A secure two-party computation method under an asymmetric trust model

Abstract

The application discloses a secure two-party computation method under an asymmetric trust model, including a semi-honest participant Alice and a malicious participant Bob; the secure two-party computation method includes an offline stage and an online stage; the offline stage includes generation and authentication of a multiplication triple, generation and authentication of a random number; the online stage includes processing of input data, addition operation, multiplication operation and output of a result; the secure two-party computation method provided by the application can resist the malicious participant, and the implementation cost is lower than that of a secure two-party computation scheme resisting a malicious opponent under a symmetric trust model.

Description

Technical Field

[0001] This invention belongs to the field of secure two-party computation technology, specifically relating to a secure two-party computation method under an asymmetric trust model. Background Technology

[0002] With the rapid development of information technologies such as machine learning and cloud computing, more and more enterprises with abundant computing resources are training models on local data and then using these models to predict future trends to assist in decision-making. For resource-constrained enterprises, the cost of training models on local data and making predictions is higher than purchasing model prediction services from comparable companies. Therefore, these resource-limited enterprises tend to engage in online inference with companies that own the models—that is, online inference between the model owner and the data owner. However, during online inference, the behavior of the model owner cannot be fully guaranteed; the model owner may provide incorrect calculation results or even infringe on the privacy of the other party. Secure two-party computation schemes can protect the privacy of both parties during the computation process. However, existing secure two-party computation schemes are constructed under a symmetric trust model, which assumes that each participant has the same level of trust while controlling the total number of malicious participants. However, in some scenarios, the level of trust among participants is not equal, and some participants have a higher probability of acting maliciously than others. For example, in online inference, the probability of a participant owning the model acting maliciously is much higher than that of the data owner. If a secure two-party computation scheme based on a symmetric trust model to resist malicious adversaries is used for online inference, it will incur additional overhead. Summary of the Invention

[0003] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and propose a secure two-party computation method under an asymmetric trust model.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A secure two-party computation method under an asymmetric trust model includes a semi-honest participant Alice and a malicious participant Bob; the secure two-party computation method includes an offline phase and an online phase;

[0006] The offline phase includes the generation and authentication of multiplication triples and the generation and authentication of random numbers;

[0007] The online phase includes processing input data, performing addition and multiplication operations, and outputting results.

[0008] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0009] 1. The method of the present invention fixes one of the participants as semi-honest and the other as potentially malicious. This method can not only resist malicious participants, but also has a lower implementation cost than existing secure two-party computation schemes.

[0010] 2. The method of this invention is more in line with real-world scenarios and can be widely applied to privacy computing, such as privacy-preserving online inference. It can greatly reduce the overhead of privacy protection, enhance data availability, and improve the practicality of secure multi-party computation schemes. Attached Figure Description

[0011] Figure 1 This is a flowchart of the method of the present invention;

[0012] Figure 2 This is a schematic diagram of an online inference scenario in an embodiment. Detailed Implementation

[0013] like Figure 1 As shown, this invention provides a secure two-party computation method under an asymmetric trust model, comprising a semi-honest participant Alice and a malicious participant Bob; the secure two-party computation method includes an offline phase and an online phase;

[0014] The offline phase includes the generation and authentication of multiplication triples and the generation and authentication of random numbers;

[0015] The online phase includes processing input data, performing addition and multiplication operations, and outputting results.

[0016] In this embodiment, Π is used [·] The protocol performs data authentication; Π [·] The agreement is as follows:

[0017] Under the asymmetric trust model, Alice possesses the complete authentication key α. Therefore, the data owned by Alice is authenticated locally, and then the authenticated share is sent to Bob.

[0018] For the data that Bob possesses, authentication via the COPE protocol is required. The specific process is as follows:

[0019] Π [xA] →((mx A ) A , (mx A ) B ), x A This represents Alice's data; Alice calculates mx. A =α·x A and mx A Sharing the secrets of addition mx A =(mx A) A +(mx A ) B Then Alice will (mx A ) B Send to Bob; where mx A Indicates x A The value obtained after authentication; (mx A ) A and (mx) A ) B It is mx A The share obtained after sharing;

[0020] ∏ [xB] →((mx B ) A , (mx B ) B ), x B This represents Bob's data; Bob and Alice execute the COPE protocol, and finally Alice receives (mx) B ) A Bob will get (mx) B ) B And (mx B ) A +(mx B ) B =α·x B =mx B , where mx B Indicates x B The value obtained after authentication, (mx B ) A and (mx) B ) B It's mx B Two additive shares; for Bob's multiple inputs, COPE.Initialize only needs to be executed once when executing the COPE protocol.

[0021] COPE (correlated oblivious product evaluation) is a two-party computation protocol. Assume the two participants are A and B, where A's input is Δ and B's input is x. Assume the bit length of Δ is k, and A's input Δ remains unchanged throughout the protocol execution. At the end of the protocol, A and B each receive a share of Δ·x. COPE consists of two phases: an initialization phase and an expansion phase. The initialization phase only needs to be executed once, while the expansion phase can be executed multiple times depending on the value of x. The initialization phase utilizes the OT protocol, and the expansion phase utilizes the pseudo-random function PRF. Specifically, the steps include: step (1) is the initialization COPE.Initialize, which is executed only once; and steps (2) to (6) are the extension phase COPE.Extend, which can be executed multiple times.

[0022] (1) B selects k seed pairs The bit length of each seed is λ. A and B then run the OT protocol k times. In the i-th OT, B acts as the sender, and its input is... A, as the receiver, has Δ as its input. i , where Δ i This indicates that after decomposing the Δ-bit, the i-th bit will be obtained by A.

[0023] (2) B uses PRF to expand the seed to obtain Where j represents the number of times the expansion phase is executed; similarly, A calculates...

[0024] (3) B calculation Then put u i Send to A;

[0025] (4) A calculation

[0026] (5) After k calculations, A will obtain q = (q 1 , ..., g k B will get Furthermore, q and t satisfy the following relationship: q = t + x·Δ;

[0027] (6) A calculates and outputs the vector inner product q =<g,q> B calculates and outputs the vector inner product t = -<g,t> g = (2 0 ,2 1 , ..., 2 k ), q and t satisfy the following relationship: q+t=x·Δ.

[0028] Oblivious transfer (OT) is a secure two-party computation protocol involving a sender and a receiver. The sender's inputs are m0 and m1, and the receiver's input is a single bit b, where b = 0 or b = 1. When b = 0, it indicates that the receiver will receive message m0 after OT ends; otherwise, it receives m1. Throughout the OT process, it is crucial to protect both the receiver's privacy input (ensuring the sender is unaware of the specific value of b) and the receiver's privacy input (ensuring the receiver only receives message m). bThe specific value of the other message is unknown. This invention employs an OT constructed based on the DDH assumption and the key derivation function KDF, specifically including the following steps:

[0029] (1) The Receiver receives data from a finite field. Randomly select α as the exponent α←Z q From the group Randomly select an element h from the data, and then calculate (h) when b = 0. 0 h 1 )=(g α , h), otherwise (h) 0 h 1 )=(h,g α ), Receiver will (h 0 h 1 ) is sent to Sender, where g is the group Generators;

[0030] (2) Sender randomly selects elements Then calculate u = g r , (k 0 k 1 )=((h 0 ) r , (h 1 ) r Next, encrypt messages m0 and m1 respectively: Finally, u, c0, and c1 are sent to the Receiver;

[0031] (3) Receiver calculates k locally b =u α Then use k b Calculate the message

[0032] Using Π triple The protocol generates and authenticates multiplication triples, Π triple The protocol consists of three phases: the first phase uses the ROT protocol to generate uncertified generated multiplication triples; the second phase uses the certified protocol Π. [.] The multiplication triples are certified, and the correctness of the multiplication triples is verified in the third stage.

[0033] Π triple The first phase of the agreement is as follows:

[0034] The ROT protocol is used to generate unauthenticated multiplication triples. Throughout the execution of the ROT protocol, Alice, the honest party, is always the sender, and Bob is the receiver. The first phase generates two sets of associated multiplication triples. The inputs are the shares of a and b, and the outputs are the share of c and the share of another pair of multiplication triples, satisfying a·b = c. The specific process is as follows:

[0035] S1, Alice locally selects shares a and b, denoted as a A ←F, b A ←F, where F is a finite field. Bob performs the same operation, and Alice eventually has a A and b A Bob owns a B and b B , respectively satisfying a A +a B =a,b A +b B =b;

[0036] S2, Alice, and Bob execute the ROT protocol λ times, where λ represents the bit length of each element in F. In each execution, Alice is the sender, and Bob is the receiver. Bob's input in the i-th ROT protocol execution is... Indicates that b B Represent the i-th bit in binary; after the ROT protocol ends, Alice has λ random number pairs. Bob got

[0037] S3, Alice handles each random pair calculate Then d i Send to Bob; in each calculation of d i Use the same 'a' at all times A Otherwise, it is necessary to repeat step S2 τ times to ensure the data b B Confidentiality;

[0038] S4, Bob's local calculation Simplify to get In the end, Alice had... Bob has t = (t1, ..., t2) λ );

[0039] S5. Alice calculates the dot product of vectors k and g to obtain q =<g,k> g = (2 0 ,2 1 , ..., 2 λ-1 Bob calculates t = -<g,t> q and t satisfy the relation q + t = aA ·b B ;

[0040] S6. Alice and Bob repeat step S2. Bob's input at this point is... Indicates that a B Represent the i-th bit in binary; then repeat steps S3, S4, and S5. In step S3, Alice uses b A Calculate d i In step S4, Bob uses Calculate t i In the end, Alice got b A ·a B Bob gets a share q′, and he receives b. A ·a B Another share t′ satisfies q′+t′=b A ·a B ;

[0041] S7, Alice calculates c A =a A ·b A Bob calculates c +q+q′. B =a B ·b B +t+t′,c A and c B Satisfying relation c A +c B =c=a·b;

[0042] S8. Alice selects two random numbers r and r′ from the finite field F and sends r and r′ to Bob;

[0043] S9, Alice calculates a A =r·a A c A =r·c A d A =r′·a A e A =b A f A =r′·c A Bob calculates a B =r·a B c B =r·c B d B =r′·a B e B =b B f A =r′·c B ;

[0044] S10, Alice, and Bob each have a share of two multiplicative triples (a, b, c) and (d, e, f), respectively, where b = e. Alice has a share of (a, b, c) and (d, e, f). A b A c A ) and (d A e A f A Bob owns (a B b B c B ) and (d B e B f B ), respectively satisfying the following relations: a A +a B =a,b A +b B =b,c A +c B =c,d A +d B =d,e A +e B =e,f A +f B =f.

[0045] ROT (Random Oblivious Transfer) is a secure two-party computation protocol involving a sender and a receiver. The sender's input is m0 and m1, where m0 and m1 are randomly selected numbers. The receiver's input is a single bit b, where b = 0 or b = 1. When b = 0, it indicates that the receiver will receive the corresponding message m0 after OT ends; otherwise, it receives m1. The biggest difference between ROT and OT is that in ROT, the sender's input is two random numbers, while the construction of both is the same.

[0046] Π triple The second phase of the agreement is as follows:

[0047] After generating unauthenticated multiplication triples, the protocol ∏ is invoked. [·] Authentication of multiplication triples;

[0048] Alice owns (a A b A c A ) and (d A e A f A Bob owns (a B b Bc B ) and (d B e B f B ), satisfying (a A +a B )·(b A +b B ) = c A +c B , (d A +d B )·(e A +e B )=f A +f B Alice and Bob each need to authenticate the data they possess, as detailed below:

[0049] Regarding the data Alice possesses... A After certification, Alice receives the certified share (ma A ) A Bob's share after obtaining certification (ma A ) B ;

[0050] Regarding Alice's data b A Perform authentication;

[0051] Regarding the data c that Alice possesses A Perform authentication;

[0052] Bob has data a B Perform authentication;

[0053] Bob has data b B Perform authentication;

[0054] Bob has data c B Perform authentication;

[0055] Alice calculates locally (ma) A =(ma A ) A +(ma B ) A , (mb) A =(mb A ) A +(mb B ) A (mc) A =(mcA ) A +(mc B ) A Bob calculates locally (ma) B =(ma A ) B +(ma B ) B , (mb) B =(mb A ) B +(mb B ) B (mc) B =(mc A ) B +(mc B ) B , satisfy (ma) A +(ma) B =α·a, (mb) A +(mb) B =α·b, (mc) A +(mc) B =α·c; where ma, mb, and mc represent the values ​​after authentication for a, b, and c, respectively; the same method is used to authenticate the triple (d, e, f);

[0056] After authentication, Alice's final share is represented as (a A b A c A ,(ma) A , (mb) A (mc) A ) and (d A e A f A (md) A , (me) A (mf) A Bob's final share is expressed as (a B b B c B ,(ma) B , (mb) B (mc) B ) and (d B e B f B (md) B , (me) B (mf) B ).

[0057] Π triple The third phase of the agreement specifically includes:

[0058] To verify the correctness of the multiplication triplet, use another multiplication triplet for verification;

[0059] Suppose we have two multiplicative triples (a, b, c, ma, mb, mc) and (d, e, f, md, me, mf), Alice has (a... A b A c A ,(ma) A , (mb) A (mc) A ) and (d A e A f A (md) A , (me) A (mf) A Bob owns (a B b B c B ,(ma) B , (mb) B (mc) B ) and (d B e B f B (md) B , (me) B (mf) B The verification process is as follows:

[0060] Alice selects a random number s from a finite field F and sends s to Bob;

[0061] Bob calculates ρ B =s·a B -d B , (mρ) B =s·(ma) B -(md) B Then put ρ B and (mρ) B Send to Alice;

[0062] Alice calculates ρ A =s·a A -d A and (mρ) A =s·(ma) A -(md) A Then reconstruct ρ = ρ A +ρ B , mρ=(mρ) A +(mρ) B Then send ρ and mρ to Bob;

[0063] Bob calculates σ B =s·c B -f B -b B ·ρ and (mσ) B =s·(mc) B -(mf) B -(mb) B ·ρ, then σ B and (mσ) B Send to Alice;

[0064] Alice also calculates a. A =s·c A -f A -b A ·ρ and (mσ) A =s·(mc) A -(mf) A -(mb) A ·ρ, then reconstruct σ=σ A +σ B , mσ=(mσ) A +(mσ) B Finally, check if σ and mσ are both equal to 0. If σ and mσ are both equal to 0, it means that the multiplication triples (a, b, c, ma, mb, mc) and (d, e, f, md, me, mf) are correct. Keep one of the multiplication triples. Otherwise, discard both multiplication triples.

[0065] Using π rand The protocol generates and authenticates random numbers. These random numbers are used in the online phase to assist Alice and Bob in sharing and authenticating their respective inputs. At this time, Alice and Bob need to know the complete random number and authenticate and share it.

[0066] Since Alice is semi-honest and Bob is malicious, random numbers and authentication sharing are generated separately for Alice and Bob, respectively. The specific process is as follows:

[0067] If Alice needs to know the complete random number r, then Alice should select the random number r locally and then call the authentication protocol ∏. [·] Authentication of r generates two shares (mr). A and (mr) B Then, add r and share the secret: r = r A +r B and r B Send to Bob; finally Alice owns (r, r A (mr) ABob owns (r B (mr) B );

[0068] If Bob needs to know the complete random number r, the specific process is as follows:

[0069] Bob locally selects a random number r, adds r, and secretly shares the result: r = r A +r B Then put r A Send to Alice;

[0070] Alice's local share r A To perform authentication, i.e., to calculate MR A =α·r A The value;

[0071] Alice and Bob invoke the authentication protocol. [·] Bob's share r B After the authentication process, Alice received α·r. B A share (mr) B ) A Bob got (mr) B ) B , satisfying (mr B ) A +(mr B ) B =mr B ;

[0072] Alice calculates (mr) A =mr A +(mr B ) A Bob calculates (mr) B =(mr B ) B , satisfying (mr) A +(mr) B =α·r, and finally Alice and Bob completed the sharing of the random number r and the authenticated mr. Alice owns (r A ,mr A Bob owns (r, r) B ,mr B ), satisfying α·(r A +r B ) = mr A +mr B .

[0073] Π [·] The agreement also includes:

[0074] After authenticating the multiplication triples and the random number, the values ​​generated during the authentication process are verified to ensure that both parties receive the correct authentication share. Specifically:

[0075] Alice and Bob each choose a share of a random number locally, and Alice has x shares. 0,A Bob has x 0,B , where x0 = x 0,A +x 0,B Then, the authentication protocol is called respectively. [·] For x 0,A x 0,B After authentication, Alice finally has x 0,A and (mx0) A Bob has x 0,B and (mx0) B x0 is used to blind the data that needs to be verified and does not participate in the calculation in the online phase;

[0076] Assume the authenticated values ​​are: x0, x1, x2, ..., x h Since these values ​​exist as shares between the two parties, Alice owns x. 0,A x 1,A x 2，A , ..., x h,A And their certification share (mx0) A (mx0) A (mx1) A (mx2) A , ..., (mx h ) A Similarly, Bob owns x 0，B x 1，B x 2，B , ..., x h,B and (mx0) B (mx1) B (mx2) B , ..., (mx h ) B Determine whether these values ​​satisfy the relation mx by using a linear combination method. i =α·x i Let i = 0, ..., h. The specific process is as follows:

[0077] Alice selects h+1 random numbers r0, r1, r2, ..., r h Then these values ​​are sent to Bob;

[0078] After Bob receives the random number, he calculates... and Then put y B and mB Send to Alice;

[0079] Alice calculates and Then determine α·(y A +y B )-(m A +m B Does it equal 0? If it equals 0, it means that for x1, x2, ..., x... h If the value is correctly certified, meaning both parties have received the correct certified share, then the agreement is terminated.

[0080] During the online phase, according to Π input The protocol processes the input data, Π input The agreement is as follows:

[0081] For Alice's input x, a random number r is used for sharing, and the specific process is as follows:

[0082] Alice uses the random number r generated during the offline phase to calculate x′=xr, and sends x′ to Bob;

[0083] Alice calculates x A =x′+r A Bob calculates x B =x′+r B , satisfying x A +x B =x;

[0084] Alice calculates mx A =α·x′+mr A Bob calculates mx B =mr B Satisfying mx A +mx B =α·x

[0085] Finally, the sharing and authentication of x were completed, and Alice now owns (x). A ,mx A Bob owns (x) B mx B ), and satisfy α·(x A +x B )=mx A +mx B ;

[0086] The same process is applied to Bob's input.

[0087] During the online phase, according to Π aaa The protocol performs addition operations, Π addThe agreement is as follows:

[0088] Alice has x A and y A Bob owns x B and y B , where x = x A +x B y = y A +y B Alice and Bob each add their own shares locally to get a share of x + y, that is, Alice calculates z. A =x A +y A mz A =mx A +my A Bob calculates z B =x B +y B mz B =mx B +my B , satisfying z A +z B =x+y,mz A +mz B =α·(x+y);

[0089] During the online phase, according to Π mul The protocol performs multiplication, Π mul The agreement is as follows:

[0090] Alice has x A and y A Bob owns x B and y B , where x = x A +x B y = y A +y B The value of x·y is calculated using a multiplication triple (a, b, c, ma, mb, mc). The specific process is as follows:

[0091] Alice calculates e A =x A -a A f A =y A -b A Bob calculates e B =x B -a B f B =y B -b B Then Alice put e A fA Send it to Bob, Bob puts e B f B Send to Alice;

[0092] Alice and Bob reconstruct e and f, and calculate e = e A +e B f = f A +f B ;

[0093] Alice calculates z A =e·f+e·b A +f·a A +c A Bob calculates z B =e·b B +f·a B +c B , satisfying z A +z B = x·y.

[0094] The specific output of the results during the online phase is as follows:

[0095] After all addition and multiplication operations have been performed, the values ​​opened during the multiplication operation are verified.

[0096] Assuming the value to be opened is x, we determine whether x is correct by verifying whether mx and x satisfy the relationship mx = α·x, that is, by checking whether mx - α·x equals 0. If it equals 0, it means that the opened x is a previously authenticated value, i.e., it is correct; otherwise, x is an incorrect value. Here, α is the authentication key, and mx is the value generated after authenticating x.

[0097] Assume a total of n multiplication operations were performed, and a total of 2n numbers {e} were exposed. i f i}, i∈[n], need to verify e i f i Is this correct? Alice possesses {(me i ) A ,(mf i ) A}, i∈n, Bob owns {(me i ) B ,(mf i ) B , i∈[n], e is generated by random numbers i f i Perform a linear combination and then verify it. The process is as follows:

[0098] Alice randomly selects 2n random numbers {r} i, r′ i}, i∈[n], then {r i , r′ i Send it to Bob;

[0099] Bob local calculation Then send mB to Alice;

[0100] Alice calculates Then calculate and determine m = m A +m B Check if it equals 0. If not, terminate the protocol; otherwise, execute the output.

[0101] When the verification passes, Alice and Bob exchange the final result shares and reconstruct the calculation result.

[0102] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0103] Example

[0104] In online inference scenarios, there are two entities: one is the service provider, i.e., a company with abundant resources and a locally trained model; the other is the service requester, i.e., a company that lacks the resources to train a model locally and wants to purchase model prediction services from a similar company. For example... Figure 2 As shown in this embodiment, it is assumed that there are two companies, A and B. Company A is the service provider and company B is the service requester. Company B uses the model that company A has already trained to make predictions. During the prediction process, it is necessary to protect the privacy data of both parties. The secure two-party computation method under the asymmetric trust model proposed in this invention is used for online inference.

[0105] The reasoning process mainly includes an offline stage and an online stage, as detailed below:

[0106] Offline Phase: The offline phase is primarily responsible for generating and authenticating the random number r, and generating and authenticating the multiplication triples (a, b, c). The number of random numbers r and the number of multiplication triples (a, b, c) are determined by the model owned by Company A. When generating random numbers r, Company A and Company B call Π rand The agreement stipulates that upon completion, each party will possess a share of `r` and a share of the value `mr` generated by authenticating `r`, with one party holding the complete `r` for sharing the input. When generating the multiplication triple (a, b, c), company A and company B call Π. triple The agreement stipulates that upon completion, each party will have a share of the multiplicative triple (a, b, c) and a share of the certified value (ma, mb, mc).

[0107] Online Phase: The online phase is primarily responsible for model calculations. Company A and Company B first call Π input The protocol shares and authenticates its inputs, then begins calculations based on the model's description. If addition is encountered, company A and company B execute Π. add If the protocol involves multiplication, then Π is executed. mul Protocol. Before reconstructing the calculation results, the calculation process needs to be verified. If the verification passes, it means that there was no malicious behavior during the execution of the protocol, and the output reconstruction is performed; otherwise, the protocol is terminated.

[0108] Finally, Company A sends its share of the results to Company B, which can then reconstruct the results locally to obtain the complete inference results.

[0109] This invention's method is combined with existing secure multi-party computation protocols that are resistant to malicious adversaries. Compared to SPDZ proposed by Keller et al., MASCOT proposed by Keller et al., and LowGear proposed by Keller et al., the main advantage of this invention is its low overhead and high efficiency in resisting malicious adversaries. SPDZ mainly uses the finite-time homomorphic encryption scheme BGV to construct a secure multi-party computation protocol. Because computation is performed on ciphertext, and zero-knowledge proofs are needed to ensure the correctness of the ciphertext, the overhead is high. LowGear utilizes the additive homomorphic property of the BGV homomorphic encryption scheme and zero-knowledge proofs to construct a secure multi-party computation protocol resistant to malicious adversaries, and its efficiency is higher than SPDZ. MASCOT uses COPE to construct an authentication protocol and ROT to generate multiplication triples, random numbers, and authentication, avoiding the use of homomorphic encryption schemes and zero-knowledge proofs, thus improving efficiency to a certain extent. Since both this invention and MASCOT use COPE and ROT technologies, the overhead of this invention and MASCOT is compared from the perspective of the number of protocol calls. The comparison results are shown in Table 1 below.

[0110] MASCOT This invention <![CDATA[Π rand Generate a random number r]]> <![CDATA[2n [·] ]]> <![CDATA[1∏ [·] ]]> <![CDATA[n triple Generate a multiplication triple (a, b, c) <![CDATA[6n [·] ]]> <![CDATA[3n [·] ]]>

[0111] Table 1

[0112] This invention is constructed under an asymmetric trust model. It assumes Alice is semi-honest and possesses the complete authentication key α. Therefore, Alice's data can be authenticated locally before being shared. Thus, the authentication protocol Π... [·] The number of calls is halved compared to MASCOT. Furthermore, when generating multiplication triples, MASCOT requires repeating the ROT protocol τ times to ensure data confidentiality, while this invention can guarantee data confidentiality by using a fixed, semi-honest Alice as the sender. Therefore, this invention has lower overhead and higher efficiency than MASCOT.

[0113] It should also be noted that, in this specification, terms such as "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0114] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure two-party computation method under an asymmetric trust model, characterized in that, It includes a semi-honest participant, Alice, and a malicious participant, Bob; the secure two-party computation method includes offline and online phases; The offline phase includes the generation and authentication of multiplication triples and the generation and authentication of random numbers; The online phase includes processing input data, performing addition and multiplication operations, and outputting results. During the online phase, according to The protocol processes the input data. The agreement is as follows: For Alice's input x, use a random number... The sharing process is as follows: Alice uses random numbers generated during the offline phase. calculate and will Send to Bob; Alice calculates Bob calculates ,satisfy ; Alice calculates Bob calculates ,satisfy Finally, the sharing and verification of x were completed, and Alice now possesses... , Bob owns , and satisfy ; The same process is applied to Bob's input; During the online phase, according to The protocol performs addition operations. The agreement is as follows: Alice owns and Bob owns and ,in, , Alice and Bob added their respective shares together locally to get... The share, i.e., Alice's calculation , Bob calculates , ,satisfy , ; During the online phase, according to The protocol performs multiplication operations. The agreement is as follows: Alice owns and Bob owns and ,in, , Using a multiplication triple calculate The value is determined through the following process: Alice calculates , Bob calculates , Then Alice put Send it to Bob, Bob will Send to Alice; Alice and Bob reconstructed and ,calculate ; Alice calculates Bob calculates ,satisfy .

2. The secure two-party computation method under an asymmetric trust model according to claim 1, characterized in that, use The protocol performs data authentication; The agreement is as follows: Under the asymmetric trust model, Alice possesses the complete authentication key. Therefore, Alice's data is authenticated locally, and then the authenticated share is sent to Bob. The data owned by Bob is authenticated using the COPE protocol, and the specific process is as follows: Represents Alice's data; Alice's calculations and will Sharing the secrets of addition Then Alice will Send to Bob; where, Indicates to The value obtained after authentication; and It is The share obtained after sharing; Represents Bob's data; Bob and Alice execute... The agreement, in the end Alice received Bob got ,and ,in Indicates to The value obtained after authentication and yes The two additive shares.

3. The secure two-party computation method under an asymmetric trust model according to claim 2, characterized in that, use The protocol generates and authenticates multiplication triples. The protocol consists of three phases: the first phase uses the ROT protocol to generate uncertified multiplication triples, and the second phase uses a certification protocol. The third stage verifies the correctness of the multiplication triples; The first phase specifically includes: The ROT protocol is used to generate unauthenticated multiplication triples. Throughout the execution of the ROT protocol, Alice, the honest party, is always the sender, and Bob is the receiver. The first stage generates two sets of associated multiplication triples, with the input being... and The share, output as The share of the other pair of multiplicative triples and the share of the other pair of multiplicative triples satisfy the following conditions: The specific process is as follows: S1, Alice Local Selection and The share, expressed as , ,in It is a finite field. Bob performs the same operation, and in the end Alice owns... and Bob owns and respectively satisfy , ; S2, Alice, and Bob execute The next ROT protocol, in which express The bit length of each element in the sequence is given. In each execution, Alice is the sender and Bob is the receiver; in the nth... Bob's input during the execution of the ROT protocol is , Indicates will Represent the i-th bit in binary; Alice owns the following after the ROT protocol ends. a random number pair Bob got ; S3, Alice handles each random pair calculate Then Send to Bob; in each calculation Use the same time ; S4, Bob's local calculation Simplifying, we get In the end, Alice got... Bob got ; S5, Alice calculates vectors sum vector The inner product is obtained , Bob calculates , q and Satisfying Relationships ; S6. Alice and Bob repeat step S2. Bob's input at this point is... , Indicates will Represent the i-th bit in binary; Steps S3, S4, and S5 are executed sequentially. In step S3, Alice uses... calculate In step S4, Bob uses calculate In the end, Alice got A share Bob got Another share ,satisfy ; S7, Alice Calculation Bob calculates , and Satisfying Relationships ; S8, Alice from a finite field Select two random numbers and and will and Send to Bob; S9, Alice Calculation , , , Bob calculates , , , ; S10, Alice, and Bob each have two multiplication triples. and The share of these two multiplicative triples satisfies Alice owns and Bob owns and They respectively satisfy the following relations: , , , , , .

4. The secure two-party computation method under an asymmetric trust model according to claim 3, characterized in that, The second phase specifically includes: After generating unauthenticated multiplication triples, the protocol is invoked. Authentication of multiplication triples; Alice owns and Bob owns and ,satisfy , Alice and Bob each need to authenticate the data they possess, as detailed below: Data owned by Alice After certification, Alice receives the certified share. Bob's share after obtaining certification ; Data owned by Alice Perform authentication; Data owned by Alice Perform authentication; Data owned by Bob Perform authentication; Data owned by Bob Perform authentication; Data owned by Bob Perform authentication; Alice Local Calculation , , Bob's local calculation , , ,satisfy , ;in , , They represent respectively to The value after authentication; for triples The same method should be used for authentication; After authentication, Alice's final share is represented as and Bob's final share is expressed as and .

5. The secure two-party computation method under an asymmetric trust model according to claim 4, characterized in that, The third stage specifically includes: To verify the correctness of the multiplication triples, the specific steps are as follows: Suppose there are two multiplication triples and Alice has and Bob owns and The verification process is as follows: Alice from a finite field Choose a random number and will Send to Bob; Bob Calculation , and will and Send to Alice; Alice calculates and Then reconstruct , Then and Send to Bob; Bob Calculation and ,Will and Send to Alice; Alice also calculates and Then reconstruct , Final judgment and Are they all equal to 0? If and All equal to 0, indicating a multiplication triple. and That's correct. Keep one of the multiplication triplets; otherwise, discard both multiplication triplets.

6. The secure two-party computation method under an asymmetric trust model according to claim 3, characterized in that, use The protocol generates and authenticates random numbers. These random numbers are used in the online phase to assist Alice and Bob in sharing and authenticating their respective inputs. At this time, Alice and Bob need to know the complete random number and authenticate and share it. Random numbers were generated and authentication sharing was performed separately for Alice and Bob, as follows: If it's Alice, she needs to know the complete random number. Then let Alice choose a random number locally. Then call the authentication protocol. right The certification process generates two shares. and Next Sharing the secrets of addition And Send it to Bob; Alice ultimately owns it. Bob owns ; If it's Bob, he needs to know the complete random number. The specific process is as follows: Bob selects a random number locally. and will Sharing the secrets of addition , and then Send to Alice; Alice's local share To perform authentication, i.e., to calculate The value; Alice and Bob invoked the authentication protocol. Bob's share After the authentication process was completed, Alice received... A share Bob got ,satisfy ; Alice calculates Bob calculates ,satisfy Finally, Alice and Bob completed the random number generation process. and after certification Alice has shared her knowledge. Bob owns ,satisfy .

7. A secure two-party computation method under an asymmetric trust model according to claim 6, characterized in that, The agreement also includes: After authenticating the multiplication triples and the random number, the values ​​generated during the authentication process are verified to ensure that both parties receive the correct authentication share. Specifically: Alice and Bob each choose a share of a random number locally, and Alice has... Bob has ,in Then call the authentication protocol respectively. right After authentication, Alice finally has and Bob has and , The data used for blinding verification is not included in the online phase of the calculation; Assuming the authenticated values ​​are Since these values ​​exist in the form of shares between the two parties, Alice owns... and their certification share The same Bob has and Determine whether these values ​​satisfy the relation by using a linear combination method. The specific process is as follows: Alice selects random numbers Then these values ​​are sent to Bob; After Bob receives the random number, he calculates... and , and then and Send to Alice; Alice calculates and Then judge Does it equal 0? If it equals 0, it means it is correct. If the value is correctly certified, meaning both parties have received the correct certified share, then the agreement is terminated.

8. The secure two-party computation method under an asymmetric trust model according to claim 1, characterized in that, During the online phase, the results output is specifically as follows: After all addition and multiplication operations have been performed, the values ​​opened during the multiplication operation are verified. Assuming the value is , through verification and Does the relationship satisfy? To judge Whether it is correct, i.e., judgment Is it equal to 0? If it is equal to 0, it means it's open. It is a previously verified value, i.e., correct; otherwise... It is an incorrect value; among which, It is the authentication key. Yes The value generated after authentication; Assuming a total of The total number of multiplication operations disclosed is [number missing]. Number Verification is required. Is this correct? Alice possesses... Bob owns By using random numbers Perform a linear combination and then verify it. The process is as follows: Alice randomly selects random numbers Then Send to Bob; Bob's local calculations Then Send to Alice; Alice calculates Then calculate and judge Check if it equals 0; if not, terminate the protocol; otherwise, execute the output. When the verification passes, Alice and Bob exchange the final result shares and reconstruct the calculation result.

Images