Communication method in secure multi-party computation protocol based on linear secret sharing technique

Abstract

The application discloses a communication method in a secure multi-party computation protocol based on linear secret sharing technology, for N nodes with M secret values, each node cuts its own secret sharing value into N parts, the method comprising: two N-1 rounds of communication are carried out according to a predetermined order and method, so that after the communication ends, each node contains all M original secret values; wherein in the first communication process, node i sends its i, i-1, i-2... part of secret sharing value to the next node i+1 in turn, and node i+1 adds its i, i-1, i-2... part of secret sharing value after receiving; in the second communication process, node i sends its i+1, i, i-1, i-2... part of secret sharing value to the next node in turn, and node i+1 replaces its i+1, i, i-1, i-2... part of secret sharing value with the received secret sharing value.

Description

Technical Field

[0001] This invention relates to the field of secure multi-party computation and proposes a new communication mode design in secure multi-party computation protocols, especially a communication method in secure multi-party computation protocols based on linear secret sharing technology. Background Technology

[0002] Building a platform to bridge data silos while remaining legal and compliant is a pressing global industry challenge. Secure Multi-Party Computation (SMC) is a cryptographic method that allows multiple participants to collaboratively compute the result of a function without revealing their individual inputs. Secure Multi-Party Learning (SMC) refers to privacy-preserving machine learning methods and frameworks based on SMC. It helps data holders establish communication channels between data silos, enabling secure collaborative training of machine learning models while ensuring data privacy and model training effectiveness. In SMC, data privacy and computational security often rely on (linear) secret sharing schemes. However, the significant communication overhead during the recovery phase of (linear) secret sharing has become a major obstacle to model training using SMC. Therefore, designing efficient secure multi-party computation protocols has become a current research hotspot.

[0003] Secret Sharing (SS) is a distributed security protocol in cryptography used to manage and protect symmetric secrets. It is an important cryptographic primitive and a crucial component in the design of complex secure multi-party computation protocols. This protocol allows a secret (such as an encryption key, important credentials, or sensitive data) to be distributed into multiple sub-secrets (shares), each of which individually provides no information about the original secret. Secret sharing techniques typically involve two phases: secret splitting and secret recovery. The secret splitting phase decomposes the original secret into multiple parts, and each part individually contains no information about the original secret. The secret recovery phase is generally linear. For a linear secret sharing scheme (LinearSS), the secret shares of a specified number of participants must be linearly summed using a specified algorithm to recover the original secret value. Communication between multiple participants is also involved in the secret recovery phase.

[0004] Based on the number of parties required during the recovery process, it can be divided into Strict Secret Sharing (Strict SS) and Threshold Secret Sharing (threshold SS). In Strict Secret Sharing, all sub-secrets are required to recover the original secret value. In Threshold Secret Sharing, only a set of sub-secrets that exceed the set threshold number can recover the original secret. Among the strict secret sharing methods, the most widely used scheme is Additive Secret Sharing. Among the threshold secret sharing methods, there are methods such as Shamir Secret Sharing, Brickell Secret Sharing, and Brickell Secret Sharing, and the most widely used is Shamir Secret Sharing.

[0005] In Additive Secret Sharing, assume there are n parties in total, and the secret value is S. During the secret splitting phase, first select a large prime number p such that S < p; randomly select n - 1 numbers r1, r2,..., r n-1 , each number is less than p; calculate the nth share r n = S - (r1 + r2 +... + r n-1 ) mod p. During the secret recovery phase, it is necessary to accumulate the secret sharing values of n parties to obtain the original secret value, that is, S = (r1 + r2 +... + r n ) mod p. In the recovery phase, multiple parties need to communicate with their respective secret sharing values as data.

[0006] In Shamir Secret Sharing, a (t, n) threshold design is adopted. Assume there are n parties in total, the secret value is S, and the threshold is t. Only when there are no less than t secret sharing values can the original secret value be recovered. During the secret splitting phase, select a large prime number p such that S < p; construct a polynomial f(x) of degree (t - 1) = a0 + a1x +... + a t-1 x t-1 , where a0 = S, and other coefficients a1,..., a t-1 are randomly selected and less than p; generate n shares, each share is (x i , f(x i ) mod p), where x i is a unique non-zero positive integer. In the secret recovery phase, use the Lagrange interpolation formula, where y i is the value of f(x i ) in the share, x i and x j are the x values in the share, l i(0) is the Lagrange multiplier of participant i (a constant value given the participants are determined). During the recovery phase, multiple participants need to communicate their respective (Lagrange multiplier weighted) secret share values ​​as data.

[0007] Regardless of the secret sharing method used, during the recovery process, all parties involved in the recovery operation need to communicate and share their respective secret sharing values ​​to obtain the final secret sharing value. Currently, the most common communication models are often the Parameter-Server model or the Tree model.

[0008] In Parameter Server mode, one node out of N nodes acts as the "Server," or central node, communicating with the other N-1 nodes. This central node retrieves the shared secret value from all N nodes, reconstructs the value, and then broadcasts the original secret value to the remaining N-1 nodes. In this mode, the amount of data to be transmitted is 2M(N-1), where M is the amount of data contained in a single node. Because the selected central node bears all the communication load, the required communication time is 2M(N-1) / B, where B is the bandwidth of each node. This mode has a significant drawback: while one node is communicating with the central node, all other nodes are idle, essentially wasting their bandwidth and network communication capabilities.

[0009] Another pattern is the Tree organization pattern, used in secure multi-party learning frameworks such as MP-SPDZ. In this pattern, all nodes are organized into a tree structure. One node serves as the root node, and the remaining nodes are organized into several layers. Logically, this pattern is the same as the Parameter Server pattern, except that the overall communication is divided into multiple rounds, the number of rounds being the height of the tree. Each communication is between two layers of the tree, with the secret shared values ​​of all nodes aggregating from the leaf nodes to the root node. Finally, the root node integrates all the secret shared values ​​and restores them, then broadcasts the original secret values ​​back to the leaf nodes layer by layer in the reverse direction. In this scheme, the number of communication rounds increases to 2log. k N, where the communication load of a single node in the parent layer is kM in each round, therefore the overall communication time is 2kMlog. k N. This scheme optimizes the overall communication time from linear growth of the number of communication nodes to logarithmic growth. However, in a certain round of actual communication, only the nodes involved in two layers are in a communication state, while the remaining nodes are still idle. Therefore, the utilization rate of bandwidth for all nodes is still inefficient. Summary of the Invention

[0010] Because the secret recovery phase requires combining the secret shared values ​​contained in all nodes, all parties involved need to participate in the communication process. Only by maximizing the communication capabilities of all nodes can the communication speed be maximized, but neither the existing Parameter-Server nor Tree models maximize the communication capabilities of all nodes.

[0011] To address the aforementioned problems in existing technologies, the purpose of this application is to provide a communication method in a secure multi-party computation protocol based on linear secret sharing technology. This invention can fully utilize the communication capabilities of all participating parties, ensuring that the communication scheme achieves optimal node bandwidth.

[0012] This application provides a communication method in a secure multi-party computation protocol based on linear secret sharing technology. For N nodes with an average of M secret sharing values, each node divides its own secret sharing value into N parts. The method includes:

[0013] The nodes communicate twice in a predetermined order and method, N-1 rounds, so that after the communication ends, each node contains all M secret value results, thus realizing the recovery of the secret shared value;

[0014] In the first communication, node i sends its i-th, i-1, i-2, ... secret sharing value to the next node i+1 in sequence. After receiving the value, node i+1 adds it to its own i-th, i-1, i-2, ... secret sharing value. In the second communication, node i sends its i+1, i, i-1, i-2, ... secret value to the next node in sequence. Node i+1 replaces its own i+1, i, i-1, i-2, ... data with the received secret value.

[0015] This communication method is applicable to both additive secret sharing and Shamir secret sharing techniques. The only difference is that in the secret recovery of Shamir secret sharing, the secret sharing value of the node needs to be pre-weighted using Lagrange coefficients. The remaining communication process is consistent between the two different secret sharing techniques.

[0016] Furthermore, the first N-1 rounds of communication are performed according to a predetermined order and method, specifically as follows:

[0017] In the first round of communication, node 1 sends the first secret shared value to node 2, and node 2 receives it and adds it to its own first secret shared value; node 2 sends the second secret shared value to node 3, and node 3 receives it and adds it to its own second secret shared value... node N sends the Nth secret shared value to node 1, and node 1 receives it and adds it to its own Nth secret shared value;

[0018] In the second round of communication, node 2 sends the first secret shared value to node 3, and node 3 receives it and adds it to its own first secret shared value; node 3 sends the second secret shared value to node 4, and node 4 receives it and adds it to its own second secret shared value... node 1 sends the Nth secret shared value to node 2, and node 2 receives it and adds it to its own Nth secret shared value;

[0019] The communication process for the remaining rounds follows the same principle;

[0020] After N-1 rounds of communication, node 1 obtains the secret value of the second data, node 2 obtains the secret value of the third data, and so on, node N obtains the secret value of the first data.

[0021] Furthermore, the second N-1 round of communication is performed according to the predetermined order and method, specifically as follows:

[0022] In the first round of communication, node 1 sends the second secret value to node 2, and node 2 replaces its own second data with the received value after receiving it; node 2 sends the third secret value to node 3, and node 3 replaces its own third data with the received value after receiving it... node N sends the first secret value to node 1, and node 1 replaces its own first data with the received value after receiving it.

[0023] In the second round of communication, node 2 sends the second secret value to node 3. After receiving it, node 3 replaces its own second data with the received value. Node 3 sends the third secret value to node 4. After receiving it, node 4 replaces its own third data with the received value. ... Node 1 sends the first secret value to node 2. After receiving it, node 2 replaces its own first data with the received value.

[0024] The communication in the remaining rounds follows the same pattern;

[0025] After N-1 rounds of communication, all N nodes have obtained all M copies of the secret value result.

[0026] Furthermore, the N nodes adopt a ring structure with the beginning and end connected. In each round of communication, each node only sends and receives data with its neighboring nodes in the sequential direction.

[0027] This application also provides a secure multi-party computation method, which performs secure multi-party computation based on linear secret sharing technology (including MP-SPDZ framework, BMR protocol, Multi-party Shuffle protocol, Multi-party RSS protocol, etc.) through the above-mentioned communication method.

[0028] This application also provides a secure multi-party learning method in a wide area network (WAN), which includes several servers, and the servers perform secure multi-party learning through the above-described communication method.

[0029] This application also provides a fraud prevention joint analysis method, including:

[0030] Each financial institution anonymizes or de-identifies its local sensitive information and standardizes the processed local customer financial information. It then uses the aforementioned communication methods to secretly share the standardized local customer financial information, thereby obtaining the local customer financial information of other financial institutions.

[0031] Financial institutions use the aforementioned communication methods to identify fraud patterns based on a secure multi-party learning framework.

[0032] This application also provides an electronic device, including:

[0033] One or more processors;

[0034] Memory, used to store one or more programs;

[0035] When the one or more programs are executed by the one or more processors, the one or more processors implement the above-described communication method.

[0036] This application discloses a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the aforementioned communication method.

[0037] The technical solutions provided by the embodiments of this application may include the following beneficial effects:

[0038] This application proposes a novel communication mode for the linear secret value recovery phase, based on the communication scheduling concept in multi-machine, multi-GPU server clusters in distributed machine learning and the similarity between communication tasks and the communication tasks in the linear secret value recovery phase of the distributed machine learning framework. This method utilizes the All-Reduce set communication primitive to ensure the correctness of the communication process in the secret value recovery phase of the secret sharing process, while also ensuring that all nodes can obtain the final correct secret value. By employing the Ring All-Reduce implementation method, it fully utilizes the bandwidth of each node, ensuring that all communication data is evenly distributed across all nodes during the communication process. This optimizes the communication time dependence on the number of nodes from linear to constant, achieving bandwidth optimization.

[0039] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0041] Figure 1 This is a schematic diagram illustrating a data packet operation in secret-shared value recovery using a communication method in a secure multi-party computation protocol based on linear secret-sharing technology, according to an exemplary embodiment.

[0042] Figure 2 This is a schematic diagram illustrating the first N-1 rounds of communication in the recovery of a secret shared value using a communication method in a secure multi-party computation protocol based on linear secret sharing technology, according to an exemplary embodiment.

[0043] Figure 3 This is a schematic diagram illustrating the second N-1 round of communication in the recovery of a secret shared value using a communication method in a secure multi-party computation protocol based on linear secret sharing technology, according to an exemplary embodiment.

[0044] Figure 4 This is a schematic diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0046] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0047] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0048] This invention aims to redesign the communication mode in current secure multi-party computation protocols based on linear secret sharing technology, based on the communication scheduling concept of multi-machine, multi-GPU server clusters in distributed machine learning. It utilizes a set communication primitive similar to "Ring All-Reduce" to schedule communication and computation between different nodes in the secure multi-party computation protocol, achieving bandwidth-optimized communication and optimizing the dependence of the overall communication time on the number of nodes from linear to constant. Specifically:

[0049] Secure multi-party computation (SMPC) technology enables a group of untrusted participants to securely collaborate on a given function using their respective data. While ensuring that each participant obtains the correct computation result, it restricts them from obtaining any information other than the computation result.

[0050] Collective communication, distinct from end-to-end communication, is a novel communication model within existing distributed machine learning frameworks. This model involves communication between multiple processes to achieve data sharing and exchange required during distributed model training. Primitive operations such as Broadcast, Scatter, (All)Gather, and (All)Reduce, included in collective communication, are widely applied in the specific communication processes of distributed model training.

[0051] All-Reduce is a collection communication primitive that requires aggregating data across all nodes and updating the results to all nodes. It includes a series of implementation methods such as Parameter Server, Recursive Halving & Doubling, Butterfly-like All-Reduce, and Ring All-Reduce. These methods exhibit different performances due to factors such as communication latency, node bandwidth, number of nodes, and amount of communication data.

[0052] The Ring All-Reduce communication mode is a redesign of the connection method and communication order of communication nodes. Unlike the previous fully connected mode (where each node communicates with every other node, and in each round of communication, only one node is selected to transmit information unidirectionally with all other nodes) and tree-connected mode (where each node only communicates with its parent and child nodes, and in each round of communication, only two levels of nodes have unidirectional communication connections, wasting the bandwidth of other nodes), this scheme arranges all nodes into a ring structure in a specific order. Data flows along the ring according to the order of the nodes within the ring, while optimizing the overall communication time complexity to an order of magnitude independent of the number of nodes. This scheme can fully utilize the bandwidth of each node, ensuring that all communication data is evenly distributed among all nodes during the communication process.

[0053] In each round of communication, each node only sends or receives information with its neighboring nodes in the sequential direction. In each round of communication, all nodes participate and only need to establish communication connections with two nodes, ensuring the efficiency of communication and the effective utilization of bandwidth by all nodes.

[0054] This application utilizes the Ring All-Reduce communication mode in the recovery process of linear secret shared values, proposing a communication method in a secure multi-party computation protocol based on linear secret sharing technology. For N nodes with an average of M secret shared values, each node divides its own secret shared value into N parts, where each part contains M / N independent secret shared values ​​that need to undergo All-Reduce operations. The method includes:

[0055] The nodes perform two rounds of communication in a predetermined order and method, such that after the communication ends, each node contains all M secret value results, thus realizing the recovery of the secret shared value;

[0056] In the first communication, node i sends its i-th, i-1, i-2, ... secret sharing value to the next node i+1 in sequence. After receiving the value, node i+1 adds it to its own i-th, i-1, i-2, ... secret sharing value. In the second communication, node i sends its i+1, i, i-1, i-2, ... secret value to the next node in sequence. Node i+1 replaces its own i+1, i, i-1, i-2, ... data with the received secret value.

[0057] In the 2(N-1) rounds of communication, each node in each round performs send and receive communication operations with two nodes respectively, with a corresponding data load of M / N. Since the pairwise data transmission process is parallel, the overall communication time is 2M(N-1) / N. In this mode, the communication time changes from a linear or logarithmic dependence on the number of communication nodes (secret sharing recovery participants) N to an independent dependence, ensuring that the overall communication time is independent of the number of communication nodes.

[0058] This application utilizes the Ring All-Reduce communication model in the process of restoring secret shared values, which ensures that all nodes participate in each round of communication, and each participant does not communicate with all other participants, but only with the two "adjacent" participants. More specifically, it mainly follows the following process:

[0059] Suppose there are N nodes, each containing M secret shared values ​​(M>N in general), and each node is labeled (1, 2, ..., N).

[0060] First, each node equally divides its secret share value into N parts, where each part contains M / N independent secret share values ​​that need to be all-reduce. However, the secret share value cannot be equally divided in all cases. In such cases, it is sufficient to ensure that the parts are as equal as possible, generally guaranteeing that the difference in the number of secret share values ​​in any two parts does not exceed one. Furthermore, this approximate equal division does not affect the correctness of the result; it only fails to guarantee that the theoretical communication volume of all nodes in each round of communication is absolutely equal, but in reality, the communication time of all nodes in each round of communication will be approximately equal.

[0061] Next, the first N-1 rounds of communication will be conducted according to the following rules:

[0062] ① In the first round of communication, node 1 sends the first secret shared value to node 2. After receiving it, node 2 adds it to its own first secret shared value; node 2 sends the second secret shared value to node 3. After receiving it, node 3 adds it to its own second secret shared value... node N sends the Nth secret shared value to node 1. After receiving it, node 1 adds it to its own Nth secret shared value;

[0063] ② In the second round of communication, node 2 sends the first secret shared value to node 3. After receiving it, node 3 adds it to its own first secret shared value; node 3 sends the second secret shared value to node 4. After receiving it, node 4 adds it to its own second secret shared value... node 1 sends the Nth secret shared value to node 2. After receiving it, node 2 adds it to its own Nth secret shared value;

[0064] ③The communication process for the remaining rounds follows the same pattern;

[0065] ④ After N-1 rounds of communication, node 1 obtains the secret value of the second data, node 2 obtains the secret value of the third data, and so on, node N obtains the secret value of the first data.

[0066] Next, the second round of communication (N-1 rounds) will be conducted according to the following rules:

[0067] ① In the first round of communication, node 1 sends the second secret value to node 2. After receiving it, node 2 replaces its own second data with the received value. Node 2 sends the third secret value to node 3. After receiving it, node 3 replaces its own third data with the received value. ... Node N sends the first secret value to node 1. After receiving it, node 1 replaces its own first data with the received value.

[0068] ② In the second round of communication, node 2 sends the second secret value to node 3. After receiving it, node 3 replaces its own second data with the received value; node 3 sends the third secret value to node 4. After receiving it, node 4 replaces its own third data with the received value... node 1 sends the first secret value to node 2. After receiving it, node 2 replaces its own first data with the received value.

[0069] ③The communication in the remaining rounds follows the same pattern;

[0070] ④ After N-1 rounds of communication, all N nodes have obtained all M copies of the secret value result.

[0071] Furthermore, the N nodes adopt a ring structure with the beginning and end connected. In each round of communication, each node only sends and receives data with its neighboring nodes in the sequential direction.

[0072] In each of the 2(N-1) rounds of communication, the communication load for each node is M / N data. After the (N-1)th round of communication, each node contains the secret value corresponding to one of the N partitions. After the second (N-1)th round of communication, each node contains all M secret value results. In the 2(N-1) rounds of communication, each node in each round performs send and receive communication operations with two nodes respectively, with a corresponding data load of M / N. Since the pairwise data transmission process is parallel, the overall communication time is 2M(N-1) / N. In this mode, the communication time changes from a linear or logarithmic dependence on the number of communication nodes N to an independent one, ensuring that the overall communication time is independent of the communication nodes.

[0073] In secure multi-party learning frameworks, computational tasks are typically compiled into circuits. During compilation, a balance is often sought between circuit depth and the number of nodes. In traditional communication models, too much circuit depth and too few nodes result in excessive computational overhead and insufficient communication overhead; conversely, too many nodes and too little circuit depth lead to insufficient computational overhead and excessive communication overhead. In the new communication model, we can ensure that overall communication time is independent of the number of nodes. Therefore, we can set compilation options to compile computational tasks into circuits with more nodes and less circuit depth. This allows us to minimize computational overhead while maintaining a relatively constant communication overhead, providing important insights for the design of secure multi-party learning frameworks and the balance between computation and communication.

[0074] MP-SPDZ is a widely used secure multi-party learning framework based on MPC technology. Utilizing secure multi-party computation primitives such as secret sharing, unintentional transmission, homomorphic encryption, and obfuscated circuits, MP-SPDZ can perform binary and arithmetic circuit computations under all commonly used security models. In MP-SPDZ, the input data of each participant serves as the original secret value, while the shared secret value is shared among all participants. Addition operations within the MP-SPDZ framework can be directly performed by adding the shared secret values, while multiplication operations require the use of Beaver triples and linear secret sharing techniques.

[0075] Beaver triples are a set of secret shared values ​​that satisfy multiplication properties. Secret sharing multiplication methods based on these triples are widely used in MP-SPDZ and other secure multi-party learning frameworks. In the MP-SPDZ framework, data is stored among the participants in a secret shared form. During secret shared addition, because secret sharing has a naturally homomorphic additive property, only the participants need to perform the addition calculation of the secret shared values, without involving communication. However, during multiplication, Beaver triples are needed to protect privacy data and assist in the multiplication operation. Since this process involves numerous secret shared recovery operations, relatively complex inter-node communication operations are required.

[0076] Suppose all participants need to calculate the product of two secret values, a and b, and [a] and [b] are already secretly shared among all participants (here, [a] represents a set of secretly shared values ​​for secret value a). We need to use an additional set of Beaver triples ([f], [g], [h]), where f, g, and h are all secret values ​​satisfying h = fg, and [f], [g], [h] are the secretly shared values. At this point, c = (a - f + f)(b - g + g) = (af)(bg) + f(bg) + g(af) + fg. Each participant can now calculate the two sets of secretly shared values, [af] and [bg]. We only need to restore these two sets of secretly shared values ​​to obtain the secretly shared value of c: [c] = (af)(bg) + (bg)[f] + (af)[g] + [h]. Therefore, the process of restoring the secretly shared values ​​is the main communication overhead of the secret shared value multiplication in MP-SPDZ.

[0077] Within the MP-SPDZ framework with N nodes, during a certain multiplication step, the introduction of Beaver triples and the recovery of the corresponding two sets of shared secret values ​​necessitates an All-Reduce operation across N nodes. Furthermore, the number of secret values ​​being recovered simultaneously is not limited to one set; depending on the circuit width, there may be many sets.

[0078] The following description is based on an example.

[0079] Figure 1-3 The flowchart of secret sharing recovery communication in secret sharing multiplication computation provided by the embodiment of the present invention (taking N=5 as an example).

[0080] Assume there are N = 5 communication nodes, and the total number of secret values ​​is M. Each of the N nodes holds a secret share corresponding to each secret value. During the secret sharing multiplication phase, the corresponding secret values ​​need to be recovered, and the secret share values ​​of the N nodes need to be summed. The Ring All-Reduce communication mode proposed in this invention is used for communication.

[0081] Figure 1 This corresponds to the data grouping operation. Each node holds M secret sharing values, corresponding to M secret values. First, the M secret sharing values ​​are divided into N groups. Although M / N is not necessarily an integer, it ensures that the amount of data in each group is almost equal. After grouping, each block contains approximately M / N secret sharing values.

[0082] Figure 2 This corresponds to the first group of communication processes, which consists of N-1 rounds, and here it is 4 rounds.

[0083] Figure 2 (a) indicates the first round of communication, which involves the communication operations P0(BLOCK0)→P1(BLOCK0), P1(BLOCK1)→P2(BLOCK1), P2(BLOCK2)→P3(BLOCK2), P3(BLOCK3)→P4(BLOCK3), and P4(BLOCK4)→P0(BLOCK4). After the communication ends, P1(BLOCK0), P2(BLOCK1), P3(BLOCK2), P4(BLOCK3), and P0(BLOCK4) respectively sum the received secret share value and their own secret share value to obtain... Figure 2 The result shown in (b) is shown in the table.

[0084] Figure 2 (c) indicates the second round of communication, which involves the communication operations P1(BLOCK0)→P2(BLOCK0), P2(BLOCK1)→P3(BLOCK1), P3(BLOCK2)→P4(BLOCK2), P4(BLOCK3)→P0(BLOCK3), and P0(BLOCK4)→P1(BLOCK4). After the communication ends, P2(BLOCK0), P3(BLOCK1), P4(BLOCK2), P0(BLOCK3), and P1(BLOCK4) respectively sum the received secret share value and their own secret share value to obtain... Figure 2 The result shown in (d) is shown in the figure.

[0085] Figure 2(e) indicates the third round of communication, which involves the communication operations P2(BLOCK0)→P3(BLOCK0), P3(BLOCK1)→P4(BLOCK1), P4(BLOCK2)→P0(BLOCK2), P0(BLOCK3)→P1(BLOCK3), and P1(BLOCK4)→P2(BLOCK4). After the communication ends, P3(BLOCK0), P4(BLOCK1), P0(BLOCK2), P1(BLOCK3), and P2(BLOCK4) respectively sum the received secret share value and their own secret share value to obtain... Figure 2 The result shown in (f) is shown in the figure.

[0086] Figure 2 (g) indicates the fourth round of communication, which involves the communication operations P3(BLOCK0)→P4(BLOCK0), P4(BLOCK1)→P0(BLOCK1), P0(BLOCK2)→P1(BLOCK2), P1(BLOCK3)→P2(BLOCK3), and P2(BLOCK4)→P3(BLOCK4). After the communication ends, P4(BLOCK0), P0(BLOCK1), P1(BLOCK2), P2(BLOCK3), and P3(BLOCK4) respectively sum the received secret share value and their own secret share value to obtain... Figure 2 The result shown in (h) is as follows.

[0087] Figure 3 This corresponds to the second group of communication processes, which consists of N-1 rounds, and here it is 4 rounds.

[0088] Figure 3 (a) indicates the first round of communication, which involves the communication operations P4(BLOCK0)→P0(BLOCK0), P0(BLOCK1)→P1(BLOCK1), P1(BLOCK2)→P2(BLOCK2), P2(BLOCK3)→P3(BLOCK3), and P3(BLOCK4)→P4(BLOCK4). After the communication ends, P0(BLOCK0), P1(BLOCK1), P2(BLOCK2), P3(BLOCK3), and P4(BLOCK4) respectively overwrite the original secret sharing value with the received secret sharing value to obtain... Figure 3 The result shown in (b) is shown in the table.

[0089] Figure 3(c) indicates the second round of communication, which involves the communication operations P0(BLOCK0)→P1(BLOCK0), P1(BLOCK1)→P2(BLOCK1), P2(BLOCK2)→P3(BLOCK2), P3(BLOCK3)→P4(BLOCK3), and P4(BLOCK4)→P0(BLOCK4). After the communication ends, P1(BLOCK0), P2(BLOCK1), P3(BLOCK2), P4(BLOCK3), and P0(BLOCK4) respectively overwrite the original secret sharing value with the received secret sharing value to obtain... Figure 4 The result shown in (d) is shown in the figure.

[0090] Figure 3 (e) indicates the third round of communication, which involves the communication operations P1(BLOCK0)→P2(BLOCK0), P2(BLOCK1)→P3(BLOCK1), P3(BLOCK2)→P4(BLOCK2), P4(BLOCK3)→P0(BLOCK3), and P0(BLOCK4)→P1(BLOCK4). After the communication ends, P2(BLOCK0), P3(BLOCK1), P4(BLOCK2), P0(BLOCK3), and P1(BLOCK4) respectively overwrite the original secret sharing value with the received secret sharing value to obtain... Figure 3 The result shown in (f) is shown in the figure.

[0091] Figure 3 (g) indicates the fourth round of communication, which involves the communication operations P2(BLOCK0)→P3(BLOCK0), P3(BLOCK1)→P4(BLOCK1), P4(BLOCK2)→P0(BLOCK2), P0(BLOCK3)→P1(BLOCK3), and P1(BLOCK4)→P2(BLOCK4). After the communication ends, P3(BLOCK0), P4(BLOCK1), P0(BLOCK2), P1(BLOCK3), and P2(BLOCK4) respectively overwrite the original secret sharing value with the received secret sharing value to obtain... Figure 3 The result shown in (h) is as follows.

[0092] After both rounds of communication are completed, each node obtains all M secret values ​​and completes the recovery operation of the secret shared values. In the above 2(N-1) rounds of communication, each node acts as both a data sender and receiver, with a single data transmission volume of M / N. Each pair of data transmissions utilizes the bandwidth of the corresponding node, resulting in a final transmission time of 2M(N-1) / N.

[0093] This model fully utilizes the bandwidth of each of the N nodes. In each round of communication, all nodes play the same role, achieving complete decentralization. It reduces the overall communication time from a linear or logarithmic relationship with the number of nodes N to a constant order of magnitude, meaning it is independent of the number of nodes. Under these circumstances, we can conclude that the property of communication time being essentially independent of the number of nodes has important implications for compiler design in secure multi-party computation.

[0094] Based on the above communication methods, this application also proposes a secure multi-party computation method for performing secure multi-party computation based on linear secret sharing technology.

[0095] In addition, this application also proposes a secure multi-party learning method in a wide area network (WAN), which includes several servers, and the servers perform secure multi-party learning through the above-mentioned communication method.

[0096] The method for recovering secret shared values ​​using our proposed new communication method, as well as the secure multi-party computation protocol and secure multi-party learning framework using this secret sharing method, show significant performance improvements.

[0097] Regarding secure multi-party computation protocols, many protocols require secret sharing techniques during their design, and the communication portion during secret sharing recovery has become a bottleneck for many protocols. Utilizing the communication method and secret sharing technique proposed in this application will significantly improve the performance of these secure multi-party computation protocols.

[0098] The following example illustrates the application of the above communication method in secure multi-party computation protocols.

[0099] The Beaver-Micali-Rogaway (BMR) protocol is a secure multi-party computation (SMC) protocol used to compute arbitrary functions while protecting participant privacy. This protocol extends Yao's GarbledCircuits method to accommodate multiple parties (more than two). It mainly includes steps such as representing the function as a circuit, constructing a scrambled circuit, distributing a scrambled table, evaluating the circuit, and reconstructing the result. In the circuit evaluation phase of the BMR protocol, the scrambled table for each gate needs to be opened using a secret-sharing recovery method before evaluation can proceed. In the result reconstruction phase, the final computation result needs to be removed by secret-sharing recovery to obtain the correct result. These operations introduce a large number of secret-sharing recovery operations and communication overhead into the entire BMR protocol; therefore, the original secret-sharing scheme can be replaced by utilizing the aforementioned communication method and secret-sharing scheme.

[0100] Multi-Party Shuffling, a technique in Secure Multi-Party Computation (SMC), is used to rearrange or shuffle datasets while maintaining data privacy. This technique is highly effective when dealing with sensitive data and is widely used in privacy-preserving voting, anonymous surveys, and data analysis. The secret-sharing shuffling, secondary MAC verification, and data output stages in multi-party shuffling all involve secret-sharing recovery operations, introducing significant communication overhead. Therefore, the original secret-sharing scheme can be replaced by utilizing the aforementioned communication methods and secret-sharing schemes.

[0101] RSS (Replicated Secret Sharing) is a new variant of secret sharing technology. It assigns a set of secret sharing values ​​to each participant, offering greater fault tolerance and versatility for secret recovery. In certain computing environments, it can reduce communication between participants. In a multi-party RSS protocol, multiple participants execute the RSS protocol. Secret sharing multiplication based on this model also involves numerous additions of auxiliary values ​​for secret sharing recovery operations, introducing significant communication overhead. Therefore, the aforementioned communication methods and secret sharing schemes can replace the original secret sharing scheme.

[0102] Furthermore, as described above, this application also presents relevant experimental tests on the MP-SPDZ framework under the original linear secret sharing technology and the MP-SPDZ framework under the communication method and secret sharing technology proposed in this application. The results are as follows.

[0103] This invention uses eight Raspberry Pi 4b compute nodes and a Huawei Future-Matrix S5735S-L series switch with eight gigabit Ethernet ports to conduct a network simulation experiment, testing the actual performance of multiple nodes executing the MP-SPDZ secure multi-party computation protocol.

[0104] In a wide area network environment (10ms latency, 100Mbps bandwidth), a typical multilayer perceptron classification network (with one input layer, two fully connected layers, one activation layer, and one fully connected output layer) was tested based on the MNIST handwritten digit dataset. Compared with the original communication mode, the new communication mode reduced the communication time from 384.1s to 142.0s, improving communication performance by 2.7 times; the total time decreased from 408.7s to 166.2s, improving overall performance by 2.46 times.

[0105] In a local area network environment (0.1ms latency, 500Mbps bandwidth), a typical multilayer perceptron classification network (with one input layer, two fully connected layers, one activation layer, and one fully connected output layer) was tested based on the MNIST handwritten digit dataset. Compared with the original communication mode, the new communication mode reduced the communication time from 103.1s to 67.8s, improving communication performance by 1.52 times; the total time decreased from 127.2s to 91.9s, improving overall performance by 1.38 times.

[0106] In secure multi-party learning frameworks, such as MP-SPDZ, a large number of secret-shared multiplication operations are required to handle the computational tasks during model training. Our proposed secret-sharing technique, utilizing a specific communication mode, can significantly improve the speed of these secret-shared multiplication operations, thereby enhancing the overall performance of MP-SPDZ.

[0107] Secure multi-party learning (SMIL) has significant applications in healthcare. Healthcare is a highly important and evolving field, and the key advantage of the SMIL framework lies in its ability to enable data sharing and analysis, disease diagnosis and treatment, and medical and drug development while protecting patient privacy. Different healthcare institutions (such as hospitals and research centers) possess vast amounts of valuable patient data, but due to privacy regulations (such as HIPAA), this data cannot be directly shared. Through the SMIL framework, institutions can collaboratively analyze data without directly sharing raw patient data. This means that cross-institutional data research, such as large-scale epidemiological studies, can be conducted without exposing individual patient information. Because of the fragmented and diverse distribution of various healthcare institutions and their related server clusters and data storage centers, data sources are increasingly dispersed, and the distribution and deployment of server clusters often span a wide area network (WAN). WANs often face the challenge of limited communication bandwidth, making communication a bottleneck in the entire SMIL task under traditional communication models. Our proposed communication model and the secure multi-party learning framework based on it can significantly improve this problem. Even with low-bandwidth communication settings, we can significantly improve communication performance compared to previous methods, achieving a closer balance between communication and computation, and greatly enhancing the efficiency of secure multi-party learning. This means that privacy-preserving data sharing and analysis can be achieved more efficiently across different healthcare infrastructure data centers.

[0108] Secure multi-party computation is finding increasingly widespread applications in the financial sector. In the financial industry, banks and other financial institutions face the challenge of identifying and preventing fraudulent activities. However, due to privacy and competition concerns, these institutions are often reluctant to share sensitive customer data, such as transaction history and credit information. By utilizing secure multi-party learning, financial institutions can jointly identify fraud patterns and suspicious transactions without directly sharing customer data; this method is known as "fraud prevention joint analysis."

[0109] Based on this, this application proposes a joint fraud prevention analysis method. Due to the need for customer privacy protection, sensitive customer information (such as name and account number) is first anonymized or de-identified. Secondly, the data is standardized to ensure consistent data formats across different institutions, facilitating subsequent processing. Then, we need to leverage the communication patterns within a new secure multi-party learning framework to secretly share financial privacy data (such as transaction records, account activity, and customer credit information) among different financial institutions. Afterward, we can execute the protocols within the secure multi-party learning framework, utilizing the new communication patterns to compute complex functions on large amounts of distributed privacy data, thereby achieving fraud pattern recognition to identify unusual transaction behaviors and suspicious cross-institutional transactions.

[0110] Furthermore, upon identifying potential fraud patterns or suspicious transactions, relevant information (such as transaction characteristics and risk scores) is extracted and decrypted when necessary. The decryption process involves opening a secret shared value. During this distributed decryption and opening phase, the aforementioned communication methods can also be utilized to improve the efficiency of fraud pattern or suspicious transaction identification and better ensure the security of financial transactions.

[0111] In subsequent secure multi-party computation examples, data sources will be more dispersed and geographically widespread, and the server clusters of different participants will be more fragmented. The distribution and deployment of these server clusters will often be spread across a single wide area network (WAN). WANs frequently face the challenge of limited communication bandwidth, making communication a bottleneck in the entire secure multi-party learning task under traditional communication models. Our proposed communication model and the secure multi-party learning framework based on it can significantly improve this problem. Even with low-bandwidth communication settings, we can significantly improve communication performance compared to previous methods, achieving a closer balance between communication and computation, and greatly enhancing the efficiency of secure multi-party learning.

[0112] Accordingly, this application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the communication method in the secure multi-party computation framework described above. Figure 4The diagram shown illustrates a hardware structure of any device with data processing capabilities within a secure multi-party computation framework according to an embodiment of the present invention, except for... Figure 4 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0113] Accordingly, this application also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the communication method in the secure multi-party computation framework described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0114] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0115] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A communication method in a secure multi-party computation protocol based on linear secret sharing technology, characterized in that, For N nodes with an average of M secret sharing values, each node divides its own secret sharing value into N parts. The method includes: The nodes communicate twice in a predetermined order and method, resulting in each node containing M secret value results after the communication ends, thus realizing the recovery of the secret shared value. In the first communication, node i sends its i-th, i-1, i-2, ... secret sharing value to the next node i+1 in sequence. After receiving the value, node i+1 adds it to its own i-th, i-1, i-2, ... secret sharing value. In the second communication, node i sends its i+1, i, i-1, i-2, ... secret value to the next node in sequence. Node i+1 replaces its own i+1, i, i-1, i-2, ... data with the received secret value. The first N-1 rounds of communication are performed according to a predetermined order and method, specifically as follows: In the first round of communication, node 1 sends the first secret shared value to node 2, and node 2 receives it and adds it to its own first secret shared value; node 2 sends the second secret shared value to node 3, and node 3 receives it and adds it to its own second secret shared value... node N sends the Nth secret shared value to node 1, and node 1 receives it and adds it to its own Nth secret shared value; In the second round of communication, node 2 sends the first secret shared value to node 3, and node 3 receives it and adds it to its own first secret shared value; node 3 sends the second secret shared value to node 4, and node 4 receives it and adds it to its own second secret shared value... node 1 sends the Nth secret shared value to node 2, and node 2 receives it and adds it to its own Nth secret shared value; The communication process for the remaining rounds follows the same principle; After N-1 rounds of communication, node 1 obtains the secret value of the second data, node 2 obtains the secret value of the third data, and so on, until node N obtains the secret value of the first data. The second N-1 round of communication is performed according to a predetermined order and method, specifically as follows: In the first round of communication, node 1 sends the second secret value to node 2, and node 2 replaces its own second data with the received value after receiving it; node 2 sends the third secret value to node 3, and node 3 replaces its own third data with the received value after receiving it... node N sends the first secret value to node 1, and node 1 replaces its own first data with the received value after receiving it. In the second round of communication, node 2 sends the second secret value to node 3. After receiving it, node 3 replaces its own second data with the received value. Node 3 sends the third secret value to node 4. After receiving it, node 4 replaces its own third data with the received value. ... Node 1 sends the first secret value to node 2. After receiving it, node 2 replaces its own first data with the received value. The communication in the remaining rounds follows the same pattern; After N-1 rounds of communication, all N nodes have obtained all M copies of the secret value result.

2. The method according to claim 1, characterized in that, The N nodes adopt a ring structure with the first and last nodes connected. In each round of communication, each node only sends and receives data with its neighboring nodes in the sequential direction.

3. A secure multi-party computation method, characterized in that, Secure multi-party computation based on linear secret sharing technology is performed using the communication method described in claim 1.

4. A secure multi-party learning method in a wide area network, characterized in that, The wide area network includes several servers, which perform secure multi-party learning with each other through the communication method described in claim 1.

5. A fraud prevention joint analysis method, characterized in that, include: Each financial institution anonymizes or de-identifies its local sensitive information and standardizes the processed local customer financial information. It then uses the communication method described in claim 1 to secretly share the standardized local customer financial information, thereby obtaining the local customer financial information of other financial institutions. Financial institutions use the communication method described in any one of claims 1-3 to identify fraud patterns based on a secure multi-party learning framework.

6. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in claim 1.

7. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in claim 1.

Images