Method and apparatus for multi-party secure computation

Abstract

Embodiments of the present specification provide a method and device for multi-party secure computation. In the method, any first party locally calculates the sum of the cross products of the respective first and second number slices of the first and second data, to obtain a first target sum value, wherein the first number is different from the second number. A random number shared by the second party and the third party is obtained, the second party also holds the first and second number slices, and the third party holds one of the first and second number slices. The first target sum value and the random number are operated to obtain a first target slice. Three local slices of the first target sum value are obtained based on the first target slice, the random number and 0. According to the agreement with the second party, the second party respectively sends the slice data of the first target slice to the fourth party, so that the fourth party obtains three corresponding slices based on the first target slice.

Description

Technical Field

[0001] This specification relates to the field of security technology, and in particular to a method and apparatus for multi-party secure computation. Background Technology

[0002] Secure Multi-Party Computation (MPC), also known as secure multi-party computation, enables untrusted parties to perform joint computations without disclosing their own data. Compared to other privacy-preserving computation technologies, it has higher computational efficiency and more universal data privacy protection capabilities.

[0003] Secure multi-party computation can be achieved based on techniques such as homomorphic encryption and secret sharing. Secret sharing techniques include various variants and branches, such as additive secret sharing, Shamir threshold sharing, replicated secret sharing, and function secret sharing. Replicated secret sharing, while sacrificing a small amount of security (theoretically, the higher the threshold, the more secure), can significantly reduce offline and online computation and is computationally simple. However, the communication complexity of replicated secret sharing increases with the number of participants. Therefore, how to utilize replicated secret sharing techniques for efficient secure multi-party computation becomes a problem to be solved. Summary of the Invention

[0004] This specification describes one or more embodiments of a method and apparatus for multi-party secure computation, which can improve the computational efficiency of multi-party secure computation.

[0005] According to a first aspect, a method for secure multi-party computation is provided for performing secure multiplication on first and second data; each of the first and second data is split into four fragments and distributed to four participating parties in a replicated secret-sharing manner; the method is executed by any first party among the four participating parties, the first party having a number i, and holding three of the four fragments of the first and second data excluding the fragment numbered i; the method includes:

[0006] The first target sum is obtained by locally calculating the sum of the cross products of the first and second numbered fragments of the first and second data, respectively; where the first number is different from the second number.

[0007] Obtain random numbers shared with a second party and a third party; wherein the second party also holds the first numbered fragment and the second numbered fragment, and the third party holds one of the first numbered fragment and the second numbered fragment;

[0008] The first target sum and the random number are processed to obtain a first target slice; based on the first target slice, the random number and 0, three local slices of the first target sum are obtained;

[0009] According to the agreement with the second party, each party sends the fragmentation data of the first target fragment to the fourth party, so that the fourth party obtains three corresponding fragments based on the first target fragment.

[0010] According to a second aspect, an apparatus for secure multi-party computation is provided for performing secure multiplication on first and second data; each of the first and second data is divided into four fragments and distributed to four participating parties in a replicated secret-sharing manner; the apparatus is located at any of the four participating parties, the first party having a number i, and holding three of the four fragments of the first and second data excluding the fragment number i; the apparatus includes:

[0011] The calculation unit is used to locally calculate the sum of the cross products of the first numbered fragments and the second numbered fragments of the first data and the second data, respectively, to obtain a first target sum value; wherein the first number is different from the second number;

[0012] An acquisition unit is used to acquire random numbers shared with a second party and a third party; wherein the second party also holds the first numbered fragment and the second numbered fragment, and the third party holds one of the first numbered fragment and the second numbered fragment;

[0013] The calculation unit is further configured to perform calculations on the first target sum and the random number to obtain a first target slice; and to obtain three local slices of the first target sum based on the first target slice, the random number, and 0.

[0014] The sending unit is configured to send the fragment data of the first target fragment to the fourth party according to the agreement with the second party, so that the fourth party obtains three corresponding fragments based on the first target fragment.

[0015] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0016] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of the first aspect.

[0017] The multi-party secure computation method provided in one or more embodiments of this specification allows for the local computation of three fragments of any first party among the four parties when four parties jointly perform a secure multiplication operation based on replication and secret sharing. This first party can calculate the sum of the cross-products of two different numbered fragments of the first and second data it holds. Furthermore, it can provide the corresponding fragment data to the other parties, thereby enabling the other parties to obtain three corresponding fragments. This significantly reduces the amount of communication during the online phase and improves the efficiency of multi-party secure computation. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;

[0020] Figure 2a A schematic diagram illustrating the calculation process of the product of non-cross terms is shown;

[0021] Figure 2b A schematic diagram illustrating the calculation process of the sum of the products of a pair of cross terms is shown.

[0022] Figure 3 This diagram illustrates an interaction of a method for secure multi-party computation according to one embodiment.

[0023] Figure 4 This diagram illustrates a data validation process in one example.

[0024] Figure 5 A schematic diagram illustrating the method of multi-party secure computation is shown.

[0025] Figure 6 A schematic diagram of a multi-party secure computation device is shown. Detailed Implementation

[0026] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0027] Multi-party computation (MPC) is typically based on the MPC protocol, whose security is defined using a reality-ideal paradigm. Here, the real world represents the actual execution of the protocol (with an adversary A), while the ideal world assumes a simulator S simulating the protocol's execution (without an adversary A). In simpler terms, simulator S executes the protocol according to its flow. Since the ideal world represents an idealized execution of the protocol, no private information is leaked; that is, the information obtained by simulator S does not include private information. If the computation from simulator S's perspective is indistinguishable from the computation from adversary A's perspective in the real world, then the information obtained by adversary A and the information obtained by the simulator are also indistinguishable. In other words, the information obtained by adversary A also does not include private information, therefore adversary A's attack is ineffective, and the protocol is secure.

[0028] The security of the aforementioned MPC protocol can be divided into perfect security and computational security. To facilitate the explanation of these two aspects, we will first introduce the definition of negligible functions.

[0029] If a function μ: N→[0, ∞] is negligible, then for any c∈N, there exists a κ. c ∈N, such that for any κ≥κ c For all polynomials p(X), μ(κ) ≤ κ - c is satisfied. If μ is negligible, for any polynomial p(X), there exists a κ. p(x) ∈N, such that for any κ≥κ p(x) For all adversaries Z and κ∈N, μ(κ)≤p(X) is satisfied. Based on the above concepts, perfect security and statistical security can be defined. Perfect security: If there exists a simulator S such that for any adversary Z and κ∈N, Pr[1←(Z)] is satisfied. Real (κ)]=Pr[1←(Z Ideal (κ)], from these two systems, we can obtain a larger system. Therefore, we can say that in the (F1, ..., Fl) hybrid model, this protocol ∏ perfectly and securely instantiates the function F. Computational security: For any adversary Z, if there exists a negligible function μZ(κ) that satisfies: |Pr[1←(Z)] Real (κ)]-Pr[1←(Z Ideal If )(κ)]|≤μZ(κ), then we can say that in the (F1, ..., Fl) mixture model, this protocol ∏ computationally securely instantiates the function F.

[0030] Furthermore, as mentioned above, the privacy and security of the MPC protocol are defined using a reality-ideal paradigm. In the ideal world, a given function is computed by a trusted third party that receives the privacy inputs from each participant and outputs the correct computation result. Therefore, the trusted third party also possesses another security property: it always returns the correct computation result to all participants, a property known as robustness or guaranteed output delivery. This leads to three related output security concepts: Robustness: In this scenario, regardless of the adversary's actions, all participants are guaranteed to receive the correct output. Fairness Security: In this scenario, even if the adversary's actions prevent honest participants from receiving the correct output, the adversary also learns no output information. Abort Security: In this scenario, two possible variations exist: In consistent abort security, all honest participants are guaranteed either to receive the correct output or to abort and receive nothing; in selective abort security, this security is weaker, as the adversary can choose which honest participants receive the correct output and which abort. Robustness can be further divided into two categories based on whether it can guarantee the privacy of input from honest participants: Traditional robustness: It can guarantee that all parties obtain correct output, but it cannot guarantee the privacy of input from honest participants. Privacy robustness: It guarantees that all parties obtain correct output while also guaranteeing the privacy of input from honest participants.

[0031] The following is an explanation of the adversaries mentioned above.

[0032] The adversary structure of a given protocol is defined as the set of possible participants that an adversary can disrupt. Clearly, it is a subset of the number of participants, *n*. The design goal of the MPC protocol is to securely resist disruptions from the adversary structure. Obviously, the type of adversary structure depends on the number of participants the adversary can corrupt, which is called the threshold. The adversary structure with a threshold of *t* is formally defined using 0 < *t* < *n*. That is, as long as the number of corrupted participants does not exceed *t*, the (t, n) secure multi-party computation protocol can guarantee the privacy of inputs and the correctness of outputs for each participant. Therefore, based on the range of *t*, the adversary structure with a threshold of *t* can be divided into three types: Honest Majority: In other words, the adversary can corrupt at most t < n / 2 participants. Dishonest majority: t < n, meaning the adversary can corrupt any participant except for one of them. In other words, t can take a maximum of n-1, which is the strongest security assumption.

[0033] Meanwhile, for secure multi-party computation to securely compute a given function, all parties must typically adhere to a protocol. Assume there exists a real-world adversary A that can corrupt some participants during protocol execution. The adversary's goal is to obtain the private input information of the other honest participants. (In a secure multi-party computation protocol, adversary A can be considered an external entity that can corrupt (corruption means making participants execute the adversary's instructions) several participants. Therefore, naturally, the adversary knows the private input information of corrupted participants but not the private input information of uncorrupted participants (i.e., honest participants). The adversary wants to know the inputs of these honest participants to gain an advantage.) Corrupted participants honestly follow the rules specified in the protocol, corresponding to the passive concept of a semi-honest corrupted participant. Corrupted participants obtain additional information by modifying the behavior of other corrupted participants during protocol execution or maliciously disrupt and suspend the protocol's execution, corresponding to the concepts of malice or initiative. Therefore, the participants in secure multi-party computation can be categorized as follows:

[0034] Honest Participant: An honest participant strictly adheres to the protocol flow and does not perform calculations or analyses to attempt to obtain information beyond what they should know. Passive / Semi-Honest Corrupted Participant: If a corrupted participant's behavior during protocol execution fully complies with the protocol rules, but they can perform calculations and analyses on inputs, outputs, and intermediate values ​​to attempt to obtain information beyond what they should know, then the corrupted participant is passive. Active / Malicious Corrupted Participant: If an adversary completely controls a corrupted participant, including arbitrarily deviating from their behavior during protocol execution—such as maliciously tampering with inputs, intermediate values, or other transmitted information to interfere with or deceive other participants—then the corrupted participant is active.

[0035] It should be noted that in the scenario where four parties in this scheme perform secure computation, an honest majority is generally required, in which case the number of malicious parties (hereinafter referred to as malicious parties) is at most 1. When the number of parties is greater than or equal to 5, the number of malicious parties is at most 2 (or more), and the design of the secret sharing protocol becomes more complex, with higher communication complexity.

[0036] The above provides a brief explanation of some concepts involved in secure multi-party computation. The following section describes the implementation methods of secure multi-party computation in traditional technologies.

[0037] Currently, cryptographic methods are a crucial category in the implementation of secure multi-party computation, and can be broadly categorized into the following types based on the methods used:

[0038] 1) Homomorphic encryption: A form of encrypted computation that allows computation to be performed in the ciphertext state of the data, with the result preserved in the ciphertext form. The output after decryption is the same as the result of computation in the plaintext state.

[0039] 2) Differential privacy: Privacy protection is achieved by adding noise to the dataset or statistical results, and distributed privacy computation is performed based on the de-identified results.

[0040] 3) Federated learning: As a special type of distributed learning, it uses non-sensitive data such as gradients and model parameters to complete distributed privacy computation.

[0041] Meanwhile, when using secure multi-party computation to perform computations involving a small number of four participants, in addition to secret sharing techniques, there are also obfuscated circuits and unintentional transmission techniques, which are described below:

[0042] 1) Obfuscated circuit technology: The data owner inputs their data into a secure computing circuit implemented with obfuscated circuit technology to perform machine learning calculations and obtain the desired output results.

[0043] 2) Accidental transmission technique: The message sender uses special cryptographic constructs to send a message to the receiver from some messages to be sent, but afterwards remains unaware of which message was sent.

[0044] However, all the methods mentioned above have their own drawbacks. For example, differential privacy methods cannot simultaneously guarantee strong security and high accuracy; excessive noise can negatively impact model accuracy. Homomorphic encryption methods are computationally expensive because the data volume is larger when represented in ciphertext than in plaintext. In federated learning methods, adversaries may be able to deduce some users' private data from their gradients and model parameters. Obfuscated circuit methods involve a large amount of communication between data owners; the online phase requires extensive interaction of obfuscation tables and other information, resulting in high overall communication costs and low computational efficiency. Unintentional transmission methods have relatively high computational overhead and are typically used in two-party environments; their complexity increases with the number of participants.

[0045] In view of the efficiency and security issues of the aforementioned methods for implementing secure multi-party computation, this proposal suggests a method for secure computation among four parties based on a replicated secret sharing mechanism. Specifically, the four parties can perform secure multiplication and secure addition operations based on a replicated secret sharing mechanism.

[0046] Regarding the definition of secret sharing through replication, assuming a given secret... Define [s] as a replicated secret sharing of s, where n secret shares (hereinafter also referred to as fragments) satisfy s = s1 + s2 + ... + s n Participant Pi holds shares {s1, s2, ..., s} j …s n ,j≠i}。Because each participant holds a share s j1≤j≤n, j≠i, lacking s i Therefore, no single participant can reconstruct the secret s, and any two parties can reconstruct the secret s.

[0047] In a scenario involving four parties in secure computation (referred to as secure four-party computation), there are secret shares s1, s2, s3, and s4. P1 has secret shares s2, s3, and s4, P2 has s1, s3, and s4, and so on. No single party has a complete set of secret shares (e.g., P1 only has secret shares s2, s3, and s4), therefore, the original secret value cannot be restored / reconstructed. However, any two parties hold all the secret shares and can reconstruct the secret s. For example, P1 has secret shares s2, s3, and s4, and P2 has s1, s3, and s4. P1 sends s2 to P2, and P2 sends s1 to P1. P1 and P2 then possess the complete set of s1, s2, s3, and s4, and can thus reconstruct the secret s.

[0048] It's worth noting that according to the definition of replicated secret sharing, assuming there are n participants, the secret share will be divided into n parts, meaning each participant will receive n-1 parts. For example, in a secure four-party computation, the secret 's' is divided into four parts: s1, s2, s3, and s4. P1 has three parts: s2, s3, and s4. Therefore, the more participants (the larger n is), the more parts each participant receives—n-1 parts. In other words, more secret parts also mean more complex computations and more communications. Therefore, replicated secret sharing is typically used when there are a small number of participants.

[0049] In a secure four-party scenario, the secret-sharing process among the four participants is based on a given secret. Define [s] as a replicated secret sharing of s, with 4 secret shares satisfying s = s1 + s2 + s3 + s4, and four participating parties P. i The shares held are: {(s2, s3, s4), (s1, s3, s4), (s1, s2, s4), (s1, s2, s3)}. In integer rings where secure multi-party computation is typically considered, the completeness of addition and multiplication can be proven. This scheme implements addition and multiplication operators on integer rings based on four-party replication and secret sharing of secret shares.

[0050] Furthermore, this scheme considers dynamic adversaries, meaning that the adversary dynamically selects corrupted participants to attack during protocol execution. Based on the number of times a participant has been a malicious party in historical protocol executions, it probabilistically eliminates the most likely malicious party. By increasing the probability of eliminating malicious parties, the probability of protocol termination is reduced, thus decreasing the computational complexity of the original method. Traditional multi-party secure computation methods generally consider static adversaries, meaning that the adversary determines the corrupted participants from the beginning of the protocol and this determination remains unchanged throughout the protocol execution. For example, in a secure four-party computation (P1, P2, P3, P4), adversary A corrupts participant P1. Then, P1 remains the only malicious party, while P2, P3, and P4 remain honest parties. However, until this malicious party is identified, P1, P2, P3, and P4 can all be malicious parties with equal probability.

[0051] When considering dynamic adversaries, the corrupted participants in this scheme change during protocol execution. For example, in the secure four-party computation (P1, P2, P3, P4), adversary A corrupts participants P1, P2, P3, and P4 as honest participants when calculating f(x); and corrupts participant P2 when calculating h(y), at which point P1, P3, and P4 are honest participants. Before this malicious party is identified, P1, P2, P3, and P4 could all be malicious parties. However, their probabilities of being malicious (hereinafter referred to as risk probabilities) differ because P1, P2, P3, and P4 have acted as malicious parties several times in previous protocol executions, and their probabilities of being malicious can be calculated based on the number of times they acted as malicious parties.

[0052] Figure 1 This is a schematic diagram illustrating an implementation scenario of one of the embodiments disclosed in this specification. Figure 1 In the secure four-party computation scenario, during the secret share distribution phase: the secret holder splits their secret into equal secret shares and distributes them to the other three participants. No participant can recover the secret from their own secret share. Specifically, in the scenario of secure four-party computation, assuming the four participants are P1, P2, P3, and P4, and P1 holds secret s, then P1 can copy secret s and share it with P2, P3, and P4. The specific implementation is as follows:

[0053] First, P1 randomly selects random numbers r2, r3, and r4, and then calculates s1 = s - r2 - r3 - r4, s2 = r2, s3 = r3, and s4 = r4. Afterward, P1 keeps s2, s3, and s4 for itself, sends s1, s3, and s4 to P2, sends s1, s2, and s4 to P3, and sends s1, s2, and s3 to P4.

[0054] After the secret share distribution is completed, the function computation phase begins. Each participant completes a secure four-party computation according to the computation circuit specified in the protocol to obtain the secret share of the result. The computation can be divided into offline computation and online computation: 1) Offline computation needs to be performed locally without interaction with other participants; 2) Online computation usually requires interaction between different participants. Therefore, in order to solve the problem of adversary attacks during the interaction process, an additional verification phase can be used to verify the correctness of the interaction data.

[0055] Data Verification Phase (Verification requires only online computation): Participants provide their secret shares to other participants, and the correctness of these secret shares is verified using a specific security verification protocol. If malicious activity is detected, the process proceeds to the malicious activity handling phase.

[0056] Malicious Behavior Handling Phase (handled only when malicious behavior occurs): Based on the broadcast data verification results, the protocol will exclude the malicious party and execute the protocol jump to secure three-party computation or secure two-party computation, and finally calculate the secret share of the result.

[0057] Data reconstruction phase: All participants recover the calculation results through interaction.

[0058] It should be noted that in this scheme, the four parties can perform secure addition or secure multiplication operations based on the shared secret. In other words, secure four-party computation includes both secure addition and secure multiplication.

[0059] For secure addition, suppose the data to be added securely are x and y, and suppose that both data have been distributed to the four participants using a replicated secret sharing method (see the distribution method of secret s above). Thus, participant P... i Holding secret shares {x j y j |1≤j≤4,j≠i}. It should be understood that the safe addition to be performed can be represented as: [z]=[x+y]. And [z]=[∑x i +∑y i ]=[∑(x i +y i Therefore, each participating party only needs to add up their respective secret shares to z. i =(x i +y i mod2 k That is, z = ∑z i Participant P i Holding secret shares {z jThe addition operation result is given by the formula |1≤j≤4,j≠i}, where any two parties can recover the addition operation result, but neither party can recover the addition operation result from the known secret share. The obtained addition operation result satisfies the form of copy secret sharing.

[0060] For secure multiplication, we also assume that the data to be multiplied securely are x and y, and that both data have been distributed to the four participants using a replicated secret sharing method (see the distribution method of secret s above). Thus, participant P... i Holding secret shares {x j y j |1≤j≤4,j≠i}. For safe multiplication that needs to be performed, it can be represented as: [z]=[x*y]. And [z]=[x*y]=[∑x i *∑y i Expanding it, it's easy to see that the entire safe multiplication can be represented as two parts: [z] = [∑x] i *y i +∑(x i *y j +z j *y i Therefore, it can be broken down into non-intersecting parts: [z] α ]=[∑(x i *y i )] and cross-term part: [z β ]=[∑(x i *y j +x j * y i)]. Where, ∑(x) i *y i )=x1y1+x2y2+x3y3+x4y4. ∑(x i *y j +x j *y i )=(x1y2+x2y1)+(x1y3+x3y1)+(x1y4+x4y1)+(x2y3+x3y2)+(x2y4+x4y2)+(x3y4+x4y3).

[0061] It is not difficult to deduce from the secret shares held by the participants that their shares can support the calculation of z. α Taking P1 as an example, z can be calculated directly. α2 =x²*y², z α3 =x³*y³, z α4 =x4*y4, and the same logic applies to other participants. They cannot derive a secret share that matches their own identifier, and the final calculation result satisfies z. α =zα1 +z α2 +z α3 +z α4 Each participant holds three shares, and the calculation meets the definition of a shared secret.

[0062] Figure 2a A schematic diagram illustrating the calculation process of the product of non-cross terms is shown. Figure 2a In this scenario, P2, P3, and P4 can locally calculate x1*y1 as one of their secret shares and set the other two secret shares to 0. P1, on the other hand, sets all three of its secret shares to 0. Thus, each party's secret share for x1*y1 satisfies the replication secret sharing requirement. Similarly, each participant can obtain its own three secret shares for x2*y2, x3*y3, and x4*y4.

[0063] It should be understood that by adding together the three secret shares held by each participant for x1*y1, x2*y2, x3*y3, and x4*y4 respectively, one can obtain their share for z. α Taking P1 as an example, the three secret shares it holds can be represented as follows:

[0064] x1*y1:(z α12 , z α13 , z α14 )

[0065] x2*y2:(z a22 , z α23 , z α24 )

[0066] x3*y3:(z α3 , z α33 , z α34 )

[0067] x4*y4:(z α42 , z α4 , z α4 )

[0068] Among them, in the case of z α12 z α2 z α32 and z α42 After summing, we can obtain P1 with respect to z. α A secret share held: z α2 By analogy, we can obtain the other two secret shares: z α3 and z α4 .

[0069] For z βThis scheme breaks it down into 6 pairs of cross terms for calculation. The sum of the products of one pair of cross terms can be, for example, (x1y2+x2y1).

[0070] The calculations for each pair of cross terms are very similar. Therefore, for the sake of simplicity, we will take the calculation of (x1y2+x2y1) as an example to explain its calculation process.

[0071] First, for participant P1, which holds secret shares x2, x3, x4 and y2, y3, y4, it cannot calculate x1y2, x2y1. For participant P2, which also holds secret shares x1, x3, x4 and y1, y3, y4, it cannot calculate x1y2, x2y1. For participant P3, which holds secret shares x1, x2, x4 and y1, y2, y4, it can locally calculate x1y2, x2y1, and therefore can also calculate x1y2+x2y1. For participant P4, which holds secret shares x1, x2, x3 and y1, y2, y3, it can locally calculate x1y2, x2y1, and therefore can also calculate x1y2+x2y1.

[0072] Figure 2b This diagram illustrates the calculation process for the sum of the products of a pair of cross terms. Figure 2b In this process, P2, P3, and P4 jointly calculate x1y2 + x2y1. For P3 and P4, since their secret shares include x1, x2, y1, and y2, they can directly calculate (x1*y2 + y1*x2). Without loss of generality, let x1y2 + x2y1 = Z. β11 +z β12 +z β13 +Z β14 In addition, it is advisable to set the share z held by P3 and P4. β13 =z β14 =0. For P1 and P2, their share of the secret is insufficient to reconstruct the secret Z. β11 Z β12 However, since x1y2 + x2y1 = Z β11 +z β12 +z β13 +Z β14 Z β13 =Z β14 =0, therefore x1y2+x2y1=z β11 +z β12Here, participant P2 will use a random number generator to generate a random value r as their secret share. Then, P1's secret share is x1y2 + x2y1 - r. x1y2 + x2y1 is known to P3 and P4, so participants P2, P3, and P4 need to share a key k beforehand. Then, they share the random value r through key k, and finally, P3 and P4 jointly send the value to P1. At this point, each participant has three secret shares for x1y2 + x2y1.

[0073] Similarly, each participant can calculate its three secret shares for each pair of crosses. By adding up the three secret shares held by each participant for each pair of crosses, its share for z can be obtained. β The three secret shares held.

[0074] Taking P1 as an example, its secret share can be represented as follows:

[0075] (x1y2+x2y1): (z β1 , z β13 , z β14 )

[0076] (x1y3+x3y1): (z β2 , z β23 , z β24 )

[0077] (x1y4+x4y1): (z β3 , z β33 Z β34 )

[0078] (x2y3+x3y2): (z β42 Z β4 Z β44 )

[0079] (x2y4+x4y2): (z β52 , z β5 , z β5 )

[0080] (x3y4+x4y3): (z β62 , z β63 , z β6 )

[0081] Among them, in the case of Z β12 z β22 z β3 Z β42 Z β52 z β62 After summing, we can obtain P1 with respect to Z. βA secret share held: z β2 By analogy, we can obtain the other two secret shares: z β3 and Z β4 .

[0082] It should be understood that obtaining z at P1, P2, P3, and P4... α and z β After each of their three secret shares, through z α and Z β Summing the three secret shares of each entity yields the three secret shares of the multiplication result z, where z = z1 + z2 + z3 + z4, where z i =z αi +z βi , 1≤i≤4. Taking P1 as an example, its three secret shares are: z2, z3, and z4.

[0083] It should be understood that any two participants can obtain the final multiplication result z through the same communication. For example, P1 sends z2 to P2, and P2 sends z1 to P1. P1 and P2 then possess the complete secret shares z1, z2, z3, and z4, and can thus obtain the multiplication result z.

[0084] It should be noted that, for the four parties involved in safe multiplication, since the calculations they perform during the safe multiplication process are similar, the following will take any one party (hereinafter referred to as the first party) as an example to explain in detail the calculations it performs during the safe multiplication process.

[0085] Furthermore, as mentioned above, during the joint execution of secure multiplication by the four participating parties, each participating party needs to determine its own slice (i.e., three secret shares) for each of the six pairs of cross terms. However, since for each pair of cross terms for which it does not hold slices, it is only responsible for receiving the corresponding slices, the following will take the first party as an example to explain in detail the process of determining its own slice for the sum of the products of the pair of cross terms.

[0086] Figure 3 An interaction diagram of a method for secure multi-party computation according to one embodiment is shown. Figure 3 As shown, the method may include the following steps:

[0087] In step S302, the first party locally calculates the sum of the cross products of the first numbered fragments and the second numbered fragments of the first data and the second data to obtain the first target sum value.

[0088] The first number is different from the second number.

[0089] Taking the first data as x, the second data as y, and the first side as P3 as an example, the first number can be 1, the second number can be 2, and the sum of the cross products of the first numbered piece and the second numbered piece is the sum of the cross products of the four pieces x1, x2, y1, and y2. The first target sum can be expressed as: (x1y2 + x2y1).

[0090] Step S304: The first party obtains a random number r shared with the second party and the third party.

[0091] The second party also holds the first numbered fragment and the second numbered fragment, while the third party holds one of the first numbered fragment and the second numbered fragment.

[0092] In the previous example, the second party could be P4, which holds four shards: x1, x2, y1, and y2. The third party could be P2, which holds two shards: x1 and y1, and the fourth party could be P1.

[0093] Of course, the aforementioned third party can also be P. i It holds two partitions, x2 and y2, and a fourth party, P2.

[0094] Step S306: The first party performs calculations on the first target sum and random number to obtain the first target slice; based on the first target slice, random number and 0, three local slices of the first target sum are obtained.

[0095] In one embodiment, the difference between the first target sum and the random number can be calculated to obtain the first target slice: x1y2+x2y1-r.

[0096] In the aforementioned example where the third party is P2 and the fourth party is P1, the first target fragment can have a corresponding number with P2, and thus can be represented as: z β12 = x1y2 + x2y1 - r. Additionally, z can be set. β11 =r, and z β13 =0, z β14 =0, which should be understood as referring to the other three slices of the first objective and value, each with a corresponding number to P1, P3, and P4. At this point, the first party has obtained all four slices for the first objective and value.

[0097] In the aforementioned example where the third party is P1 and the fourth party is P2, the first target fragment can have a corresponding number with P1, and thus can be represented as: z β11 = x1y2 + x2y1 - r. Additionally, z can be set. β12 =r, and z β13 =0, z β14=0, which should be understood as referring to the other three slices of the first objective and value, each with a corresponding number to P2, P3, and P4. At this point, the first party has obtained all four slices for the first objective and value.

[0098] In step S308, according to the agreement with the second party, the first party and the second party respectively send the fragmentation data of the first target fragment to the fourth party, so that the fourth party obtains three corresponding fragments based on the first target fragment.

[0099] In one embodiment, the aforementioned shard data is one of the original value and hash value of the first target shard; the aforementioned protocol stipulates that the second party sends the other of the original value and hash value in order to verify the first target shard.

[0100] Specifically, if the first party sends the original value of the first target fragment to the fourth party, then the second party sends the hash value of the first target fragment to the fourth party. Conversely, if the first party sends the hash value of the first target fragment to the fourth party, then the second party sends the original value of the first target fragment to the fourth party.

[0101] After receiving the fragment data of the first target fragment, the fourth party can verify the first target fragment (the verification process will be explained later), and after the verification is successful, it can obtain three of its own fragments based on the first target fragment and two zeros.

[0102] In the aforementioned example where the third party is P2 and the fourth party is P1, after receiving the first target fragment: x1y2+x2y1-r, P1 can set Z. β12 =x1y2+x2y1-r,z β13 =0, Z β14 =0, which should be understood as meaning that these three have corresponding numbers to P2, P3, and P4 respectively.

[0103] In addition, P3 can be set to Z. β11 =r,z β12 =x1y2+x2y1-r, Z β14 =0, and then these three are respectively assigned corresponding numbers to P1, P2, and P4. P2 can be set to Z. β11 =r,z β13 =0, z β14 =0, and these three have corresponding numbers to P1, P3, and P4 respectively.

[0104] In the aforementioned example where the third party is P1 and the fourth party is P2, after receiving the first target fragment: x1y2+x2y1-r, P2 can set Z. β11 =x1y2+x2y1-r,z β13 =0, Z β14=0, which should be understood as meaning that these three have corresponding numbers to P1, P3, and P4 respectively.

[0105] In addition, P3 can set z β11 =x1y2+x2y1-r,z β12 =r,z β14 =0, and then these three are respectively assigned corresponding numbers to P1, P2, and P4. P2 can be set to Z. β11 =x1y2+x2y1-r,z β13 =0, z β14 =0, and these three have corresponding numbers to P1, P3, and P4 respectively.

[0106] Thus, for the first objective and value, each participant has obtained three corresponding slices, satisfying: x1y2 + x2y1 = Z β11 +z β12 +z β13 +z β14 .

[0107] The above describes the process by which the first party determines its own fragment for the first target sum. For the second target sum, it can receive the fragment data of the second target fragment corresponding to the second target sum from the two target parties respectively, and determine the three corresponding fragments of the second target sum.

[0108] In this context, assuming the first data has an index i, the second objective sum is the sum of the cross products of the index i fragment of the first and second data and the other fragments. For example, if i = 3, then the sum of the cross products of the index i fragment and the other fragments is x3, x j y3,y j The sum of the cross products of the four pieces, where 1≤j≤4 and j≠3.

[0109] For this second target value, the first party can refer to the fourth party mentioned above to determine the three corresponding slices. Of course, if the first party and the two target parties have shared random numbers, the first party can also refer to the third party to determine the three corresponding slices, which will not be elaborated on here.

[0110] Similar to the method for determining the local partitions of the first and second target sums, the first side can obtain three local partitions for each target sum of the first and second data. Then, by summing the three local partitions for each target sum, the cross-product part (i.e., z) of the first side for the multiplication result is obtained. β (The three original parts)

[0111] Furthermore, the first party can also locally calculate the product of the same numbered fragments of the first and second data to obtain the non-cross product part of the multiplication result (i.e., z).α (The three original parts)

[0112] Finally, the three original pieces of the non-cross product part and the three original pieces of the cross product part are summed to obtain the three original pieces of the multiplication result (i.e., z = z1 + z2 + z3 + z4).

[0113] In summary, the multi-party secure computation method provided in the embodiments of this specification allows any first party among the four participating parties in the multi-party secure computation to locally calculate the sum of the cross-products of two different numbered fragments of the first and second data it holds, thereby obtaining three fragments of its own. In addition, it can provide the corresponding fragment data to the other parties, so that the other parties can obtain three corresponding fragments. This can greatly reduce the amount of communication in the online phase, thereby improving the efficiency of multi-party secure computation.

[0114] The following describes the process by which the fourth party verifies the first target fragment based on the federated messaging protocol after receiving the fragment data of the first target fragment.

[0115] Taking the example of the first party sending the original value (also called the third value) of the first target fragment to the fourth party, and the second party sending the hash value (also called the fourth value) of the first target fragment to the fourth party, after receiving the original value and the hash value, the fourth party verifies whether the received hash value is the hash value of the received original value. If it is, the verification is successful, and the fourth party can determine the three corresponding fragments of the first target and the value. If not, an accusation message is broadcast to the first party and the second party, which includes the first party and the second party in the list of suspected malicious parties. In addition, the accusation message also includes the first value corresponding to the original value of the first target fragment and the second value corresponding to the hash value of the first target fragment.

[0116] Upon receiving the aforementioned accusation message, the first party may perform a first verification and a second verification. The first verification includes verifying whether the second value is the hash value of the first value. If not, the first party broadcasts the accusation message to the fourth party, including the fourth party in the list of suspected malicious parties. The second verification includes verifying whether the first value is the original value of the first target fragment. If not, the first party broadcasts the accusation message to both the second and fourth parties, including the fourth party in the list of suspected malicious parties.

[0117] Upon receiving the aforementioned accusation message, the second party may perform a third and a fourth verification. The third verification includes verifying whether the second value is the hash value of the first value; if not, broadcasting the accusation message to the fourth party, including the fourth party in the list of suspected malicious parties. The fourth verification includes verifying whether the second value is the hash value of the first target shard; if not, broadcasting the accusation message to both the first and fourth parties, including the fourth party in the list of suspected malicious parties.

[0118] Finally, the first, second, and fourth parties jointly identified the malicious party group based on the aforementioned allegations.

[0119] The verification process described above will be illustrated below with examples.

[0120] Let the first party be denoted as P. i Let the second party be represented as P. j Let the fourth party be represented as P. g Furthermore, the original value of the first target fragment is represented as x, and the original value of the first target fragment held by Pi is represented as x. i , will P j The original value of the first target fragment held is represented as x. j It should be understood that, under normal circumstances, x = x i =x j The specific verification process is as follows:

[0121] (1)P i Send x i Give P g P j Send c1 = hash(x) j ) Give P g .

[0122] (2)P g Calculate c2 = hash(x) i ), and determine whether c1 and c2 are the same. If they are the same, P g This will output the correct x = x i Verification ends; otherwise, proceed to the accusation phase, P g It will broadcast accusations against the collection {accuse, (P)} i P j ), (x i Let P', c'2)} i P j And proceed to step (3), where accuse, (P i P j ) indicates that the accusation against P i P j If P g If x is an honest participant, then i =x i c2 = c2, otherwise P g Will tamper with x i c2.

[0123] (3)P i and P j Upon receiving the set of accusations, the first step is to verify hash(x). iIf P' is equal to c'2, then P'' is equal to c'2. i and P j All will accuse P g And by P i and P j Broadcast accusation set {accuse, P} g} Give P g (Because only in step (2) P) g Only after verifying that c1≠c2 will we proceed to step (3), at which point we will verify hash(x) again. i ′)=c′2, indicating that P g (It is a malicious party).

[0124] (4) In addition, P i Verify your holdings of x i Is it with P? g x in the broadcast i If they are equal, no operation is performed; otherwise, P... i Broadcast accusation set {accuse, P} g} Give P j P g .

[0125] (5) In addition, P j Verify whether your c1 holding matches P. g If c2 in the broadcast is equal, no operation is performed; otherwise, P... j Broadcast accusation set {accuse, P} g} Give P i P g .

[0126] (6) Based on the above set of accusations, the following consensus is reached (note the broadcast messages P in steps (3) to (5)). i P j P g (As everyone knows):

[0127] (6.1) If P i P j P g Only P was found i Broadcast accusation set {accuse, P} g}(Explanation of hash(x) i ′)≠c′2,x i ′≠x i If c′2=c1, then it means P i and P g If all parties involved could be malicious, then all parties agree to output the set of malicious parties {P}. i P g}, that is, by Pi P j P g Send the malicious group to the fourth party P h .

[0128] (6.2) If P i P j P g Only P was found j Broadcast accusation set {accuse, P} g}(Explanation of hash(x) i ′)≠c′2,x i ′=x i If c′2≠c1, then it means P j and P g If all parties involved could be malicious, then all parties agree to output the set of malicious parties {P}. j P g}, that is, by P i P j P g Send the malicious group to the fourth party P h .

[0129] (6.4) If P i P j P g P was discovered i and P j All broadcast accusations against the collection {accuse, P} g}(Explanation of hash(x) i ′)≠c′2,x i ′≠x i c′2≠c1, if P g If not the malicious party, then x i =x i If at least one of c2 and c1 is true, and none of them are true now, it can only mean that Pg is the malicious party. Then all the participants agree to output the set of malicious parties, that is, Pg. i P j P g The set of evil participants {P g}Sent to fourth party P h .

[0130] (6.5) If P i P j P g P was discovered i and P j None of the accusations are broadcast to the set {accuse, P} g}(Explanation of hash(x) i ′)≠c′2,x i ′=xi If c′2=c1, then it means P i and P j One of the participants gave P g If the sent message is incorrect, then all participating parties agree to output the set of malicious parties {P}. i P j}, that is, by P i P j P g Send the malicious group to the fourth party P h .

[0131] It should be understood that in most cases, there is only one malicious party in a secure four-party computation. Ensuring that the two honest parties execute the protocol is sufficient to output the set of malicious parties. The protocol guarantees that, in the event of malicious adversary behavior, it can output a set containing at most two parties, and definitely includes a malicious party.

[0132] Let P be... i For P3, P j For P4, P g For P1, a diagram illustrating the corresponding data validation method is provided. This diagram can be found in [reference needed]. Figure 4 , Figure 4 In the end, the set of malicious parties obtained includes the following four cases: {P1, P3}, {P1, P4}, {P1} and {P3, P4}, that is, the set of malicious parties that satisfy the protocol's requirement that the output contains at most two participants.

[0133] In cases where the malicious party set includes two participants, each participant can provide this set to a trusted third party. This allows the trusted third party to identify suspected malicious parties based on the risk probability of each participant within the set. The risk probability here is positively correlated with the number of times the corresponding participant has been marked as a malicious party in historical joint calculations.

[0134] For example, suppose the set of malicious parties is: {P} m P n}, and assume that the probabilities (i.e., risk probabilities) of the two parties performing malicious actions based on their historical malicious behavior are p respectively. m =75%, p n =25%, trusted third-party calculation (Here, k = 64). Data r∈[0, 2] is generated using a random number generator. k -1], if r < 3·2 62 Then exclude participant P n If r≥3·2 62 Then exclude participant P m .

[0135] In summary, a trusted third party can select a suspected malicious party from the set of malicious parties. The trusted third party can then broadcast a notification indicating the suspected malicious party to all four participating parties. Figure 4 Taking the set of malicious parties output in the code as an example, the suspected malicious party here is P. i P j and P g one of them.

[0136] It should be understood that after receiving notification from the suspected malicious party, each participating party needs to recalculate its own fragments based on the result of the multiplication operation. Since the recalculation process is similar for each participating party, the following explanation will use the first party as an example to illustrate the process of recalculating its own fragments.

[0137] Specifically, the first option is to sum the three local fragments of the multiplication result with the local fragment that has the corresponding number to the suspected malicious party and one of the remaining two local fragments, and use the sum and the other as the two updated fragments of the first party; or, directly use the remaining two local fragments as the two updated fragments of the first party.

[0138] For example, suppose the first party is P. i It holds three of z's own shards: z j z g , zh,; the second party is P j It holds three of z's own shards: zi, z g ,zh; third party is P h It holds three of z's own shards: z i z j z g The fourth party is P. g It holds three of z's own shards: z i z j z h Furthermore, it is assumed that the suspected malicious party is P. g .

[0139] So P i After receiving the above notification, z can be calculated. gh =z g +z h and z gh and z j As for the two updated shards it holds for z. Additionally, P j The above calculation can also be performed, and z gh and z i As for the two updated shards it holds for z. And P h directly z i and z iAs two updated shards held by z.

[0140] It should be understood that after each participant recalculates its own sharding, the initial z = z i +z j +z g +z h Updated to: z = z i +z j +z gh .

[0141] Of course, in another example, P i After receiving the above notification, z can be calculated. jg =z j +z g and z jg and z h As for the two updated shards held by z, P h z jg and z i As for its two updated shards held by z, and P j z i and z h As two updated shards held by z.

[0142] Furthermore, in other examples, P i After receiving the above notification, you can also z j and z h As two update shards, and by P j and P h Two parties perform calculations, etc.

[0143] In summary, the method by which each participant recalculates its own shards can be flexibly set.

[0144] It should be noted that after excluding suspected malicious parties from the four participants, the remaining three participants can execute target computation based on a secure three-party computation protocol with abort security, according to their respective updated fragments. This protocol outputs an abort signal instructing the target malicious party if a malicious party (also known as a genuine malicious party) is present among the three participants.

[0145] It should be noted that the reason for performing the target computation based on a secure three-party computation protocol with suspension security is that we cannot determine whether the excluded suspected malicious parties are actually malicious parties. In other words, we are unsure whether the remaining three participants are necessarily honest participants.

[0146] Specifically, if each participant receives an abort signal, it shall designate its two updated fragments as its two target fragments; if it does not receive an abort signal, it shall determine its two target fragments based on its own fragments calculated for the target.

[0147] The above protocol is the SPDZ-wise protocol, and the three participating parties P i P j and P h For example, initially, the three participants each hold two update shards: {z gh , z j},{z gh , z i},{z i , z j Then, these three entities can perform target calculations according to the SPDZ-wise protocol. If no abort signal is received, the calculation is complete, and P... i P j and P h Each holds two target fragments: {z j ′,z′ h},{z i ′,z′ h},{z i ′,z j If a termination signal is detected, the party that identified the malicious behavior broadcasts the termination signal to all other parties, and all parties suspend calculations, and set P... i P j and P h Each holds the original input, i.e., let z i ′=z i , z j ′=z j , z′ h =z gh P i P j and P h Each receives its own two target fragments: {z′ j , z′ h},{z′ i , z′ h},{z′ i , z j ′}.

[0148] In addition, upon receiving an abort signal, each participant needs to update their two target fragments again.

[0149] Taking the first party as an example, the first party can sum the two target fragments it holds and use the sum as its final fragment; or, it can directly use the other of the two target fragments it holds, excluding the target fragment with the corresponding number to the target malicious party, as its final fragment.

[0150] In the example above, let's assume the malicious target is P. j Then P i The following calculation can be performed: z′ jh =z j ′+z′ h and z′ jh As its final fragment. P h directly z i z′ is the final fragment held by it. Therefore, the two participants have a stake in z′=z′. jh +z i Each holds different shards.

[0151] Of course, it can also be P i directly z h As the final fragment held by it, P h The following calculation can be performed: z′ ij =z i ′+z j ′, and z′ ij As its final slice. Thus, the two participants have a stake in z′=z′. ij +z h Each holds different shards.

[0152] As mentioned above, the malicious party set described in the embodiments of this specification includes at most two malicious parties. Therefore, after excluding the suspected malicious party and the target malicious party, the remaining two parties can perform secure two-party operations. The following explanation uses secure two-party multiplication as an example.

[0153] As in the example above, the remaining two participants are P. i and P h And P i The fragment z′ holding z′ jh P h The fragment z holding z′ i Furthermore, assume that the two participants are respectively targeting w′=w′ jh +w i 'Holds different fragments, specifically, P i Holding w′ jh P h Holding w i Then, the process by which the two parties jointly calculate z′·w′ is as follows:

[0154] (a) The aforementioned suspected malicious party P g Generate two multiplication triples (a0, b0, c0) and (a1, b1, c1) such that (a0 + a1)·(b0 + b1) = (c0 + c1), and send (a0, b0, c0) to P. i Send (a1, b1, c1) to P h .

[0155] (b)P i Calculate α jh =z′ jh -a0,β jh =w′ jh -b0 is sent to P h P h Calculate α i =z i ′-a1,β i =w i ′-b1 sent to P i At this time P i and P h α = α can be calculated locally. jh +α i ,β=β jh +β i .

[0156] (c)P i Calculate [z′·w′] i =c0+b0α+a0β, P h Calculate [z′·w′] h =c1+b1α+a1β+αβ, which can verify [z′·w′] i +[z′·w′] h =z′·w′, i.e., P i and P h The two-sided partitions of z′·w′ are calculated, and the safe two-sided multiplication is completed.

[0157] Figure 5 A schematic diagram of a multi-party secure computation method is shown. Figure 5Initially, four participants, P1, P2, P3, and P4, perform a secure four-party computation. After data verification, a set of malicious parties, P3 and P4, is identified from these four participants. If, based on their respective risk probabilities, P4 is more likely to be malicious, it is excluded from the four participants. Similarly, if, based on their respective risk probabilities, P3 is more likely to be malicious, it is excluded from the four participants, and each participant updates its own fragment. The remaining three participants, P1, P2, and P4, perform a target computation based on the DZ-wise protocol. If no malicious party is found during this target computation, these three participants complete the target computation and obtain their respective result fragments. If a malicious party is discovered during the target computation, it is excluded, and each participant updates its own fragment. Finally, the remaining two participants can perform a secure two-party computation.

[0158] Combination Figure 5 As can be seen, this scheme first outputs a set of malicious parties based on the verification results, then excludes one participant from the set based on risk probability before proceeding with a protocol jump to reconstruct the secret share. Next, depending on whether the secure three-party computation protocol with abort security outputs an abort signal, it determines whether a next round of protocol jump is needed. If an abort signal is output, the participant not excluded in the previous round is excluded, and the excluded participant assists in generating multiplication triples to complete the computation. It should be understood that through the above protocol jump, privacy robustness in multi-party secure computation can be ensured.

[0159] The innovative points of this solution are summarized below:

[0160] (1) Based on the number of malicious participants and malicious behavior, the original covert adversary model was extended and a variable covert adversary model was proposed. Based on the secure four-party computation protocol under the optimized malicious model, the process of the variable covert adversary model was analyzed and optimized, which solved the problem of protocol branches depending on probabilistic implementation to a certain extent.

[0161] (2) This solution achieves privacy robustness based on protocol jump technology and federated messaging protocol. The framework can identify malicious activity and robustly complete subsequent calculations to obtain the correct results.

[0162] (3) The model was optimized from the perspectives of the computation function and protocol flow of secure multi-party computation, and an additional secure two-party computation protocol was designed to reduce the amount of computation after the jump.

[0163] In addition, this solution has the following advantages compared to traditional technologies:

[0164] First, this scheme has universal applicability. Compared to obfuscated circuit methods that require additional computational circuit design for each computation, and federated learning methods that are only applicable to machine learning, this scheme achieves completeness on the integer ring. Second, this scheme splits the computation into offline and online stages. Only the data transmission part of the online stage requires additional verification and encryption, thus reducing the computational cost compared to homomorphic encryption methods. Third, in terms of security, this scheme can rigorously prove the security of each step and extends to stronger security properties that can be manipulated by adversaries. Compared to differential privacy methods that rely on the means and degree of data anonymization to achieve security and the correctness of computational results, this scheme has higher security and computational accuracy. Finally, compared to secure computation protocols with other numbers of participants, the secure four-party computation considered in this scheme achieves privacy robustness by introducing an additional participant instead of the expensive cryptographic primitives required for the original secure three-party computation that achieves privacy robustness, and the complexity does not exhibit an "exponential explosion" with the increase in the number of participants.

[0165] Corresponding to the above-described secure multi-party computation method, one embodiment of this specification also provides an apparatus for secure multi-party computation, used to perform secure multiplication on first and second data, each of which is split into four fragments and distributed to four participating parties in a replicated secret-sharing manner. The apparatus is located at any of the four participating parties, specifically the first party, which has a number i and holds three of the four fragments of the first and second data, excluding the fragment numbered i. For example... Figure 6 As shown, the device includes:

[0166] The calculation unit 602 is used to locally calculate the sum of the cross products of the first numbered fragments and the second numbered fragments of the first data and the second data, respectively, to obtain a first target sum value, wherein the first number is different from the second number.

[0167] The acquisition unit 604 is used to acquire random numbers shared with the second party and the third party, wherein the second party also holds the first numbered fragment and the second numbered fragment, and the third party holds one of the first numbered fragment and the second numbered fragment.

[0168] The calculation unit 602 is also used to perform calculations on the first target sum and the random number to obtain the first target slice, and to obtain three local slices of the first target sum based on the first target slice, the aforementioned random number and 0.

[0169] The sending unit 606 is used to send the fragment data of the first target fragment to the fourth party according to the agreement with the second party, so that the fourth party can obtain three corresponding fragments based on the first target fragment.

[0170] In one embodiment, the calculation unit 602 is also used to locally calculate the product of the same numbered segments of the first data and the second data to obtain three local segments of the non-cross product part of the multiplication result.

[0171] The calculation unit 602 is further configured to sum the three original parts of the non-cross-product portion and the three original parts of the cross-product portion of the multiplication result to obtain the three original parts of the multiplication result. The three original parts of the cross-product portion are obtained by summing the three original parts of each target sum calculated for the first data and the second data.

[0172] In one embodiment, the fragmented data sent by the sending unit 606 is one of the original value and hash value of the first target fragment; the above protocol stipulates that the second party sends the other of the original value and hash value.

[0173] In one embodiment, the device further includes:

[0174] The receiving unit 608 is configured to receive a first accusation message broadcast from a fourth party, wherein the first party and the second party are included in a list of suspected malicious parties. The first accusation message also includes a first value and a second value corresponding to the original value and hash value of the first target fragment, respectively.

[0175] Verification unit 610 is configured to perform first and second verifications in response to the first charge message;

[0176] The first verification includes verifying whether the second value is the hash value of the first value; if not, broadcasting a second accusation message, wherein the fourth party is included in the list of suspected malicious parties. The second verification includes verifying whether the first value is the original value of the first target fragment; if not, broadcasting a third accusation message, wherein the fourth party is included in the list of suspected malicious parties. The determination unit 612 is used to jointly determine the set of malicious parties with the second party and the fourth party based on the first, second and third accusation messages.

[0177] In another embodiment, the receiving unit 608 is further configured to receive the third and fourth values ​​of the second target fragment corresponding to the second target sum value from the two target parties respectively, wherein the second target sum value is the sum of the cross products of the number i fragment of the first data and the second data and other fragments;

[0178] Verification unit 610 is also used to verify whether the fourth value is the hash value of the third value;

[0179] The sending unit 606 is also configured to broadcast a fourth accusation message if the verification of the fourth value is not the hash value of the third value, wherein the two target parties are included in the list of suspected malicious parties, such that the first party and the two target parties jointly determine the set of malicious parties.

[0180] In one embodiment, the receiving unit 608 is further configured to receive a notification from a trusted third party indicating a suspected malicious party; wherein the suspected malicious party is one of a first party, a second party, and a fourth party;

[0181] The calculation unit 602 is also used to sum the three local fragments of the multiplication result, the local fragment with the corresponding number to the suspected malicious party, and one of the remaining two local fragments, and use the sum and the other as the two updated fragments of the first party; or, directly use the remaining two local fragments as the two updated fragments of the first party.

[0182] In one embodiment, the device further includes:

[0183] The execution unit 614 is used to jointly perform target computation based on a secure three-party computation protocol with abort security with the two remaining participants other than the suspected malicious party, based on their respective two update fragments, to obtain the first party's two target fragments. The secure three-party computation protocol outputs an abort signal indicating the target malicious party in the presence of a target malicious party.

[0184] The execution unit 614 is specifically used to: when receiving an abort signal, treat the two updated fragments it holds as the two target fragments it holds; when not receiving an abort signal, determine the two target fragments it holds based on the calculation results of its own fragments for the target.

[0185] In one embodiment, the calculation unit 602 is further configured to, upon receiving an abort signal, sum the two target fragments it holds and use the summation result as the final fragment it holds; or, use the other of the two target fragments it holds, excluding the target fragment with a corresponding number to the target malicious party, as the final fragment it holds.

[0186] In one embodiment, the aforementioned suspected malicious party is determined by a trusted third party based on the risk probability of each participant in the malicious party set. This risk probability is positively correlated with the number of times the corresponding participant has been marked as a malicious party in historical joint calculations. The malicious party set includes any two of the first party, the second party, and the fourth party.

[0187] The functions of each functional unit of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.

[0188] The apparatus for secure multi-party computation provided in one embodiment of this specification can greatly reduce the amount of communication during the online phase, thereby improving the efficiency of secure multi-party computation.

[0189] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 3 The method described.

[0190] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 3 The method described.

[0191] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the medium or device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0192] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0193] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this specification. It should be understood that the above description is only a specific embodiment of this specification and is not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this specification should be included within the scope of protection of this specification.

Claims

1. A method for secure multi-party computation, used to perform secure multiplication on first and second data; wherein each of the first and second data is split into four fragments and distributed to four participating parties in a replicated secret-sharing manner, the method being performed by any first party among the four participating parties, the first party having a number i, and holding three of the four fragments of the first and second data excluding the fragment numbered i; the method comprising: The first target sum is obtained by locally calculating the sum of the cross products of the first and second numbered fragments of the first and second data, respectively. The first number is different from the second number; Obtain random numbers shared with a second party and a third party; wherein the second party also holds the first numbered fragment and the second numbered fragment, and the third party holds one of the first numbered fragment and the second numbered fragment; The first target sum and the random number are processed to obtain a first target slice; based on the first target slice, the random number and 0, three local slices of the first target sum are obtained; According to the agreement with the second party, each party sends the fragmentation data of the first target fragment to the fourth party, so that the fourth party obtains three corresponding fragments based on the first target fragment.

2. The method according to claim 1, further comprising: The product of the same numbered fragments of the first and second data is calculated locally to obtain three local fragments of the non-cross product part of the multiplication result; The three original parts of the non-cross product portion and the three original parts of the cross product portion of the multiplication result are summed to obtain the three original parts of the multiplication result; the three original parts of the cross product portion are obtained by summing the three original parts of each target sum calculated for the first data and the second data.

3. The method according to claim 1, wherein, The transmitted fragment data is one of the original value and hash value of the first target fragment; the protocol stipulates that the second party sends the other of the original value and hash value.

4. The method according to claim 3, further comprising: The first accusation message is received from the fourth party, wherein the first party and the second party are included in the list of suspected malicious parties. The first accusation message also includes a first value and a second value corresponding to the original value and hash value of the first target fragment, respectively. In response to the first charge message, first and second verifications are performed; The first verification includes verifying whether the second value is the hash value of the first value; if not, broadcasting a second accusation message, wherein the fourth party is included in the list of suspected malicious parties. The second verification includes verifying whether the first value is the original value of the first target fragment; if not, broadcasting a third accusation message, wherein the fourth party is included in the list of suspected malicious parties. Together with the second and fourth parties, a set of malicious parties is determined based on the first, second, and third accusation messages.

5. The method according to claim 1, further comprising: The third and fourth values ​​of the second target fragments corresponding to the second target sum value are received from the two target parties respectively, wherein the second target sum value is the sum of the cross products of the number i fragment of the first data and the second data and the other fragments; Verify whether the fourth value is the hash value of the third value; If not, broadcast a fourth charge message, in which the two target parties are included in the list of suspected malicious parties, such that the first party and the two target parties jointly determine the set of malicious parties.

6. The method according to claim 2, further comprising: Receive a notification from a trusted third party indicating a suspected malicious party; wherein the suspected malicious party is one of a first party, a second party, and a fourth party; Among the three local fragments of the multiplication result, the local fragment with the corresponding number to the suspected malicious party is summed with one of the remaining two local fragments, and the sum and the other are used as the two updated fragments of the first party; or, the remaining two local fragments are directly used as the two updated fragments of the first party.

7. The method according to claim 6, further comprising: The two remaining parties, excluding the suspected malicious party, jointly perform target computation based on a secure three-party computation protocol with abort security, based on their respective two update fragments, to obtain the first party's two target fragments; The secure third-party computation protocol outputs a termination signal instructing the target malicious party to terminate the operation if a malicious party is present. The step of obtaining the two target fragments of the first party includes, upon receiving the abort signal, taking the two updated fragments it holds as the two target fragments it holds; If the abort signal is not received, the two target fragments held by the entity are determined based on the calculation results of its own fragments for the target.

8. The method according to claim 7, further comprising: Upon receiving the abort signal, sum the two target fragments held by the entity and use the sum as the final fragment held by the entity. Alternatively, one of the two target fragments held by the malicious party can be designated as the final fragment held by the malicious party, excluding the target fragment with the corresponding number.

9. The method according to claim 6, wherein, The suspected malicious party is determined by the trusted third party based on the risk probability of each participant in the malicious party set. The risk probability is positively correlated with the number of times the corresponding participant has been marked as a malicious party in historical joint calculations. The malicious party set includes any two of the first party, the second party, and the fourth party.

10. An apparatus for secure multi-party computation, used to perform secure multiplication on first and second data; each of the first and second data is split into four fragments and distributed to four participating parties in a replicated secret-sharing manner, the apparatus being disposed at any first party among the four participating parties, the first party having a number i, and holding three of the four fragments of the first and second data excluding the fragment numbered i; the apparatus comprising: The calculation unit is used to locally calculate the sum of the cross products of the first numbered fragments and the second numbered fragments of the first data and the second data, respectively, to obtain the first target sum value; The first number is different from the second number; An acquisition unit is used to acquire random numbers shared with a second party and a third party; wherein the second party also holds the first numbered fragment and the second numbered fragment, and the third party holds one of the first numbered fragment and the second numbered fragment; The calculation unit is further configured to perform calculations on the first target sum and the random number to obtain a first target slice; and to obtain three local slices of the first target sum based on the first target slice, the random number, and 0. The sending unit is configured to send the fragment data of the first target fragment to the fourth party according to the agreement with the second party, so that the fourth party obtains three corresponding fragments based on the first target fragment.

11. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed in the computer, it causes the computer to perform the method of any one of claims 1-9.

12. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-9.

Images