A privacy extraction method and system based on Yao's obfuscation circuit

Abstract

This invention discloses a privacy extraction method and system based on Yao's obfuscation circuit, relating to the field of privacy-preserving data processing technology. The method includes: an obfuscation circuit generating algorithm executed by a first port and data transmitted to a second port; a calculation algorithm executed by the second port and data transmitted to the first port; an extraction algorithm executed by the first port and data transmitted to a third port; and a verification algorithm completed by an independent third port. This invention uses a pseudo-random function to ensure random extraction; uses unintended transmission to ensure the privacy and independence of the extraction processes at the first and second ports; and uses a verification algorithm to ensure that the entire extraction process is verifiable by a third party. It satisfies the following requirements: Security: No attacker can influence the extraction results through data analysis or tampering without being detected by the verifier; Randomness: No participant can independently complete the extraction or predict the extraction results; Verifiability: Any parameter during the extraction process can be verified by a third party, and any cheating can be detected and verified.

Description

Technical Field

[0001] This invention relates to the field of privacy-preserving data processing technology, and more specifically to a privacy extraction method and system based on Yao's obfuscated circuit. Background Technology

[0002] Endorsing nodes are a unique node type in consortium blockchains, whose role is to simulate and endorse transaction requests on behalf of ordinary ledger nodes. Research on the security of endorsed nodes mainly focuses on defense against external attacks, with little attention paid to cheating or collusion within the endorsing nodes themselves. Regarding the privacy extraction of endorsed nodes, currently only the VRF-based random selection scheme for Hyperledger Fabric (HF) endorsed nodes proposed by Meng Wutong et al. in 2019 exists. This scheme inserts an endorsement right extraction mechanism before transaction endorsement execution. Each candidate endorsed node must first complete VRF-based random number generation and endorsement qualification extraction. Candidate endorsed nodes that obtain endorsement qualification can endorse the transaction in this round; otherwise, the endorsement result is invalid. Afterwards, the endorsed node returns VRF verification information to a second port, which verifies the random selection results of the endorsement qualifications of each endorsed node in this round. This scheme changes the participation of endorsed nodes from fixed to random, reducing the probability of successful adversary attacks and improving the security of endorsed nodes.

[0003] However, existing methods for privacy extraction from endorsement nodes still have the following drawbacks:

[0004] (1) The algorithm design is complex and the computation is large.

[0005] Current research on consortium blockchains largely applies existing research to public blockchains, including research on endorsing nodes. For example, Meng Wutong et al.'s random selection scheme is derived from Algorand, a public blockchain platform created in 2016. Given the identityless and decentralized communication environment of public blockchains, random selection algorithms typically require a combination of multiple cryptographic algorithms for encryption / decryption, authentication, and digital signatures to ensure security. This approach suffers from drawbacks such as complex algorithm design and high computational cost. Furthermore, because consortium blockchain random selection research heavily borrows from public blockchain algorithms, redundant steps are often present. For instance, nodes that have already provided identity certificates still need to execute a key pair generation algorithm during the selection process, using two sets of keys for authentication.

[0006] (2) It cannot prevent collusion between endorsement nodes and between endorsement nodes and the second port.

[0007] In Meng Wutong et al.'s optimized scheme, random sampling is completed independently by the endorsing node, including the generation of random factors, the calculation of sampling parameters, and the generation of verification information. The verification information is decrypted by a third-party node to check the validity of the sampling results. Its main purpose is to prevent external attackers from impersonating endorsing nodes and disrupting consensus. However, existing solutions cannot prevent cheating and collusion within the endorsing node itself, and they do not consider collusion between the second port initiating the transaction request and the endorsing node.

[0008] Therefore, how to provide a privacy extraction method and system based on Yao's obfuscation circuit to make the extraction process private and independent, so that no party can predict the extraction result or obtain the extraction result alone, and to ensure that the entire extraction process can be verified by a third party, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0009] In view of this, the present invention provides a privacy extraction method and system based on Yao's obfuscation circuit. The present invention enhances the privacy and security of endorsed data, increases the difficulty of targeted attacks and node collusion attacks, alleviates the security risks of HF in practical applications, and the model is built based on the original communication path of Hyperledger Fabric without increasing the communication burden.

[0010] To achieve the above objectives, the present invention adopts the following technical solution: a privacy extraction method based on Yao's obfuscation circuit, applied to a first port, comprising:

[0011] Generate the first random seed and construct the first pseudo-random function;

[0012] Construct a confusion circuit based on the first pseudo-random function to generate a confusion sequence;

[0013] The input and output parameters of the obfuscating circuit are packaged into first parameter information according to a preset rule, and the first parameter information is encrypted to obtain a first verification value;

[0014] A first concatenated string is generated based on the input parameters of the obfuscation circuit, the obfuscation sequence, and the first verification value;

[0015] The first concatenated string is sent to the second port so that the second port completes the unintentional transmission protocol, decrypts to obtain the final function value and generates the second parameter information, encrypts the second parameter information to obtain temporary encrypted information, and performs secondary encryption with the first verification value to generate the second verification value. The second concatenated string is generated based on the final function value and the second verification value and sent to the first port.

[0016] After receiving the second concatenated string from the second port, the first extraction result is obtained by looking up the obfuscation circuit table generated by the obfuscation circuit based on the final function value.

[0017] A third concatenated string is generated based on the first extraction result and the second verification value. The third concatenated string is used to establish a connection between the first port and the third port.

[0018] Preferably, generating the first random seed and constructing the first pseudo-random function includes:

[0019] The first random seed is hashed, and the two random factors u and v of the first pseudo-random function are obtained based on the hash value;

[0020] Random values ​​are selected to determine the variables and function values ​​of the first pseudo-random function, and the definition of the first pseudo-random function is determined based on the relationship between the two random factors u and v.

[0021] Preferably, random values ​​x0, x1, y0, y1, z0, z1 are selected; x and y are set as variables of the first pseudo-random function, z is the function value of the first pseudo-random function, and x∈{x0,x1}, y∈{y0,y1}, z∈{z0,z1}, then the definition of the first pseudo-random function f(x) is:

[0022] (1) When u > v, let x = x1

[0023]

[0024] (2) When u≤v, let x=x0

[0025]

[0026] Preferably, constructing a confusion circuit based on the first pseudo-random function to generate a confusion sequence includes:

[0027] Using the first pseudo-random function as the functional function of the confusion circuit, a confusion circuit table and confusion values ​​are constructed.

[0028] The variable of the first pseudo-random function is used as the input parameter of the confusion circuit, and the function value of the first pseudo-random function is used as the output parameter of the confusion circuit.

[0029] Construct a confusion circuit table based on the relationship between input and output parameters;

[0030] The function values ​​of the obfuscated circuit table are subjected to AES double symmetric encryption to generate obfuscated values;

[0031] The obfuscation values ​​are randomly shuffled and made to meet preset conditions to obtain an obfuscated sequence.

[0032] Preferably, the input and output parameters of the obfuscation circuit are packaged into first parameter information according to a preset rule, and the first parameter information is encrypted to obtain a first verification value, including:

[0033] The first port uses its own private key to sign the first parameter information using the RSA algorithm, and then encrypts the signature result using the third port's public key to obtain the first verification value.

[0034] Preferably, the function values ​​of the first pseudo-random function include a first function value z0 and a second function value z1;

[0035] The final function value is the second function value z1;

[0036] The first extraction result is either the first function value z0 or the second function value z1.

[0037] A privacy extraction method based on Yao's obfuscation circuit, applied to a third port, includes:

[0038] The system receives a third concatenated string, which includes a first extraction result and a second verification value. The first extraction result is obtained by looking up the obfuscation circuit table through the first port based on the final function value. The final function value is obtained by decrypting the first concatenated string generated by the first port through the second port. The obfuscation circuit table is generated by the obfuscation circuit constructed through the first port.

[0039] The second verification value is obtained by encrypting the second parameter information generated from the final function value, and then encrypting the encryption result with the first verification value twice; the first verification value is obtained by encrypting the first parameter information; the first parameter information is obtained by packaging the input and output parameters of the obfuscation circuit constructed by the first port according to a preset rule;

[0040] Use your own private key to decrypt the second verification value and verify the first extraction result;

[0041] Determine whether the first port and / or the second port are being cheated.

[0042] Preferably, the method of decrypting the second verification value using one's own private key and verifying the first extraction result includes: decrypting the second verification value using one's own private key to obtain temporary encrypted information and the first verification value;

[0043] The first verification value is decrypted using the public key of the first port to obtain the third parameter information;

[0044] The temporary encrypted information is decrypted using the public key of the second port to obtain the fourth parameter information;

[0045] The first extraction result is verified based on the third parameter information and the fourth parameter information.

[0046] Preferably, determining whether the first port and / or the second port is cheating includes: the first extraction result is a first function value z0 or a second function value z1;

[0047] The function value of the fourth parameter information is compared with the first function value z0; if the function value of the fourth parameter information is the same as the first function value z0, then the extraction is valid and neither the first port nor the second port has cheated; otherwise, the extraction is invalid.

[0048] Alternatively, the function value of the fourth parameter information can be compared with the second function value z1; if the function value of the fourth parameter information is consistent with the second function value z1, then the extraction is valid and neither the first port nor the second port has cheated; otherwise, the extraction is invalid.

[0049] Preferably, a privacy extraction method and system based on Yao's obfuscation circuit, applied to a first port, includes:

[0050] The obfuscation circuit generation module is used to generate a first pseudo-random function and an obfuscation sequence, and to package the input parameters and output parameters of the obfuscation circuit into first parameter information according to a preset rule, and to encrypt the first parameter information to obtain a first verification value; and to generate a first concatenated string based on the input parameters of the obfuscation circuit, the obfuscation sequence and the first verification value.

[0051] The first data sending module is used to send the first concatenated string to the second port;

[0052] The data receiving module is used to receive the second concatenated string sent from the second port;

[0053] The extraction module is used to find the first extraction result by looking up the obfuscated circuit table generated by the obfuscated circuit based on the final function value, and generate a third concatenated string with the second verification value.

[0054] The second data sending module is used to send the third concatenated string to the second port.

[0055] As can be seen from the above technical solution, compared with the prior art, this invention discloses a privacy extraction method and system based on Yao's obfuscation circuit, including one first port, n second ports, and one third port, for generating, calculating, extracting, and verifying the obfuscation circuit that constitutes the model algorithm; wherein, the obfuscation circuit generation algorithm includes two sub-algorithms: pseudo-random function generation and obfuscation sequence generation, which are executed by the first port and transmit data to the second ports. The calculation algorithm includes two sub-algorithms: obfuscation circuit calculation and verification value generation, which are executed by the second ports and transmit data to the first port. The extraction algorithm is executed by the first port and transmits data information to the third port. The verification algorithm is completed by the independent third port.

[0056] This invention uses a pseudo-random function to ensure random sampling; it uses unintended transmission to ensure the sampling processes of the first and second ports are private and independent, with neither party able to predict or obtain the sampling result independently; and it uses a verification algorithm to ensure the entire sampling process is verifiable by a third party. It satisfies the following:

[0057] (1) Security: No attacker can manipulate the results by analyzing or tampering with the data and the verifier will be able to detect it.

[0058] (2) Randomness: No participant can independently complete the sampling or predict the sampling results.

[0059] (3) Verifiability: Any parameter in the extraction process can be verified by a third party, and any cheating can be detected and verified.

[0060] This invention fully utilizes existing Hyperledger Fabric communication paths to construct an endorsement identity extraction model between the server and endorsement nodes, randomly selecting endorsement qualifications for each round of transactions. The model uses a pseudo-random function to construct a confusion circuit, allowing nodes with different identities to independently execute the confusion circuit calculations. Privacy extraction is achieved through unintentional transmission, and the credibility of the extraction process is guaranteed by third-party verification. Furthermore, security analysis shows that this invention is secure under both two-party collusion attack models and multi-party collusion attack models. This invention enhances the privacy and security of endorsement data, increases the difficulty of targeted attacks and node collusion attacks, alleviates security vulnerabilities encountered in practical applications of Hyperledger Fabric, and does not increase communication burden based on the existing Hyperledger Fabric communication path. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0062] Figure 1 This is a schematic diagram of the multi-party privacy extraction model structure provided in an embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of the functions of each port in the third-party privacy extraction provided in an embodiment of the present invention;

[0064] Figure 3 A flowchart of the obfuscated circuit generation algorithm provided in an embodiment of the present invention;

[0065] Figure 4 A flowchart of the calculation algorithm provided in an embodiment of the present invention;

[0066] Figure 5 This is a flowchart of the algorithm for each port in the third-party privacy extraction provided in this embodiment of the invention; Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] This invention discloses a privacy extraction method based on Yao's obfuscation circuit, applied to a first port, comprising:

[0069] Generate the first random seed and construct the first pseudo-random function;

[0070] Construct a confusion circuit based on the first pseudo-random function to generate a confusion sequence;

[0071] The input and output parameters of the obfuscating circuit are packaged into first parameter information according to a preset rule, and the first parameter information is encrypted to obtain a first verification value;

[0072] A first concatenated string is generated based on the input parameters of the obfuscation circuit, the obfuscation sequence, and the first verification value;

[0073] The first concatenated string is sent to the second port so that the second port completes the unintentional transmission protocol, decrypts to obtain the final function value and generates the second parameter information, encrypts the second parameter information to obtain temporary encrypted information, and performs secondary encryption with the first verification value to generate the second verification value. The second concatenated string is generated based on the final function value and the second verification value and sent to the first port.

[0074] After receiving the second concatenated string from the second port, the first extraction result is obtained by looking up the obfuscation circuit table generated by the obfuscation circuit based on the final function value.

[0075] A third concatenated string is generated based on the first extraction result and the second verification value. The third concatenated string is used to establish a connection between the first port and the third port.

[0076] In one embodiment of the present invention, the first port is the server, the second port is the client, and the third port is the authenticator; the present invention is based on the Hyperledger Fabric multi-party verifiable privacy extraction model, such as... Figure 1As shown, the participants include 1 server and n clients. i (i∈[1,n])) and one verifier, labeled as Server and Client respectively. i (i∈[1,n]), Verifier. When n=1, it can be regarded as a 3-party verifiable privacy extraction model. Among them, the Server in Fabric can be the SDK, the Client in Fabric can be the endorsement node, and the Verifier in Fabric can be the sorting node; the embodiments of this invention are mainly described in terms of 3 parties.

[0077] The embodiments of this invention consist of algorithms (Gen, Compute, Draw, Verify), such as... Figure 2 As shown, Gen represents the obfuscated circuit generation algorithm, Compute represents the computation algorithm, Draw represents the extraction algorithm, and Verify represents the verification algorithm.

[0078] Step 1: Gen:(proposal)←GenPRF(seed). The scrambled circuit generation algorithm includes two sub-algorithms: pseudo-random function generation and scrambled sequence generation. These are executed by the server and the data is transmitted to the client.

[0079] Step 2, Compute:(z,proof)←Compute(proposal). The calculation algorithm includes two sub-algorithms: obfuscation circuit calculation and verification value generation. The Client executes the algorithm and transmits the response information to the Server.

[0080] Step 3, Draw:(x,z',proof')←Draw(z). The extraction algorithm is executed by the Server, which then transmits the verification information to the verifier.

[0081] Step 4, Verify: (1,⊥)←Verify(). The verification algorithm is performed by an independent third-party Verifier.

[0082] This invention fully utilizes the existing communication path of Hyperledger Fabric (HF) to construct an endorsement identity extraction model between the server and endorsement nodes, randomly selecting endorsement qualifications for each round of transactions. The model uses a pseudo-random function to construct a confusion circuit, allowing nodes with different identities to independently execute the confusion circuit calculation. Privacy extraction is achieved through unintentional transmission, and the credibility of the extraction process is guaranteed by third-party verification. This enhances the privacy and security of endorsement data, increases the difficulty of targeted attacks and node collusion attacks, and alleviates security risks encountered in practical applications of HF. Furthermore, the model is built on the existing Hyperledger Fabric communication path without increasing the communication burden.

[0083] Specifically, generating the first random seed and constructing the first pseudo-random function includes:

[0084] The first random seed is hashed, and the two random factors u and v of the first pseudo-random function are obtained based on the hash value;

[0085] Random values ​​are selected to determine the variables and function values ​​of the first pseudo-random function, and the definition of the first pseudo-random function is determined based on the relationship between the two random factors u and v.

[0086] Specifically, select random values ​​x0, x1, y0, y1, z0, z1; let x and y be variables of the first pseudo-random function, z be the function value of the first pseudo-random function, and x∈{x0,x1}, y∈{y0,y1}, z∈{z0,z1}, then the definition of the first pseudo-random function f(x) is:

[0087] (1) When u > v, let x = x1

[0088]

[0089] (2) When u≤v, let x=x0

[0090]

[0091] Specifically, the function values ​​of the first pseudo-random function include a first function value z0 and a second function value z1;

[0092] The final function value is the second function value z1;

[0093] The first extraction result is either the first function value z0 or the second function value z1.

[0094] Specifically, a confusion circuit is constructed based on the first pseudo-random function to generate a confusion sequence, including:

[0095] Using the first pseudo-random function as the functional function of the confusion circuit, a confusion circuit table and confusion values ​​are constructed.

[0096] The variable of the first pseudo-random function is used as the input parameter of the confusion circuit, and the function value of the first pseudo-random function is used as the output parameter of the confusion circuit.

[0097] Construct a confusion circuit table based on the relationship between input and output parameters;

[0098] The function values ​​of the obfuscated circuit table are subjected to AES double symmetric encryption to generate obfuscated values;

[0099] The obfuscation values ​​are randomly shuffled and made to meet preset conditions to obtain an obfuscated sequence.

[0100] Specifically, the input and output parameters of the obfuscating circuit are packaged into first parameter information according to a preset rule, and the first parameter information is encrypted to obtain a first verification value, including:

[0101] The first port uses its own private key to sign the first parameter information using the RSA algorithm, and then encrypts the signature result using the third port's public key to obtain the first verification value.

[0102] In one embodiment of the present invention, the main algorithm one, the obfuscation circuit generation algorithm Gen:(GenPRF, GenGValues, Proof1), is executed by the Server, and includes 3 sub-algorithms: GenPRF generated by a first pseudo-random function, GenGValues ​​generated by an obfuscated sequence, and Proof1 generated by a first verification value. The first pseudo-random function generation algorithm constructs a first pseudo-random function using a random factor, and the obfuscation sequence generation algorithm constructs an obfuscation circuit table, generates obfuscated values, and shuffles them according to the first pseudo-random function. The algorithm flowchart is shown below. Figure 3 As shown, the specific process is as follows:

[0103] 1. For the sub-algorithm GenPRF:(Hash(seed),x,x0,x1,y0,y1,z0,z1,f(x))←seed, the specific process is as follows:

[0104] Step 101: The server first generates a first random seed, performs SHA_256 hash processing on the first random seed, and records the hash value as Hash(seed).

[0105] Step 102: Take the first 8 bits of Hash(seed), denoted as u0, and take the last 8 bits of Hash(seed), denoted as u1. Let...

[0106]

[0107] Where u and v are the random factors of the first pseudo-random function in this round, and the Server will determine the definition of the pseudo-random function f(x) based on the relationship between the random factors.

[0108] Step 103: Randomly select 6 random values ​​x0, x1, y0, y1, z0, z1; the random values ​​are generated by an embedded random number generator or code.

[0109] Step 104: Suppose variables x, y, and z satisfy f(x,y)→z, and x∈{x0,x1}, y∈{y0,y1}, z∈{z0,z1}, then for the first pseudo-random function f(x):

[0110] (1) When u > v, let x = x1

[0111]

[0112] (2) When u≤v, let x=x0

[0113]

[0114] 2. The GenPRF algorithm for pairwise algorithms: (Hash(seed), x, x0, x1, y0, y1, z0, z1, f(x)) ← seed, the specific process is as follows:

[0115] Step 201: Based on the principle of aliasing circuits, the pseudo-random function f(x):(x,y)→z is used as the function function of the aliasing circuit containing only one circuit unit. Its variables x and y are regarded as the two input lines of the aliasing circuit, and the function value z is regarded as the output line of the aliasing circuit. At the same time, let (x0,x1) represent the values ​​of input line x as 0 and 1, (y0,y1) represent the values ​​of input line y as 0 and 1, and (z0,z1) represent the values ​​of output line z as 0 and 1.

[0116] Step 202: Construct the confusion circuit table and confusion values ​​as follows:

[0117] (1) When u > v, construct the confusion circuit table for this round according to Formula 2 (as shown in Table 1).

[0118] Table 1

[0119]

[0120]

[0121] (2) When u≤v, construct the confusion circuit table for this round according to formula 3 (as shown in Table 2).

[0122] Table 2

[0123] x y z 1 <![CDATA[x0]]> <![CDATA[y0]]> <![CDATA[z0]]> 2 <![CDATA[x0]]> <![CDATA[y1]]> <![CDATA[z0]]> 3 <![CDATA[x1]]> <![CDATA[y0]]> <![CDATA[z0]]> 4 <![CDATA[x1]]> <![CDATA[y1]]> <![CDATA[z1]]>

[0124] Step 203: Based on the obfuscation circuit table in Table 1 or Table 2, perform AES double symmetric encryption on the function value z for the four possible values ​​to generate obfuscated values ​​(f0, f1, f2, f3).

[0125] (1) When u > v, generate the obfuscation value of Formula 2 based on Table 1, as shown in Formula 4. Taking the first row of Table 1 as an example, firstly, perform the first layer of AES symmetric encryption on z1 using x0 as the key, then perform the second layer of encryption on the result of the first layer of encryption using y0 as the key, and record the final encryption result as f0; and so on, to obtain the obfuscation values ​​f1, f2, f3 respectively, as shown in Formula 4:

[0126]

[0127] (2) When u≤v, similarly, based on Table 2, the obfuscation value of Formula 3 is generated, as shown in Formula 5. Taking the first row of Table 2 as an example, z0 is first encrypted with x0 as the key, and then the result of the first encryption is encrypted with y0 as the key, and the final encryption result is recorded as f0; and so on, the obfuscation values ​​f1, f2, and f3 are obtained respectively, as shown in Formula 5:

[0128]

[0129] Step 204: To prevent the Client from guessing the value of x based on the order of the obfuscated values, the obfuscated values ​​need to be randomly shuffled. Randomly select 8 bits of binary data from the Hash(seed), group any two of them together, convert them to decimal data, and denot them as h0, h1, h2, and h3 respectively.

[0130] In a specific embodiment of the present invention, the 9th and 10th bits of Hash(seed) are taken and recorded as their decimal value h0; the 11th and 12th bits are taken and recorded as their decimal value h1; the 13th and 14th bits are taken and recorded as their decimal value h2; and the 15th and 16th bits are taken and recorded as their decimal value h3.

[0131] Step 205: (h0, h1, h2, h3) satisfy h0 ≠ h1 ≠ h2 ≠ h3. If the value obtained is the same as an existing value, then it should be processed according to Formula 6.

[0132] h i =h i +1(mod 4),i=1,2,3 (Formula 6).

[0133] Step 206: Given that a 2-bit binary number can represent a value range of [0,3], we can replace the original indices of the obfuscated value (f0,f1,f2,f3) with random values ​​(h0,h1,h2,h3) to obtain the disordered obfuscated sequence F, as shown in Formula 7.

[0134] F = {F[0], F[1], F[2], F[3]} = {f[h0], f[h1], f[h2], f[h3]} (Formula 7).

[0135] 3. Pair Algorithm Proof1: (proof S )←(x,(y a ,z b ),(y 1-a ,z 1-b The specific process is as follows: (z0), a, b∈{0,1}.

[0136] Step 301: The server first uses its own private key S SK For (x, (y) a ,z b ),(y 1-a ,z 1-b (x, (y)) are signed using the RSA algorithm, which serves as the basis for the Verifier to restore the protocol process and verify the validity of the extraction. Where (x, (y) a ,z b ),(y 1-a ,z 1-b (),z0) represents the first parameter information, specifically meaning: x is the actual value of x; (y a ,z b (y) represents the y and z values ​​when x takes the value x0; 1-a ,z 1-b ) represents the y and z values ​​when x takes the value x1; z0 is the actual value of z0.

[0137] Step 302: To prevent the Client from decrypting using the Server's public key, encrypt the signature result using the Verifier public key to generate a proof value. S Only the holder of the Verifier private key can access the proof. S Decrypt. Final verification value (proof) S It consists of an inner signature and an outer encryption, as shown in Formula 8.

[0138] proof S =RSA_Enc(V PK ,RSA_Enc(S SK ,(x,(y a ,z b ),(y1-a ,z 1-b ),z0))) (Formula 8).

[0139] like Figure 5 As shown, the Server will use x||y0||y1||F[0]|||F[1]||F[2]||F[3]||proof s Send this as the first concatenated string to the Client.

[0140] A privacy extraction method based on Yao's obfuscation circuit, applied to the second port, includes:

[0141] Generate a second random seed and construct a second pseudo-random function;

[0142] The confusion sequence is calculated based on the second pseudo-random function, the final function value is decrypted, and the second parameter information is generated.

[0143] The second parameter information is signed and encrypted using its own private key to obtain temporary encrypted information;

[0144] The temporary encrypted information and the first verification value are then encrypted again using the public key of the third port to generate a second verification value;

[0145] The final function value and the second verification value are combined to generate a second concatenated string, which is then sent to the first port.

[0146] In one embodiment of the present invention, the second main algorithm, Compute:(ComputeGC,Proof2), is executed by the Client and includes two sub-algorithms: the obfuscated circuit calculation algorithm for ComputeGC and the verification value generation algorithm for Proof2. The obfuscated circuit calculation algorithm adds a random factor to complete the unintentional transmission protocol and decrypts to obtain the final function value z of the pseudo-random function in this round. The verification value generation algorithm performs signature and encryption operations on z to generate the second verification value, proof. The algorithm flowchart is as follows. Figure 4 As shown, the specific process is as follows:

[0147] 1. The sub-algorithm ComputeGC:(z)←(x,y0,y1,F[0],F[1],F[2],F[3]), the specific process is as follows:

[0148] Step 401: The Client first generates a second random seed, performs SHA_256 hash processing on the second random seed, and records the hash value as Hash(seed).

[0149] Step 402: Take the first 8 bits of the Hash(seed), denoted as v0, and take the last 8 bits of the Hash(seed), denoted as v1. Obtain the Client's random factor u according to Formula 1-2. c v c .

[0150] Where u and v are the random factors of the pseudo-random function in this round, the Client will determine the definition of the pseudo-random function f(x) based on the relationship between the random factors.

[0151]

[0152] Step 403: When u c >v c Let y = y0; when u c ≤v c Let y = y1.

[0153] Step 404: Using y as the key, perform the first layer of AES symmetric decryption on the confused sequence (F[0], F[1], F[2], F[3]) in sequence.

[0154] Step 405: Using x as the key, perform a second AES decryption on the first decryption result; according to the unintentional transmission protocol, there is one and only one obfuscated sequence value that can be correctly decrypted, which is the final function value of the pseudo-random function between the Server and the Client in this round.

[0155] 2. Pair Algorithm Proof2: (proof) ← (x, y, z, proof) S C SK V PK The specific process is as follows:

[0156] Step 501: The Client first uses its own private key C SK Signing (x, y, z) yields temporary encrypted information, as shown in Formula 9, to prevent data tampering during transmission.

[0157] temp = RSA_Enc(C SK ,(x,y,z))(Formula 9).

[0158] Step 502: Since the Server possesses the Client's public key, although it cannot tamper with the information, it can decrypt the y value and then selectively choose a suitable x value to obtain the desired extraction result. Furthermore, since the pseudo-random function is generated by the Server, no other party besides the Server can detect this cheating. Based on the above considerations, temp needs further processing. In this invention, the Verifier's public key V is used. PKFor temp and proof S RSA asymmetric encryption is used to prevent the server from eavesdropping on the client's selected values ​​and manipulating the extraction results. Finally, a second verification value, "proof," is generated, as shown in Formula 10.

[0159] proof = RSA_Enc(V PK ,(temp,proof S )) (Formula 10).

[0160] like Figure 5 As shown, the Client sends z||proof as the second concatenated string to the Server.

[0161] In one embodiment of the present invention, the main algorithm three, the extraction algorithm Draw:(proof,D)←(proof,draw(z)), is executed by the server, and the specific process is as follows:

[0162] Step 601: After receiving the data from the Client, the Server looks up the obfuscation circuit table based on the z value to obtain the final extraction result D, D∈{0,1}, as shown in Formula 11.

[0163]

[0164] Step 602: Due to the unintentional transmission protocol, the Server cannot deduce the value of y corresponding to the z value. If D=1, the Client is selected in this round; otherwise, the Client is not selected as a valid endorser in this round, and the endorsement result is invalid.

[0165] Step 603: The Server sends the second verification value (proof) and the extraction result (D) to the Verifier.

[0166] like Figure 5 As shown, the Server sends proof||D as the third concatenated string to the Verifier.

[0167] A privacy extraction method based on Yao's obfuscation circuit, applied to a third port, includes:

[0168] The system receives a third concatenated string, which includes a first extraction result and a second verification value. The first extraction result is obtained by looking up the obfuscation circuit table through the first port based on the final function value. The final function value is obtained by decrypting the first concatenated string generated by the first port through the second port. The obfuscation circuit table is generated by the obfuscation circuit constructed through the first port.

[0169] The second verification value is obtained by encrypting the second parameter information generated from the final function value, and then encrypting the encryption result with the first verification value twice; the first verification value is obtained by encrypting the first parameter information; the first parameter information is obtained by packaging the input and output parameters of the obfuscation circuit constructed by the first port according to a preset rule;

[0170] Use your own private key to decrypt the second verification value and verify the first extraction result;

[0171] Determine whether the first port and / or the second port are being cheated.

[0172] Specifically, the process of decrypting the second verification value using one's own private key and verifying the first extraction result includes: decrypting the second verification value using one's own private key to obtain temporary encrypted information and the first verification value;

[0173] The first verification value is decrypted using the public key of the first port to obtain the third parameter information;

[0174] The temporary encrypted information is decrypted using the public key of the second port to obtain the fourth parameter information;

[0175] The first extraction result is verified based on the third parameter information and the fourth parameter information.

[0176] Specifically, determining whether the first port and / or the second port is cheating includes: the first extraction result is a first function value z0 or a second function value z1;

[0177] The function value of the fourth parameter information is compared with the first function value z0; if the function value of the fourth parameter information is the same as the first function value z0, then the extraction is valid and neither the first port nor the second port has cheated; otherwise, the extraction is invalid.

[0178] Alternatively, the function value of the fourth parameter information can be compared with the second function value z1; if the function value of the fourth parameter information is consistent with the second function value z1, then the extraction is valid and neither the first port nor the second port has cheated; otherwise, the extraction is invalid.

[0179] In one embodiment of the present invention, the main algorithm four, the verification algorithm Verify:(proof,D), is executed by an independent third party, Verifier, and the specific process is as follows:

[0180] Step 701: The Verifier first uses its own private key V SK Decrypt the second verification value, proof, as shown in Formula 12, to obtain temp,proof. S ,

[0181] {temp,proofS} = RSA_Dec(V SK , proof) (Formula 12).

[0182] Step 702: Decrypt the proof using the Server's public key. S Obtain the Server algorithm execution parameters x S ,(y S ,z S ),(y S ',z S '), z0, that is, the third parameter information, as shown in formula 13,

[0183] {x S ,(y S ,z S ),(y S ',z S '),z0}=RSA_Dec(S PK proof S )(Formula 13).

[0184] Step 703: Decrypt temp using the Client's public key to obtain the Client's algorithm execution parameter x. C ,y C ,z C That is, the fourth parameter information, as shown in Formula 14, where the function value of the fourth parameter information is z. C ;

[0185] {x C ,y C ,z C}=RSA_Dec(C PK ,temp) (Formula 14).

[0186] Step 704: The Verifier checks the extraction results based on the obtained parameters. If the function value of the fourth parameter matches z0, the extraction is valid, and neither the Server nor the Client has cheated; otherwise, the extraction is invalid. The specific verification process includes:

[0187] judge:

[0188] x C Is it equal to x? S If they are not equal, the verification fails and the verification algorithm ends. If they are equal, the verification continues.

[0189] z C Check if it equals z0. If not, the verification fails and the verification algorithm ends. If they are equal, continue the verification.

[0190] If z C equals z SDetermine y C Is it equal to y? S If they are not equal, proceed to the next step; if they are equal, the verification passes and the verification algorithm ends.

[0191] If z C equals z S ', determine y C Is it equal to y? S If they are not equal, the verification fails and the verification algorithm ends. If they are equal, the verification passes and the verification algorithm ends.

[0192] If z C It is not equal to z S It is not equal to z S If '', then the verification fails and the verification algorithm ends.

[0193] The verification algorithm ensures that the value of each key parameter during the algorithm execution process is double-verified (comparing server-side data with client-side data).

[0194] In another embodiment of the present invention, the calculation result of Verifier can be compared with z1 to see if they are consistent. If they are consistent, the extraction is valid; if they are inconsistent, the extraction is invalid.

[0195] like Figure 5 As shown, if the extraction is invalid, the process returns to the Server to regenerate the obfuscation circuit algorithm and extract again.

[0196] Specifically, the final function value of the pseudo-random function between the Server and the Client is z1. However, experiments have shown that z1 has only a one-in-four chance of successful extraction, which has a certain impact on the extraction results. Therefore, in this embodiment of the invention, it is preferable to use the function value z of the fourth parameter information. C Compared to z0, it increases the success rate of extraction and avoids a large number of invalid extractions.

[0197] Furthermore, this invention is based on Fabric's existing consensus mechanism for signing, authentication, and encryption services, thus it does not consider issues such as man-in-the-middle attacks or privacy leaks during transmission. The following sections provide security analyses for a two-party collusion attack model between a server and one client, and a multi-party collusion attack model between multiple clients.

[0198] (1) Two-party collusion attack model between Server and 1 Client

[0199] Definition 1: Two-Party Conspiracy Attack Model. Two parties with different identities share all known information with each other and are able to honestly execute the protocol process, but attempt to tamper with the obtained parameter values ​​or the final output values ​​after conspiring communication.

[0200] Theorem 1 assumes that the classical unintentional transmission protocol and Yao's obfuscated circuit are computationally secure under the semi-honest model. Then, this model satisfies security under the two-party collusion attack model.

[0201] Prove that the original extraction result of the Server and Client is z, and they conspire to forge the extraction result z'. Then, after executing formulas 12, 13, and 14 on the Verifier, the algorithm process parameter P is obtained, as shown in formula 15.

[0202] P={(x C ,y C ,z C ),x S ,(y S ,z S ),(y S ',z S ')}(Formula 15).

[0203] The verifier independently calculates the extraction result, denoted as R, as shown in Formula 16.

[0204] (y C ,z C )∈{(y S ,z S ),(y S ',z S ')}? R=z C :⊥(Formula 16).

[0205] If R has a value, then accept z. C If the result is not specified, the extraction is considered successful; otherwise, the extraction is marked as failed. Then, R and z0 are compared. If they are the same, the extraction is valid; otherwise, it is invalid. When the Server and Client cheat to generate z', since the value of R is independently calculated by the Verifier using the decrypted data, and any third party without the Verifier's private key cannot decrypt the proof data, R as the correct value must be different from the cheating value z'. Third-party verification fails, and this model is secure under a two-way collusion attack between the Server and Client.

[0206] (2) Multi-party collusion attack model between Server and multiple Clients

[0207] Definition 2: Multi-party conspiracy attack model. Two or more parties with the same identity share all known information and attempt to manipulate the output value through illegal input, data tampering, or other means.

[0208] Theorem 2 assumes that the classical unintentional transmission protocol and Yao's obfuscated circuit are computationally secure under the semi-honest model, then this model satisfies security under the multi-party collusion attack model.

[0209] Prove that there are n (n≥2) Clients: {Client1, Client2, ..., Client...} n} Share known information with each other, as a Client i Taking i∈{1,2,...,n} as an example, the following information can be collected:

[0210]

[0211] In this model, privacy extraction is performed independently by the Server and each Client. That is, the Server executes the model algorithm separately with each Client, including but not limited to seed generation, pseudo-random function generation, and obfuscation circuit construction. Therefore, the values ​​of the members in the parameter information sets X, Y, and F are not correlated, and the difficulty for the Client to predict the extraction results through statistical analysis of the parameters cannot be reduced. Regarding the Client's execution result information set Z, since each Client uses a different pseudo-random function, the z-value is only valid for itself. Statistical analysis is not possible, nor can the final extraction result be influenced by tampering with multiple z-values. The Server verification value (proof) received by the Client... n S The PROOF collection is meaningless because it does not possess the private key of the Verifier and therefore cannot perform outer-layer decryption.

[0212] Specifically, a privacy extraction method and system based on Yao's obfuscation circuit, applied to the first port, includes:

[0213] The obfuscation circuit generation module is used to generate a first pseudo-random function and an obfuscation sequence, and to package the input parameters and output parameters of the obfuscation circuit into first parameter information according to a preset rule, and to encrypt the first parameter information to obtain a first verification value; and to generate a first concatenated string based on the input parameters of the obfuscation circuit, the obfuscation sequence and the first verification value.

[0214] The first data sending module is used to send the first concatenated string to the second port;

[0215] The data receiving module is used to receive the second concatenated string sent from the second port;

[0216] The extraction module is used to find the first extraction result by looking up the obfuscated circuit table generated by the obfuscated circuit based on the final function value, and generate a third concatenated string with the second verification value.

[0217] The second data sending module is used to send the third concatenated string to the second port.

[0218] A privacy extraction method and system based on Yao's obfuscation circuit, applied to a third port, includes:

[0219] The data receiving module is used to receive a third concatenated string sent by the first port, the third concatenated string including the first extraction result and the second verification value;

[0220] The decryption module is used to decrypt the second verification value using its own private key to obtain the third parameter information and the fourth parameter information.

[0221] The calculation module is used to verify the first extraction result based on the third parameter information and the fourth parameter information;

[0222] The judgment module is used to determine whether the first port and / or the second port has been cheated based on the test results.

[0223] This invention uses a pseudo-random function as the functional function of the YAO obfuscation circuit. Clients such as the SDK act as the constructors of the YAO obfuscation circuit, while endorsement nodes act as the circuit computers, each independently completing the obfuscation circuit algorithm and using the algorithm results as the extraction results. A verification algorithm is added to the obfuscation circuit algorithm to enable verification by any third party. Parameters used during algorithm execution are first signed and then encrypted, serving as verification information for third-party verification. The SDK and endorsement nodes are responsible for jointly randomly selecting endorsement qualifications, while the ranking nodes are responsible for detecting the validity of the selection through the verification information. By randomly and privately selecting and verifying endorsement qualifications, this invention prevents collusion and cheating between endorsement nodes and between endorsement nodes and the SDK.

[0224] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0225] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A Yao's garbled circuit based privacy extraction method, characterized in that, The application is applied to a first port, comprising: generating a first random seed and constructing a first pseudo-random function; constructing a garbled circuit according to the first pseudo-random function and generating a garbled sequence; packing input parameters and output parameters of the garbled circuit into first parameter information according to a preset rule, encrypting the first parameter information, and obtaining a first verification value; generating a first splicing string according to the input parameters of the garbled circuit, the garbled sequence, and the first verification value; sending the first splicing string to a second port to make the second port complete an oblivious transfer protocol, decrypting to obtain a final function value, generating second parameter information, encrypting the second parameter information to obtain temporary encrypted information, and generating a second verification value by twice encrypting the temporary encrypted information and the first verification value, and sending a second splicing string generated according to the final function value and the second verification value to the first port; after receiving the second splicing string of the second port, finding a garbled circuit table generated by the garbled circuit according to the final function value to obtain a first extraction result; generating a third splicing string according to the first extraction result and the second verification value, which is used for establishing a connection between the first port and a third port.

2. The Yao's garbled circuit based privacy extraction method of claim 1, wherein, The generating of the first random seed and the constructing of the first pseudo-random function comprise: hashing the first random seed to obtain two random factors of the first pseudo-random function according to the hash value u , v ; The random value is selected to determine a variable and a function value of the first pseudo-random function, and the definition of the first pseudo-random function is determined according to the size relationship between the two random factors u , v .

3. The Yao's garbled circuit based privacy extraction method of claim 2, wherein, The constructing of the garbled circuit according to the first pseudo-random function and the generating of the garbled sequence comprise: taking the first pseudo-random function as a function function of the garbled circuit, constructing a garbled circuit table and a garbled value; a variable of the first pseudo-random function is used as an input parameter of the garbled circuit, and a function value of the first pseudo-random function is used as an output parameter of the garbled circuit; constructing a garbled circuit table according to the relationship between the input parameter and the output parameter; performing AES double symmetric encryption on the function value of the garbled circuit table to generate a garbled value; randomly scrambling the garbled value and making it satisfy a preset condition to obtain a garbled sequence.

4. The Yao's garbled circuit based privacy extraction method of claim 1, wherein, The packing of the input parameters and the output parameters of the garbled circuit into the first parameter information according to the preset rule and the encrypting of the first parameter information to obtain the first verification value comprise: the first port uses a private key of itself to perform RSA algorithm signature on the first parameter information, and uses a public key of the third port to encrypt the signature result to obtain the first verification value.

5. A Yao's garbled circuit based privacy extraction method, characterized in that, The application is applied to a third port, comprising: receiving a third splicing string, the third splicing string comprising a first extraction result and a second verification value; wherein the first extraction result is obtained by the first port according to a final function value and a garbled circuit table; the final function value is obtained by the second port decrypting a first splicing string generated by the first port; the garbled circuit table is generated by the first port constructing a garbled circuit; the second verification value is obtained by twice encrypting an encryption result of second parameter information generated by the final function value and the first verification value; the first verification value is obtained by encrypting first parameter information; the first parameter information is obtained by packing input parameters and output parameters of the garbled circuit constructed by the first port according to a preset rule; decrypting the second verification value by using a private key of itself and verifying the first extraction result; Judge whether the first port and / or the second port are cheating.

6. The Yao's garbled circuit based privacy extraction method of claim 5, wherein, Decrypt the second verification value by using the private key of the first port, and verify the first extraction result, including: decrypting the second verification value by using the private key of the first port to obtain temporary encrypted information and a first verification value; Decrypt the first verification value by using the public key of the first port to obtain third parameter information; Decrypt the temporary encrypted information by using the public key of the second port to obtain fourth parameter information; Verify the first extraction result according to the third parameter information and the fourth parameter information.

7. The Yao's garbled circuit based privacy extraction method of claim 6, wherein, The judging whether the first port and / or the second port cheats includes that the first extraction result is a first function value or a second function value ​ comparing the function value of the fourth parameter information with the first function value ; if the function value of the fourth parameter information is consistent with the first function value , the extraction is valid, and the first port and the second port do not cheat; otherwise, the extraction is invalid; or compare the function value of the fourth parameter information with the second function value If the function value of the fourth parameter information is consistent with the second function value , this extraction is valid, and the first port and the second port have not cheated; otherwise, the extraction is invalid.

8. A Yao's garbled circuit-based private extraction system, comprising: Applied to the first port, comprising: A garbled circuit generation module is configured to generate a first pseudo-random function and a garbled sequence, pack input parameters and output parameters of the garbled circuit into first parameter information according to a preset rule, encrypt the first parameter information to obtain a first verification value, and generate a first splicing string according to the input parameters of the garbled circuit, the garbled sequence and the first verification value; A first data sending module is configured to send the first splicing string to the second port; A data receiving module is configured to receive a second splicing string sent by the second port; An extraction module is configured to find a garbled circuit table generated by the garbled circuit according to a final function value to obtain a first extraction result, and generate a third splicing string with the second verification value; A second data sending module is configured to send the third splicing string to the second port.

Images