Secure multi-party computation method and apparatus

Abstract

A secure multi-party computation method and device. The method comprises: a first party determining a first fragment, a first ciphertext and a second ciphertext, the first ciphertext being a result of encrypting a first intermediate value using a first random number, the first intermediate value being obtained by performing a preset operation on the first fragment and a first result of operating a first privacy value and a first value via a target function, the second ciphertext being a result of encrypting a second intermediate value using a second random number, the second intermediate value being obtained by performing a preset operation on the first fragment and a second result of operating the first privacy value and a second value via the target function; the first party sending a target message to a second party, so that the second party obtains the first ciphertext and the second ciphertext; the second party correctly decrypting one of the first ciphertext and the second ciphertext using a target random number corresponding to an actual value of the target data to obtain a second fragment, the first fragment and the second fragment forming two fragments of a calculation result of operating the target data and the first privacy value via the target function.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of computer, and in particular, to a secure multi-party computation method and device. BACKGROUND

[0002] Secure Multi-party Computation (SMPC) refers to that a plurality of participants jointly compute the result of a target function, and the input data of the target function is not disclosed during the computation. In a typical technical scenario, one input data of the target function is held by one participant, and another input data is a target data having two possible values. One participant holds the two possible values of the target data and the random numbers corresponding to the two possible values respectively, and another participant only holds the random number corresponding to the true value of the target data.

[0003] In the foregoing technical scenario, how to efficiently implement secure multi-party computation of the target function is a technical problem to be solved. SUMMARY

[0004] One or more embodiments of the present specification provide a secure multi-party computation method and device.

[0005] In a first aspect, a secure multi-party computation method is provided, which is used to compute the computation result of the operation of a target data and a first privacy value held by a first party through a target function. The target data has a possible first value and a second value. The first party also holds a first random number and a second random number corresponding to the first value and the second value respectively. The method comprises: determining, by the first party, a first shard, a first ciphertext and a second ciphertext. The first ciphertext is a result of encrypting a first intermediate value by using a first random number. The first intermediate value is obtained by performing a preset operation on a first result of the operation of the first privacy value and the first value through a target function and the first shard. The second ciphertext is a result of encrypting a second intermediate value by using the second random number. The second intermediate value is obtained by performing the preset operation on a second result of the operation of the first privacy value and the second value through a target function and the first shard. Sending, by the first party, a target message to a second party, so that the second party obtains the first ciphertext and the second ciphertext. Correctly decrypting, by the second party, one of the first ciphertext and the second ciphertext by using a target random number corresponding to the true value of the target data to obtain a second shard. The first shard and the second shard form two shards of the computation result.

[0006] In a possible implementation, the preset operation is a subtraction operation, and the first and second fragments are two addition fragments of the calculation result; or the preset operation is an exclusive OR operation, and the first and second fragments are two exclusive OR fragments of the calculation result.

[0007] In a possible implementation, the target message includes the first and second ciphertexts.

[0008] In a possible implementation, the target message further includes hash values of the first and second intermediate values. The second party correctly decrypts one of the first and second ciphertexts by using the target random number corresponding to the real value of the target data to obtain the second fragment, specifically including: the second party decrypts the first and second ciphertexts to obtain first and second decryption results, and calculates hash values of the first and second decryption results; and the second party determines the first or second decryption result as the second fragment according to the hash values of the first and second intermediate values and the hash values of the first and second decryption results.

[0009] In a possible implementation, the first or second ciphertext is a predetermined value, and the second party holds the predetermined value; and the target message includes target ciphertexts in the first and second ciphertexts except the predetermined value.

[0010] In a possible implementation, the target message further includes a hash value of an intermediate value corresponding to the target ciphertext in the first and second intermediate values. The second party correctly decrypts one of the first and second ciphertexts by using the target random number corresponding to the real value of the target data to obtain the second fragment, specifically including: the second party decrypts the target ciphertext by using the target random number corresponding to the real value of the target data to obtain a decryption result, and calculates a hash value of the decryption result; and when the hash value of the decryption result is the same as the hash value in the target message, the second party determines the decryption result as the second fragment.

[0011] In a possible implementation, the second party correctly decrypts one of the first and second ciphertexts by using the target random number corresponding to the real value of the target data to obtain the second fragment, and further includes: when the hash value of the decryption result is different from the hash value in the target message, the second party decrypts the predetermined value by using the target random number to obtain the second fragment.

[0012] In a possible implementation, the first party is a generation party of the garbled circuit, and the second party is an execution party of the garbled circuit; the first value and the second value are 0 and 1 respectively, and the first random number and the second random number are garbled values corresponding to the first value and the second value respectively. The method further includes: the second party executes the garbled circuit to obtain the target random number.

[0013] In a possible implementation, the first party determines the first shard, the first ciphertext, and the second ciphertext in parallel with the second party executing the garbled circuit to obtain the target random number.

[0014] In a second aspect, a secure multi-party computation method is provided for computing a result of operation of target data and a first private value held by a first party by a target function, the target data having a possible first value and a second value, the first party also holding a first random number and a second random number corresponding to the first value and the second value respectively, the method being executed by the first party. The method includes: determining a first shard, a first ciphertext, and a second ciphertext, the first ciphertext being a result of encrypting a first intermediate value by a first random number, the first intermediate value being obtained by performing a preset operation on the first shard and a first result of operation of the first private value and the first value by a target function, the second ciphertext being a result of encrypting a second intermediate value by the second random number, the second intermediate value being obtained by performing the preset operation on the first shard and a second result of operation of the first private value and the second value by the target function; sending a target message to a second party, so that the second party obtains the first ciphertext and the second ciphertext, and performs correct decryption on one of the first ciphertext and the second ciphertext by using a target random number corresponding to an actual value of the target data to obtain a second shard, the first shard and the second shard forming two shards of the computation result.

[0015] In a possible implementation, the target message includes the first ciphertext and the second ciphertext.

[0016] In a possible implementation, the target message further includes hash values of the first intermediate value and the second intermediate value respectively.

[0017] In a possible implementation, the first ciphertext or the second ciphertext is a predetermined value, and the second party holds the predetermined value; the target message includes target ciphertexts in the first ciphertext and the second ciphertext except the predetermined value.

[0018] In a possible implementation, the target message further includes hash values of intermediate values in the first intermediate value and the second intermediate value corresponding to the target ciphertexts.

[0019] In a possible implementation, the first party is a generator of the garbled circuit, and the second party is an executor of the garbled circuit; the first value and the second value are 0 and 1 respectively, and the first random number and the second random number are garbled values corresponding to the first value and the second value respectively; and the target random number is obtained by the second party executing the garbled circuit.

[0020] In a third aspect, a secure multi-party computation method is provided for computing a result of operation of target data and a first private value held by a first party by a target function, the target data having a possible first value and a second value, the first party also holding a first random number and a second random number corresponding to the first value and the second value respectively, and the method being executed by a second party. The method comprises: receiving a target message from the first party, obtaining a first ciphertext and a second ciphertext, the first ciphertext being a result of encrypting a first intermediate value by a first random number, the first intermediate value being obtained by performing a preset operation on a first shard and a first result of operation of the first private value and the first value by a target function, the second ciphertext being a result of encrypting a second intermediate value by the second random number, the second intermediate value being obtained by performing the preset operation on the first shard and a second result of operation of the first private value and the second value by the target function, the first shard being determined by the first party; and correctly decrypting one of the first ciphertext and the second ciphertext by a target random number corresponding to an actual value of the target data to obtain a second shard, the first shard and the second shard forming two shards of the computation result.

[0021] In a possible implementation, the target message comprises the first ciphertext and the second ciphertext.

[0022] In a possible implementation, the target message further comprises hash values of the first intermediate value and the second intermediate value respectively. The correctly decrypting one of the first ciphertext and the second ciphertext by the target random number corresponding to the actual value of the target data to obtain the second shard specifically comprises: decrypting the first ciphertext and the second ciphertext by the target random number corresponding to the actual value of the target data to obtain a first decryption result and a second decryption result, and calculating hash values of the first decryption result and the second decryption result respectively; and determining the first decryption result or the second decryption result as the second shard according to the hash values of the first intermediate value and the second intermediate value, the hash values of the first decryption result and the second decryption result.

[0023] In a possible implementation, the first ciphertext or the second ciphertext is a predetermined value, and the second party holds the predetermined value; and the target message includes a target ciphertext in the first ciphertext and the second ciphertext other than the predetermined value.

[0024] In a possible implementation, the target message further includes a hash value of an intermediate value corresponding to the target ciphertext in the first intermediate value and the second intermediate value. The correct decryption of one of the first ciphertext and the second ciphertext by using the target random number corresponding to the real value of the target data to obtain the second shard specifically includes: decrypting the target ciphertext by using the target random number corresponding to the real value of the target data to obtain a decryption result, and calculating a hash value of the decryption result; and when the hash value of the decryption result is the same as the hash value in the target message, the decryption result is determined as the second shard.

[0025] In a possible implementation, the correct decryption of one of the first ciphertext and the second ciphertext by using the target random number corresponding to the real value of the target data to obtain the second shard further includes: when the hash value of the decryption result is different from the hash value in the target message, decrypting the predetermined value by using the target random number to obtain the second shard.

[0026] In a fourth aspect, a secure multi-party computation apparatus is provided, configured to compute a result of operation of target data and a first private value held by a first party by a target function, the target data having a first value and a second value, and the first party further holding a first random number and a second random number corresponding to the first value and the second value respectively. The apparatus is deployed at the first party, and the apparatus includes: a determination unit, configured to determine a first shard, a first ciphertext, and a second ciphertext, the first ciphertext being a result of encryption of a first intermediate value by a first random number, the first intermediate value being obtained by performing a preset operation on a first result of operation of the first private value and the first value by the target function and the first shard, and the second ciphertext being a result of encryption of a second intermediate value by the second random number, the second intermediate value being obtained by performing the preset operation on a second result of operation of the first private value and the second value by the target function and the first shard; and a communication unit, configured to send a target message to a second party, so that the second party obtains the first ciphertext and the second ciphertext, and correctly decrypts one of the first ciphertext and the second ciphertext by using a target random number corresponding to a real value of the target data to obtain a second shard, the first shard and the second shard forming two shards of the result.

[0027] Fifthly, a secure multi-party computation device is provided for calculating the result of a target data and a first privacy value held by a first party through a target function operation. The target data has possible first and second values, and the first party also holds a first random number and a second random number corresponding to the first and second values, respectively. The device is deployed in a second party and includes: a communication unit configured to receive a target message from the first party and obtain a first ciphertext and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using the first random number. The first intermediate value is obtained by performing a preset operation on a first result of the first privacy value and the first value through a target function operation with a first fragment. The second ciphertext is the result of encrypting a second intermediate value using the second random number. The second intermediate value is obtained by performing the preset operation on a second result of the first privacy value and the second value through a target function operation with the first fragment. The first fragment is determined by the first party. A processing unit configured to correctly decrypt one of the first ciphertext and the second ciphertext using a target random number corresponding to the actual value of the target data to obtain a second fragment. The first fragment and the second fragment form two fragments of the calculation result.

[0028] In a sixth aspect, a computer-readable storage medium is provided having a computer program / instructions stored thereon, wherein when the computer program / instructions are executed in a computing device, the computing device performs the method as described in any one of the second or third aspects.

[0029] In a seventh aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code / instructions, and the processor, when executing the executable code / instructions, implements the method as described in any one of the second or third aspects.

[0030] Through the technical solutions provided in one or more embodiments of this specification, the first party holds a first privacy value, and also holds a first possible value and a second possible value of the target data, as well as their corresponding first and second random numbers. The second party holds the target random number corresponding to the actual value of the target data. Based on this, the first party can determine a first fragment, a first ciphertext, and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using the first random number. The first intermediate value is obtained by performing a preset operation on the first fragment with the first result of the target function calculation of the first privacy value and the first value. The second ciphertext is the result of encrypting a second intermediate value using the second random number. The second intermediate value is obtained by performing a preset operation on the first fragment with the second result of the target function calculation of the first privacy value and the second value. The second party can correctly decrypt one of the first ciphertext and the second ciphertext using the target random number corresponding to the actual value of the target data to obtain the second fragment. Thus, the first and second parties do not need to perform secure subtraction on the target data through obfuscation circuits, and can more efficiently complete the secure multi-party computation of the target function, enabling the first and second parties to each obtain the first fragment and the second fragment of the calculation result of the target function. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a schematic diagram of a logic gate circuit provided as an example in the embodiments of this specification;

[0033] Figure 2 This is a schematic diagram of a secure multi-party computation method provided in the embodiments of this specification;

[0034] Figure 3 This is a schematic diagram illustrating how participant 1 determines fragments and ciphertext, as exemplarily provided in the embodiments of this specification.

[0035] Figure 4 This is one of the schematic diagrams of a secure multi-party computing device provided in the embodiments of this specification;

[0036] Figure 5 This is a second schematic diagram of a secure multi-party computing device provided in the embodiments of this specification. Detailed Implementation

[0037] The various non-limiting embodiments provided in this specification will now be described in detail with reference to the accompanying drawings.

[0038] Secret sharing, also known as secret splitting or secret sharing, is a typical cryptographic technique frequently used for managing secret information. The basic principle is to split a secret value (such as a key) into multiple shares, each held by a different participant. The secret value can only be recovered by merging the shares held by more than a threshold number of participants. Currently, secret sharing is also frequently used for secure multi-party computation. In this case, the aforementioned threshold number refers to the number of participants involved in the secure multi-party computation of an objective function. For each input data of the objective function, it needs to be split into multiple shares and distributed to the aforementioned participants. Each participant then processes its respective share to obtain a share of the computation result. Finally, merging the shares obtained by each participant yields the result of the objective function computation. Secret sharing is typically used to perform secure multi-party computations of objective functions involving multiplication and / or addition operations.

[0039] Obfuscated circuits achieve secure multi-party computation by simulating application-specific integrated circuits (ASICs) using computing devices. Any given computational task can be implemented using an obfuscated circuit designed for it. Specifically, multiple operational gates (AND gates, XOR gates, etc.) are connected according to the computational logic of the task to form a logic gate circuit, and each line of the operational gates is encrypted. The encrypted logic gate circuit is called an obfuscated circuit, which can ultimately be executed by a computing device to achieve secure multi-party computation. The process of generating an obfuscated circuit is described below as an example.

[0040] First, the generator of the obfuscated circuit can construct logic gates for the computational task. For example, a, b, and d are three single-bit privacy values, and the computational task includes calculating s = a AND b AND d; see reference... Figure 1 As shown, the generation method of the confusion circuit can be to design a logic gate circuit consisting of two AND gates, AND gate 1 and AND gate 2, for the computing task. The input lines of AND gate 1 include a and b, and the output line is c; the input lines of AND gate 2 include c and d, and the output line is s.

[0041] Next, the generator of the confusion circuit generates a truth table for each operational gate in the logic gate circuit. The truth table of the operational gate indicates several sets of mapping relationships between the values ​​of its two input lines and the values ​​of its output line. For example, the truth table of AND gate 1 needs to indicate through a set of mapping relationships that when the values ​​of input lines a and b are both 0, the value of output line c is 0.

[0042] Next, the generator of the obfuscated circuit determines the random number (also called the obfuscated value) corresponding to the two possible values ​​0 and 1 for each line in the logic gate circuit. Different lines use different random numbers. For example, the random number corresponding to the possible value 0 of line a can be set to... Let the random number corresponding to the possible value 1 of line a be: Similarly, let the random numbers corresponding to the two possible values ​​0 and 1 of line b be... Let the random numbers corresponding to the two possible values ​​0 and 1 of line c be respectively. Let the random numbers corresponding to the two possible values ​​0 and 1 of line d be respectively Let the random numbers corresponding to the two possible values ​​0 and 1 of line s be respectively

[0043] Next, the generator of the obfuscated circuit constructs an obfuscated truth table for each operational gate in the logic gate circuit, corresponding to the truth table of that operational gate. The obfuscated truth table includes several ciphertexts corresponding to several mapping relationships indicated by the corresponding truth table. For example, if the truth table of AND gate 1 contains a mapping relationship indicating that "when input lines a and b are both 0, the output line c is 0," then the obfuscated truth table can include ciphertexts using random numbers. and random numbers Encrypted random numbers The ciphertext corresponding to the mapping relationship is obtained.

[0044] Once the truth tables for all operational gates in the logic gate circuit are prepared, the method for generating the obfuscated circuit completes the generation of the obfuscated circuit corresponding to the specific computational task. This obfuscated circuit can then be executed by the obfuscated circuit executor.

[0045] For lines whose input data is generated by the generator of the obfuscation circuit (e.g., lines a and d), the generator can send the random number (obfuscation value) corresponding to the input data of that line to the executor of the obfuscation circuit. For lines whose input data is generated by the executor of the obfuscation circuit (e.g., line b), the generator acts as the sender of the oblivious transfer (OT) protocol, and the executor acts as the receiver of the OT protocol. The generator uses the input data (0 or 1) of that line as the OT selection, and jointly executes a 2-to-1 OT protocol, allowing the executor to obtain the obfuscation value corresponding to the input data of that line. Finally, the executor sequentially uses the obfuscation values ​​corresponding to the input data of each of the two input lines of each arithmetic gate to correctly decrypt a ciphertext in the obfuscation truth table corresponding to that arithmetic gate, obtaining the obfuscation value corresponding to the true value of the output line of that arithmetic gate. This allows the executor to determine the obfuscation value corresponding to the true value of the output line of the last arithmetic gate, for example, obtaining...Figure 1 The diagram shows the obfuscated value corresponding to the actual value of the output line s in the logic gate circuit. The obfuscated circuit can convert the obfuscated value corresponding to the actual value of the output line of the last operational gate into the actual value of that output line, thus obtaining the computation result of the task.

[0046] Unlike secret-sharing techniques, obfuscated circuits, in addition to performing secure multi-party computations of target functions involving multiplication and / or addition, can also support a variety of other complex computations.

[0047] As mentioned above, in a typical technical scenario, an input data B of the objective function that requires secure multi-party computation may be held by one participant, and another input data A, as the objective data, may have two possible values. One participant holds the two possible values ​​of the objective data A and their corresponding random numbers, while the other participant only holds the random number corresponding to the actual value of the objective data A.

[0048] Taking the previously mentioned secret sharing and obfuscation circuits as an example, secret sharing and obfuscation circuits may be used in combination; for example, the objective function for secure computation is C = f(A, B). Here, the target data A is a single-bit private data that may take the value 0 or 1, and B and C are integers; A is in the encrypted state of the obfuscation circuit, meaning the generator of the obfuscation circuit holds the two possible values ​​of A and their corresponding random numbers / obfuscated values, while the executor of the obfuscation circuit holds the random number / obfuscated value corresponding to the actual value of A, and B is the private data held by the generator of the obfuscation circuit. When performing secure multi-party computation on the aforementioned objective function C = f(A, B), the computation result C is required to be in the encrypted state of secret sharing, meaning that the generator and executor of the obfuscation circuit each hold a slice of the computation result C, and the result of XORing or summing the two slices of the computation result C is the computation result C.

[0049] In one possible implementation, the target data A can be converted into a secret-shared encrypted state. Then, the target function C = f(A, B) can be securely computed based on the secret-sharing technique, such that the two parties performing the secure multi-party computation of the target function C = f(A, B) each hold a slice of the computation result C. However, converting the target data A into a secret-shared encrypted state often requires using an obfuscation circuit to perform a secure subtraction. The logic gate circuit corresponding to this obfuscation circuit needs to be configured with t AND gates, where t is the number of bits of the slice of target data A obtained by performing the secure subtraction. The technical implementation is extremely complex, and a large amount of data needs to be transferred when executing the obfuscation circuit, resulting in extremely low efficiency.

[0050] This specification provides at least one secure multi-party computation method and apparatus in its embodiments. A first party holds a first privacy value, and also holds a first possible value and a second possible value of target data, as well as their corresponding first and second random numbers. A second party holds a target random number corresponding to the actual value of the target data. Based on this, the first party can determine a first slice, a first ciphertext, and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using the first random number. The first intermediate value is obtained by performing a preset operation on the first slice using the first result of the first privacy value and the first possible value calculated by a target function. The second ciphertext is the result of encrypting a second intermediate value using the second random number. The second intermediate value is obtained by performing a preset operation on the first slice using the second result of the first privacy value and the second possible value calculated by a target function. The second party can correctly decrypt one of the first ciphertext and the second ciphertext using the target random number corresponding to the actual value of the target data to obtain the second slice. Thus, the first and second parties do not need to perform secure subtraction on the target data using obfuscation circuits, allowing for more efficient secure multi-party computation of the target function, enabling each party to obtain a first slice and a second slice of the computation result of the target function.

[0051] Figure 2 This is a schematic diagram of a secure multi-party computation method provided in the embodiments of this specification. The participants 1 (i.e., the first party) and 2 (i.e., the second party) involved in this method can each be implemented as any device, platform, equipment, or cluster of devices with computing / processing capabilities. This method can be used to securely compute the result C of the target data A and the privacy value B held by participant 1 through the objective function C = f(A, B), ultimately enabling participant 1 and participant 2 to each obtain a fragment C1 and a fragment C2 of the computation result C. The summation or XOR operation of fragments C1 and C2 is equal to the computation result C. The target data A has possible first value A0 and second value A1. Furthermore, participant 1 can also hold a first random number L0 and a second random number L1 corresponding to the first value A0 and the second value A1, respectively. Figure 1 As shown, the method may include, but is not limited to, the following steps S21 to S25.

[0052] First, in step S21, participant 1 determines fragment C1, ciphertext E1, and ciphertext E2. Ciphertext E1 is the result of encrypting intermediate value d1 using the first random number L0. Intermediate value d1 is obtained by performing a preset operation on fragment C1 with the first result of the objective function operation on privacy value B and first value A0. Ciphertext E2 is the result of encrypting intermediate value d2 using the second random number L1. Intermediate value d2 is obtained by performing a preset operation on fragment C1 with the second result of the objective function operation on privacy value B and second value A1.

[0053] In one possible implementation, see Figure 3 As shown, participant 1 can determine fragment C1, ciphertext E1 and ciphertext E2 by executing the following steps S211 to S215.

[0054] In step S211, a random number is obtained and determined as slice C1.

[0055] In step S213, the privacy value B and the first value A0 are determined by the objective function to obtain the first result, and a preset operation is performed on the first result and the segment C1 to obtain the intermediate value d1; and the privacy value B and the second value A1 are determined by the objective function to obtain the second result and the segment C1 to obtain the intermediate value d2.

[0056] The first value A0 of the target data A can be substituted into the parameter A in the objective function C = f(A, B), and the first result is f(A0, B); the second value A1 of the target data A can be substituted into the parameter A in the objective function C = f(A, B), and the second result is f(A1, B). If the preset operation is, for example, subtraction or XOR, then for the intermediate values ​​d1 and d2: the intermediate value d1 can be calculated using the expression f(A0, B) - C1, and the intermediate value d2 can be calculated using the expression f(A1, B) - C1; or, the intermediate value d1 can be calculated using the expression f(A0, B) XOR C1, and the intermediate value d2 can be calculated using the expression f(A1, B) XOR C1, where XOR represents the exclusive OR operation.

[0057] In step S215, the intermediate value d1 is encrypted using the first random number L0 to obtain ciphertext E1, and the intermediate value d2 is encrypted using the second random number L1 to obtain ciphertext E2.

[0058] Ciphertext E1 can be calculated using the expression E(L0, d1), and ciphertext E2 can be calculated using the expression E(L1, d2), where E represents the encryption algorithm used by participant 1 when encrypting intermediate values ​​d1 and d2. Referring to the previous text, since the intermediate value d1 can be calculated using the expression f(A0, B)-C1 and the intermediate value d2 can be calculated using the expression f(A1, B)-C1, or the intermediate value d1 can be calculated using the expression f(A0, B)XOR C1 and the intermediate value d2 can be calculated using the expression f(A1, B)XOR C1, therefore, for the ciphertext E1 and ciphertext E2 obtained in step S215: ciphertext E1 can be calculated using the expression E(L0, f(A0, B)-C1) and the ciphertext E2 can be calculated using the expression E(L1, f(A1, B)-C1), or the ciphertext E1 can be calculated using the expression E(L0, f(A0, B)XOR C1) and the ciphertext E2 can be calculated using the expression E(L1, f(A1, B)XOR C1).

[0059] In one possible implementation, ciphertext E1 or ciphertext E2 can be a predetermined value held by participant 2. Then, for the aforementioned step S21, the predetermined value held by participant 2 can first be determined as ciphertext E1 or ciphertext E2, and then fragment C1 can be determined based on the predetermined value. Subsequently, based on fragment C1, the target ciphertext other than the predetermined value in ciphertext E1 and ciphertext E2 can be determined. For example, let ciphertext E1 be a predetermined value held by participant 2. Furthermore, referring to the previous text, let's continue to assume that ciphertext E1 is calculated using the aforementioned expression E(L0, f(A0, B)-C1) or expression E(L0, f(A0, B)XOR C1). Then, given that the value of expression E(L0, f(A0, B)-C1) or expression E(L0, f(A0, B)XOR C1) is a predetermined value, fragment C1 can be calculated based on expression E(L0, f(A0, B)-C1) or expression E(L0, f(A0, B)XOR C1). Subsequently, given that fragment C1 has been determined, fragment C1 can be substituted into expression E(L1, f(A1, B)-C1) or expression E(L1, f(A1, B)XOR C1) used to calculate ciphertext E2, thereby calculating ciphertext E2 and using it as the target ciphertext.

[0060] Back Figure 2 In step S23, participant 1 sends a target message to participant 2, enabling participant 2 to obtain ciphertext E1 and ciphertext E2. Wherein, participant 1, through the aforementioned... Figure 3When the various method steps shown complete the determination of fragment C1, ciphertext E1, and ciphertext E2, the target message includes at least ciphertext E1 and ciphertext E2, and optionally includes the hash value of intermediate value d1 and the hash value of intermediate value d2; when ciphertext E1 or ciphertext E2 is a predetermined value held by participant 2, the target message includes at least the target ciphertext in ciphertext E1 and ciphertext E2 other than the predetermined value, and optionally includes the hash value of intermediate value d1 or intermediate value d2 corresponding to the target ciphertext.

[0061] Finally, in step S25, participant 2 uses the target random number corresponding to the true value of target data A to correctly decrypt one of ciphertext E1 and ciphertext E2 to obtain fragment C2.

[0062] After obtaining ciphertext E1 and ciphertext E2, refer to the expressions E(L0, f(A0, B)-C1) and E(L0, f(A0, B)XOR C1) used to calculate ciphertext E1, and the expressions E(L1, f(A1, B)-C1) and E(L1, f(A1, B)XOR C1) used to calculate ciphertext E2. Since the true value of the target data A is either the first value A0 or the second value A1, and the target random number corresponding to the true value of the target data A is either the first random number L0 or the second random number L1, participant 2 can only correctly decrypt one of ciphertext E1 and ciphertext E2. The decryption result of correctly decrypting ciphertext E1 or ciphertext E2 is the fragment C2 of the calculation result C of the target function C = f(A, B).

[0063] The decryption algorithm can be used to ensure that participant 2 can only correctly decrypt one of the ciphertexts E1 and E2, thereby ensuring that participant 2 can obtain fragment C2; or the hash values ​​of intermediate values ​​d1 and / or d2 contained in the target message can be used to ensure that participant 2 can verify whether the decryption results obtained by decrypting ciphertexts E1 and E2 respectively are correct, and thus the correct decryption result is determined as fragment C2.

[0064] In one possible implementation, when the target message includes ciphertext E1, ciphertext E2, and hash values ​​of intermediate values ​​d1 and d2 respectively: Participant 2 can use the target random number to decrypt ciphertext E1 and ciphertext E2 to obtain a first decryption result and a second decryption result, and calculate the hash values ​​of the first decryption result and the second decryption result respectively. Then, based on the hash values ​​of intermediate values ​​d1 and d2, and the hash values ​​of the first decryption result and the second decryption result respectively, the first decryption result or the second decryption result is determined as fragment C2. For example, the expression used to calculate ciphertext E1 is E(L0, f(A0, B)-C1), and the expression used to calculate ciphertext E2 is E(L1, f(A1, B)-C1). Assuming the actual value of the target data A is A0, that is, the target random number used by participant 2 to decrypt ciphertext E1 and ciphertext E2 is the random number L0 corresponding to A0; then the first decryption result obtained by participant 2 using the random number L0 to decrypt ciphertext E1 can be calculated by the expression f(A0, B)-C1. The second decryption result obtained by decrypting ciphertext E2 obviously cannot be calculated by f(A1, B)-C1. Therefore, the hash value of the intermediate value d1 is the same as the hash value of the first decryption result, and the hash value of the intermediate value d2 is different from the hash value of the second decryption result. In other words, participant 2 successfully decrypted ciphertext E1 but failed to successfully decrypt ciphertext E2. At this time, the first decryption result can be determined as fragment C2.

[0065] In one possible implementation, when the target message includes target ciphertext (excluding predetermined values) in ciphertext E1 and ciphertext E2, and the hash value of the intermediate value d1 or intermediate value d2 corresponding to the target ciphertext: Participant 2 can use a target random number to decrypt the target ciphertext to obtain a decryption result, and calculate the hash value of the decryption result. When the hash value of the decryption result is the same as the hash value in the target message, the decryption result is determined as fragment C2; when the hash value of the decryption result is different from the hash value in the target message, the predetermined value is decrypted using the target random number to obtain fragment C2. For example, the target ciphertext is ciphertext E2, which is the hash value of ciphertext E2 and the intermediate value d2 in the target message. The expression used to calculate ciphertext E2 is E(L1, f(A1, B)-C1). Assuming that the actual value of the target data A is A0, the target random number used by participant 2 to decrypt ciphertext E2 is the random number L0 corresponding to A0. The decryption result obtained by using random number L0 to decrypt ciphertext E2 obviously cannot be calculated by f(A1, B)-C1. The hash value of the decryption result of ciphertext E2 is different from the hash value of the intermediate value d2 included in the target message, indicating that participant E2 failed to decrypt ciphertext E2 correctly. At this time, participant 2 can continue to use random number L0 to correctly decrypt the predetermined value (ciphertext E1) it holds to obtain fragment C2.

[0066] Participant 1 can be the generator of the obfuscated circuit, and participant 2 can be the executor of the obfuscated circuit; the first value A0 and the second value A1 are 0 and 1 respectively, the first random number L0 and the second random number L1 are the obfuscated values ​​corresponding to the first value A0 and the second value A1 respectively, and the target random number can be obtained by participant 2 executing the obfuscated circuit generated by participant 1, for example, the target random number is... Figure 1 The obfuscated value corresponds to the actual value of line s in the logic gate circuit shown. It should be noted that the process of participant 1 determining the fragment C1, ciphertext E1 and ciphertext E2 can be executed in parallel with the process of participant 2 executing the obfuscation circuit to obtain the target random number. For example, during the process of participant 1 executing step 21, participant 1 can generate the obfuscation circuit to be obfuscated by participant 2, and participant 2 can execute the obfuscation circuit.

[0067] Based on the same concept as the aforementioned method embodiments, this specification also provides a secure multi-party computation device for calculating the result of a target data and a first privacy value processed by a target function. The target data has possible first and second values. The first party also holds a first random number and a second random number corresponding to the first and second values, respectively. The device is deployed on the first party. Figure 4 As shown, the device includes: a determining unit 41 configured to determine a first fragment, a first ciphertext, and a second ciphertext, wherein the first ciphertext is the result of encrypting a first intermediate value using a first random number, the first intermediate value is obtained by performing a preset operation on the first fragment with the first result of operating the first privacy value and the first value using a target function, and the second ciphertext is the result of encrypting a second intermediate value using a second random number, the second intermediate value is obtained by performing the preset operation on the first fragment with the second result of operating the first privacy value and the second value using a target function; and a communication unit 43 configured to send a target message to a second party, enabling the second party to obtain the first ciphertext and the second ciphertext, and to correctly decrypt one of the first ciphertext and the second ciphertext using a target random number corresponding to the actual value of the target data to obtain a second fragment, wherein the first fragment and the second fragment form two fragments of the calculation result.

[0068] Based on the same concept as the aforementioned method embodiments, this specification also provides a secure multi-party computation device for calculating the result of a target data and a first privacy value processed by a target function. The target data has possible first and second values. The first party also holds a first random number and a second random number corresponding to the first and second values, respectively. The device is deployed on the second party. Figure 5As shown, the device includes: a communication unit 51 configured to receive a target message from the first party and obtain a first ciphertext and a second ciphertext, wherein the first ciphertext is the result of encrypting a first intermediate value using a first random number, the first intermediate value is obtained by performing a preset operation on a first private value and the first value using a target function, and a first slice; the second ciphertext is the result of encrypting a second intermediate value using a second random number, the second intermediate value is obtained by performing the preset operation on a first slice using a second result of performing a target function on the first private value and the second value, and the first slice is determined by the first party; and a processing unit 53 configured to correctly decrypt one of the first ciphertext and the second ciphertext using a target random number corresponding to the actual value of the target data to obtain a second slice, wherein the first slice and the second slice form two slices of the calculation result.

[0069] Those skilled in the art will recognize that, in one or more of the examples above, the functions described herein can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, the computer program corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions / code on a computer-readable medium so that when the computer program corresponding to these functions is executed by a computer, the methods described in any embodiment of this specification can be implemented by the computer.

[0070] This specification also provides a computer-readable storage medium storing a computer program, which, when executed in a computing device, enables the computing device to perform various method steps performed by participant 1 or participant 2 as provided in any embodiment of this specification.

[0071] This specification also provides a computing device in its embodiments, including a memory and a processor. The memory stores executable code, and when the processor executes the executable code, it implements the various method steps performed by participant 1 or participant 2 provided in any embodiment of this specification.

[0072] The various embodiments in this specification are described in a progressive manner. Similar or identical parts in each embodiment can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0073] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0074] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A secure multi-party computation method for calculating the result of a target data and a first privacy value held by a first party through an objective function operation, wherein the target data has a possible first value and a second value, and the first party also holds a first random number and a second random number corresponding to the first value and the second value, respectively; The method is performed by the first party, and the method includes: The first ciphertext, the first ciphertext, and the second ciphertext are determined. The first ciphertext is the result of encrypting the first intermediate value using the first random number. The first intermediate value is obtained by performing a preset operation on the first ciphertext and the first value using the first result of the objective function operation on the first ciphertext and the first ciphertext. The second ciphertext is the result of encrypting the second intermediate value using the second random number. The second intermediate value is obtained by performing the preset operation on the first ciphertext and the first ciphertext using the second result of the objective function operation on the first ciphertext and the first ciphertext. A target message is sent to a second party, enabling the second party to obtain the first ciphertext and the second ciphertext. The second party then uses the target random number corresponding to the actual value of the target data to correctly decrypt one of the first ciphertext and the second ciphertext to obtain a second fragment. The first fragment and the second fragment form two fragments of the calculation result.

2. The method according to claim 1, wherein the target message comprises the first ciphertext and the second ciphertext.

3. The method according to claim 2, wherein the target message further includes the hash values ​​of the first intermediate value and the second intermediate value respectively.

4. The method according to claim 1, wherein the first ciphertext or the second ciphertext is a predetermined value, and the second party holds the predetermined value; the target message includes the first ciphertext and the target ciphertext in the second ciphertext other than the predetermined value.

5. The method according to claim 4, wherein the target message further includes the hash value of the intermediate value corresponding to the target ciphertext in the first intermediate value and the second intermediate value.

6. The method according to any one of claims 1-5, wherein the first party is the generator of the obfuscation circuit, and the second party is the executor of the obfuscation circuit; the first value and the second value are 0 and 1 respectively, and the first random number and the second random number are obfuscation values ​​corresponding to the first value and the second value respectively; the target random number is obtained by the second party executing the obfuscation circuit.

7. A secure multi-party computation method for calculating the result of a target data and a first privacy value held by a first party through an objective function operation, wherein the target data has a possible first value and a second value, and the first party also holds a first random number and a second random number corresponding to the first value and the second value, respectively; The method is performed by a second party, and the method includes: The first party receives a target message and obtains a first ciphertext and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using a first random number. The first intermediate value is obtained by performing a preset operation on a first segment by processing the first privacy value and the first value using a target function. The second ciphertext is the result of encrypting a second intermediate value using a second random number. The second intermediate value is obtained by performing the preset operation on the first segment by processing the first privacy value and the second value using a target function. The first segment is determined by the first party. Using the target random number corresponding to the true value of the target data, one of the first ciphertext and the second ciphertext is correctly decrypted to obtain the second fragment. The first fragment and the second fragment form two fragments of the calculation result.

8. The method according to claim 7, wherein the target message comprises the first ciphertext and the second ciphertext.

9. The method according to claim 8, wherein the target message further includes the hash values ​​of the first intermediate value and the second intermediate value; wherein, The step of using the target random number corresponding to the true value of the target data to correctly decrypt one of the first ciphertext and the second ciphertext to obtain the second fragment specifically includes: Using the target random number corresponding to the actual value of the target data, the first ciphertext and the second ciphertext are decrypted to obtain the first decryption result and the second decryption result, and the hash value of the first decryption result and the second decryption result is calculated respectively; Based on the hash values ​​of the first intermediate value and the second intermediate value, and the hash values ​​of the first decryption result and the second decryption result, the first decryption result or the second decryption result is determined as the second fragment.

10. The method according to claim 7, wherein the first ciphertext or the second ciphertext is a predetermined value, and the second party holds the predetermined value; the target message includes the first ciphertext and the second ciphertext, excluding the predetermined value, as target ciphertext.

11. The method according to claim 10, wherein the target message further includes the hash value of the intermediate value corresponding to the target ciphertext in the first intermediate value and the second intermediate value; wherein, The step of using the target random number corresponding to the true value of the target data to correctly decrypt one of the first ciphertext and the second ciphertext to obtain the second fragment specifically includes: Using the target random number corresponding to the actual value of the target data, the target ciphertext is decrypted to obtain the decryption result, and the hash value of the decryption result is calculated; When the hash value of the decryption result is the same as the hash value in the target message, the decryption result is identified as the second fragment.

12. The method according to claim 11, wherein the step of correctly decrypting one of the first ciphertext and the second ciphertext to obtain the second fragment by using the target random number corresponding to the true value of the target data, further comprises: When the hash value of the decryption result is different from the hash value in the target message, the predetermined value is decrypted using the target random number to obtain the second fragment.

13. A secure multi-party computation device for calculating the result of a target data and a first privacy value held by a first party through a target function operation, wherein the target data has a possible first value and a second value, and the first party also holds a first random number and a second random number corresponding to the first value and the second value, respectively; The device is deployed in the first party, and the device includes: The determining unit is configured to determine a first fragment, a first ciphertext, and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using a first random number. The first intermediate value is obtained by performing a preset operation on the first fragment with the first privacy value and the first value obtained by performing a first operation on the first privacy value and the first value obtained by performing the preset operation on the first fragment. The communication unit is configured to send a target message to a second party, enabling the second party to obtain the first ciphertext and the second ciphertext, and to correctly decrypt one of the first ciphertext and the second ciphertext using a target random number corresponding to the actual value of the target data to obtain a second fragment. The first fragment and the second fragment form two fragments of the calculation result.

14. A secure multi-party computation device for calculating the result of a target data and a first privacy value held by a first party through a target function operation, wherein the target data has a possible first value and a second value, and the first party also holds a first random number and a second random number corresponding to the first value and the second value, respectively; The device is deployed in a second party, and the device includes: The communication unit is configured to receive a target message from the first party and obtain a first ciphertext and a second ciphertext. The first ciphertext is the result of encrypting a first intermediate value using a first random number. The first intermediate value is obtained by performing a preset operation on a first segment by processing a first privacy value and a first value using a target function. The second ciphertext is the result of encrypting a second intermediate value using a second random number. The second intermediate value is obtained by performing the preset operation on a first segment by processing a second result of processing a first privacy value and a second value using a target function. The first segment is determined by the first party. The processing unit is configured to correctly decrypt one of the first ciphertext and the second ciphertext using the target random number corresponding to the actual value of the target data to obtain a second fragment, wherein the first fragment and the second fragment form two fragments of the calculation result.

15. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computing device, the computing device performs the method of any one of claims 1-12.

16. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-12.

Images