inverse determination process using the special properties of powers of 2 as an example.

[0065] Those skilled in the art will understand that powers of 2 in binary form have the following properties:

[0066] (1) The powers of 2 and their inverses are all 1 by only one bit (e.g., the t-th bit counted from the least significant bit as the 0th bit), and the rest are 0. When the powers of 2 are in a Boolean shared form between the two participants, the two Boolean slices are different by only one bit.

[0067] (2) For integer powers of 2, the bit before the decimal point is 1 and the rest are 0, while for the inverse of integer powers of 2, the bit after the decimal point is 1 and the rest are 0.

[0068] (3) If the least significant bit before the decimal point is designated as the 0th bit, then the inverse of a power of 2 and a power of 2 have the following relationship: 2 t The (t+1)th bit before the decimal point (the t-th bit) is 1, 2 t The inverse of the digit is 1 in the t-th bit after the decimal point.

[0069] Based on the above properties, the Boolean sharing form corresponding to the inverse of the power of 2 can be determined by reversing the Boolean fragments of the powers of 2, thereby arranging the bits with a value of 1 after the decimal point. Then, according to the Boolean sharing form to arithmetic sharing form conversion protocol (such as the B2A protocol mentioned above), the fragments of each participant are converted into arithmetic fragments.

[0070] As a concrete example, the principle of finding the inverse of a power of 2 in binary form is as follows: Suppose a value 8 = 2... 3 If the number of decimal places f is 4, then its binary form is 1000 0000, where 1 is in the 7th bit, i.e., 8 = 2. 7 ×2 -4 =2 3 The four 0s in the lower bits represent the fractional part after the decimal point, and the bit value 1 is located in the third bit counting from the least significant bit before the decimal point. Reversing the binary data 1000 0000, changing the most significant bit to the least significant bit, we get 0000 0001. If we keep the decimal point position unchanged, we have: 2 0 ×2 -4 =2 -4 =8 -1 ×2 -1 If you want to get 8 -1 If the number of decimal places is changed to f=3, then 0000 0001 corresponds to 2. 0 ×2 -3 =8 -1 Alternatively, pad with 0s in the least significant bit and truncate the most significant bit to get 0000 0010, corresponding to f=4 decimal places and 2. 1 ×2 -4 =8 -1 .

[0071] In the Boolean sharing form, if both the first and second parties perform the same processing on their local Boolean fragments, they can each obtain a Boolean fragment that is the inverse of a power of 2. Optionally, the first and second parties can obtain an arithmetic sharing form that is the inverse of a power of 2 by executing a secure B2A (Boolean sharing form to arithmetic sharing form) protocol on the two Boolean fragments. The secure B2A protocol can be any protocol capable of converting Boolean sharing form to arithmetic sharing form, and will not be elaborated further here. Thus, according to the principle of finding the inverse of a power of 2, each party can obtain a fragment of 1 / a, forming an arithmetic sharing form of 1 / a in the first and second parties.

[0072] Further, referring to step 104, the first and second parties determine the product x' / a of x' and 1 / a via safe multiplication. This product x' / a constitutes a shared form between the two parties.

[0073] Figure 2 A flowchart illustrating a specific example of safe multiplication is shown. Figure 2 As shown, during the secure multiplication of data g held by the first party and data h held by the second party, a trusted third party (such as...) can be involved. Figure 2 A pseudo-random number generator (in the context of the system) generates random numbers s and v, and two shards z1 and z2 stored in an arithmetic-shared manner, sv = z. A third party can generate various auxiliary parameters according to the constraint sv = z0 + z1. The first party can obtain s and z1 from a trusted third party or generate them locally, while the second party can obtain one of z1 and z2 from the trusted third party and obtain the other from the third party or generate it locally. For example, if s and z1 are generated by the first party using a pseudo-random number generator consistent with the agreement of the trusted third party, v is generated by the second party using a pseudo-random number generator consistent with the agreement of the trusted third party, and z2 is obtained by the second party from the trusted third party, then the offline communication volume can be only the communication volume of a single data shard (such as z1).

[0074] Here, s and v can be considered as perturbation terms for g and h respectively, and e and f represent the perturbation results of g and h after adding noise, respectively. The first party calculates the perturbation result e = gs and sends it to the second party, while the second party calculates the perturbation result f = hv and sends it to the first party. Further, the first party can calculate one sum-sharing segment of g × h, c0 = sf + z0, and the second party can calculate another sum-sharing segment of g × h, c1 = ev + z1. Substituting the expressions for e and f, we have: c0 + c1 = sf + z0 + ve + z1 = gh. That is, c0 and c1 constitute the sum-sharing form of the product of g and h.

[0075] Will Figure 2 If g is replaced with x' and h is replaced with 1 / a, then it can be done. Figure 2The principle shown determines the product x' and 1 / a, x' / a, which is arithmetically shared through the first slice held by the first party and the second slice held by the second party.

[0076] Then, referring to step 105, the first and second sides use Newton's iteration method to... As the inverse of the square root of x' / a The initial value is used to determine the inverse square root y' of x' / a after a predetermined number of iterations.

[0077] The Newton-Raphson iteration formula used to calculate the inverse square root of x' / a is: y t+1 ' = 1.5y t '-0.5x' / a×y t ' 3 During the iteration process, y t Since ' and x' / a form a shared form in the first and second parts, the iterative process can be completed using fractional square calculations, multiplication calculations, addition calculations, etc., such as y t ' 3 The process can be broken down into two safe multiplications, or one safe square calculation and one safe multiplication calculation, which will not be elaborated here.

[0078] Figure 3 A flowchart illustrating a specific example of the Security Square Protocol is shown. Figure 3 The calculation principle of the safe square protocol is shown below: For a data l, with the introduction of a disturbance j, we have: l 2 =(xj) 2 +2(xj)j+j 2 Assume that data l is constructed and shared by the first and second parties. The first party holds the first fragment l0, and the second party holds the second fragment l1. Let lj be the perturbation value dl, and denote the constant term j as... 2 =k can be considered as a balance term to eliminate disturbances, and can then be determined by a trusted third party (such as...) Figure 3 The diagram shows a random number generator (a server) generating fragments j0, j1, k0, and k1 for each of j and k, providing j0 and k0 to the first party and j1 and k1 to the second party. Here, j0, j1, k0, and k1 can be generated according to the constraint (j0 + j1). 2 = (k0 + k1), where three of these are randomly generated, and the fourth is calculated from the other three. For example, the first party generates random numbers j0 and k0, the second party generates random number j1, and a trusted third party generates random numbers j0, k0, and j1, calculates k1, and provides it to the second party. In this way, offline communication can be limited to the communication of only one data fragment (such as k1).

[0079] Then, the first party can calculate a fragment of the disturbance value dl, dl0 = l0 - j0, and provide it to the second party. Similarly, the second party can calculate another fragment of the disturbance value dl, dl1 = l1 - j1, and provide it to the first party. In this way, the first and second parties can each calculate the disturbance value dl = dl0 + dl1. In practice, one party can also calculate a fragment of the disturbance value dl and provide it to the other party, while the other party calculates the other fragment of dl locally and provides the disturbance value dl to the other party.

[0080] Furthermore, both the first and second parties calculate l locally. 2 The corresponding fragments. For example... Figure 3 As shown, in a specific example, the first party can compute a fragment s0 = (l 2 )0=(lj) 2 +2(lj)j0+(j 2 )0=dl×dl+2dl×j0+k0, the second side can calculate another piece s1=(l 2 )1=2(lj)j1+(j 2 )1=2dl×j1+k1. In practice, the first and second parties can also use local data to calculate the corresponding fragments in other ways, such as the second party calculating s1=dl×dl+2dx×j1+k1, the first party calculating s0=2dl×j0+k0, etc., which are not limited here.

[0081] In y t ' 3 Decomposed into a safe square y t ' 2 Calculate with a safe multiplication y t ' 2 ×y t In the case of ', it is possible to make Figure 3 l = y t Therefore, y can be calculated safely. t ' 2 reuse Figure 2 The safe multiplication calculation y shown t ' 2 ×y t It is worth noting that, unless otherwise specified, each fragment in the execution of the Security Square protocol is modulo 2. n In the form of.

[0082] The number of iterations in Newton's iterative formula can be determined based on the number of integer and decimal places of the fixed-point or floating-point number. For example, when comparing 64 to a fixed-point number with 14 decimal places, the number of iterations is 4. After the iterations, y' forms an arithmetic shared form in the first and second powers.

[0083] Thus, through step 105, we can obtain the inverse square root of x' / a, which is equivalent to reducing x' by a factor of a. To obtain the inverse square root of x', we need to multiply y' by the inverse square root of a, which gives us the inverse square root of x', i.e., the inverse square root of x'. in, It can be used with y' Safe multiplication calculation.

[0084] Thus, referring to step 106, the first party and the second party execute y' and Safe multiplication to determine the inverse square root of the target value x. The first party and the second party respectively obtain the first and second fragments of y, forming a shared form.

[0085] in, This is the inverse of the square root of a power of 2. The inverse of the square root of a power of 2 can be calculated using the conventional, safe method of finding the square root of the inverse, or it can utilize the special properties of powers of 2 to construct a squaring operation, thereby reducing the amount of communication between the parties involved in the safe computation. Specifically, for... Based on the above safe inverse calculation, safe square root calculation can be performed. Safe square root calculation can be implemented using a GMW circuit or by constructing a safe square root calculation mechanism. The following description uses the special properties of powers of 2 as an example.

[0086] The first and second parties can safely execute the square root extraction protocol for powers of 2 to obtain the inverse square root of the reference data a. Arithmetic sharing format.

[0087] The following example illustrates how to construct a safe square to calculate the inverse square root of a power of 2.

[0088] Specifically, since the square of a power of 2 is still a power of 2, the square root calculation of the inverse of a power of 2 can be transformed into the calculation of taking the fourth root and then squaring it. Below, we take the power of 2, p = 2... q The principle is described in detail using the square root of .

[0089] First, determine the number of decimal places f for a fixed-point or floating-point number represented by n bits to be a multiple of 4. This is because, for 2... -f Taking the square root yields 2. -f / 2 However, under the technical concept of this specification, it is necessary to construct a square calculation, and 2 -f / 4 The square of is 2 -f / 2Therefore, for ease of calculation, f can be set to a multiple of 4. Furthermore, the local Boolean fragment can be divided into four groups of equally spaced bits using the first and second methods in an arithmetic progression of bits (equally spaced bits). Specifically, bits 0, 4, 8, 12... form one group; bits 1, 5, 9... form another group; bits 2, 6, 10... form another group; and bits 3, 7, 11... form yet another group. Alternatively, given that j takes the values ​​0, 1, 2, and 3, the bits corresponding to all i that satisfy 4i + j ≤ n form one group. Assuming the relative position of the decimal point and the bit value remains unchanged within each group, the fixed-point number corresponding to a single group of bit values ​​can be denoted as f / 4.

[0090] Thus, for the bit value of a single group of equally spaced bits, the corresponding arithmetic reference value is determined using its corresponding binary number. Assume the first party holds the first Boolean segment p of p. L The second party holds the second Boolean fragment p of p. R Then the number of decimal places corresponding to a single group is f / 4, and the first party can determine four first reference values: y L1 =p0 L ×2 0-f / 4 +p4 L ×2 1-f / 4 +p8 L ×2 2 -f / 4 ...; y L2 =p1 L ×2 0-f / 4 +p5 L ×2 1-f / 4 +p9 L ×2 2-f / 4 ...; y L3 =p2 L ×2 0-f / 4 +p6 L ×2 1-f / 4 +p 10 L ×2 2 -f / 4 ...; y L4 =p3 L ×2 0-f / 4 +p7 L ×2 1-f / 4 +p 11 L ×2 2-f / 4 Similarly, the second party determines four second reference values: y R1 =p0 R ×2 0-f / 4 +p4 R ×2 1-f / 4 +p8 R ×2 2-f / 4 ...; yR2 =p1 R ×2 0-f / 4 +p5 R ×2 1-f / 4 +p9 R ×2 2-f / 4 ...; y R3 =p2 R ×2 0-f / 4 +p6 R ×2 1-f / 4 +p 10 R ×2 2-f / 4 ...; y R4 =p3 R ×2 0-f / 4 +p7 R ×2 1-f / 4 +p 11 R ×2 2-f / 4 ...

[0091] Since only one bit of a power of 2 is 1, for the four Boolean segments of p, y L1 -y R1 y L2 -y R2 y L3 -y R3 y L4 -y R4 Only one of them is not zero, and among each reference value, when a single bit is raised to the fourth power, it is related to the corresponding bit in p. L There are 4 between the corresponding actual values. 0 / 4 4 1 / 4 4 2 / 4 4 3 / 4 The difference is a multiple of each other. Therefore... The arithmetic value satisfies:

[0092]

[0093] The coefficients corresponding to the square values ​​are 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ... 2. This can be seen as a balancing coefficient to balance this multiple difference. Thus, by determining the square of the corresponding difference between the four reference values ​​of each side using the first and second sides, the square root value of p can be obtained. Furthermore, it can be guaranteed that the square root value is positive.

[0094] Let p = 1 / a, then its inverse square root can be determined using the method described above. The first party and the second party respectively hold The first and second fragments constitute The arithmetic sharing form. Among them, the method of constructing squares to realize the inverse of the square root of powers of 2 can significantly reduce the communication volume compared to the conventional square root inverse calculation (such as the GMW circuit method). For example, the online communication volume for calculating the fourth square is 8n. This can be done at any time after the value of 'a' is determined in step 102 and before the safe multiplication is performed in step 106. For example, it can be done directly after determining 1 / a in step 103. This instruction manual does not impose any limitations on this.

[0095] pass Figure 1 The illustrated process allows the first and second parties to determine the inverse calculation method for the square root of a non-negative number x with a small additional term ε. In this process, by adding a small positive number ε to the square root of x, the problem can be avoided when the target data x is close to 0 under the safe computational architecture. The situation where an unbounded boundary is truncated to 0, affecting the business processing result.

[0096] according to Figure 1 As shown in the interaction flow, the first and second parties execute similar processes in determining the inverse square root of the target data x. Figure 4 Taking the first party as an example, describe the process executed by any of the participating parties.

[0097] like Figure 4 As shown, the process executed by the first party includes the following steps:

[0098] Step 401: Add a first piece of predetermined addition ε squared to the first piece of x to obtain the first piece of approximate value x'; wherein, the modulus of predetermined addition ε is less than a predetermined value, and the first piece of approximate value x' and the second piece of approximate value x' obtained by the second party by adding the second piece of predetermined addition ε squared to the second piece of local x constitute a shared form of approximate value x';

[0099] Step 402: Perform a security decision protocol with the second party on the approximate value x' to obtain the first fragment of reference data a, wherein the reference data a is the smallest power of 2 greater than the approximate value x'; this step can be performed jointly with the second party, and the first fragment of reference data a and the second fragment of a obtained by the second party constitute a shared form of reference data a.

[0100] Step 403: Using the first slice of reference data a, the second party securely executes the power of 2 inversion protocol to obtain the first slice of the inverse 1 / a of reference data a; correspondingly, the second party can obtain the second slice of 1 / a.

[0101] Step 404: Using the first piece of the inverse 1 / a of the reference data a, the first piece of x', and the second party through safe multiplication, determine the first product x' / a, and obtain the first piece of the first product x' / a; correspondingly, the second party can obtain the second piece of the first product x' / a.

[0102] Step 405, together with the second party, safely utilizes Newton's iteration method, using the inverse square root of 2. As the initial value of the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, and the first piece of the inverse square root y' of x' / a is obtained; correspondingly, the second part of the inverse square root y' of x' / a can be obtained.

[0103] Step 406: Using the first piece of the inverse square root y' of x' / a, and the inverse square root of a obtained by performing a power-of-2 square root inverse with the second party. The first slice is used to perform a safe multiplication with the second slice to determine the inverse square root of the target value x. The first slice of y is obtained. Correspondingly, the second party can obtain the second slice of y.

[0104] It is worth noting that, Figure 4 The data processing flow shown is Figure 1 The interactive flow shown is the process executed by the first party, therefore, Figure 1 The relevant descriptions of first-party companies in the text also apply. Figure 4 The process shown will not be repeated here.

[0105] On the other hand, since x approaches 0 when the predetermined additional term ε is added, then... Since the value of x approaches 1 / ε, a safe zero-value test can be performed on the value of x, that is, to safely determine whether it is 0. If it is 0, the inverse square root of x is set to the upper bound of 1 / ε. If it is not 0, the inverse square root of x is determined to be y by Newton's iteration method. Figure 5 This illustrates a specific implementation process of the proposed solution. The following section combines... Figure 5 The illustrated process describes one implementation scheme based on the technical concept of this specification.

[0106] First, referring to step 501, the first party and the second party determine the largest power of 2 b not greater than the target data x through a security determination protocol, and obtain the first and second fragments of b respectively. The security determination protocol here is similar to that in step 102, and will not be described again here.

[0107] Then, referring to step 502, the first and second parties securely determine whether x is zero, obtaining the first and second slices of the judgment result s, respectively. The judgment result s can be a single bit of 0 or 1, forming a shared form between the first and second parties. Thus, both the first and second slices of the judgment result s can be represented by a single bit of 0 or 1, forming a Boolean shared form or a modulo-2 arithmetic shared form of s.

[0108] It is understandable that since b is the largest power of 2 not greater than x, when x is 0, b = 0, and the values ​​of each bit in the two Boolean slices forming the Boolean shared form are the same. Otherwise, b has only one bit set to 1 in binary, meaning that only one bit in its Boolean slices has a different value. Based on this characteristic, in one embodiment, the first and second parties can each sum the values ​​of each bit in their local Boolean slice of b modulo 2, which serves as the local slice of s. When b = 0, the slices of s in the first and second parties are the same (s = 0, x = 0); otherwise, the slices of s in the first and second parties are different (s = 1, x ≠ 0).

[0109] In other embodiments, the sharing form of s can also be obtained through other security determination protocols such as security equality determination (security determination whether the fragments held by the two parties are equal), which will not be listed here.

[0110] In addition, the first party and the second party can also communicate with Figure 1 A similar process is used to determine the candidate value y of the inverse square root of x via Newton's iteration method. The process of determining the candidate value y of the inverse square root of x can be performed before step 501, or in parallel with at least one of steps 501 and 502, or after one of the steps has been completed; there is no limitation on this.

[0111] Assuming the candidate value y is determined after step 501, denoted as step 502', then step 502' may include the following sub-steps:

[0112] Sub-step 5021': The first and second parties each multiply the corresponding slice of b by a factor of 2, using it as the corresponding slice of the reference data a. The method for multiplying the corresponding slice of b by a factor of 2 modulo 2 in arithmetic form is as follows: n In the form of Boolean sharing, it is done by shifting one bit to the higher bit and padding the lower bit with a 0.

[0113] In sub-step 5022, the first and second parties securely execute the power-of-2 inversion protocol, obtaining the first and second fragments of the inverse 1 / a of the reference data a, respectively. The power-of-2 inversion protocol has been described previously and will not be repeated here. Utilizing the special properties of powers of 2 for inversion significantly reduces communication overhead.

[0114] Sub-step 5023': The first and second sides are multiplied securely to determine the first product x / a, and the first and second parts of the first product x / a are obtained respectively;

[0115] Sub-step 5024': The first and second sides safely utilize Newton's iteration method, using the inverse square root of 2. As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, and the first and second pieces of the inverse square root y' of x / a are obtained respectively. The Newton iteration formula at this point is, for example, y t+1 ' = 1.5y t -0.5x / a×y t ' 3 .

[0116] Sub-step 5025': Perform safe multiplication between the first and second sides to determine the inverse candidate value of the square root of the target value x. And the first and second slices of the candidate value y are obtained respectively. Where, the inverse square root of a... It is obtained by the first party and the second party performing the inverse square root protocol of a power of 2.

[0117] Further, referring to step 503, the first party and the second party safely select one of the candidate value y and the inverse of the predetermined additional term ε as the calculation result of the square root inverse of the target data x through the judgment result s, for subsequent business processing. Wherein, if s is 1, the candidate value y is selected; if s is 0, the inverse of the predetermined additional term ε, 1 / ε, is selected.

[0118] The choice between y and 1 / ε can be made through secure computation. In a specific example, a secure computation s×(y-1 / ε)+1 / ε can be used to choose between y and 1 / ε. It can be seen that when s=0, 1 / ε can be chosen, while when s=1, y is chosen. Since s, y, and 1 / ε are all shared between the first and second parties, neither the first nor the second party can know which value was ultimately chosen for subsequent business processing, effectively protecting data privacy.

[0119] pass Figure 5The process shown allows the first and second parties to determine the inverse square root of x in different ways depending on whether x is 0 (or truncated to 0 due to its small size). When x is 0, the constant 1 / ε is used as the inverse square root to avoid data errors caused by the unbounded inverse square root, which would affect the accuracy of the business processing.

[0120] Figure 5 In the illustrated process, the first and second parties execute similar procedures in determining the inverse square root of the target data x. Figure 6 Taking the first party as an example, describe the process executed by any one of the participating parties. For example... Figure 6 As shown, the data processing flow executed by the first party may include:

[0121] Step 601: Through the security decision protocol, determine the largest power of 2 b that is not greater than the target data x, and obtain the first piece of b;

[0122] Step 602: Based on the first slice of b and the second-party security determination whether x is zero, the first slice of the judgment result s is obtained, wherein the first slice of the judgment result s is a single bit of 0 or 1;

[0123] Step 603: The second party safely selects the inverse of the square root of the target data x between the candidate value y and the inverse of the predetermined additional item ε through the judgment result s, so as to carry out subsequent business processing. Wherein, if s is 1, the candidate value y is selected, and if s is 0, the inverse of the predetermined additional item ε, 1 / ε, is selected.

[0124] The candidate value y is determined as follows: The first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a safe power-of-2 inverse protocol is executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a safe multiplication is performed with the second party to determine the first product x / a, thus obtaining the first piece of the first product x / a; and using Newton's iteration method safely with the second party, the inverse of the square root of 2 is calculated... As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse of a obtained by performing a power-of-2 square root inversion protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0125] It is worth noting that, Figure 6 The data processing flow shown is Figure 5The interactive flow shown is the process executed by the first party, therefore, Figure 5 The relevant descriptions of first-party companies in the text also apply. Figure 6 The process shown will not be repeated here.

[0126] It is understood that the terms "first party" and "second party" are used only to distinguish between two participants in secure computation. The terms "first" and "second" in the above names, such as "first shard," "second shard," etc., are all qualifiers added to the descriptions corresponding to the respective participants. In other words, these "first" and "second" qualifiers describe the correspondence with the corresponding participants. In practice, the operations performed by the first party and the second party can be interchanged, while the correspondence described above remains consistent. That is, the terms "first" and "second" in the names can also be interchanged for correspondence, but this specification does not impose any restrictions on this.

[0127] Furthermore, according to some optional implementation methods, in multi-party secure computation involving more than two parties, to facilitate the arithmetic inverse and square root extraction of the target data, the fragments held by one or more parties can be XORed sequentially and then merged into one party. Ultimately, this results in x forming a shared form distributed across the two parties. In this way, the square root inverse of the target data can be executed by the two parties without revealing the target data itself. The shared fragments obtained by these two parties for the square root inverse of the target data can be randomly split and distributed to other parties, thus allowing the square root inverse of the target data to be constructed and shared across multiple parties.

[0128] Reviewing the above process, in the scenario of calculating the square root of the inverse arithmetic for any non-negative number x in the two-party secure computation scenario, the non-zero reference data 'a', which is a power of 2, is used, and the constant term is selected through Newton's iteration method. As the initial value for iteration, the inverse square root of the ratio of the target value to 'a' is calculated to avoid non-negative numbers 'x' appearing in the denominator. After the iteration is complete, the inverse square root of 'a' is used... The inverse square root of the ratio of the target value to 'a' is restored to the inverse square root of the target value. Furthermore, by converting and inverting and square-rooting the powers of 2 'a', appropriate secure computation protocols can be executed based on the special characteristics of powers of 2, significantly reducing communication overhead.

[0129] For non-negative numbers x, a technique of adding a predetermined additional term ε can be employed to give the inverse square root of x an upper bound. Based on this technique, one implementation adds the predetermined additional term ε to the square root of x, and uses the inverse square root determined by Newton's iteration method using an approximate value x' as the inverse square root of x, thus avoiding the calculation of the inverse square root of x when it is 0. Another implementation determines whether x is 0, and based on the determination result, selects an upper bound of 1 / ε when x = 0, and determines the inverse square root of x according to the aforementioned Newton's iteration method when x is non-0. The technique in this specification can provide a new way to calculate the inverse square root of non-negative numbers in multi-party secure computation scenarios, solve the problem of invalid calculation results when non-negative numbers are 0, and improve the data processing effectiveness of multi-party secure computation.

[0130] According to another embodiment, an apparatus for data processing in a multi-party secure computation provided on the computing side is also provided. Figure 7 An apparatus 700 for data processing in a multi-party secure computation according to one embodiment is shown. The apparatus 700 can be located in any of the multiple parties involved in the multi-party secure computation. The following description uses the example of the apparatus 700 being located in the first party.

[0131] In the two-party secure computation, the target data x is shared in the form of a first fragment and a second fragment corresponding to the first party and the second party, respectively. Device 700 is used to determine the inverse square root of x.

[0132] like Figure 7 As shown, the device 700, located in the first party among multiple participating parties, includes:

[0133] The preprocessing unit 701 is configured to add a first piece of the square of a predetermined additional term ε to the first piece of x to obtain a first piece of an approximate value x', wherein the modulus of the predetermined additional term ε is less than a predetermined value;

[0134] The reference value determination unit 702 is configured to perform a security determination protocol with the second party on the approximate value x' to obtain the first slice of reference data a, wherein the reference data a is the smallest power of 2 greater than the approximate value x'.

[0135] The secure inversion unit 703 is configured to use the first slice of reference data a to securely execute a power-of-2 inversion protocol with the second party to obtain the first slice of the inverse 1 / a of reference data a.

[0136] The secure multiplication unit 704 is configured to use the first piece of the inverse 1 / a of the reference data a, the first piece of x', and the second party to determine the first product x' / a through secure multiplication, thereby obtaining the first piece of the first product x' / a.

[0137] Iteration unit 705 is configured to work with the second party to safely utilize Newton's iteration method, using the inverse square root of 2. As the initial value of the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, and the first piece of the inverse square root y' of x / a is obtained;

[0138] The secure multiplication unit 704 is further configured to utilize the first slice of the inverse square root y' of x' / a, and the inverse square root of a obtained by performing a power-of-2 inverse square root protocol with the second party. The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0139] Figure 7 Another data processing apparatus 800 for multi-party secure computation is shown, located on one of the computing parties. This apparatus 800 can be located on any of the multiple participating parties in the multi-party secure computation. The following description uses the example of the apparatus 800 being located on the first party.

[0140] like Figure 8 As shown, device 800 may include:

[0141] The determination unit 801 is configured to determine the largest power of 2 b not greater than the target data x via a security determination protocol, and obtain the first slice of b; and, based on the first slice of b and whether the second-party security determination x is zero, obtain the first slice of the determination result s, wherein the first slice of the determination result s is a single bit of 0 or 1.

[0142] The selection unit 802 is configured to safely select the inverse of the square root of the target data x between the candidate value y and the inverse of the predetermined additional item ε through the judgment result s, and to perform subsequent business processing. Wherein, if s is 1, the candidate value y is selected, and if s is 0, the inverse of the predetermined additional item ε, 1 / ε, is selected.

[0143] The secure computing unit 803 is configured to securely determine the candidate value y with a second party in the following manner: First, the first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a power-of-2 inversion protocol is securely executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a first product x / a is determined with the second party via secure multiplication, thus obtaining the first piece of the first product x / a; finally, a candidate value y is securely determined with the second party using Newton's iteration method, using the square root of 2 as the inverse... As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse of a obtained by performing a power-of-2 square root inversion protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second party to determine the inverse candidate value of the square root of the target value x. Obtain the first slice of y.

[0144] It is worth noting that, Figure 7 , Figure 8 The devices 700 and 800 shown are respectively with Figure 4 , Figure 6 Corresponding to the described method, Figure 4 , Figure 6 The corresponding descriptions in the method embodiments also apply to devices 700 and 800, and will not be repeated here.

[0145] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 4 , Figure 6 The methods described above.

[0146] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, it implements a combination... Figure 4 , Figure 6 The methods described above.

[0147] Those skilled in the art will recognize that the functions described in the embodiments of this specification in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0148] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the technical concept of this specification. It should be understood that the above are merely specific embodiments of the technical concept of this specification and are not intended to limit the scope of protection of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solutions of the embodiments of this specification should be included within the scope of protection of the technical concept of this specification.

Claims

1. A data processing method in multi-party secure computation, used to determine the arithmetic shared form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, the method being executed by the first party, comprising: Add the square of the predetermined addition term ε to the first piece of x to obtain the first piece of the approximate value x', where the modulus of the predetermined addition term ε is less than the predetermined value; The second party performs a security decision protocol on the approximate value x' to obtain the first slice of reference data a, where reference data a is the smallest power of 2 greater than the approximate value x'; Using the first slice of reference data a, a power-of-2 inverse protocol is securely executed with the second party to obtain the first slice of the inverse 1 / a of reference data a; Using the first piece of the inverse 1 / a of the reference data a, the first piece of x', and the second power through safe multiplication, the first product x' / a is determined, and the first piece of the first product x' / a is obtained; The second party safely utilizes Newton's iteration method, using the inverse of the square root of 2 / 1. As the initial value of the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, and the first piece of the inverse square root y' of x' / a is obtained; Using the first piecewise fractal of the inverse square root y' of x' / a, and the square root inverse 1 / a obtained by performing a power-of-2 square root inverse with the second party. The first slice is used to perform a safe multiplication with the second side to determine the inverse square root of the target data x, y = y' / , thus obtaining the first slice of y.

2. The method as described in claim 1, wherein the security determination protocol is one of the following: the most significant bit determination protocol in Boolean sharing form, the most non-zero bit determination protocol in arithmetic sharing form, and the power of 2 interval determination protocol.

3. The method of claim 2, wherein, The first slice of reference data a obtained by performing a security determination protocol with the second party on the approximate value x' includes: The first slice of b is obtained by determining the largest power of 2 that is no greater than the approximate value x' through the security determination protocol. The first fragment of b is enlarged by 2 times and used as the first fragment of reference data a.

4. The method of claim 1, wherein, In Newton's iteration method, the iteration value of the (t+1)th iteration is: 1.5 times the iteration value of the tth iteration, minus 0.5 times the first product x' / a and the cube of the iteration value of the tth iteration.

5. The method of claim 1, wherein, The first segment of a corresponds to n bits, with f decimal places. The protocol for securely executing the power-of-2 inversion with the second party includes: Reverse the order of the first fragment of a to obtain the first reference fragment; The number of decimal places of the first reference slice is determined to be nf-1, or, if the number of decimal places is nf, the low-order bits of the first reference slice are padded with a 0 and the highest-order bits are truncated, which is used as the first slice of the inverse of a.

6. The method of claim 5, wherein, the square root inverse of a resulting from the inverse square protocol of the second party performing the power of 2 the first slice of the first tile comprises: The bits of the first slice of the inverse of a are split into a predetermined number of equally spaced bits, and the corresponding first reference values ​​are determined according to the binary numbers formed by the equally spaced bits of each group. The result of summing the squares of the differences between each first reference value and the corresponding second reference value under a predetermined balance coefficient, calculated by the second-party security calculation, yields the inverse square root of a. The first slice, wherein a single second reference value is determined by a binary number consisting of corresponding groups of equally spaced bits in the second slice, which is the inverse of a.

7. A data processing method in multi-party secure computation, used to determine the arithmetic shared form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, the method being executed by the first party, comprising: Using a security decision protocol, the largest power of 2 b not greater than the target data x is determined, and the first slice of b is obtained. Based on the first slice of b and the second-party security determination of whether x is zero, the first slice of the judgment result s is obtained, wherein the first slice of the judgment result s is a single bit of 0 or 1; The second party uses the judgment result s to safely select the inverse of the square root of the target data x between the candidate value y and the inverse of the predetermined additional item ε for subsequent business processing. Where s is 1, the candidate value y is selected, and s is 0, the inverse of the predetermined additional item ε, 1 / ε, is selected. The candidate value y is determined as follows: The first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a safe power-of-2 inverse protocol is executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a safe multiplication is performed with the second party to determine the first product x / a, thus obtaining the first piece of the first product x / a; and using Newton's iteration method safely with the second party, the inverse 1 / a of the square root of 2 is multiplied by the second party to obtain the first piece of the first product x / a. As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse 1 / a obtained by performing a power-of-2 inverse square root protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second slice to determine the inverse candidate value y = y' / of the square root of the target data x. , thus obtaining the first slice of y.

8. The method of claim 7, wherein, b is a Boolean shared form consisting of the first piece of b held by the first party and the second piece of b held by the second party. The first piece of the judgment result s is the result of continuously summing each bit of the first piece of b modulo 2.

9. The method of claim 7, wherein the second party safely selects between the candidate value y and the inverse of the predetermined additional term ε based on the judgment result s, is performed in the following manner: The second product of the difference between s and y and 1 / ε, plus the sum of 1 / ε, is used as the selection result.

10. The method of claim 7, wherein the security determination protocol is one of the following: the most significant bit determination protocol in Boolean sharing form, the most non-zero bit determination protocol in arithmetic sharing form, and the power of 2 interval determination protocol.

11. The method of claim 7, wherein, In Newton's iteration method, the iteration value of the (t+1)th iteration is: 1.5 times the iteration value of the tth iteration, minus 0.5 times the first product x / a and the cube of the iteration value of the tth iteration.

12. A data processing apparatus for multi-party secure computation, used to determine the arithmetic sharing form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, the apparatus being disposed on the first party, comprising: The preprocessing unit is configured to add a first piece of the square of a predetermined additional term ε to the first piece of x to obtain a first piece of the approximate value x', wherein the modulus of the predetermined additional term ε is less than a predetermined value; The reference value determination unit is configured to perform a security determination protocol with the second party on the approximate value x' to obtain the first slice of reference data a, wherein the reference data a is the smallest power of 2 greater than the approximate value x'. The secure inversion unit is configured to use the first slice of reference data a to securely execute a power-of-2 inversion protocol with the second party to obtain the first slice of the inverse 1 / a of reference data a; The secure multiplication unit is configured to use the first slice of the inverse 1 / a of the reference data a, the first slice of x', and the second party to determine the first product x' / a through secure multiplication, thereby obtaining the first slice of the first product x' / a; The iterative unit is configured to work with the second party to safely utilize Newton's iteration method, using the inverse of the square root of 2 / 1. As the initial value of the inverse square root of the first product x' / a, after a predetermined number of iterations, the inverse square root y' of x' / a is determined, and the first piece of the inverse square root y' of x / a is obtained; The secure multiplication unit is further configured to utilize the first slice of the inverse square root y' of x' / a, and the inverse square root 1 / a obtained by performing a power-of-2 inverse square root protocol with the second party. The first slice is used to perform a safe multiplication with the second slice to determine the inverse candidate value y = y' / of the square root of the target data x. , thus obtaining the first slice of y.

13. A data processing apparatus for multi-party secure computation, used to determine the arithmetic sharing form of the square root inverse of target data x, which is shared between a first party and a second party, wherein the first party and the second party respectively hold a first slice and a second slice of the target data x represented by n bits, the apparatus being disposed on the first party, comprising: The decision unit is configured to determine the largest power of 2 b not greater than the target data x via a security decision protocol, and obtain the first fragment of b. as well as Based on the first slice of b and the second-party security determination of whether x is zero, the first slice of the judgment result s is obtained, wherein the first slice of the judgment result s is a single bit of 0 or 1; The selection unit is configured to safely select the inverse of the square root of the target data x between the candidate value y and the inverse of the predetermined additional term ε through the judgment result s, and to perform subsequent business processing. Wherein, if s is 1, the candidate value y is selected, and if s is 0, the inverse of the predetermined additional term ε, 1 / ε, is selected. The secure computing unit is configured to securely determine the candidate value y with the second party in the following manner: First, the first piece of b is multiplied by two to become the first piece of reference data a; using the first piece of reference data a, a power-of-2 inversion protocol is securely executed with the second party to obtain the first piece of the inverse 1 / a of reference data a; using the first piece of the inverse 1 / a of reference data a and the first piece of x, a first product x / a is determined with the second party via secure multiplication, thus obtaining the first piece of the first product x / a; finally, with the second party, a power-of-2 inversion protocol is securely executed with the second party to obtain the first piece of the first product x / a; and finally, the square root of 2 is used to calculate the first product x / a using Newton's iteration method. As the initial value for the inverse square root of the first product x / a, after a predetermined number of iterations, the inverse square root y' of x / a is determined, resulting in the first piece of the inverse square root y' of x / a; using the first piece of the inverse square root y' of x / a, and the square root inverse 1 / a obtained by performing a power-of-2 inverse square root protocol with the second party, the inverse square root of a is... The first slice is used to perform a safe multiplication with the second slice to determine the inverse candidate value y = y' / of the square root of the target data x. , thus obtaining the first slice of y.

14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-11.

15. A computing device comprising a memory and a processor, wherein: The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-11.

Images