A mobile secure multi-party computing method and system based on replicated secret sharing

Abstract

The present invention relates to a method and system for mobile secure multi-party computing based on replicated secret sharing, comprising: a client generates a key for generating a share corresponding to an input, and sends the key and a part of the share to a group of servers participating in the first round of computing; a server in the group of servers participating in the first round of computing generates a multiplication triplet using the key sent by the client, and forms a replicated secret sharing share of the multiplication triplet in the server, which is used to check the multiplication result in the computing process; the server performs computing according to a circuit and verifies the multiplication result in the computing process, and sends the multiplication result to the participants in the next round of computing if there is no problem; when the last round of computing is completed, the server sends the computing result to the client, and the client recovers the computing result. The present invention can make the server not have to run a preprocessing stage in advance, realize true mobility, and greatly improve flexibility.

Description

Technical Field

[0001] The present invention relates to a mobile secure multi-party computing method and system based on copy secret sharing, belonging to the technical field of computer software. Background Art

[0002] In the era of rapid development of the Internet, data has become an important factor of production and has brought huge social and economic benefits. However, in recent years, data security issues have occurred frequently, leading to people's increasing concern about personal data privacy. Many countries and regions have formulated corresponding laws and regulations to protect privacy. Therefore, when organizations collect and share data, if they do not comply with the above regulations, it is illegal, but the independence of data between organizations also makes it difficult to fully utilize data information.

[0003] Secure Multi-party Computation (MPC) originated from the millionaire's problem proposed by Professor Yao Qizhi. MPC allows a group of participants to calculate an agreed function without exposing their private inputs, and guarantees that the data of the participants will not be leaked even if some of the participants are attacked by opponents. With the continuous breakthroughs in technology, MPC is being applied to increasingly complex computing tasks, such as scientific computing and training machine learning models on large distributed data sets, which usually take hours or even days to complete. However, most current MPC protocols do not allow parties to exit or rejoin during the execution of a computing task, and do not allow new parties to join a computing task during the calculation. This undoubtedly raises the entry threshold for computing tasks, which is unfair to parties with limited computing resources or who need to perform another task during the execution of an existing computing task. During the computing task, if a party exits due to system failure, network failure, etc., the computing is interrupted, which will cause the task to have to be recalculated, which will waste a lot of computing resources and communication resources.

[0004] Gentry et al. proposed the YOSO (You Only Speak Once, YOSO) model, which requires each participant to send information only once. At the same time, they built the computationally secure YOSO MPC protocol and the information-theoretic secure YOSO MPC protocol based on the YOSO model, and implemented Guaranteed Output Delivery (GOD). However, this model is centered on the concept of role, uses blockchain to randomly assign participants in each round, and uses an additive homomorphic scheme, so multiplication ternary is required to assist in calculation. In addition, the scheme requires the construction of a future broadcast channel for interaction with new participants who may participate in computing tasks in the future. Therefore, the scheme does not achieve true liquidity.

[0005] Choudhuri et al. proposed the concept of Fluid Secure Multi-party Computation (Fluid MPC). Fluid MPC not only allows parties to dynamically join or exit during the execution of computing tasks, but also allows new participants to join computing tasks. Most importantly, in Fluid MPC, the joining or exit of parties will not interrupt the execution of computing tasks. This greatly improves the flexibility of the MPC protocol and allows more potential users with limited resources or time to participate in computing tasks. Rachuri et al. proposed the Le Mans scheme, which extends the work of Damg°ard et al. to fluid scenarios, thereby achieving malicious security in dishonest majority scenarios.

[0006] Fluid MPC divides the computation task into multiple consecutive rounds of computation. The result of each round of computation is used as the input of the next round of computation. The participants of each round of computation can be different. Each participant can choose to exit the computation or continue to participate in the next round of computation after the current round of computation ends. As far as we know, Fluid MPC achieves the best liquidity, that is, each participant only needs to send and receive data once in a round of computation to exit the computation. Each party needs to calculate the interpolation polynomial locally to generate the secret share. When there are a large number of participants, high-order power operations are usually required, and a large number of secret shares are generated and sent to the participants of the next round of computation, which will cause large computational and communication overheads. Therefore, in practice, the computational complexity of the share conversion method is not suitable for participants with very limited computing resources. Le Mans has a similar disadvantage. It requires all participants to run a preprocessing stage to generate multiplication triplets. Participants can also exit the computation after sending and receiving data once in a round of computation, but since all participants participating in the computation task, whether participating in part or all of the computation, need to run a preprocessing stage to generate multiplication triplets, Le Mans does not allow new participants to join during the computation execution. In addition, both of the above schemes only achieve abort security, that is, the computing task will be terminated when a malicious adversary commits evil acts.

[0007] Unlike the Shamir secret sharing scheme used in Fluid MPC and the arithmetic sharing scheme in Le Mans, Replicated Secret Sharing (RSS) is a threshold secret sharing scheme that has natural advantages in share calculation and secret recovery. In the RSS scheme, since each participant holds multiple shares of a secret value, each participant does not need to interact when calculating multiplication like Fluid MPC to obtain the additive secret share of the multiplication result. In addition, there is no need to generate relevant randomness (such as the multiplication triples in Le Mans) in the preprocessing stage to assist the multiplication calculation, so that the participants do not need to run the preprocessing protocol in advance, and new participants can join the calculation during the execution of the calculation.

[0008] Large-scale computing tasks often take several hours or even dozens of hours, and malicious participants may send wrong messages, causing errors in the calculation or even termination of the calculation, which is unacceptable in large-scale computing tasks. Therefore, it is necessary to verify the messages sent by each participant in the computing task to ensure that the task can be carried out correctly. In 2007, Lindell et al. proposed a maliciously secure garbled circuit (GC) scheme based on Cut-and-choose with complete security proof. The scheme randomly opens part of the circuit (used to calculate the agreed function) for inspection. Based on the above work, Furukawa et al. combined Cut-and-choose with secret sharing and constructed a protocol that can check the multiplication results in the secret sharing scheme.

[0009] From the above introduction, we can see that as the application scenarios of secure multi-party computing become more and more complex and the computing duration becomes longer and longer, the existing solutions cannot simultaneously meet the following requirements: 1) allowing participants to dynamically join or exit computing tasks without interrupting task execution; 2) even if there are malicious adversaries during the computing process, the task can still run normally and output correct results. Summary of the invention

[0010] In view of the shortcomings of the existing technology, in order to break the limitation that participants in secure multi-party computing need to stay online and to ensure that computing tasks can be carried out smoothly and output correctly even if malicious adversaries commit evil acts in large computing tasks, the present invention proposes a mobile secure multi-party computing method based on RSS.

[0011] Terminology explanation:

[0012] Replicated Secret Sharing: Replicated Secret Sharing (RSS) has an access structure Γ. The access structure is defined as the set of qualified parties Q ∈ Γ, which is the set of parties granted access rights, and the set of the remaining parties is called the set of unqualified parties. Any set of t or fewer parties cannot recover the secret value (i.e., they form a set of unqualified parties), while any set of t + 1 or more parties can jointly recover the secret value (thus forming a set of qualified parties). RSS can be applied to any scenario where n ≥ 2. To perform secret sharing using RSS, we consider v as an element on the ring and split it into shares v T using additive secret sharing, so that where Γ includes all the maximum unqualified sets of parties (in our example, all sets containing t parties). Then, each party i ∈ [1, n] holds the share v T and

[0013] Fluid MPC: Fluid Secure Multi-Party Computation divides the computing task into multiple rounds. The output of each round of computation serves only as the input for the next round, and each round only receives the computation result of the previous round as input. The servers participating in each round of computation do not need to be exactly the same. After participating in the current l-th round of computation, the server can exit the computation without interrupting the execution of the computing task, and at the same time, new servers can be added to the (l + 1)-th round of computation or servers that participated in the d-th round (d < l) of computation can be added to the l-th round of computation.

[0014] Cut-and-choose: The Cut-and-choose technique is a widely used cryptographic tool in cryptography and plays an important role in the design of secure multi-party computation protocols. Its main idea is that one party constructs multiple garbled circuits in the protocol, and the other party requests to open a part of the circuits for inspection. If the inspection passes, the remaining circuits are computed to determine the final output of the circuits.

[0015] The technical solution of the present invention is as follows:

[0016] A fluid secure multi-party computation method based on replicated secret sharing, running on a client-server (C / S) architecture. The client-server architecture includes several clients and several groups of servers. The client outsources the computing task to a group of servers; it is assumed that the adversary can corrupt at most less than half of the clients, and the number of corrupted servers in a group of servers participating in each round of computation does not exceed half; it includes:

[0017] The client generates a key to generate shares corresponding to the input, and sends the key and some shares to a group of servers participating in the first round of calculation;

[0018] A server in a group of servers in the first round of calculation generates a multiplication triplet using the key sent by the client, and forms a replicated secret sharing share of the multiplication triplet in the server for checking the multiplication result in the calculation process;

[0019] The server performs calculations based on the circuit (used to calculate the agreed function) and verifies the multiplication results during the calculation process. If there is no problem, the multiplication results are sent to the participants in the next round of calculations.

[0020] When the last round of calculation is completed, the server sends the calculation results to the client, and the client restores the calculation results.

[0021] Preferably, according to the present invention, the client generates a key, generates a corresponding input share, and sends the key and a part of the share to a group of servers participating in the first round of calculation; including:

[0022] Setting up a client-server architecture includes the client server use Represents the i-th client, using Represents a group of servers participating in the lth round of calculation, using Indicates the jth server participating in the lth round of calculation, using represents the replication secret share;

[0023] For each client A set of servers calculated according to the first round quantity generate random keys, where n>2t+1, use the key to call the share protocol to calculate the corresponding share and send it to a group of servers participating in the first round of calculation

[0024] Further preferably, the share protocol is called using the key to calculate the corresponding share, including:

[0025] Assume that there are n participants holding shares, and less than or equal to t participants cannot recover the secret value corresponding to the share, while any t participants plus an additional participant can recover the secret value corresponding to the share. t is the threshold of the RSS. Assuming that the client shares the secret value v, a group of servers in the first round of calculation The size is n, then the maximum unqualified set of servers is The client needs to generate shares, each share is generated by a pseudo-random number generator according to a key k T Generate; when the client shares the secret value v, it chooses a special share And the key k T Send to server Will Send to server

[0026] According to the preferred embodiment of the present invention, a group of servers in the first round of calculation The server in generates a multiplication triplet using the key sent by the client, and generates the corresponding replication secret sharing share of the multiplication triplet according to the number of multiplication gates in this round of calculation. include:

[0027] First, the server uses a pseudo-random number generator to generate a random number based on the key k T Generate the replicated secret share corresponding to the client input;

[0028] Second, use the random number generator to generate a random number based on the key k T Generate NB+C random numbers as the replication secret shares of a and b in the multiplication triplet, and multiply the corresponding shares of a and b to obtain the addition secret share of c in the multiplication triplet;

[0029] Finally, through interaction, the addition secret share of c in the multiplication triplet is sent to the corresponding server according to the RSS threshold, and the replication secret sharing share corresponding to NB+C multiplication triplet is formed in the server.

[0030] According to the preferred embodiment of the present invention, a group of servers in the first round of calculation The server uses the shares sent by the client to perform corresponding calculations according to the circuit and verifies the multiplication results during the calculation process, including:

[0031] A set of servers for the first round of calculations The server in verifies the generated multiplication triples using the verify protocol based on the Cut-and-choose technique to check whether the equation c = a·b holds.

[0032] Use the multiplication triplet to verify the result of the current round of multiplication. If the execution result is detected to be incorrect during the verification process, the corrupt party is determined by comparing the consistency of the share hash. The corrupt party is eliminated and the current round of calculation is repeated. If there is no problem with the verification, the multiplication result is sent to a group of servers participating in the next round of calculation using the secret sharing protocol for iterative execution until the last round of calculation.

[0033] Further preferably, the generated multiplication triplet is verified using a verify protocol based on a Cut-and-choose technique, including:

[0034] The server publishes C multiplication triplets, each server verifies whether the published C multiplication triplets are correct, and divides the remaining NB multiplication triplets into N groups, where N corresponds to the number of multiplication gates in the current round;

[0035] For each set of multiplication triplets, the server calls the verify protocol and uses the next B-1 multiplication triplets to verify the first multiplication triplet.

[0036] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of a streaming secure multi-party computing method based on replicated secret sharing when executing the computer program.

[0037] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a streaming secure multi-party computing method based on replicated secret sharing.

[0038] A mobile secure multi-party computing system based on replicated secret sharing, comprising:

[0039] The module for generating a key and a share of a corresponding input is configured as follows: the client generates a key for generating a share of a corresponding input, and sends the key and a portion of the share to a group of servers participating in the first round of calculation;

[0040] The module for generating multiplication triples and corresponding copy secret sharing shares is configured as follows: a server in a group of servers in the first round of calculation uses the key sent by the client to generate a multiplication triple, and forms a copy secret sharing share of the multiplication triple in the server, which is used to check the multiplication result in the calculation process; the module for verifying the multiplication result is configured as follows: the server performs calculation according to the circuit and verifies the multiplication result in the calculation process, and sends the multiplication result to the participants in the next round of calculation if there is no problem;

[0041] The calculation result recovery module is configured as follows: when the last round of calculation is completed, the server sends the calculation result to the client, and the client recovers the calculation result.

[0042] The beneficial effects of the present invention are:

[0043] 1. The present invention breaks the limitation that the participants need to run the preprocessing stage in advance to generate triples, and truly realizes that the participants can exit or rejoin at will during the execution of the computing task without interrupting the computing task.

[0044] 2. The present invention uses a pseudo-random number generator to generate replicated secret shares based on random keys. In the secret sharing stage, even if the participants have a large amount of data, they only need to send a random key and a selected share corresponding to each piece of data to complete the sharing of the secret value, which greatly reduces the communication volume.

[0045] 3. The present invention reconstructs the calculation process of Fluid MPC so that Fluid MPC can achieve guaranteed output delivery. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Schematic diagram of the secret sharing protocol based on (1,3)-RSS;

[0047] Figure 2 Schematic diagram of the computing task execution process. DETAILED DESCRIPTION

[0048] The present invention will be further described below in conjunction with the embodiments, but it does not constitute any limitation to the present invention. Any limited number of modifications made by anyone within the scope of the claims of the present invention are still within the scope of the claims of the present invention.

[0049] A method for mobile secure multi-party computation based on replicated secret sharing, running on a client-server (C / S) architecture, which includes several clients and several groups of servers. The client outsources the computing task to a group of servers; different assumptions are made on the client and the server: 1) It is assumed that the adversary's corruption of the client is static, that is, after determining the clients participating in the computing task, the adversary selects the client to be corrupted, and it remains unchanged during the subsequent computing tasks; 2) The computing task is divided into multiple rounds, and the participants of each round of tasks do not have to remain the same, and the adversary can decide which servers to corrupt at any time from the beginning of each round until the end of the current round of calculation. It is assumed that the adversary corrupts less than half of the clients at most, and no more than half of the servers in the group of servers participating in each round of calculation are corrupted; including:

[0050] Client Generate a key to generate the corresponding input share, and send the key and part of the share to a group of servers participating in the first round of calculation

[0051] In order to prevent malicious adversaries from doing evil during the calculation process, a group of servers in the first round of calculation The server in the algorithm uses the key sent by the client to generate a multiplication triplet and forms a replicated secret sharing share of the multiplication triplet in the server for checking the multiplication result during the calculation process. This operation not only prevents malicious adversaries from doing evil during the calculation process, but also saves the participants from having to run a preprocessing protocol in advance. Therefore, if a new user wants to join the calculation task during the calculation process, the user can join directly without additional communication.

[0052] The server performs calculations based on the circuit (used to calculate the agreed function) and verifies the multiplication results during the calculation process. If there is no problem, the multiplication results are sent to the participants in the next round of calculations.

[0053] When the last round of calculation is completed, the server sends the calculation results to the client in the form of shares, and the clients interact with each other to restore the calculation results.

[0054] In some specific embodiments of the present invention, the client Generate a key, generate shares corresponding to the input, and send the key and some shares to a group of servers participating in the first round of calculations include:

[0055] Setting up a client-server architecture includes the client server use Represents the i-th client, using Represents a group of servers participating in the lth round of calculation, using Indicates the jth server participating in the lth round of calculation, using represents the replication secret share;

[0056] For each client A set of servers calculated according to the first round quantity generate random keys, where n>2t+1, use the key to call the share protocol to calculate the corresponding share and send it to a group of servers participating in the first round of calculation

[0057] In some specific embodiments of the present invention, the share protocol is called using a key to calculate the corresponding share, including:

[0058] Since RSS is a threshold secret sharing scheme, that is, it is assumed that there are n participants holding shares, and less than or equal to t participants cannot recover the secret value corresponding to the share, and any t participants plus an additional participant can recover the secret value corresponding to the share. t is the threshold of the RSS, so the client needs to generate a corresponding number of shares according to the number of servers. Assuming that the client shares the secret value v, a group of servers in the first round of calculation The size is n, then the maximum unqualified set of servers is The client needs to generate shares, each share is generated by a pseudo-random number generator according to a key k T To reduce the amount of communication, the client selects a special share when sharing the secret value v And the key k T Send to server Will Send to server

[0059] In some specific embodiments of the present invention, a group of servers in the first round of calculation The server in generates a multiplication triplet using the key sent by the client, and generates the corresponding replication secret sharing share of the multiplication triplet according to the number of multiplication gates in this round of calculation. include:

[0060] First, the server uses a pseudo-random number generator to generate a random number based on the key k k Generate the replicated secret share corresponding to the client input;

[0061] Second, use the random number generator to generate a random number based on the key k T Generate NB+C random numbers as the replication secret shares of a and b in the multiplication triplet, and multiply the corresponding shares of a and b to obtain the addition secret share of c in the multiplication triplet;

[0062] Finally, through interaction, the addition secret share of c in the multiplication triplet is sent to the corresponding server according to the RSS threshold, and the replication secret sharing share corresponding to NB+C multiplication triplet is formed in the server.

[0063] In some specific embodiments of the present invention, a group of servers in the first round of calculation The server uses the shares sent by the client to perform corresponding calculations according to the circuit and verifies the multiplication results during the calculation process, including:

[0064] Since a replicated secret sharing scheme is used, each server can complete operations such as addition and multiplication on the shares without interaction. During the calculation process, a share may be held by multiple servers, and multiple servers may repeatedly calculate a multiplication cross term during the calculation process. To solve the above problem, the present invention defines a mapping function ρ, which is used to specify the multiplication cross term calculated by the server.

[0065] The multiplication triplets generated by the server have not been verified, so the correctness of the multiplication triplets cannot be determined, and the multiplication results cannot be verified using these multiplication triplets. Therefore, the multiplication triplets need to be verified using the Cut-and-choose technique. A group of servers in the first round of calculations The server in verifies the generated multiplication triples using the verify protocol based on the Cut-and-choose technique to check whether the equation c = a·b holds.

[0066] Use the multiplication triplet to verify the multiplication result of the current round; if the execution result is detected to be incorrect during the verification process, the corrupt party is identified by comparing the consistency of the share hash; all participants are required to disclose the hash value of the share during the calculation process. Since RSS allows a share to be held by multiple participants, and the participants are the honest majority, the corrupt party can be identified by comparing the hash value of the local share with the hash value disclosed by other participants, and the corrupt party is eliminated and the current round of calculation is repeated; if there is no problem with the verification, the multiplication result is sent to a group of servers participating in the next round of calculation using the secret sharing protocol for iterative execution until the last round of calculation;

[0067] If the verification result is incorrect, the server can publicly disclose the hash value of the share sent in this round. Since one share will be held by multiple servers, and most of the servers in each round are honest, the corrupt party can be confirmed by comparing the hash value. After the corrupt party is determined, the corrupt party can be eliminated and the remaining honest servers will re-calculate this round. After the current round of calculation is completed, the server should use the same secret sharing method as the client to send the calculation results of this round to the servers participating in the next round of calculation, and iterate in sequence until the last round of calculation is completed.

[0068] In some specific embodiments of the present invention, the generated multiplication triples are verified using a verify protocol based on a Cut-and-choose technique, including:

[0069] The server publishes C multiplication triplets, each server verifies whether the published C multiplication triplets are correct, and divides the remaining NB multiplication triplets into N groups, where N corresponds to the number of multiplication gates in the current round;

[0070] For each set of multiplication triplets, the server calls the verify protocol and uses the next B-1 multiplication triplets to verify the first multiplication triplet.

[0071] This embodiment combines the characteristics of replicated secret sharing and the mobile secure multi-party computing framework to propose a new share conversion protocol: ProtocolΠ share (v) This protocol enables the secret sharer to use the key to calculate a special share locally and send the special share and the key to the corresponding calculation party. Even if the secret sharer has a large amount of data, only one share needs to be sent for each piece of data, and the number of keys remains unchanged, such as Figure 1 As shown, the specific algorithm is as follows:

[0072]

[0073] This embodiment combines the Cut-and-choose technology to verify the calculation results of the servers participating in each round of calculation. This technology can make the server not have to run a preprocessing stage in advance. Therefore, the present invention realizes true fluidity, that is, participants can dynamically join or exit the calculation task without interrupting the task execution, and also allows new participants to join the calculation, which greatly improves flexibility. Figure 2 As shown in the figure, the verification protocol based on Cut-and-choose The specific process is as follows:

[0074]

[0075]

[0076] The present invention reconstructs the computational flow of the existing mobile secure multi-party computation framework, increases the original two processes in the computation phase to four processes, adds a setup process for generating multiplication triples, and a check process for checking the multiplication results of the current computation. In addition, the corrupt party can be located during the check process, so the present solution can achieve the highest security guarantee in secure multi-party computation: Guaranteed Output Delivery (GOD).

[0077] A computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the above-mentioned mobile secure multi-party computing method based on replicated secret sharing are implemented.

[0078] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned mobile secure multi-party computing method based on replicated secret sharing.

[0079] A mobile secure multi-party computing system based on replicated secret sharing, comprising:

[0080] The key and corresponding input share generation module is configured as: client Generate a key to generate the corresponding input share, and send the key and part of the share to a group of servers participating in the first round of calculation

[0081] The module for generating multiplication triples and corresponding replication secret sharing shares is configured as follows: In order to prevent malicious adversaries from doing evil during the calculation process, a group of servers in the first round of calculation The server in the method generates a multiplication triplet using the key sent by the client, and forms a copy of the secret sharing share of the multiplication triplet in the server for checking the multiplication result in the calculation process; the multiplication result verification module is configured as follows: the server performs calculation according to the circuit (used to calculate the agreed function) and verifies the multiplication result in the calculation process, and sends the multiplication result to the participants in the next round of calculation if there is no problem;

[0082] The calculation result recovery module is configured as follows: when the last round of calculation is completed, the server sends the calculation result to the client in the form of shares, and the calculation result is restored by interaction between the clients.

Claims

1. A mobile secure multi-party computing method based on replicated secret sharing, characterized in that: It runs on a client-server architecture, which consists of several clients and several groups of servers. The clients outsource computing tasks to a group of servers. Assume that the adversary can corrupt less than half of the clients at most, and no more than half of the servers participating in each round of calculation are corrupted; including: The client generates a key to generate shares corresponding to the input, and sends the key and some shares to a group of servers participating in the first round of calculation; A server in a group of servers in the first round of calculation generates a multiplication triplet using the key sent by the client, and forms a replicated secret sharing share of the multiplication triplet in the server for verifying the multiplication result in the calculation process; The server performs calculations based on the circuit and verifies the multiplication results during the calculation process. If there are no problems, the multiplication results are sent to the participants in the next round of calculations. When the last round of calculation is completed, the server sends the calculation results to the client, and the client restores the calculation results; A set of servers for the first round of calculations The server in generates a multiplication triplet using the key sent by the client, and generates the corresponding replication secret sharing share of the multiplication triplet according to the number of multiplication gates in this round of calculation. include: First, the server uses a pseudo-random number generator to generate a random number based on the key k T Generate the replicated secret share corresponding to the client input; Second, use the random number generator to generate a random number based on the key k T Generate NB+C random numbers as the replication secret shares of a and b in the multiplication triplet, and multiply the corresponding shares of a and b to obtain the addition secret share of c in the multiplication triplet; Finally, through interaction, the addition secret share of c in the multiplication triplet is sent to the corresponding server according to the RSS threshold, and the replication secret sharing share corresponding to NB+C multiplication triplet is formed in the server. A set of servers for the first round of calculations The server uses the shares sent by the client to perform corresponding calculations according to the circuit and verifies the multiplication results during the calculation process, including: A set of servers for the first round of calculations The server in verifies the generated multiplication triples using the verify protocol based on the Cut-and-choose technique to check whether the equation c = a·b holds. Use the multiplication triplet to verify the result of the current round of multiplication. If an incorrect execution result is detected during the verification process, the corrupt party is identified by comparing the consistency of the share hash. The corrupt party is eliminated and the current round of calculation is repeated. If there is no problem with the verification, the multiplication result is sent to a group of servers participating in the next round of calculation using a secret sharing protocol for iterative execution until the last round of calculation.

2. The method for mobile secure multi-party computing based on replicated secret sharing according to claim 1, characterized in that: The client generates a key, generates shares corresponding to the input, and sends the key and some shares to a group of servers participating in the first round of calculations; including: Setting up a client-server architecture includes the client server use Represents the i-th client, using Represents a group of servers participating in the lth round of calculation, using Indicates the jth server participating in the lth round of calculation, using represents the replication secret share; For each client A set of servers calculated according to the first round quantity generate random keys, where n>2t+1, use the key to call the share protocol to calculate the corresponding share and send it to a group of servers participating in the first round of calculation 3. The method for mobile secure multi-party computing based on replicated secret sharing according to claim 2, characterized in that: Use the key to call the share protocol to calculate the corresponding share, including: Assume that there are n participants holding shares, and less than or equal to t participants cannot recover the secret value corresponding to the share, while any t participants plus an additional participant can recover the secret value corresponding to the share. t is the threshold of the RSS. Assuming that the client shares the secret value v, a group of servers in the first round of calculation The size is n, then the maximum unqualified set of servers is The client needs to generate shares, each share is generated by a pseudo-random number generator according to a key k T Generate; when the client shares the secret value v, it chooses a special share And the key k T Send to server Will Send to server 4. A mobile secure multi-party computing method based on replicated secret sharing according to any one of claims 1 to 3, characterized in that: The generated multiplication triples are verified using the verify protocol based on the Cut-and-choose technique, including: The server publishes C multiplication triplets, each server verifies whether the published C multiplication triplets are correct, and divides the remaining NB multiplication triplets into N groups, where N corresponds to the number of multiplication gates in the current round; For each set of multiplication triplets, the server calls the verify protocol and uses the next B-1 multiplication triplets to verify the first multiplication triplet.

5. A mobile secure multi-party computing system based on replicated secret sharing, characterized in that: include: The module for generating a key and a share of a corresponding input is configured as follows: the client generates a key for generating a share of a corresponding input, and sends the key and a portion of the share to a group of servers participating in the first round of calculation; The module for generating multiplication triples and corresponding copy secret sharing shares is configured as follows: a server in a group of servers in the first round of calculation uses the key sent by the client to generate a multiplication triple, and forms a copy secret sharing share of the multiplication triple in the server, which is used to check the multiplication result in the calculation process; the module for verifying the multiplication result is configured as follows: the server performs calculation according to the circuit and verifies the multiplication result in the calculation process, and sends the multiplication result to the participants in the next round of calculation if there is no problem; The calculation result recovery module is configured as follows: when the last round of calculation is completed, the server sends the calculation result to the client, and the client recovers the calculation result; A set of servers for the first round of calculations The server in generates a multiplication triplet using the key sent by the client, and generates the corresponding replication secret sharing share of the multiplication triplet according to the number of multiplication gates in this round of calculation. include: First, the server uses a pseudo-random number generator to generate a random number based on the key k T Generate the replicated secret share corresponding to the client input; Second, use the random number generator to generate a random number based on the key k T Generate NB+C random numbers as the replication secret shares of a and b in the multiplication triplet, and multiply the corresponding shares of a and b to obtain the addition secret share of c in the multiplication triplet; Finally, through interaction, the addition secret share of c in the multiplication triplet is sent to the corresponding server according to the RSS threshold, and the replication secret sharing share corresponding to NB+C multiplication triplet is formed in the server. A set of servers for the first round of calculations The server uses the shares sent by the client to perform corresponding calculations according to the circuit and verifies the multiplication results during the calculation process, including: A set of servers for the first round of calculations The server in verifies the generated multiplication triples using the verify protocol based on the Cut-and-choose technique to check whether the equation c = a·b holds. Use the multiplication triplet to verify the result of the current round of multiplication. If an incorrect execution result is detected during the verification process, the corrupt party is identified by comparing the consistency of the share hash. The corrupt party is eliminated and the current round of calculation is repeated. If there is no problem with the verification, the multiplication result is sent to a group of servers participating in the next round of calculation using a secret sharing protocol for iterative execution until the last round of calculation.

Images