Multi-party secure computation method, device and equipment and computer readable storage medium

Abstract

The application discloses a multi-party secure calculation method, device and equipment and a computer readable storage medium. The method comprises the following steps: receiving a calculation task sent by a distributed calculation master node; obtaining calculation data required for completing the calculation task through a probe, wherein the calculation data comprises any one of a data source, data calculated by the probe, and data calculated by a distributed calculation node; performing calculation according to the calculation data and the calculation task to obtain a first calculation result; and sending the first calculation result to the distributed calculation master node, so that the distributed calculation master node aggregates a plurality of first calculation results to obtain a second calculation result corresponding to a multi-party secure calculation task. According to the embodiment of the application, the calculation efficiency of a single calculation node and the timeliness of data synchronization between calculation nodes can be improved, and thus the calculation efficiency of the entire multi-party secure calculation task can be improved.

Description

Technical Field

[0001] This application belongs to the field of multi-party secure computation technology, and in particular relates to a multi-party secure computation method, apparatus, device and computer-readable storage medium. Background Technology

[0002] With the advent of the big data era, the conflict between privacy protection and data sharing has become increasingly prominent. How to achieve confidential data sharing via the internet without compromising privacy is a crucial issue in cryptography and a significant practical problem in information security. Against this backdrop, Secure Multi-party Computation (MPC) has emerged, enabling privacy data sharing while protecting individual privacy information. Secure Multi-party Computation refers to a group of mutually distrustful participants collaborating on computations while protecting their individual privacy.

[0003] Existing multi-party secure computation (MMC) systems are typically based on a single server or a single compute node, where the computation task is completed locally for each participating party. However, MMCs are often characterized by large computational loads, large data volumes, and high storage requirements, resulting in lengthy completion times for a single task. Furthermore, the low timeliness of data synchronization between MMC nodes further contributes to the overall low computational efficiency of the MMC task. Summary of the Invention

[0004] This application provides a multi-party secure computation method, apparatus, device, computer-readable storage medium, and computer program product, which can improve the computational efficiency of a single computing node and the timeliness of data synchronization between computing nodes, thereby improving the computational efficiency of the entire multi-party secure computation task.

[0005] In a first aspect, embodiments of this application provide a multi-party secure computation method applied to distributed computing nodes, the method comprising:

[0006] Receive computing tasks sent by the distributed computing master node;

[0007] The probe acquires the computational data required to complete the computational task. The computational data includes any one of the following: data from a data source, data calculated by the probe, and data calculated by a distributed computing node.

[0008] Based on the computational data and the computational task, a first computational result is obtained;

[0009] The first calculation result is sent to the distributed calculation master node, so that the distributed calculation master node aggregates a plurality of the first calculation results to obtain a second calculation result corresponding to the multi-party secure calculation task.

[0010] In a possible implementation, the method further includes:

[0011] The state information corresponding to the distributed calculation node is sent to the distributed calculation master node according to a preset period, so that the distributed calculation master node performs calculation task allocation according to the state information.

[0012] In a second aspect, an embodiment of the present application provides a multi-party secure calculation method, applied to a probe, and the method includes:

[0013] In the process of performing the multi-party secure calculation, a data packet transmitted between calculation nodes is acquired, the calculation nodes including a distributed calculation node and a probe;

[0014] The data packet is parsed to obtain a request header identifier;

[0015] In a case where the request header identifier includes a data synchronization identifier, a target calculation node and target data corresponding to the data synchronization identifier are acquired, wherein the data synchronization identifier is used to represent that the target calculation node requests to acquire the target data;

[0016] According to the data synchronization identifier, the target data is sent to the target calculation node.

[0017] In a possible implementation, before the data packet transmitted between the calculation nodes is acquired, the method further includes:

[0018] A configuration file is acquired;

[0019] The configuration file is parsed to obtain a plurality of configuration identifiers;

[0020] After the request header identifier is obtained, the method further includes:

[0021] The request header identifier is searched in the plurality of configuration identifiers;

[0022] In a case where the request header identifier is included in the plurality of configuration identifiers, the request header identifier is parsed.

[0023] In a possible implementation, the method further includes:

[0024] The data synchronization identifier and a first data synchronization process corresponding to the data synchronization identifier are stored, and the first data synchronization process includes the sending of the target data to the target calculation node.

[0025] In a possible implementation, after the data synchronization identifier and the corresponding first data synchronization process are stored, the method further includes:

[0026] According to the data synchronization identifier, the first data synchronization process is compared with a second data synchronization process in a configuration file.

[0027] In a possible implementation, after the request header identifier is obtained, the method further includes:

[0028] In a case where the step identifier is included in the request header identifier, the computing node and the computing step corresponding to the step identifier are acquired;

[0029] The step identifier and the corresponding first computing process are stored, the first computing process including the computing step and the corresponding computing node.

[0030] In a possible implementation, after the step identifier and the corresponding first computing process are stored, the method further includes:

[0031] According to the step identifier, the first computing process is compared with a second computing process in a configuration file.

[0032] In a third aspect, an embodiment of the present application provides a multi-party secure computing device, applied to a distributed computing node, and the device includes:

[0033] A receiving module is configured to receive a computing task sent by a distributed computing master node.

[0034] A first acquiring module is configured to acquire, by a probe, computing data required for completing the computing task, the computing data including any one of a data source, data calculated by the probe, and data calculated by a distributed computing node.

[0035] A computing module is configured to perform calculation according to the computing data and the computing task, to obtain a first calculation result.

[0036] A first sending module is configured to send the first calculation result to the distributed computing master node, so that the distributed computing master node aggregates a plurality of first calculation results to obtain a second calculation result corresponding to a multi-party secure computing task.

[0037] In a fourth aspect, an embodiment of the present application provides a multi-party secure computing device, applied to a probe, and the device includes:

[0038] A second acquiring module is configured to acquire, in a process of performing multi-party secure calculation, a data packet transmitted between computing nodes, the computing nodes including a distributed computing node and a probe.

[0039] The first parsing module is configured to parse the data packet to obtain a request header identifier.

[0040] The third obtaining module is configured to, in a case where the request header identifier comprises a data synchronization identifier, obtain a target computing node and target data corresponding to the data synchronization identifier, wherein the data synchronization identifier is used to represent that the target computing node requests to obtain the target data.

[0041] The second sending module is configured to send the target data to the target computing node according to the data synchronization identifier.

[0042] In a fifth aspect, an electronic device is provided, and the device comprises a processor and a memory storing computer program instructions.

[0043] The processor implements the method in any possible implementation method of the first aspect or the second aspect when executing the computer program instructions.

[0044] In a sixth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores computer program instructions. The computer program instructions are executed by a processor to implement the method in any possible implementation method of the first aspect or the second aspect.

[0045] In a seventh aspect, a computer program product is provided. Instructions in the computer program product are executed by a processor of an electronic device to cause the electronic device to perform the method in any possible implementation method of the first aspect or the second aspect.

[0046] The multi-party secure computing method, device, and equipment, computer readable storage medium, and computer program product provided in the embodiments of the present application can reduce the computing amount of each distributed computing node and improve the computing efficiency by receiving the computing task sent by the distributed computing master node. Since the probe can perform partial computing, the computing efficiency can be further improved. Since the computing data comprises any one of a data source, data obtained by the probe, and data obtained by the distributed computing node, the timeliness of data synchronization between the computing nodes can be improved by obtaining the computing data through the probe. The distributed computing master node can aggregate the computing result to obtain the complete computing result by sending the computing result to the distributed computing master node. In this way, the computing efficiency of a single computing node and the timeliness of data synchronization between the computing nodes can be improved through the embodiments of the present application, and the computing efficiency of the entire multi-party secure computing task can be further improved. BRIEF DESCRIPTION OF DRAWINGS

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a schematic diagram of the structure of a multi-party secure computing system provided in an embodiment of this application;

[0049] Figure 2 This is a flowchart illustrating a multi-party secure computation method applied to distributed computing nodes, as provided in an embodiment of this application.

[0050] Figure 3 This is a flowchart illustrating a multi-party security calculation method for probes provided in an embodiment of this application;

[0051] Figure 4 This is a flowchart illustrating another multi-party security computation method for probes provided in an embodiment of this application;

[0052] Figure 5 This is a flowchart illustrating a multi-party secure computation method provided in an embodiment of this application;

[0053] Figure 6 This is a schematic diagram of the structure of a multi-party secure computing device applied to a distributed computing node, provided in an embodiment of this application.

[0054] Figure 7 This is a schematic diagram of a multi-party security computing device for probes provided in an embodiment of this application;

[0055] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0056] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0058] In this application, secure multi-party computation is a cryptographic privacy protection technology that refers to the joint execution of a secure multi-party computation algorithm by multiple parties without a trusted third party. They perform secure computation based on their respective input data to obtain a computation result without disclosing their input data to other parties.

[0059] Distributed computing, the opposite of centralized computing, refers to breaking down a computational process into multiple smaller tasks and distributing them across multiple machines. Each machine performs the computation independently, and the results are then uploaded and merged to arrive at the final conclusion. A distributed computing engine is a framework or system that implements distributed computing.

[0060] Probes, also known as "instruments," are essentially black boxes after system startup. A probe can be considered a plug-in, acting like a proxy to obtain system data through probe rules, completely decoupled from the system. Furthermore, probes make data flow transparent and the process verifiable.

[0061] A typical multi-party secure computation scenario usually involves two or more parties. Each party deploys its own secure computing node, and the nodes interact and cooperate through a multi-party security protocol. Because the amount of data used for computation between nodes is typically large (potentially up to a billion records), it places high demands on the central processing unit (CPU), memory, network communication, and physical storage. In existing multi-party secure computation systems, each party's multimedia personal computer (MPC) node responsible for secure computation is typically composed of a high-performance single-machine server, which may include, for example, a 40-core CPU and 256GB of memory. In other words, existing single-node multi-party secure computation systems suffer from drawbacks such as high single-machine hardware requirements, long computation time, poor system performance, and lack of support for distributed computing.

[0062] Furthermore, in multi-party secure computation scenarios, computing nodes need to utilize data from multiple data sources for computation. Since the data volume is often substantial, the timeliness of multiple data sources and the effectiveness of data sharing between nodes become challenges. In existing technologies, computing nodes interact with each other through Application Programming Interfaces (APIs), which faces problems such as long interface processing times due to large data volumes, and even data interaction failures.

[0063] Therefore, in order to solve the problems of the prior art, the embodiments of this application provide a multi-party secure computing method, apparatus, device, computer-readable storage medium, and computer program product.

[0064] The multi-party secure computation system provided in the embodiments of this application is described below.

[0065] Figure 1 A schematic diagram of the structure of a multi-party secure computing system provided in an embodiment of this application is shown. Figure 1 As shown in the embodiments of this application, the multi-party secure computation system may include an embedded big data distributed computing engine. Multiple parties can participate in the multi-party secure computation. Taking two parties as an example, one party can be the initiating node, and the other party can be a collaborating node. The initiating node and the collaborating node can complete the entire multi-party secure computation task through data interaction and collaboration. During the multi-party secure computation process, the initiating node and the collaborating node respectively distribute their local secure computation tasks to their local embedded big data distributed computing engine.

[0066] The embedded big data distributed computing engine can be a cluster composed of multiple nodes, divided into a multi-party secure computing master node and multi-party secure computing nodes. The multi-party secure computing master node is responsible for decomposing and distributing computing tasks, summarizing computing results, and reporting the summarized computing results to the secure computing nodes above.

[0067] During multi-party secure computation, probes can proactively acquire node configuration data sources and intercept requests between nodes via network interface cards. Data synchronization can be performed through probes. Furthermore, leveraging the characteristics of probe links, data flow can be made transparent, enabling the system to verify its innocence, and abnormal requests can be intercepted and reported.

[0068] The multi-party secure computation method provided in the embodiments of this application is described below.

[0069] The multi-party secure computation method provided in this application embodiment may include the following steps.

[0070] The first step involves the initiating node of a multi-party secure computation task initiating the task, and the collaborating nodes receiving the task, thus enabling all parties to start the secure computation task.

[0071] The second step is to start the probe on the node service to obtain the node data source configuration, monitor the data source in real time, and obtain secure data from other nodes and synchronize it to the local distributed computing engine master node in real time.

[0072] The third step involves the secure computing node distributing its local secure computing task to the local distributed computing engine master node, at which point all parties begin local computing. The local distributed computing engine master node is responsible for the resource management of the entire cluster, receiving computing tasks, scheduling and breaking them down among computing nodes, and summarizing the results.

[0073] The fourth step involves the local distributed computing engine master node breaking down the secure computing task into multiple sub-tasks.

[0074] Fifth, the distributed computing engine master node distributes the subtasks to various computing nodes in the cluster, and each computing node performs local computation. After the computation is completed, the computation result is reported to the master node.

[0075] The sixth step involves the distributed computing engine master node summarizing the subtask calculation results from each computing node in the cluster and reporting them to the secure computing node.

[0076] Step 7: All participating nodes, including the initiating node and collaborating nodes, have completed their computation tasks. The entire secure computation task is now complete.

[0077] Because the above computation process is a distributed computing process, and each computing node is responsible for completing a subtask consisting of partial data and partial computation, it does not require high-configuration hardware such as memory and CPU to complete the task. Generally speaking, to complete the same computational task, the more nodes that make up the distributed computing cluster, the lower the hardware configuration requirements for individual nodes. This accelerates secure multi-party computation, reduces the hardware requirements of individual nodes, and improves overall performance.

[0078] Furthermore, the probe scheme provided in this application embodiment enables more effective node data sharing, ensures real-time performance, and decouples the system functionally. By using probes, data and requests can be verified, demonstrating data flow and request invocation processes.

[0079] Figure 2 This illustration shows a flowchart of a multi-party secure computation method applied to distributed computing nodes, provided by an embodiment of this application. Figure 2 As shown, the multi-party secure computation method for distributed computing nodes provided in this application includes steps S210 to S240.

[0080] S210: Receive computing tasks sent by the distributed computing master node.

[0081] Computational tasks can be smaller tasks derived from the decomposition of large tasks by distributed computing master nodes.

[0082] As an example, a distributed computing master node may include a global scheduler, and distributed computing nodes may include local schedulers. The distributed computing master node can use the global scheduler to send computing tasks to the local schedulers of the distributed computing nodes.

[0083] S220. Obtain the computational data required to complete the computational task through the probe. The computational data includes any one of the following: data from the data source, data calculated by the probe, and data calculated by the distributed computing nodes.

[0084] Here, the computational data acquired by the distributed computing nodes can be data from a local data source, or data computed by any distributed computing node other than the current distributed computing node in the multi-party secure computation system. That is, the distributed computing nodes can interact with data from their local distributed computing nodes, as well as with distributed computing nodes from other parties. Furthermore, probes can perform basic processing computation tasks based on configuration files, enabling the distributed computing nodes to perform core computational tasks. In other words, the data computed by the probes can also be used as computational data for the distributed computing nodes.

[0085] As an example, if distributed computing node A requires data computed by distributed computing node B, and if distributed computing node A and distributed computing node B are the same party in a multi-party secure computation, the data can be transmitted from distributed computing node B to a probe, and then forwarded by the probe to distributed computing node A. If distributed computing node A and distributed computing node B are different parties in the multi-party secure computation, the data can be transmitted from distributed computing node B to a probe belonging to distributed computing node B, then forwarded by the probe to a probe belonging to distributed computing node A, and finally forwarded by the probe to distributed computing node A.

[0086] S230. Perform calculations based on the calculation data and calculation tasks to obtain the first calculation result.

[0087] As an example, a distributed computing node may include a task executor. The task executor can receive computing tasks sent by a local scheduler and perform the computing process based on the computing data and the computing tasks.

[0088] S240. Send the first calculation result to the distributed computing master node so that the distributed computing master node can summarize the multiple first calculation results to obtain the second calculation result corresponding to the multi-party secure computing task.

[0089] Based on this, in order to make reasonable use of computing resources and improve computing efficiency, some embodiments may further include:

[0090] The system sends status information corresponding to the distributed computing nodes to the distributed computing master node at a preset period, so that the distributed computing master node can allocate computing tasks based on the status information.

[0091] Here, status information can be used to characterize whether a distributed computing node is performing a computation task, is idle, or is in a fault state. Distributed computing nodes can send status information to the distributed computing master node via a local scheduler at preset intervals. Additionally, the distributed computing master node can include a task caching service to cache status information. Upon receiving the status information, the distributed computing master node can allocate computation tasks based on the status information in the task caching service.

[0092] In this way, by sending status information to the distributed computing master node according to a preset period, the distributed computing master node can allocate computing tasks based on the status information of the distributed computing nodes, thereby making reasonable use of computing resources and improving computing efficiency.

[0093] The multi-party secure computation method of this application embodiment receives computation tasks sent by a distributed computing master node through distributed computing nodes, which can reduce the computational load of each distributed computing node and improve computational efficiency. Since probes can perform partial computations, computational efficiency can be further improved. Because the computational data includes any one of the following: data source, data calculated by probes, and data calculated by distributed computing nodes, obtaining computational data through probes can improve the timeliness of data synchronization between computing nodes. By sending the computation results to the distributed computing master node, the distributed computing master node can summarize the computation results to obtain the complete computation result. Thus, through this application embodiment, the computational efficiency of a single computing node and the timeliness of data synchronization between computing nodes can be improved, thereby improving the overall computational efficiency of the multi-party secure computation task.

[0094] Figure 3 This illustration shows a flowchart of a multi-party security computation method for probes provided in an embodiment of this application. Figure 3 As shown, the multi-party security computation method for probes provided in this application includes the following steps:

[0095] S310. During the multi-party secure computation process, data packets transmitted between computing nodes are acquired. The computing nodes include distributed computing nodes and probes.

[0096] S320. Parse the data packet to obtain the request header identifier;

[0097] S330. If the request header identifier includes a data synchronization identifier, obtain the target computing node and target data corresponding to the data synchronization identifier, wherein the data synchronization identifier is used to indicate that the target computing node requests to obtain the target data;

[0098] S340. Send the target data to the target computing node according to the data synchronization identifier.

[0099] The multi-party secure computation method in this embodiment acquires and parses data packets transmitted between computing nodes using probes to obtain request header identifiers. This allows for monitoring of data transmission between computing nodes and verification of the accuracy of data transmission. By including a data synchronization identifier in the request header identifier and performing a data synchronization process, the security of data transmission between computing nodes can be guaranteed.

[0100] The specific implementation methods for each of the above steps are described below.

[0101] In some embodiments, during S310, the probe can collect multiple TCP packets and reassemble the collected TCP packets into HTTP packets to obtain the data packets transmitted between computing nodes, i.e., the complete request of the computing nodes.

[0102] In some embodiments, in S320, after the probe receives the data packet, it can parse the data packet. If the data packet includes a request header identifier, the request corresponding to the data packet can be considered a valid request. If the data packet does not include a request header identifier, the request corresponding to the data packet can be considered an invalid request.

[0103] If the request corresponding to the data packet is invalid, the request can be intercepted, thereby improving the security of multi-party secure computation.

[0104] If the request corresponding to the data packet is a valid request, in order to obtain the data synchronization identifier and / or step identifier in the data packet, in some embodiments, before S310 above, the following may be included:

[0105] Get the configuration file;

[0106] Parse the configuration file to obtain multiple configuration identifiers;

[0107] Therefore, following the above-mentioned S320, the following may also be included:

[0108] Search for the request header identifier among multiple configuration identifiers;

[0109] If a request header identifier is included in multiple configuration identifiers, the request header identifier is parsed.

[0110] Here, the configuration file may include the data source, data synchronization identifier and its corresponding data synchronization process, step identifier and its corresponding calculation process, and configuration identifier. Different configuration identifiers may include different data synchronization identifiers and / or step identifiers.

[0111] To give a concrete example, a compute node may need to make multiple requests to complete a computation. Since these multiple requests belong to the same computation, assuming the identifier corresponding to this request is "job," then the value of this type of request, i.e., the identifier "job," is the same. However, because the execution order and meaning of the steps in different requests may be different, assuming the configuration identifier is "ev," then "ev" will be different.

[0112] As an example, if the configuration identifier includes a request header identifier, the request header identifier can be parsed to determine whether it includes a step identifier and / or a data synchronization identifier. If the configuration identifier does not include a request header identifier, then the request header identifier does not need to be parsed.

[0113] Thus, by parsing the request header identifier when the configuration identifier includes the request header identifier, the data synchronization identifier and / or step identifier in the data packet can be obtained.

[0114] In some embodiments, in S330, if the request header identifier includes a data synchronization identifier, data synchronization between computing nodes can be performed based on the data synchronization identifier. Specifically, data synchronization can involve sending data to computing node A. Thus, to complete the data synchronization process, the target computing node and target data corresponding to the data synchronization identifier can be obtained. The target computing node can be the node that initiated the data acquisition request, and the target data can be data calculated by distributed computing nodes, data calculated by probes, or data from a data source.

[0115] In some embodiments, in S340, after obtaining the target computing node and the target data, the target data can be sent to the target computing node.

[0116] Based on this, in order to visualize data synchronization during multi-party secure computation, some embodiments may further include:

[0117] The storage data synchronization identifier and its corresponding first data synchronization process are included, which includes sending target data to the target computing node.

[0118] Here, during the probe's data synchronization process, a data synchronization identifier and its corresponding first data synchronization process can be stored simultaneously. Alternatively, after the probe performs data synchronization, the data synchronization identifier and its corresponding first data synchronization process can be stored. The data synchronization identifier and its corresponding first data synchronization process can serve as credential data to demonstrate the data synchronization process. Furthermore, the first data synchronization process can be the actual data synchronization process during multi-party secure computation.

[0119] In this way, by storing data synchronization identifiers and their corresponding first data synchronization processes, the data synchronization process can be displayed based on the data synchronization identifiers and their corresponding first data synchronization processes, thus realizing the visualization of data synchronization during multi-party secure computation.

[0120] Based on this, in order to verify the accuracy of the actual data synchronization process and improve the accuracy of the multi-party secure computation results, in some embodiments, after the aforementioned storage data synchronization identifier and its corresponding first data synchronization process, the following may be included:

[0121] Based on the data synchronization identifier, the first data synchronization process is compared with the second data synchronization process in the configuration file.

[0122] Here, the second data synchronization process can be the standard data synchronization process stored in the configuration file. Thus, by comparing the actual data synchronization process and the standard data synchronization process belonging to the same data synchronization identifier, the accuracy of the actual data synchronization process can be verified. If the actual data synchronization process is inaccurate, it can be modified accordingly, thereby improving the accuracy of the multi-party secure computation results.

[0123] Based on this, in order to visualize the computation process during multi-party secure computation, in some embodiments, after S320 above, the following may be included:

[0124] If the request header includes a step identifier, retrieve the computation node and computation step corresponding to the step identifier;

[0125] The storage step identifier and its corresponding first calculation process are included. The first calculation process includes the calculation steps and their corresponding calculation nodes.

[0126] Here, after the probe obtains the computation node and computation step corresponding to the step identifier, it can store the step identifier and its corresponding first computation process. The step identifier and its corresponding first computation process can serve as credential data for displaying the computation process. Furthermore, the first computation process can be the actual computation process within a multi-party secure computation process.

[0127] In this way, by storing step identifiers and their corresponding first calculation processes, the calculation process can be displayed based on the step identifiers and their corresponding first calculation processes, thus realizing the visualization of the calculation process in the multi-party secure computation process.

[0128] Therefore, in order to verify the accuracy of the actual calculation process and improve the accuracy of the multi-party secure calculation results,

[0129] In some embodiments, after the above-described storage step identifier and its corresponding first calculation process, the following may also be included:

[0130] Based on the step identifiers, the first calculation process is compared with the second calculation process in the configuration file.

[0131] Here, the second calculation process can be a standard calculation process stored in the configuration file. Thus, by comparing the actual calculation process with the standard calculation process belonging to the same step identifier, the accuracy of the actual calculation process can be verified. If the actual calculation process is inaccurate, it can be modified accordingly, thereby improving the accuracy of the multi-party secure calculation results.

[0132] To better describe the actual workflow of the probe, some specific examples are given based on the above embodiments.

[0133] First, a probe can be an agent. An agent can process and package the original .class before it is loaded using aspect ratio analysis, inject enhanced functions into the target code, achieve code decoupling, and perform logical processing at a specified interface.

[0134] The process of performing logical processing through an agent can be shown as follows:

[0135] Step 1: Enable agent mode in the program using the java-agent parameter configuration;

[0136] Step 2: Configure the agent to describe information about the program, such as specifying function entry points;

[0137] Step 3: Start the program agent. Based on step 2, runtime bytecode enhancement can be achieved, modifying or replacing classes and methods.

[0138] Step 4: The program data synchronization interface is called, and step 3 initiates data synchronization asynchronously through a proxy.

[0139] Step 5: The program algorithm component is invoked. Step 3 obtains the process of the algorithm component through a proxy, persists it, and visualizes it.

[0140] Based on this, as an example, such as Figure 4 As shown, the actual workflow of the probe may include the following steps:

[0141] S41. Load and parse the configuration file;

[0142] S42. Collect TCP data packets;

[0143] S43. Assemble the TCP packets into a complete request;

[0144] S44. Determine if it is a valid request. If yes, proceed to S45. If no, end.

[0145] S45, Parse request;

[0146] S46. Determine whether the request header identifier includes a step identifier. If yes, proceed to S47; otherwise, proceed to S49.

[0147] S47, Persistent Database;

[0148] S48. Algorithm flowchart presentation;

[0149] S49. Determine whether the request header identifier includes a data synchronization identifier. If yes, proceed to S410; otherwise, end.

[0150] S410, data synchronization.

[0151] Here, before S41 mentioned above, it may also include:

[0152] Step 1: Configure the probe to collect packets and set the port and identifier;

[0153] Step 2: Install the probe onto the program's server.

[0154] Furthermore, the persistent database can specifically store step identifiers and their corresponding computation processes in the database. Data synchronization can specifically involve the probe calling the interfaces of the first and second computing nodes based on the data synchronization identifier to send data from the second computing node to the first computing node. The first computing node can be any one of multiple computing nodes, and the second computing node can be any one of multiple computing nodes other than the first computing node.

[0155] Therefore, by adding probes during the multi-party secure computation process, it is possible to effectively solve the problem of synchronizing data from multiple data sources, and to make the algorithm transparent and the data flow traceable without intrusion, thus providing strong evidence for the system to prove its innocence.

[0156] To better describe the overall solution, some specific examples are given based on the above embodiments.

[0157] like Figure 5 As shown, probes, distributed computing master nodes, and distributed computing nodes can belong to the same party in a multi-party secure computation. Assistant nodes and distributed computing master nodes can belong to different parties in a multi-party secure computation. Assistant nodes and distributed computing master nodes can interact with each other and synchronize data via probes.

[0158] A distributed computing master node may include a global scheduler and a task caching service. The global scheduler receives tasks submitted by local schedulers. After receiving a task, the distributed computing master node can cache it through the task caching service and then allocate tasks based on those submitted by the local schedulers. The tasks submitted by the local schedulers may include, for example, the computation results and status information submitted by the distributed computing nodes.

[0159] A distributed computing node can include a local scheduler, task executors, local storage services, and an object manager. The local scheduler can submit tasks to the global scheduler. The task executors can execute computation tasks. After obtaining the computation results, they can be stored through the local storage service. Furthermore, the object manager can be used for data association between distributed computing nodes within the same distributed computing engine.

[0160] The probe can include a data scheduler and a listener. The data scheduler can acquire data sources in real time and is used for data synchronization and sharing, while the listener can be used to visualize network requests and store credential data.

[0161] Therefore, the multi-party secure computation system in this embodiment combines the advantages of multi-party secure computation and distributed computing by embedding a big data distributed computing engine. It can achieve efficient multi-party secure computation on a cluster of servers with ordinary configurations, solving the shortcomings of traditional multi-party secure computation such as insufficient computing power, high hardware requirements, and low computing performance. By adding probes, it is possible to ensure real-time updates and sharing of multiple data sources across nodes without intrusive code, and to verify the accuracy of data transmission, achieving process verifiability.

[0162] Based on the multi-party secure computation method provided in the above embodiments, this application also provides specific implementations of a multi-party secure computation device. Please refer to the following embodiments.

[0163] like Figure 6 As shown in the embodiments of this application, the multi-party secure computing device 600 applied to distributed computing nodes includes the following modules:

[0164] The receiving module 610 is used to receive computing tasks sent by the distributed computing master node;

[0165] The first acquisition module 620 is used to acquire the computational data required to complete the computational task through a probe. The computational data includes any one of the following: data from a data source, data calculated by the probe, and data calculated by a distributed computing node.

[0166] The calculation module 630 is used to perform calculations based on the calculation data and calculation tasks to obtain the first calculation result;

[0167] The first sending module 640 is used to send the first calculation result to the distributed computing master node, so that the distributed computing master node can summarize the multiple first calculation results to obtain the second calculation result corresponding to the multi-party secure computing task.

[0168] The multi-party secure computing device 600 described above will be explained in detail below:

[0169] In some embodiments, the multi-party secure computing device 600 may further include:

[0170] The third sending module is used to send status information corresponding to the distributed computing node to the distributed computing master node according to a preset period, so that the distributed computing master node can allocate computing tasks according to the status information.

[0171] The multi-party secure computation device of this application embodiment receives computation tasks sent by the distributed computing master node through distributed computing nodes, which can reduce the computational load of each distributed computing node and improve computational efficiency. Since the probe can perform partial computation, computational efficiency can be further improved. Because the computational data includes any one of the following: data source, data calculated by the probe, and data calculated by the distributed computing nodes, obtaining computational data through the probe can improve the timeliness of data synchronization between computing nodes. By sending the computation results to the distributed computing master node, the distributed computing master node can summarize the computation results to obtain the complete computation result. Thus, through this application embodiment, the computational efficiency of a single computing node and the timeliness of data synchronization between computing nodes can be improved, thereby improving the overall computational efficiency of the multi-party secure computation task.

[0172] like Figure 7 As shown in the embodiments of this application, the multi-party security computing device 700 for probes includes the following modules:

[0173] The second acquisition module 710 is used to acquire data packets transmitted between computing nodes during the multi-party secure computation process. The computing nodes include distributed computing nodes and probes.

[0174] The first parsing module 720 is used to parse the data packet to obtain the request header identifier;

[0175] The third acquisition module 730 is used to acquire the target computing node and target data corresponding to the data synchronization identifier when the request header identifier includes a data synchronization identifier, wherein the data synchronization identifier is used to indicate that the target computing node requests to acquire the target data;

[0176] The second sending module 740 is used to send target data to the target computing node according to the data synchronization identifier.

[0177] The multi-party secure computing device 700 described above will be explained in detail below:

[0178] In some embodiments, the multi-party secure computing device 700 may further include:

[0179] The fourth acquisition module is used to acquire the configuration file before acquiring the data packets transmitted between computing nodes;

[0180] The second parsing module is used to parse the configuration file and obtain multiple configuration identifiers;

[0181] Based on this, the multi-party secure computing device 700 may also include:

[0182] The lookup module is used to search for the request header identifier among multiple configuration identifiers after obtaining the request header identifier;

[0183] The third parsing module is used to parse the request header identifier when multiple configuration identifiers include the request header identifier.

[0184] In some embodiments, the multi-party secure computing device 700 may further include:

[0185] The first storage module is used to store data synchronization identifiers and their corresponding first data synchronization processes, the first data synchronization processes including sending target data to the target computing node.

[0186] In some embodiments, the multi-party secure computing device 700 may further include:

[0187] The first comparison module is used to compare the first data synchronization process with the second data synchronization process in the configuration file based on the data synchronization identifier after storing the data synchronization identifier and its corresponding first data synchronization process.

[0188] In some embodiments, the multi-party secure computing device 700 may further include:

[0189] The fifth acquisition module is used to acquire the computation node and computation step corresponding to the step identifier when the request header identifier includes a step identifier;

[0190] The second storage module is used to store step identifiers and their corresponding first calculation processes, the first calculation process including calculation steps and their corresponding calculation nodes.

[0191] In some embodiments, the multi-party secure computing device 700 may further include:

[0192] The second comparison module is used to compare the first calculation process with the second calculation process in the configuration file based on the step identifier after storing the step identifier and its corresponding first calculation process.

[0193] The multi-party secure computing device in this embodiment acquires and parses data packets transmitted between computing nodes using probes to obtain request header identifiers. This allows for monitoring of the data transmitted between computing nodes and verification of the accuracy of data transmission. By including a data synchronization identifier in the request header identifier and performing a data synchronization process, the security of data transmission between computing nodes can be guaranteed.

[0194] Based on the multi-party secure computation method provided in the above embodiments, this application also provides specific implementation methods for electronic devices. Figure 8 A schematic diagram of an electronic device 800 provided in an embodiment of this application is shown.

[0195] Electronic device 800 may include processor 810 and memory 820 storing computer program instructions.

[0196] Specifically, the processor 810 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0197] Memory 820 may include mass storage for data or instructions. For example, and not limitingly, memory 820 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 820 may include removable or non-removable (or fixed) media. Where appropriate, memory 820 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 820 is non-volatile solid-state memory.

[0198] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of this application.

[0199] The processor 810 implements any of the multi-party secure computation methods described in the above embodiments by reading and executing computer program instructions stored in the memory 820.

[0200] In one example, the electronic device 800 may also include a communication interface 830 and a bus 840. For example, Figure 8 As shown, the processor 810, memory 820, and communication interface 830 are connected through bus 840 and complete communication with each other.

[0201] The communication interface 830 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0202] Bus 840 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 840 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0203] For example, the electronic device 800 can be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0204] This electronic device can execute the multi-party secure computation method described in the embodiments of this application, thereby achieving a combination Figures 2 to 7 The method and apparatus for multi-party secure computation are described.

[0205] Furthermore, in conjunction with the multi-party secure computation methods described in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement any of the multi-party secure computation methods described in the above embodiments.

[0206] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0207] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0208] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0209] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0210] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A multi-party secure computation method, characterized in that, Applied to distributed computing nodes, the method includes: Receive computing tasks sent by the distributed computing master node; The probe acquires the computational data required to complete the computational task. The computational data includes any one of the following: data from the data source, data calculated by the probe, and data calculated by the distributed computing node. The probe is connected to the data source, the distributed computing node, and the distributed computing master node, respectively. The data calculated by the probe is the data obtained by the probe through basic processing and calculation of the data in the data source based on the configuration file. The data calculated by the distributed computing node includes data calculated by any distributed computing node in the multi-party secure computation system other than the current distributed computing node. Any distributed computing node other than the current distributed computing node includes distributed computing nodes on the same side as the current distributed computing node and distributed computing nodes on a different side from the current distributed computing node. Based on the computational data and the computational task, a first computational result is obtained; The first calculation result is sent to the distributed computing master node so that the distributed computing master node can summarize the multiple first calculation results to obtain a second calculation result corresponding to the multi-party secure computing task.

2. The method according to claim 1, characterized in that, The method further includes: The distributed computing master node sends status information corresponding to the distributed computing node at a preset period, so that the distributed computing master node can allocate computing tasks according to the status information.

3. A multi-party secure computation method, characterized in that, Applied to a probe, which is connected to a distributed computing node and a data source respectively, the method includes: During the multi-party secure computation process, data packets transmitted between computing nodes are acquired, including distributed computing nodes and probes; The data packet is parsed to obtain the request header identifier; If the request header identifier includes a data synchronization identifier, the target computing node and target data corresponding to the data synchronization identifier are obtained. The data synchronization identifier is used to indicate that the target computing node requests to obtain the target data. The target data includes any one of the following: data in the data source, data calculated by the probe, and data calculated by the distributed computing node. The data calculated by the probe is the data obtained by the probe through basic processing calculation of the data in the data source based on the configuration file. The data calculated by the distributed computing node includes the data calculated by any distributed computing node in the multi-party secure computing system other than the current distributed computing node. Any distributed computing node other than the current distributed computing node includes distributed computing nodes on the same side as the current distributed computing node and distributed computing nodes on a different side from the current distributed computing node. The target data is sent to the target computing node according to the data synchronization identifier.

4. The method according to claim 3, characterized in that, Before acquiring the data packets transmitted between computing nodes, the method further includes: Get the configuration file; The configuration file is parsed to obtain multiple configuration identifiers; After obtaining the request header identifier, the method further includes: Search for the request header identifier among the plurality of configuration identifiers; If the request header identifier is included among the plurality of configuration identifiers, the request header identifier is parsed.

5. The method according to claim 3, characterized in that, The method further includes: The data synchronization identifier and its corresponding first data synchronization process are stored, wherein the first data synchronization process includes sending the target data to the target computing node.

6. The method according to claim 5, characterized in that, After storing the data synchronization identifier and its corresponding first data synchronization process, the method further includes: Based on the data synchronization identifier, the first data synchronization process is compared with the second data synchronization process in the configuration file.

7. The method according to claim 3, characterized in that, After obtaining the request header identifier, the method further includes: If the request header identifier includes a step identifier, obtain the computing node and computing step corresponding to the step identifier; The step identifier and its corresponding first calculation process are stored, and the first calculation process includes the calculation step and its corresponding calculation node.

8. The method according to claim 7, characterized in that, After storing the step identifier and its corresponding first calculation process, the method further includes: Based on the step identifier, the first calculation process is compared with the second calculation process in the configuration file.

9. A multi-party secure computing device, characterized in that, The device, applied to distributed computing nodes, includes: The receiving module is used to receive computing tasks sent by the distributed computing master node; The first acquisition module is used to acquire the computational data required to complete the computational task through a probe. The computational data includes any one of the following: data from a data source, data calculated by the probe, and data calculated by a distributed computing node. The probe is connected to the data source, the distributed computing node, and the distributed computing master node, respectively. The data calculated by the probe is the data obtained by the probe through basic processing and calculation of the data in the data source based on a configuration file. The data calculated by the distributed computing node includes data calculated by any distributed computing node in the multi-party secure computation system other than the current distributed computing node. Any distributed computing node other than the current distributed computing node includes distributed computing nodes on the same side as the current distributed computing node and distributed computing nodes on a different side from the current distributed computing node. The calculation module is used to perform calculations based on the calculation data and the calculation task to obtain a first calculation result; The first sending module is used to send the first calculation result to the distributed computing master node, so that the distributed computing master node can summarize the multiple first calculation results to obtain the second calculation result corresponding to the multi-party secure computing task.

10. A multi-party secure computing device, characterized in that, The device is used for probes, which are connected to distributed computing nodes and data sources respectively. The device includes: The second acquisition module is used to acquire data packets transmitted between computing nodes during the multi-party secure computation process, wherein the computing nodes include distributed computing nodes and probes; The first parsing module is used to parse the data packet to obtain the request header identifier; The third acquisition module is used to acquire the target computing node and target data corresponding to the data synchronization identifier when the request header identifier includes a data synchronization identifier. The data synchronization identifier is used to indicate that the target computing node requests to acquire the target data. The target data includes any one of the following: data in the data source, data calculated by the probe, and data calculated by the distributed computing node. The data calculated by the probe is the data obtained by the probe through basic processing calculation of the data in the data source based on the configuration file. The data calculated by the distributed computing node includes the data calculated by any distributed computing node in the multi-party secure computing system other than the current distributed computing node. Any distributed computing node other than the current distributed computing node includes distributed computing nodes on the same side as the current distributed computing node and distributed computing nodes on a different side from the current distributed computing node. The second sending module is used to send the target data to the target computing node according to the data synchronization identifier.

11. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the multi-party secure computation method as described in any one of claims 1-2 or 3-8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the multi-party secure computation method as described in any one of claims 1-2 or 3-8.

13. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the multi-party secure computation method as described in any one of claims 1-2 or 3-8.

Images