Secure multi-party computing method and device for one-way communication, and participating equipment

Abstract

The present application discloses a secure multi-party computation method and apparatus for one-way communication, and participating devices, and relates to the field of cryptography. The method comprises: a first participating device uses one-way communication, two-choice oblivious transmission to send two first messages; a second participating device calculates and receives a calculation result []1; the first participating device determines a parameter []0 based on a first random number sequence; the first participating device uses one-way communication, two-choice oblivious transmission to send two second messages; the second participating device calculates and receives a calculation result [] ′ 1; The first participating device determines the parameter [] according to the second random number sequence ′ 0; the first participating device calculates parameter [z] 0; the second participating device calculates parameter [z] 1. It can be seen that this application changes bidirectional communication into unidirectional communication, thereby improving the secret sharing process of the multiplication operation, thereby reducing the communication cost of the multiplication operation and improving the calculation efficiency.

Description

Technical Field

[0001] The present application relates to the field of cryptography, and specifically to a secure multi-party computing method and apparatus for one-way communication, and participating devices. Background Art

[0002] Secure Multi-Party Computation (MPC) is a key branch of privacy-preserving computing technology. The principle behind secure multi-party computing is that each participating party holds a portion of data and, without exposing their data, communicates and interacts through a protocol to complete the computation. Additive Secret Sharing (SSS) is a commonly used secret sharing scheme in secure multi-party computing. In SS, basic operations such as addition, subtraction, multiplication, and division are performed as ciphertext computations. This ensures that all participating parties do not disclose their own data, but rather exchange encrypted data, while still collaborating to complete the overall computation. Additive Secret Sharing includes secret sharing for addition and multiplication operations.

[0003] In secret sharing involving multiplication operations, frequent and extensive two-way communication and interaction are often required between participants to complete the computation. This not only results in a high communication cost for the entire secret sharing process, but also reduces overall computational efficiency. This is because each basic operation requires a round of two-way communication between the participants, and this communication process has a certain communication delay, which is also affected by channel quality and interference. Therefore, each operation needs to consider the two-way communication delay (usually between a few milliseconds and several hundred milliseconds). When the channel quality is poor, the communication delay can be very long, increasing the overall computation time.

[0004] Since the secret sharing process of multiplication operations involves frequent and large-scale two-way communication, which results in high communication costs and low computational efficiency, further research is needed to improve the secret sharing process of multiplication operations in order to reduce communication costs and improve computational efficiency. Summary of the Invention

[0005] The embodiments of the present application provide a secure multi-party computing method and apparatus for one-way communication, and participating devices, in the hope of solving the problem of how to improve the secret sharing process of multiplication operations.

[0006] In a first aspect, a secure multi-party computing method for one-way communication of the present application is applied to a first participating device among participating devices of the secure multi-party computing, wherein the participating devices of the secure multi-party computing further include a second participating device, wherein the first participating device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participating device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the method comprises:

[0007] Using one-way communication, two-choice oblivious transmission, to send two pieces of first information to the second participant device, where the two pieces of first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participant device;

[0008] Determine a parameter [w]0 according to the first random number sequence;

[0009] Using one-way communication, two-choice oblivious transmission, to send two pieces of second information to the second participant device, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device;

[0010] Determine a parameter [w]′0 according to the second random number sequence;

[0011] Calculate the product of the secret share [x]0 and the secret share [y]0, and then add the parameter [w]0 and the parameter [w]′0 respectively to finally obtain the parameter [z]0, where the parameter [z]0 is a secret share of the product of the first private data and the second private data required by the first participating device.

[0012] It can be seen that the present application adopts the oblivious transmission of two choices of one-way communication to perform secret sharing of multiplication operations. The oblivious transmission of two choices of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also realize the confidentiality of data transmission through the oblivious transmission of two choices, thereby improving the secret sharing process of the multiplication operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0013] In a second aspect, a secure multi-party computing method for one-way communication of the present application is applied to a second participating device in a secure multi-party computing, wherein the participating devices of the secure multi-party computing further include a first participating device, wherein the first participating device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participating device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the method comprises:

[0014] Receiving two pieces of first information from the first participating device using one-way communication and oblivious transmission, wherein the two pieces of first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device;

[0015] Calculate a reception calculation result [w]1 of the two first information using the secret sharing [y]1;

[0016] receiving two pieces of second information from the first participant device using one-way communication and two-choice oblivious transmission, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device;

[0017] Calculate a reception calculation result [w]′1 of the two pieces of second information using the secret sharing [x]1;

[0018] Calculate the product of the secret share [x]1 and the secret share [y]1, and then add the received calculation result [w]1 and the received calculation result [w]′1 respectively to finally obtain parameter [z]1, where the parameter [z]1 is a secret share of the product of the first private data and the second private data required by the second participating device.

[0019] In a third aspect, a secure multi-party computing apparatus for one-way communication of the present application is applied to a first participating device among participating devices of the secure multi-party computing, wherein the participating devices of the secure multi-party computing further include a second participating device, wherein the first participating device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participating device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the apparatus comprises:

[0020] a sending unit, configured to send two pieces of first information to the second participant device by using one-or-two oblivious transmission in unidirectional communication, where the two pieces of first information are determined according to the secret share [x]0 and a first random number sequence generated by the first participant device;

[0021] a determining unit, configured to determine a parameter [w]0 according to the first random number sequence;

[0022] The sending unit is further configured to send two pieces of second information to the second participating device by using one-way communication of two-choice oblivious transmission, where the two pieces of second information are determined according to the secret share [y]0 and a second random number sequence generated by the first participating device;

[0023] The determining unit is further configured to determine a parameter [w]′0 according to the second random number sequence;

[0024] a calculation unit, configured to calculate the product of the secret share [x]0 and the secret share [y]0, and then add the parameter [w]0 and the parameter [w]′0 respectively to finally obtain the parameter [z]0, wherein the parameter [z]0 is a secret share of the product of the first private data and the second private data required by the first participating device.

[0025] In a fourth aspect, a secure multi-party computing apparatus for one-way communication according to the present application is applied to a second participant in a secure multi-party computing apparatus, wherein the secure multi-party computing apparatus further includes a first participant, wherein the first participant possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participant possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the apparatus comprises:

[0026] a receiving unit, configured to receive two pieces of first information from the first participating device by adopting one-or-two oblivious transmission in one-way communication, where the two pieces of first information are determined according to the secret share [x]0 and a first random number sequence generated by the first participating device;

[0027] A calculation unit, configured to calculate a reception calculation result [w]1 of the two first information using the secret sharing [y]1;

[0028] The receiving unit is further configured to receive two pieces of second information from the first participating device by adopting one-or-two oblivious transmission in one-way communication, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device;

[0029] The calculation unit is further configured to calculate a reception calculation result [w]′1 of the two second information using the secret sharing [x]1;

[0030] The calculation unit is further used to calculate the product of the secret sharing [x]1 and the secret sharing [y]1, and then add the received calculation result [w]1 and the received calculation result [w]′1 respectively to finally obtain the parameter [z]1, where the parameter [z]1 is a secret sharing of the product of the first private data and the second private data required by the second participating device.

[0031] The fifth aspect is a participating device of the present application, which is a first participating device or a second participating device, including a processor, a memory, and a computer program or instructions stored on the memory, and the processor executes the computer program or instructions to implement the steps of the method in the above-mentioned first aspect or second aspect.

[0032] The sixth aspect is a computer-readable storage medium of the present application, wherein the computer-readable storage medium stores a computer program or instructions, and when the computer program or instructions are executed by a processor, the steps of the method in the first aspect or the second aspect are implemented.

[0033] The seventh aspect is a computer program product of the present application, comprising a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method in the first or second aspect above.

[0034] The beneficial effects brought about by the technical solutions of the second to seventh aspects can be referred to the technical effects brought about by the technical solution of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments of the present application.

[0036] Figure 1 This is a schematic diagram of the architecture of a secure multi-party computing system according to an embodiment of the present application;

[0037] Figure 2 This is a flowchart of a secure multi-party computing method for one-way communication according to an embodiment of the present application;

[0038] Figure 3 This is a block diagram of the functional units of a secure multi-party computing device for one-way communication according to an embodiment of the present application;

[0039] Figure 4 This is a block diagram of the functional units of another one-way communication secure multi-party computing device according to an embodiment of the present application;

[0040] Figure 5 It is a structural diagram of a participating device in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to help those skilled in the art better understand the technical solutions of this application, the following is a clear and complete description of the technical solutions in the embodiments of this application in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the description of the embodiments of this application, all other embodiments obtained by those skilled in the art without making any creative work are within the scope of protection of this application.

[0042] It should be understood that the terms "first," "second," and the like in the embodiments of the present application are used to distinguish between different objects, rather than to describe a specific order. In addition, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, software, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may also include steps or units that are not listed, or may include other steps or units inherent to these processes, methods, products, or devices.

[0043] The term "embodiment" as used in the embodiments of this application means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various locations in the specification does not necessarily refer to the same embodiment, nor does it refer to independent or alternative embodiments that are mutually exclusive with other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0044] In the embodiments of this application, "and / or" describes the relationship between associated objects and indicates that three relationships can exist. For example, "A and / or B" can represent the following three situations: A exists alone; A and B exist simultaneously; and B exists alone. A and B can be singular or plural.

[0045] In the embodiments of the present application, the symbol " / " can indicate that the preceding and following objects are in an "or" relationship. In addition, the symbol " / " can also represent a division sign, that is, performing a division operation. For example, A / B can mean A divided by B.

[0046] In the embodiments of the present application, the symbol "*", "·", or "×" can represent a multiplication sign, that is, performing a multiplication operation. For example, A*B, A·B, or A×B can represent A multiplied by B.

[0047] In the embodiments of the present application, "at least one item" or similar expressions refers to any combination of these items, including any combination of single items or plural items, and refers to one or more, and multiple refers to two or more. For example, at least one item (item) of a, b, or c can represent the following seven situations: a, b, c, a and b, a and c, b and c, a, b, and c. Among them, each of a, b, and c can be an element or a set containing one or more elements.

[0048] In the embodiments of this application, "equal to" can be used in conjunction with "greater than" and is applicable to the technical solution adopted when "greater than" is used, and can also be used in conjunction with "less than" and is applicable to the technical solution adopted when "less than" is used. When "equal to" is used in conjunction with "greater than", it should not be used in conjunction with "less than"; when "equal to" is used in conjunction with "less than", it should not be used in conjunction with "greater than".

[0049] The technical solutions, beneficial effects, and related concepts involved in the embodiments of the present application are described in detail below.

[0050] 1. Secure Multi-Party Computation System

[0051] 1. Description

[0052] It should be noted that secure multi-party computing requires the participation of multiple parties to perform basic operations such as secret sharing of private data. Each participant can be considered a participating device. In this way, these participating devices can be constructed into a secure multi-party computing system. In other words, the secure multi-party computing system can include multiple participating devices.

[0053] For example, Figure 1 As shown, the secure multi-party computing system 10 includes a participant device 110 and a participant device 120. Participant devices 110 and 120 can communicate with each other, such as quantum communication.

[0054] It should be noted that Figure 1 This is merely an example of a schematic diagram of the architecture of a secure multi-party computing system and does not limit the network architecture of the secure multi-party computing system in the embodiments of the present application.

[0055] The following is a detailed description of the participating devices in the embodiments of the present application.

[0056] 2. Participating equipment

[0057] Participating devices may be entities / software / hardware combinations / units / modules / devices that have information encryption / communication / processing functions.

[0058] In some possible implementations, the participating devices may be terminal devices, cloud servers, IoT servers, web servers, application servers, load balancers (Nginx), data center network devices, electronic devices, handheld devices, wearable devices, vehicle-mounted devices, vehicle-mounted terminals, augmented reality (AR) devices, virtual reality (VR) devices, IoT (Internet of Things) devices, projection devices, projectors, user equipment (UE), terminals, mobile terminals, smart phones, smart screens, smart TVs, smart watches, laptops, smart speakers, cameras, game controllers, microphones, stations (STA), access points (AP), mobile stations (MS), personal digital assistants (PDAs), personal computers (PCs), session initiation protocol (SIP) phones, wireless local loop (WLL) stations, centralized controllers, base stations (BSs), base transceiver stations (BTSs), and more. One of the following: station (BTS), site controller, switch, network equipment, etc.

[0059] It should be noted that the embodiments of the present application do not specifically limit the specific structure of the execution subject of the secure multi-party computing for one-way communication. As long as it can be processed by running a computer program or instruction that records the method provided by the embodiments of the present application, and according to the method provided by the embodiments of the present application. For example, the execution subject of the method provided by the embodiments of the present application can be a participating device, or it can be a processor / device / module / unit in the participating device that can call and execute the computer program or instruction, and there is no specific limitation on this.

[0060] 3. Hardware architecture examples of participating devices

[0061] In some possible implementations, the participating device may include at least one of a processor, a memory, a communication component, an input / output driver, etc. Each of these is exemplarily described below.

[0062] ①Processor

[0063] In some possible implementations, the processor may be configured to run or load an operating system, which may be any one or more computer operating systems that implement business processing through processes, such as the Linux operating system, the Unix operating system, the Android operating system, the iOS operating system, the Windows operating system, the Zephyr operating system, a real-time operating system (RTOS), the DOS operating system, the Mac operating system, the ThreadX operating system, an embedded operating system, the NucleusPlus operating system, and the like.

[0064] In some possible implementations, the processor can be viewed as a complete system on chip (SOC).

[0065] In some possible implementations, the processor may include one or more processing units. For example, the processing unit may include at least one of a central processing unit (CPU), an application processor (AP), a microcontroller unit (MCU), a single chip microcomputer (SCM), a single chip microcomputer, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a baseband processor, and a neural network processing unit (NPU). Different processing units may be separate or integrated.

[0066] In some possible implementations, a processing unit may be a single-core or multi-core.

[0067] In some possible implementations, a processing unit may run or load a multi-core subsystem, wherein the multi-core subsystem may be an operating system with multi-core processing capabilities.

[0068] In some possible implementations, the processor may further include a memory for storing computer programs or instructions.

[0069] For example, the processor may call a program stored in the memory to run an operating system.

[0070] For example, the memory in the processor can store or cache instructions that the processor has just used or is using repeatedly. If the processor needs to use the instruction or data again, it can directly call it from the memory, thus avoiding repeated access, reducing the processor's waiting time and improving system efficiency.

[0071] For another example, the memory in the processor can also store or cache data, and synchronize or transmit the data to other processors for execution. The memory in the processor can be a high-speed cache memory.

[0072] ②Memory

[0073] In some possible implementations, the memory may be used to store computer programs or instructions.

[0074] In some possible implementations, the memory includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0075] ③Communication components

[0076] It should be noted that the communication component can be used to support communication between participating devices.

[0077] In some possible implementations, the communication component may provide communication solutions including 2G / 3G / 4G / 5G, etc., applied on participating devices.

[0078] In some possible implementations, the communication component can provide communication solutions applied on participating devices, including Bluetooth (BT), WLAN, WiFi network, near field communication (NFC), ultra wide band (UWB), infrared technology (IR), quantum communication, etc.

[0079] In some possible implementations, the communication component may provide at least one of the communications applied on participating devices, including a serial peripheral interface (SPI), an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, a universal serial bus (USB) interface, and the like.

[0080] In some possible implementations, at least some functional modules of the communication component may be provided in a processor; or, at least some functional modules of the communication component may be provided in the same device as some modules of the processor.

[0081] ④Input / output driver

[0082] In some possible implementations, an input / output driver may be used to process various inputs / outputs from a user-operated device.

[0083] For example, the input / output driver may be operable to detect and process various user input events or output events, etc.

[0084] II. Related Notes

[0085] 1. Secure Multi-Party Computation

[0086] In secure multi-party computation, basic operations like addition, subtraction, multiplication, and division are performed using ciphertext. Each party involved in the computation does not disclose their own data, but only exchanges encrypted data, allowing them to collaborate and complete the overall computation.

[0087] Existing secure multi-party computation (SMC) technologies require frequent and extensive bidirectional communication, which compromises their computational efficiency. Because the communication process has a certain communication latency (typically ranging from a few to several hundred milliseconds), SMC takes far longer than direct plain-text computation. Typically, existing SMCs are hundreds, thousands, or even tens of thousands of times slower than insecure plain-text computations.

[0088] The classic solution for secure multi-party computation is additive secret sharing, which includes secret sharing for addition operations and secret sharing for multiplication operations.

[0089] In additive secret sharing, assuming there are N participants (numbered 0, 1, ..., N-1), the private data x of each participant in the calculation will be represented as N independent random numbers, namely [x]0, [x]1, ..., [x] N-1 , and [x]0+[x]1+…+[x] N-1 =x. Among them, the i-th participant only has [x] i (i=0,1,…,N-1), and the random number [x] i It is called a secret sharing of private data x. At the same time, participant i will never share the secret he holds [x] i Tell any other participants. This way, as long as one participant doesn't collude with the others, no other participant can learn any information about the original data x. Although no participant reveals their share of the secret, N participants can still perform some operations together. The following examples illustrate secret sharing for addition and multiplication operations.

[0090] ◆Secret sharing of addition operation

[0091] Assume there are N participants (numbered 0, 1, ..., N-1), and each participant has a secret share of private data x [x]0, [x]1, ..., [x] N-1 One of them, and the secret sharing of private data y [y]0, [y]1, …, [y] N-1 One of them, that is, the i-th participant only has [x] i and random number [y] i Thus, in the secret sharing of addition operation, multiple participants need to perform the addition operation between private data x and private data y without leaking information. Assume that z = x + y represents the addition operation between private data x and private data y. Therefore, the i-th participant needs to calculate a secret sharing of data z locally, that is, [z] i =[x]i +[y] i , then the N random numbers obtained are [z]0, [z]1, ..., [z] N-1 It is called N secret sharing of data z. In this way, it is easy to verify as follows:

[0092] [z]0+[z]1+…+[z] N-1 =([x]0+[y]0)+([x]1+[y]1)+…+([x] N-1 +[y] N-1 )

[0093] =([x]0+[x]1+…+[x] N-1 )+([y]0+[y]1+…+[y] N-1 ) = x + y = z;

[0094] Therefore, in the secret sharing of addition operations, the addition operation between data can be performed without communication. Instead, each participant can perform the addition operation locally using the secret sharing they have. Similarly, the subtraction operation between data can also be performed in the same way, without the need for communication.

[0095] ◆Secret sharing of multiplication operations

[0096] In multiplication secret sharing, multiple participants need to perform a multiplication operation between private data x and private data y without leaking any information. Assuming z = x * y represents the multiplication operation between private data x and private data y, the multiplication secret sharing can be divided into the following three steps:

[0097] Step 1:

[0098] A triplet (a, b, c) for auxiliary calculation is randomly generated, where a*b=c, and the triplet (a, b, c) is secretly shared among N participants, i.e., the i-th participant obtains a triplet ([a] i ,[b] i ,[c] i ), and [a]0+[a]1+…+[a] N-1 =a, [b]0+[b]1+…+[b] N-1 =b, [c]0+[c]1+…+[c] N-1 =c.

[0099] In existing schemes, step 1 can be implemented through some complex cryptographic operations (such as homomorphic encryption, oblivious transfer, etc.) or by introducing a trusted third party, and these implementation methods require one or more rounds of two-way communication between the participants or between the participants and the trusted third party.

[0100] Step 2:

[0101] The i-th participant calculates [d] i =[x] i -[a] i ,[e] i =[y] i -[b] i , and [d] i and [e] i Send to the other N-1 participants. Thus, in step 2, through one or more rounds of two-way communication between the N participants, each participant receives all the secret shares of d and e, i.e., [d]0, [d]1, ..., [d] N-1 and [e]0, [e]1,…,[e] N-1 .

[0102] Step 3:

[0103] Since each participant receives all the secret shares of d and e, each participant can calculate d = [d]0 + [d]1 + ... + [d] N-1 and e=[e]0+[e]1+…+[e] N-1 .

[0104] Afterwards, the i-th participant calculates [z] i =[c] i +e*[x] i +d*[y] i In particular, when i = 0, the 0th participant calculates [z]0 = [c]0 + e*[x]0 + d*[y]0 – e*d. This is easy to verify as follows:

[0105] z=[z]0+[z]1+…+[z] N-1 =x*y;

[0106] Therefore, i It is a secret sharing of z=x*y, that is, [z] i It is a secret sharing of the product of private data x and private data y.

[0107] In short, the entire secret sharing process for the multiplication operation does not expose any useful data. Of the three steps described above, steps 2 and 3 involve two-way communication. More importantly, these communications occur on the critical path to complete the computation. Therefore, the local computation time is added to the communication latency in the overall computation time.

[0108] In addition, the above three steps only complete the multiplication operation of a single secret sharing. In actual applications, such as deep learning models, there may be tens of billions of multiplication operations, and the participants in the calculation are often far apart and communicate through a network with limited bandwidth, which makes the communication delay time very large, thereby increasing the overall calculation time and reducing the calculation efficiency.

[0109] 2. Oblivious Transfer (OT)

[0110] In the field of computer and information security, oblivious transfer is a cryptographic protocol used to communicate between a sender and a receiver. In this protocol, the sender can send multiple messages, but the receiver only receives one of these messages, leaving the others hidden. Furthermore, the sender cannot determine which message the receiver has received. Therefore, neither the sender nor the receiver knows what information the other has received.

[0111] 1-out-of-2 (1 out of 2) oblivious transfer is a practical oblivious transfer protocol, also known as two-choice oblivious transfer, and is currently a commonly used one. In this protocol, the sender has two pieces of information, M0 and M1, and the receiver wants to know one of them. After the two-choice oblivious transfer is completed, the receiver learns one of the pieces of information but not the other. Furthermore, the sender does not know whether the receiver has learned M0 or M1.

[0112] 3. Partially Homomorphic Encryption (PHE) Algorithm

[0113] The semi-homomorphic encryption algorithm can support one of the operations of addition or multiplication, and can include a multiplication semi-homomorphic encryption algorithm and an addition semi-homomorphic encryption algorithm, and can include an RSA encryption algorithm, an ElGamal encryption algorithm, a Paillier encryption algorithm, and the like.

[0114] The Paillier encryption algorithm, an extension of the RSA algorithm, implements additive semi-homomorphic encryption. It works by converting plaintext into numbers, encrypting them, and then performing certain operations on the encrypted result to achieve semi-homomorphic encryption.

[0115] The following is an explanation of the ElGamal encryption algorithm.

[0116] ElGamal encryption algorithm

[0117] The ElGamal encryption algorithm is a semi-homomorphic encryption algorithm based on multiplication, that is, a multiplication semi-homomorphic encryption algorithm. It is a public-private key asymmetric encryption system built by taking advantage of the difficulty of the discrete logarithm problem. Among them, an ElGamal encryption system can be defined by a four-tuple (α, β, key, p), where p represents a selected large prime number, key represents the private key, 1 <key<p-1:

[0118] β=α key ;

[0119] For a plaintext x, choose a random integer k as the session key and calculate c1 and c2 as the ciphertext obtained by encrypting the plaintext x:

[0120] c1=E1(k)=E1(k,α)=a k mod p;

[0121] c2=E2(x,k)=E2(x,k,β)=x·β k mod p.

[0122] In this way, the ciphertext c1 and ciphertext c2 can be decrypted into plaintext x through the private key:

[0123] D e (c1,c2,key)=c2·(c1 key ) -1 mod p.

[0124] For another plaintext x′, select another random integer k′ as the session key, and calculate c1′ and c2′ as the ciphertext obtained by encrypting the plaintext x′:

[0125] c1′=E1(k′)=E1(k′,α)=α k′ mod p;

[0126] c2′=E2(x′,k′)=E2(x′,k′,β)=x′·β k′ mod p.

[0127] Since the ElGamal encryption algorithm has multiplication homomorphism, the product of ciphertexts can be equal to the ciphertext of the product of plaintexts, that is:

[0128] c1·c1′=E1(k)·E1(k′)=E1(k,α)·E1(k′,α)=α k α k′ mod p=α k+k′ mod p E1(k+k′);

[0129] c2·c2′=E2(x,k)·E2(x′,k′)=E2(x,k,β)·E2(x′,k′,β)=x·β k ·x′·β k′ mod p

[0130] =x·x′·β k+k′ mod p = E2(x·x′,k+k′);

[0131] For products of ciphertexts, it is possible to decrypt only the product of the plaintexts without decrypting the individual ciphertexts. For example, if only c″1=c1·c′1 is disclosed without revealing the individual c1 and c′1, then only the product of the plaintexts x″=x·x′ can be decrypted, without decrypting the individual x or x′.

[0132] Similarly, the multiplication of ciphertext and plaintext is also homomorphic, that is:

[0133] c2·x′=E2(x,k)·x′=E2(x,k,β)·x′=x·β k x′ mod p = (x x′) β k modp

[0134] =E2(x·x′,k)=E2(x·x′,k,β).

[0135] 3. Improvement of the Secret Sharing Process of Multiplication Operation

[0136] 1. Description

[0137] Based on the above, it can be seen that since the secret sharing process of the multiplication operation involves frequent and large-scale two-way communication, it results in a large communication cost and low computing efficiency. This application considers avoiding two-way communication in the secret sharing process of the multiplication operation and only performing one-way communication, that is, changing two-way communication into one-way communication, so that the communication process is no longer on the critical path of the calculation.

[0138] To this end, this application introduces an "oblivious multiplication" operation, which can use the two-choice oblivious transmission of one-way communication to perform secret sharing of the multiplication operation. The two-choice oblivious transmission of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also achieve confidentiality of data transmission through two-choice oblivious transmission.

[0139] It can be seen that the present application can improve the secret sharing process of the multiplication operation through the "oblivious multiplication" operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency. The "oblivious multiplication" operation is described in detail below.

[0140] 2. “Accidental Multiplication” Operation

[0141] 1) Definition

[0142] The "oblivious multiplication" operation of this application can use a one-way communication, two-choice oblivious transmission to perform secret sharing of the multiplication operation. The following uses participant A and participant B as an example to illustrate the "oblivious multiplication" operation.

[0143] For example, suppose that participant A has a data u and participant B has a data v. First, participant B performs binary encoding on the data v. Assume that there are L binary bits in total, recorded as s0, s1, ..., s L-1 , then:

[0144]

[0145] Participant A constructs a sequence T = {t0, t1, ..., t L-1}. Among them, t i Satisfy the following:

[0146] t i =u*2 i .

[0147] In this way, it is easy to verify that:

[0148]

[0149] Secondly, participant A generates a random number sequence R = {r0, r1, ..., r L-1}. Thus, for each pair (t i , r i ), (t i , r i ) is constructed into two pieces of information in the oblivious transmission of two choices, namely, information M0=R={r0,r1,...,r L-1}={m 0，i}, information M1=T+R={t0+r0,t1+r1,…,t L-1 +r L-1}={m 1，i}, and m 0，i =r i , m 1，i =t i +r i .

[0150] Again, participant A uses the one-way communication of two-choice oblivious transmission to send information M0 and information M1 to participant B. In which, participant A sends information m each time. 0，i and information m 1，i , so the one-way communication two-choice oblivious transmission process needs to be performed L times in total.

[0151] In each one-way communication, during the oblivious transfer process, participant B uses s i Information m 0，i and information m 1，i Select to receive. i =0, then participant B chooses to receive m 0，i ; If s i =1, then participant B chooses to receive m 1，i ; On the contrary, the same logic applies, so I will not elaborate on this.

[0152] According to the definition of oblivious transfer, party B cannot obtain information m at the same time. 0，i and information m 1，i , that is, you cannot get r at the same time i and t i +r i , so participant B cannot calculate t i , and thus cannot obtain any information about the secret sharing u owned by participant A, so it is safe.

[0153] Finally, participant B uses s i The received data is recorded as q i , then:

[0154] q i =(1-s i )*r i +s i *(t i +r i )=s i *t i +r i .

[0155] In this way, participant B uses s i The calculation result [w]1 of receiving information M0 and information M1 is:

[0156]

[0157] At the same time, Party A calculates:

[0158]

[0159] In this way, it is easy to verify that:

[0160] [w]0+[w]1=u*v.

[0161] It can be seen that for the product w = u*v of data u and data v, [w]0 calculated by participant A can be a secret sharing of w, and [w]1 calculated by participant B can be another secret sharing of w, that is, w = [w]0 + [w]1.

[0162] From the above process, it can be seen that participant A and participant B each calculate a secret sharing of the product of data u and data v, but will not expose the data they own to each other.

[0163] 2) One-way communication with two-choice oblivious transmission

[0164] ① Description

[0165] One-way communication with two-choice oblivious transfer can be understood as using one-way communication. This allows the two-way communication in the secret sharing process of multiplication operations to be converted to one-way communication, eliminating the communication process from being on the critical path of the computation.

[0166] The present application is described below using an example of a one-way communication in which two choices of oblivious transmission are used, including an one-way communication in which two choices of oblivious transmission are used based on photons.

[0167] ② One-way communication based on optical quantum and two-choice oblivious transmission

[0168] Quantum communication uses the non-cloning property of quantum to achieve confidentiality of communication. A single photon generated by a single photon source is a light quantum. A light quantum can have horizontal (|→>) vertical (|↑>) polarization, or diagonal polarization. Direction of polarization.

[0169] The present application can simply select the "horizontal vertical" (+) or "diagonal" (×) measurement method (referred to as the "measurement basis", which includes the measurement basis of the horizontal vertical direction (+) and the measurement basis of the diagonal direction (×)) to measure the photons generated by the single-photon source. When the measurement basis is consistent with the polarization direction of the photon (that is, the measurement basis of the horizontal vertical direction (+) is consistent with the polarization in the horizontal and vertical directions, and the measurement basis of the diagonal (×) direction is consistent with the polarization in the diagonal direction), accurate results can be obtained. When there is a deviation between the measurement basis and the polarization direction of the photon (such as a deviation of 45°), only random results can be obtained.

[0170] Since quantum communication can utilize the non-cloning property of quantum to achieve confidentiality and security of communication, this application is based on the two-choice oblivious transmission of one-way communication of optical quanta, which not only combines quantum communication with two-choice oblivious transmission to improve the confidentiality and security of information transmission, but also realizes the one-way communication process.

[0171] The following is the information m between the above participants A and B. 0，i and information m 1，iThe following describes an example of performing a binary oblivious transfer of one-way communication based on photons.

[0172] ◆Participant A

[0173] Participant A performs the following steps in a binary oblivious transfer based on one-way communication using photons:

[0174] Step 0:

[0175] Participant A and Participant B determine two hash functions H1 and H2 and two integer parameters L and l, and then choose an ElGamal encryption system (α, β, key, p) so that p>2 2*L*l Participant A sends p to participant B through a traditional one-way communication channel (such as the Internet).

[0176] Step 1:

[0177] Participant A generates a random number sequence of length L {a i} and a random number sequence of length L {b i}. Among them, a i Represents a random number sequence {a i}, the i-th random number in b i Represents a random number sequence {b i}, 0≤i<L, 0<a i , b i <2 l ;and a i ≠a j , b i ≠b j and

[0178] For a i , find a suitable random integer k i (k i >0) and h i (h i >0), and for a i Perform ElGamal encryption and get:

[0179]

[0180] in,

[0181] Participant A will send the random number Encode into a l-bit binary string, and then connect all The binary string is recorded as

[0182] Participant A uses hash function H1 and hash function H2 to calculate the hash value h of the above binary string a and hash value h′ a :

[0183]

[0184]

[0185] Assume that the information m of participant A 0，i The binary bits of h′ a have the same length, the information m 0，i The binary bits and h′ a Bitwise XOR gives:

[0186]

[0187] At the same time, calculate the mask of A′ and get:

[0188]

[0189] Similarly, for b i , find a suitable random integer k′ i (k′ i >0) and h′ i (h′ i >0), and b i Perform E1Gamal encryption on , and we get:

[0190]

[0191] in,

[0192] Participant A will send the random number Encode into a l-bit binary string, and then connect all The binary string is recorded as

[0193] Participant A also uses hash function H1 and hash function H2 to calculate the hash value h of the above binary string. b and hash value h′ b :

[0194]

[0195]

[0196] Assume that the information m of participant A 1，i The binary bits of h′ b have the same length, the information m 1，i The binary bits and h′b Bitwise XOR to get the ciphertext B′:

[0197]

[0198] At the same time, calculate the mask of the ciphertext B′ and get:

[0199]

[0200] Finally, participant A will hash the value h a 、Hash value h b , ciphertext A′, ciphertext B′, mask a and Mask b Sent to participant B through a traditional one-way communication channel (such as the Internet).

[0201] It should be noted that in order to ensure the information m 0，i and information m 1，i In the process of one-way communication, the confidentiality and security of the two-choice oblivious transmission process, this application requires the information m 0，i and information m 1，i To encrypt, and in order to obtain the hash value required for encryption, this application introduces a random number sequence {a i}、Random number sequence {b i}, hash function H1 and hash function H2. Among them, first, the random number sequence {a i} and random number sequence {b i} Perform ElGamal encryption and binary encoding, and then use hash function H1 and hash function H2 to calculate h a (h s For verification during decryption), h′ a (h′ a For information m 0，i encryption), h b (h b used for verification during decryption) and h′ b (h′ b For information m 1，i encryption), and finally using h′ a Information m 0，i Encrypt to get the ciphertext A′, and use h′ b Information m 1，i Encryption is performed to obtain ciphertext B'.

[0202] Step 2:

[0203] First, participant A sets the sequence and sequence Perform concatenation and obtain the concatenated sequence:

[0204] or

[0205] Participant A randomly shuffles the encrypted values ​​in the concatenated sequence and obtains the sequence {z i}for:

[0206]

[0207] Among them, z i Represents the sequence {z i} the i-th encrypted value in .

[0208] Secondly, since 0<a i , b i , z i <2 l , we can use l light quanta to represent z i Participant A uses a pair of light quanta with horizontal and vertical polarization (+). Encoding, and using l photon pairs with polarization in diagonal direction (×) Encoding. At this time, the photon sequence The i-th segment pair in for:

[0209]

[0210]

[0211] It can be seen that the light quantum sequence The length is 2*L*l.

[0212] Since the use of l photon pairs with horizontal and vertical polarization directions (+) Encoding, and using l photon pairs with polarization in diagonal direction (×) Encoding is performed, so when participant B uses the horizontal and vertical direction (+) measurement basis to measure the light quantum sequence When measuring, the sequence measured by participant B is is correct, and the measured sequence It is random, unpredictable or wrong. When participant B uses the diagonal direction (×) measurement basis to measure the light quantum sequence When measuring, the sequence measured by participant B is is random, unpredictable, or wrong, and the measured sequence is correct.

[0213] In addition, when participant B wants to obtain information m 0，i When participant B can use information m0，i The corresponding measurement basis (i.e. the measurement basis of the horizontal and vertical directions (+)) is measured. When participant B wants to obtain information m 1，i When participant B can use information m 1，i The corresponding measurement basis (ie, the measurement basis in the diagonal direction (×)) is measured.

[0214] Of course, participant A can also use l photon pairs with diagonal polarization Encoding, and using l light quantum pairs with horizontal and vertical polarization Encoding is performed and no further details are given.

[0215] Finally, participant A sends a photon sequence to participant B via a one-way photon channel.

[0216] Step 3:

[0217] First, participant A sends the random number sequence {a i} and random number sequence {b i} are connected in series, and the resulting series sequence is:

[0218] a0,a1,...,a L-1 ,b0,b1,...,b L-1 or b0, b1, ..., b L-1 , a0, a1, ..., a L-1 .

[0219] Secondly, participant A follows the sequence {z i}, perform the same random order on the above concatenated sequence and obtain the sequence {m i}for:

[0220] {m i}=a0,b0,a L-1 , a1, b L-1 ,…,b1,0≤i<2L.

[0221] Finally, participant A will sequence {m i}Sent to participant B through a traditional one-way communication channel (such as the Internet).

[0222] ◆Participant B

[0223] Participant B performs the following steps in a binary oblivious transfer based on one-way communication using photons:

[0224] Step 4:

[0225] Participant B receives p (step 0), hash value h from participant A through a traditional one-way communication channel (such as the Internet).a 、Hash value h b , ciphertext A′, ciphertext B′, mask a , Mask b (Step 1), sequence {m i}(step 3), and the optical quantum sequence is received through the optical quantum channel of unidirectional communication (Step 2).

[0226] Step 5:

[0227] If participant B wants to receive information m 0，i , and s i =0, then participant B selects information m 0，i The corresponding measurement basis (i.e. the measurement basis in the horizontal and vertical directions (+)) is used to measure the light quantum sequence If participant B wants to receive information m 1，i , and s i =1, then the information m of participant B 1，i The corresponding measurement basis (i.e. the measurement basis in the diagonal direction (×)) is used to measure the light quantum sequence

[0228] Assume that participant B wants to receive information m 0，i , take the measurement basis of the horizontal and vertical directions (+) as an example for specific explanation.

[0229] First, for the photon sequence The i-th fragment in because It is encoded with light quanta with horizontal and vertical polarization (+), and the measurement basis of participant B in the horizontal and vertical directions (+) is used for measurement, so the accurate measurement result must be Let another random, unpredictable or erroneous measurement result be c i , and c i <2 l Therefore, the i-th segment The measurement result z′ i The following can be satisfied:

[0230] or z′ i = = c i .

[0231] Next, the measurement results of each segment are multiplied in turn to obtain the measurement product result C:

[0232]

[0233] Finally, using the mask Mask aDecrypt the measured product result C to obtain the decrypted product result D:

[0234]

[0235] Because c i <2 l , a i <2 l , making

[0236]

[0237] So,

[0238]

[0239] It should be noted that during the encryption process, participant A will select information m 0，i The corresponding measurement basis (such as the measurement basis in the horizontal and vertical directions) is encoded, and the information m is selected 1，i The corresponding measurement basis (such as the measurement basis in the diagonal direction) is encoded. In this way, when participant B wants to obtain information m 0，i When participant B can use information m 0，i The corresponding measurement base is measured. When participant B wants to obtain information m 1，i When participant B can use information m 1，i The corresponding measurement base is measured.

[0240] Secondly, since participant A can choose a measurement basis (either a horizontal or vertical measurement basis or a diagonal measurement basis) to measure the light quantum sequence Each fragment in the ciphertext is measured, so that half of the resulting measured decrypted products are correct, and the other half are random, unpredictable, or incorrect. However, participant B cannot distinguish which measurement results are correct and which are random, unpredictable, or incorrect. In other words, half of the measurement results are semi-homomorphically encrypted ciphertext, and the other half are random, unpredictable results.

[0241] Finally, since the random number sequence {a i} and random number sequence {b i The ciphertext obtained by encrypting is encrypted using ElGamal, and the ciphertexts encrypted by ElGamal can be multiplied (i.e., multiplication homomorphism), so that their product is still a semi-homomorphic encrypted ciphertext. Therefore, participant B can use the mask to decrypt the random number selected by participant A (i.e., the random number sequence {a i} and random number sequence {b i}) (and the product of all random unpredictable results).

[0242] Step 6:

[0243] First, participant B uses the sequence {m i The i-th random number m in i Perform a modulus operation on the decrypted product D to obtain the modulus value Dmodm i .

[0244] Secondly, using the modulus value Dmodm i To determine whether the measurement result z′ i As the decryption random number w i ; Among them, w i Satisfy the following:

[0245] w i =z′ i , Dmodm i =0.

[0246] Since participant B uses the horizontal and vertical measurement basis for decryption, and It is encoded using light quanta with horizontal and vertical polarization, so when m i =a i When decrypted correctly, Dmodm i =Dmoda i =0.

[0247] When m i =b i When decrypted correctly, Dmodm i =Dmodb i ≠0. Thus, The final decrypted random number sequence {w i} is a sequence

[0248] Again, w i Encode into a l-bit binary string, and then connect all {w i} binary string, denoted as w0| l w1| l ...| l w L-1 | l .

[0249] Participant B uses hash function H1 to calculate the hash value h of the above binary string w :

[0250] h w =H1(w0| l w1| l ...| lw L-1 | l ).

[0251] If h w =h a , then participant B uses hash function H2 to calculate the hash value h of the above binary string w′ :

[0252] h w′ =H2(w0| l w1| l ...| l w L-1 | l ).

[0253] Finally, participant B can calculate the information m he wants to receive based on the ciphertext A′ 0，i :

[0254]

[0255] However, Bob cannot calculate the information m 1，i .

[0256] 3. Secret Sharing Process of Multiplication Operation

[0257] In combination with the above content, the present application below uses the "inadvertent multiplication" operation to perform secret sharing of the multiplication operation, thereby improving the secret sharing process of the multiplication operation in order to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0258] Assume that participant A has a secret sharing [x]0 of private data x (for the sake of distinction and description, private data x can be called "first private data") and a secret sharing [y]0 of private data y (for the sake of distinction and description, private data y can be called "second private data"), while participant B has another secret sharing [x]1 of private data x and another secret sharing [y]1 of private data y, and x = [x]0 + [x]1, y = [y]0 + [y]1.

[0259] Now to calculate z = x * y, participant A needs to have a secret share of z [z]0, and participant B needs to have another secret share of z [z]1, and z = [z]0 + [z]1. The specific steps are as follows:

[0260] Step 1:

[0261] Participant A and Participant B perform the above-mentioned "oblivious multiplication" operation on secret share [x]0 and secret share [y]1, where secret share [x]0 replaces the above-mentioned data u, and secret share [y]1 replaces the above-mentioned data v.

[0262] In the specific implementation, participant A uses the one-way communication of two-choice oblivious transmission to send information M0=R={r0, r1,…, r L-1}={m 0，i} and information M1=T+R={t0+r0,t1+r1,…,t L-1 +r L-1}={m 1，i For ease of distinction, information M0 and information M1 may be referred to as “two pieces of first information”.

[0263] Thus, the information M0 in the two first messages is equal to the random number sequence R generated by participant A (for the sake of distinction, the random number sequence R can be referred to as the "first random number sequence"), and the information M1 in the two first messages is equal to the number sequence T constructed by the secret sharing [x]0 plus the random number sequence R. Wherein, the number sequence T = {t0, t1, ..., t L-1}, and t i Satisfy the following:

[0264] t i =[x]0*2 i .

[0265] Finally, participant A obtains the parameter [w]0 as:

[0266]

[0267] Among them, r i Represents the i-th random number in the random number sequence R.

[0268] At the same time, participant B receives the calculation result [w]1 as:

[0269]

[0270] In this way, it is easy to verify that:

[0271] [w]0+[w]1=[x]0*[y]1.

[0272] Step 2:

[0273] Participant A and participant B perform the above-mentioned "inadvertent multiplication" operation on the secret share [y]0 and the secret share [x]1, where [y]0 replaces the above-mentioned data u and the secret share [x]1 replaces the above-mentioned data v.

[0274] In the specific implementation, participant A uses the one-way communication of two-choice oblivious transmission to send information M′0=R′={r′0,r′1,...,r′ L-1}={m′ 0，i} and information M′1=T′+R′={t′0+r′0,t′1+r′1,...,t′ L-1 +r′ L-1}={m′ 1，i For the sake of distinction, the information M′0 and the information M′1 may be referred to as “two pieces of second information”.

[0275] Thus, the information M′0 in the two second messages is equal to the random number sequence R′ generated by participant A (for the sake of distinction, the random number sequence R′ can be referred to as the “second random number sequence”), and the information M′1 in the two second messages is equal to the number sequence T′ constructed by the secret sharing [y]0 plus the random number sequence R′. Wherein, the number sequence T′={t′0, t′1, …, t′ L-1}, and t′ i Satisfy the following:

[0276] t′ i =[y]0*2 i .

[0277] Finally, participant A obtains the parameter [w]′0 as:

[0278]

[0279] Among them, r i ′ represents the i-th random number in the random number sequence R′.

[0280] At the same time, participant B receives the calculation result [w]′1 as:

[0281]

[0282] In this way, it is easy to verify that:

[0283] [w]′0+[w]′1=[y]0*[x]1.

[0284] Step 3:

[0285] Participant A calculates a secret share [z]0 of z = x*y as:

[0286] [z]0=[x]0*[y]0+[w]0+[w]′0;

[0287] Similarly, participant B calculates another secret share [z]1 of z=x*y as:

[0288] [z]1=[x]1*[y]1+[w]1+[w]′1;

[0289] In this way, it is easy to verify that:

[0290] [z]0+[z]1=[x]0*[y]0+[w]0+[w]′0+[x]1*[y]1+[w]1+[w]′1

[0291] =[x]0*[y]0+[x]1*[y]1+([w]0+[w]1)+([w]′0+[w]′1)

[0292] =[x]0*[y]0+[x]1*[y]1+[x]0*[y]1+[y]0*[x]1

[0293] =([x]0+[x]1)*([y]0+[y]1)=x*y.

[0294] It can be seen that [z]0 and [z]1 are respectively a legal secret sharing of z=x*y.

[0295] 4. A secure multi-party computation method for one-way communication

[0296] 1) Description

[0297] In combination with the above content, the present application proposes a secure multi-party computation method for one-way communication, in the hope of improving the secret sharing process of multiplication operations, so as to reduce communication costs and improve computational efficiency.

[0298] The following example takes participant A as the first participant device and participant B as the second participant device. Figure 2 As shown, Figure 2 This is a flowchart of a secure multi-party computation method based on one-way communication according to an embodiment of the present application. A first participating device possesses a secret shared [x]0 for first private data and a secret shared [y]0 for second private data, and a second participating device possesses another secret shared [x]1 for the first private data and another secret shared [y]1 for the second private data. The method may include the following steps:

[0299] S210. The first participating device uses one-way communication, two-choice oblivious transmission to send two first messages, where the two first messages are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device.

[0300] Correspondingly, the second participating device adopts one-way communication and oblivious transmission to receive the two first information.

[0301] S220: The second participating device calculates a received calculation result [w]1 of the two first information using the secret sharing [y]1.

[0302] S230: The first participating device determines a parameter [w]0 according to the first random number sequence.

[0303] S240. The first participating device sends two pieces of second information by using one-way communication and oblivious transmission. The two pieces of second information are determined according to the secret share [y]0 and a second random number sequence generated by the first participating device.

[0304] Correspondingly, the second participating device adopts the one-way communication and the oblivious transmission to receive the two second information.

[0305] S250: The second participating device calculates a received calculation result [w]′1 of the two second information using the secret sharing [x]1.

[0306] S260: The first participating device determines a parameter [w]′0 according to the second random number sequence.

[0307] S270. The first participating device calculates the product of the secret share [x]0 and the secret share [y]0, and then adds the parameters [w]0 and [w]′0 respectively to finally obtain the parameter [z]0. The parameter [z]0 is a secret share of the product of the first private data and the second private data required by the first participating device.

[0308] S280. The second participating device calculates the product of the secret share [x]1 and the secret share [y]1, and then adds the received calculation results [w]1 and [w]′1 to obtain the parameter [z]1. The parameter [z]1 is a secret share of the product of the first private data and the second private data required by the second participating device.

[0309] It can be seen that the present application adopts the oblivious transmission of two choices of one-way communication to perform secret sharing of multiplication operations. The oblivious transmission of two choices of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also realize the confidentiality of data transmission through the oblivious transmission of two choices, thereby improving the secret sharing process of the multiplication operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0310] 2) Some possible implementations

[0311] In some possible implementations, the two first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device, including:

[0312] One of the two first messages is equal to the first random number sequence, and the other of the two first messages is equal to the first target sequence;

[0313] The i-th value in the first target sequence is equal to the sum of the i-th value in the sequence constructed by the secret share [x]0 and the i-th random number in the first random number sequence, where i is an integer.

[0314] It should be noted that, in combination with the content of "3. Secret Sharing Process of Multiplication Operation" above, the information M0 in the two first messages is equal to the random number sequence R generated by participant A (for the sake of distinction, the random number sequence R can be called the "first random number sequence"), and the information M1 in the two first messages is equal to the number sequence T constructed by the secret sharing [x]0 plus the random number sequence R. Wherein, the number sequence T = {t0, t1, ..., t L-1}, and t i Satisfy the following:

[0315] t i =[x]0*2 i .

[0316] In some possible implementations, the two second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device, including:

[0317] One of the two second messages is equal to the second random number sequence, and the other of the two second messages is equal to the second target sequence;

[0318] The i-th value in the second target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [y]0 and the i-th random number in the second random number sequence.

[0319] It should be noted that, combined with the content of "3. Secret Sharing Process of Multiplication Operation" above, it can be seen that the information M'0 in the two second messages is equal to the random number sequence R' generated by participant A (for the sake of distinction, the random number sequence R' can be called the "second random number sequence"), and the information M'1 in the two second messages is equal to the sequence T' constructed by the secret sharing [y]0 plus the random number sequence R'. Among them, the sequence T'={t'0,t'1,…,t' L-1}, and t′ i Satisfy the following:

[0320] t′ i =[y]0*2 i .

[0321] In some possible implementations, the result of the received calculation of the two first information is equal to the product of the secret share [x]0 and the secret share [y]1 minus the parameter [w]0;

[0322] The received calculation result of the two second messages is equal to the product of the secret share [y]0 and the secret share [x]1 minus the parameter [w]′0.

[0323] It should be noted that, combined with the content in "3. Secret Sharing Process of Multiplication Operation" above, the received calculation results [w]1 of the two first information are:

[0324]

[0325] The received calculation results [w]′1 of the two second messages are:

[0326]

[0327] In some possible implementations, the parameter [w]0 is equal to the inverse of the cumulative sum of all random numbers in the first random number sequence;

[0328] The parameter [w]′0 is equal to the inverse of the cumulative sum of all random numbers in the second random number sequence.

[0329] It should be noted that, combined with the content in "3. Secret Sharing Process of Multiplication Operation" above, the parameter [w]0 is:

[0330]

[0331] The parameter [w]′0 is:

[0332]

[0333] IV. Exemplary Description of a One-Way Communication Secure Multi-Party Computation Device

[0334] 1. Description

[0335] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that, in order to realize the above functions, the participating devices include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should know that, in combination with the methods, functions, modules, units or steps of the various examples described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain method, function, module, unit or step is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described methods, functions, modules, units or steps for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0336] In the embodiments of the present application, the participating devices can be divided into functional units / modules according to the above-mentioned method examples. For example, each functional unit / module can be divided according to each function, or two or more functions can be integrated into one functional unit / module. The above-mentioned integrated functional units / modules can be implemented in hardware or in software programs. It should be noted that the division of functional units / modules in the embodiments of the present application is schematic and is only a logical functional division. In actual implementation, other division methods may be used.

[0337] In the case of an integrated unit, Figure 3 The unidirectional communication secure multi-party computing device 300 specifically includes a sending unit 310, a determining unit 320, and a computing unit 330.

[0338] It should be noted that the sending unit 310 may be a module unit for sending information / data, etc., and there is no specific limitation on this.

[0339] The determination unit 320 may be a module unit for determining parameters, etc., and is not particularly limited thereto.

[0340] The calculation unit 330 may be a module unit for calculating parameters, etc., and is not particularly limited thereto.

[0341] In some possible implementations, the sending unit 310 , the determining unit 320 , and the calculating unit 330 may be integrated into one unit or respectively integrated into different units.

[0342] For example, the sending unit 310 , the determining unit 320 , and the calculating unit 330 may be integrated into a processing unit.

[0343] For another example, the sending unit 310 may be integrated into the communication unit, and the determining unit 320 and the calculating unit 330 may be integrated into the processing unit.

[0344] It should be noted that the processing unit can be a processor or controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute the various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processing unit can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0345] In some possible implementations, the one-way communication secure multi-party computing apparatus 300 may further include a storage unit for storing computer programs or instructions executed by the one-way communication secure multi-party computing apparatus 300 .

[0346] For example, the storage unit may be a memory.

[0347] In some possible implementations, the one-way communication secure multi-party computing device 300 may be a chip / chip module / processor / hardware, etc.

[0348] In specific implementation, the one-way communication secure multi-party computing device 300 is used to execute the steps described in the above method embodiment, which will be described in detail below.

[0349] A sending unit 310 is configured to send two pieces of first information to a second participant device using one-or-two oblivious transmission in one-way communication, where the two pieces of first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participant device;

[0350] A determining unit 320, configured to determine a parameter [w]0 according to the first random number sequence;

[0351] The sending unit 310 is further configured to send two pieces of second information to the second participant device by using oblivious transmission of a one-way communication, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device;

[0352] The determining unit 320 is further configured to determine a parameter [w]′0 according to the second random number sequence;

[0353] A calculation unit 330 is configured to calculate the product of the secret share [x]0 and the secret share [y]0, and then add the parameters [w]0 and [w]′0 to obtain the parameter [z]0, where the parameter [z]0 is a secret share that is the product of the first private data and the second private data required by the first participating device.

[0354] It can be seen that the present application adopts the oblivious transmission of two choices of one-way communication to perform secret sharing of multiplication operations. The oblivious transmission of two choices of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also realize the confidentiality of data transmission through the oblivious transmission of two choices, thereby improving the secret sharing process of the multiplication operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0355] It should be noted that the specific implementation of each operation performed by the one-way communication secure multi-party computing device 300 can be found in the corresponding description of the method embodiment shown above, and will not be repeated here.

[0356] 2. Other implementation methods

[0357] Some of the implementation methods involved are further explained below, and other contents not involved can be found in the above description in detail, which will not be repeated here.

[0358] In some possible implementations, the two first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device, including:

[0359] One of the two first messages is equal to the first random number sequence, and the other of the two first messages is equal to the first target sequence;

[0360] The i-th value in the first target sequence is equal to the sum of the i-th value in the sequence constructed by the secret share [x]0 and the i-th random number in the first random number sequence, where i is an integer.

[0361] In some possible implementations, the two second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device, including:

[0362] One of the two second messages is equal to the second random number sequence, and the other of the two second messages is equal to the second target sequence;

[0363] The i-th value in the second target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [y]0 and the i-th random number in the second random number sequence.

[0364] In some possible implementations, the result of the received calculation of the two first information is equal to the product of the secret share [x]0 and the secret share [y]1 minus the parameter [w]0;

[0365] The received calculation result of the two second messages is equal to the product of the secret share [y]0 and the secret share [x]1 minus the parameter [w]′0.

[0366] In some possible implementations, the parameter [w]0 is equal to the inverse of the cumulative sum of all random numbers in the first random number sequence;

[0367] The parameter [w]′0 is equal to the inverse of the cumulative sum of all random numbers in the second random number sequence.

[0368] 5. Another Exemplary Description of a Secure Multi-Party Computing Device for One-Way Communication

[0369] 1. Description

[0370] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that, in order to realize the above functions, the participating devices include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should know that, in combination with the methods, functions, modules, units or steps of the various examples described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain method, function, module, unit or step is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described methods, functions, modules, units or steps for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0371] In the embodiments of the present application, the participating devices can be divided into functional units / modules according to the above-mentioned method examples. For example, each functional unit / module can be divided according to each function, or two or more functions can be integrated into one functional unit / module. The above-mentioned integrated functional units / modules can be implemented in hardware or in software programs. It should be noted that the division of functional units / modules in the embodiments of the present application is schematic and is only a logical functional division. In actual implementation, other division methods may be used.

[0372] In the case of an integrated unit, Figure 4 This is a block diagram of the functional units of another one-way communication secure multi-party computing device according to an embodiment of the present application. The one-way communication secure multi-party computing device 400 specifically includes: a receiving unit 410 and a computing unit 420.

[0373] It should be noted that the receiving unit 410 may be a module unit for receiving information / data, etc., and there is no specific limitation on this.

[0374] The calculation unit 420 may be a module unit for calculating information / data / parameters, etc., and is not particularly limited thereto.

[0375] In some possible implementations, the receiving unit 410 and the computing unit 420 may be integrated into one unit or respectively integrated into different units.

[0376] For example, the receiving unit 410 and the computing unit 420 may be integrated into a processing unit.

[0377] For another example, the receiving unit 410 may be integrated into the communication unit, and the computing unit 420 may be integrated into the processing unit.

[0378] It should be noted that the processing unit can be a processor or controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute the various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processing unit can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0379] In some possible implementations, the one-way communication secure multi-party computing apparatus 400 may further include a storage unit for storing computer programs or instructions executed by the one-way communication secure multi-party computing apparatus 400 .

[0380] For example, the storage unit may be a memory.

[0381] In some possible implementations, the one-way communication secure multi-party computing device 400 may be a chip / chip module / processor / hardware, etc.

[0382] In specific implementation, the one-way communication secure multi-party computing device 400 is used to execute the steps described in the above method embodiment, which will be described in detail below.

[0383] A receiving unit 410 is configured to receive two pieces of first information from a first participating device using one-way communication and oblivious transmission, where the two pieces of first information are determined based on a secret share [x]0 and a first random number sequence generated by the first participating device;

[0384] A calculation unit 420 is configured to calculate a reception calculation result [w]1 of the two first information using the secret sharing [y]1;

[0385] The receiving unit 410 is further configured to receive two pieces of second information from the first participating device using one-way communication and oblivious transmission, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device;

[0386] The calculation unit 420 is further configured to calculate a reception calculation result [w]′1 of the two second information using the secret sharing [x]1;

[0387] The calculation unit 420 is further configured to calculate the product of the secret share [x]1 and the secret share [y]1, and then add the received calculation results [w]1 and the received calculation results [w]′1 to obtain a parameter [z]1, where the parameter [z]1 is a secret share that is the product of the first private data and the second private data required by the second participating device.

[0388] It can be seen that the present application adopts the oblivious transmission of two choices of one-way communication to perform secret sharing of multiplication operations. The oblivious transmission of two choices of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also realize the confidentiality of data transmission through the oblivious transmission of two choices, thereby improving the secret sharing process of the multiplication operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0389] It should be noted that the specific implementation of each operation performed by the one-way communication secure multi-party computing device 400 can be found in the corresponding description of the method embodiment shown above, and will not be repeated here.

[0390] 2. Other implementation methods

[0391] Some of the implementation methods involved are further explained below, and other contents not involved can be found in the above description in detail, which will not be repeated here.

[0392] In some possible implementations, the two first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device, including:

[0393] One of the two first messages is equal to the first random number sequence, and the other of the two first messages is equal to the first target sequence;

[0394] The i-th value in the first target sequence is equal to the sum of the i-th value in the sequence constructed by the secret share [x]0 and the i-th random number in the first random number sequence, where i is an integer.

[0395] In some possible implementations, the two second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device, including:

[0396] One of the two second messages is equal to the second random number sequence, and the other of the two second messages is equal to the second target sequence;

[0397] The i-th value in the second target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [y]0 and the i-th random number in the second random number sequence.

[0398] In some possible implementations, the result of the received calculation of the two first information is equal to the product of the secret share [x]0 and the secret share [y]1 minus the parameter [w]0;

[0399] The received calculation result of the two second messages is equal to the product of the secret share [y]0 and the secret share [x]1 minus the parameter [w]′0.

[0400] In some possible implementations, the parameter [w]0 is equal to the inverse of the cumulative sum of all random numbers in the first random number sequence;

[0401] The parameter [w]′0 is equal to the inverse of the cumulative sum of all random numbers in the second random number sequence.

[0402] VI. Exemplary Description of a Participating Device

[0403] The following is a schematic diagram of the structure of a participating device in an embodiment of the present application. Figure 5 The participating device 500 includes a processor 510 , a memory 520 , and at least one communication bus for connecting the processor 510 and the memory 520 .

[0404] In some possible implementations, the processor 510 may be one or more central processing units (CPUs). When the processor 510 is a CPU, the CPU may be a single-core CPU or a multi-core CPU. The memory 520 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CD-ROM), and is used to store computer programs or instructions.

[0405] In some possible implementations, the participant device 500 further includes a communication interface, which is used to receive and send data.

[0406] In some possible implementations, the participant device 500 is a first participant device, and the processor 510 in the participant device 500 is configured to execute a computer program or instruction 521 stored in a memory 520 to implement the following steps:

[0407] Using one-way communication, two-choice oblivious transmission is used to send two first messages to the second participating device, where the two first messages are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device;

[0408] Determine parameter [w]0 according to the first random number sequence;

[0409] Using one-way communication, two-choice oblivious transmission is used to send two pieces of second information to the second participant device, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device;

[0410] Determine the parameter [w]′0 according to the second random number sequence;

[0411] Calculate the product of secret share [x]0 and secret share [y]0, and then add parameters [w]0 and [w]′0 respectively to finally obtain parameter [z]0, where parameter [z]0 is a secret share that is the product of the first private data and the second private data required by the first participating device.

[0412] In some possible implementations, the participant device 500 is a second participant device, and the processor 510 in the participant device 500 is configured to execute a computer program or instruction 521 stored in a memory 520 to implement the following steps:

[0413] Receiving two pieces of first information from a first participating device using one-way communication and two-choice oblivious transmission, where the two pieces of first information are determined based on a secret share [x]0 and a first random number sequence generated by the first participating device;

[0414] Calculate a received calculation result [w]1 of the two first information using secret sharing [y]1;

[0415] Receiving two pieces of second information from the first participating device by using one-way communication and two-choice oblivious transmission, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device;

[0416] Calculate the received calculation result [w]′1 of the two second information using the secret sharing [x]1;

[0417] Calculate the product of secret share [x]1 and secret share [y]1, and then add the received calculation results [w]1 and received calculation results [w]′1 to finally obtain parameter [z]1. Parameter [z]1 is a secret share of the product of the first private data and the second private data required by the second participating device.

[0418] It can be seen that the present application adopts the oblivious transmission of two choices of one-way communication to perform secret sharing of multiplication operations. The oblivious transmission of two choices of one-way communication can not only transform two-way communication into one-way communication through one-way communication, but also realize the confidentiality of data transmission through the oblivious transmission of two choices, thereby improving the secret sharing process of the multiplication operation, so as to reduce the communication cost of the multiplication operation and improve the computational efficiency.

[0419] It should be noted that the specific implementation of each operation performed by the participating device 500 can refer to the corresponding description of the method embodiment shown above, and will not be repeated here.

[0420] VII. Other Explanations

[0421] An embodiment of the present application further provides a computer-readable storage medium, wherein a computer program or instructions are stored on the computer-readable storage medium, and when the computer program or instructions are executed by a processor, the steps described in the above embodiment are implemented.

[0422] The present application also provides a computer program product, including a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the steps described in the above embodiment are implemented. Exemplarily, the computer program product can be a software installation package.

[0423] In addition, a computer program product should be understood as a software product that mainly implements the technical solution of the present application through computer programs or instructions.

[0424] It should be noted that, for the above-mentioned various embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations. Those skilled in the art should know that this application is not limited by the order of the actions described, because some steps in the embodiments of the present application can be performed in other orders or simultaneously. In addition, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions, steps, modules or units involved are not necessarily required by the embodiments of the present application.

[0425] In the above embodiments, the embodiments of the present application have different focuses on the description of each embodiment. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0426] Those skilled in the art will appreciate that the methods, steps, or functions of the related modules / units described in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product, or it may be implemented by a processor executing a computer program instruction. Wherein, the computer program product includes at least one computer program instruction, and the computer program instruction may be composed of corresponding software modules, which may be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disks, mobile hard disks, read-only compact discs (CD-ROMs), or any other form of storage medium well known in the art. The computer program instruction may be stored in a computer-readable storage medium, or may be transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program instruction may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center by wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or may be a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium, or a semiconductor medium (eg, an SSD).

[0427] The modules / units included in the various devices or products described in the above embodiments may be software modules / units, hardware modules / units, or may be partially software modules / units and partially hardware modules / units. For example, for various devices or products whose applications are applied to or integrated into a chip, the modules / units included therein may all be implemented in the form of hardware such as circuits; or, some of the modules / units included therein may be implemented in the form of software programs, which run on a processor integrated inside the chip, while some of the modules / units in the other part (if any) may be implemented in the form of hardware such as circuits. The same applies to various devices or products whose applications are applied to or integrated into a chip module, or various devices or products whose applications are applied to or integrated into a terminal.

[0428] The above specific implementation methods further describe in detail the purpose, technical solutions, and beneficial effects of the embodiments of the present application. It should be understood that the above are only specific implementation methods of the embodiments of the present application and are not intended to limit the scope of protection of the embodiments of the present application. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of the present application shall be included in the scope of protection of the embodiments of the present application.

Claims

1. A secure multi-party computing method for one-way communication, characterized in that: A method for a first participating device in a secure multi-party computation, wherein the participating devices further include a second participating device, wherein the first participating device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participating device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; and wherein the method comprises: Using one-way communication, two-choice oblivious transmission, to send two pieces of first information to the second participant device, where the two pieces of first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participant device; Determine a parameter [w]0 according to the first random number sequence; Using one-way communication, two-choice oblivious transmission, to send two pieces of second information to the second participant device, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device; Determine a parameter [w]′0 according to the second random number sequence; Calculate the product of the secret share [x]0 and the secret share [y]0, and then add the parameter [w]0 and the parameter [w]′0 respectively to finally obtain the parameter [z]0, where the parameter [z]0 is a secret share of the product of the first private data and the second private data required by the first participating device.

2. The method according to claim 1, characterized in that The two first pieces of information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device, and include: One of the two first messages is equal to the first random number sequence, and the other of the two first messages is equal to the first target sequence; The i-th value in the first target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [x]0 and the i-th random number in the first random number sequence, where i is an integer.

3. The method according to claim 1, characterized in that The two second pieces of information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device, and include: One of the two second messages is equal to the second random number sequence, and the other of the two second messages is equal to the second target sequence; The i-th value in the second target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [y]0 and the i-th random number in the second random number sequence.

4. The method according to claim 1, wherein The received calculation result of the two first information is equal to the product of the secret share [x]0 and the secret share [y]1 minus the parameter [w]0; The received calculation result of the two second information is equal to the product of the secret share [y]0 and the secret share [x]1 minus the parameter [w]′0.

5. The method according to claim 1 or 4, characterized in that The parameter [w]0 is equal to the inverse of the cumulative sum of all random numbers in the first random number sequence; The parameter [w]′0 is equal to the inverse of the cumulative sum of all random numbers in the second random number sequence.

6. A secure multi-party computing method for one-way communication, characterized in that: A second participant device in a secure multi-party computing (SMC) comprising a first participant device, wherein the first participant device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participant device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the method comprising: Receiving two pieces of first information from the first participating device using one-way communication and oblivious transmission, wherein the two pieces of first information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device; Calculate a reception calculation result [w]1 of the two first information using the secret sharing [y]1; receiving two pieces of second information from the first participant device using one-way communication and two-choice oblivious transmission, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participant device; Calculate a reception calculation result [w]′1 of the two pieces of second information using the secret sharing [x]1; Calculate the product of the secret share [x]1 and the secret share [y]1, and then add the received calculation result [w]1 and the received calculation result [w]′1 respectively to finally obtain parameter [z]1, where the parameter [z]1 is a secret share of the product of the first private data and the second private data required by the second participating device.

7. The method according to claim 6, characterized in that The two first pieces of information are determined based on the secret share [x]0 and a first random number sequence generated by the first participating device, and include: One of the two first messages is equal to the first random number sequence, and the other of the two first messages is equal to the first target sequence; The i-th value in the first target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [x]0 and the i-th random number in the first random number sequence, where i is an integer.

8. The method according to claim 6, characterized in that The two second pieces of information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device, and include: One of the two second messages is equal to the second random number sequence, and the other of the two second messages is equal to the second target sequence; The i-th value in the second target sequence is equal to the sum of the i-th value in the sequence constructed by the secret sharing [y]0 and the i-th random number in the second random number sequence.

9. The method according to claim 6, characterized in that The received calculation result [w]1 is equal to the product of the secret share [x]0 and the secret share [y]1 minus the parameter [w]0, where the parameter [w]0 is determined according to the first random number sequence; The received calculation result [w]′1 is equal to the product of the secret share [y]0 and the secret share [x]1 minus the parameter [w]′0, where the parameter [w]′0 is determined according to the second random number sequence.

10. The method according to claim 9, characterized in that The parameter [w]0 is equal to the inverse of the cumulative sum of all random numbers in the first random number sequence; The parameter [w]′0 is equal to the inverse of the cumulative sum of all random numbers in the second random number sequence.

11. A secure multi-party computing device for one-way communication, characterized in that: A first participant device in a secure multi-party computing device, wherein the secure multi-party computing device further includes a second participant device, wherein the first participant device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participant device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the apparatus comprises: a sending unit, configured to send two pieces of first information to the second participant device by using one-or-two oblivious transmission in unidirectional communication, where the two pieces of first information are determined according to the secret share [x]0 and a first random number sequence generated by the first participant device; a determining unit, configured to determine a parameter [w]0 according to the first random number sequence; The sending unit is further configured to send two pieces of second information to the second participating device by using one-way communication of two-choice oblivious transmission, where the two pieces of second information are determined according to the secret share [y]0 and a second random number sequence generated by the first participating device; The determining unit is further configured to determine a parameter [w]′0 according to the second random number sequence; a calculation unit, configured to calculate the product of the secret share [x]0 and the secret share [y]0, and then add the parameter [w]0 and the parameter [w]′0 respectively to finally obtain the parameter [z]0, wherein the parameter [z]0 is a secret share of the product of the first private data and the second private data required by the first participating device.

12. A secure multi-party computing device for one-way communication, characterized in that: A second participant device in a secure multi-party computing device, wherein the secure multi-party computing device further comprises a first participant device, wherein the first participant device possesses a secret sharing [x]0 of first private data and a secret sharing [y]0 of second private data, and the second participant device possesses another secret sharing [x]1 of the first private data and another secret sharing [y]1 of the second private data; the apparatus comprises: a receiving unit, configured to receive two pieces of first information from the first participating device by adopting one-or-two oblivious transmission in one-way communication, where the two pieces of first information are determined according to the secret share [x]0 and a first random number sequence generated by the first participating device; A calculation unit, configured to calculate a reception calculation result []1 of the two first information using the secret sharing [y]1; The receiving unit is further configured to receive two pieces of second information from the first participating device by adopting one-or-two oblivious transmission in one-way communication, where the two pieces of second information are determined based on the secret share [y]0 and a second random number sequence generated by the first participating device; The calculation unit is further configured to calculate a reception calculation result []′1 of the two second information using the secret sharing [x]1; The calculation unit is further used to calculate the product of the secret sharing [x]1 and the secret sharing [y]1, and then add the received calculation result []1 and the received calculation result []′1 respectively to finally obtain the parameter [z]1, where the parameter [z]1 is a secret sharing of the product of the first private data and the second private data required by the second participating device.

13. A participant device, the participant device being a first participant device or a second participant device, comprising a processor, a memory, and a computer program or instruction stored in the memory, wherein: The processor executes the computer program or instructions to implement the steps of the method according to any one of claims 1 to 5 or 6 to 10.

14. A computer-readable storage medium, characterized in that The device stores a computer program or instruction, which implements the steps of the method according to any one of claims 1 to 5 or 6 to 10 when executed.

Images