Two-party secure computing method, device, electronic device, storage medium and product

Abstract

The present application provides a two-party secure computing method, device, electronic device, storage medium and product. The method includes: obtaining first data, obtaining multiple first sub-data based on the first data, obtaining a first ciphertext generated by a second party, the first ciphertext includes multiple second sub-data, the number of the multiple first sub-data and the multiple second sub-data are the same, obtaining a second ciphertext based on the multiple first sub-data and the first ciphertext, and sending the second ciphertext to the second party so that the second party decrypts the second ciphertext to obtain the target data. The above method greatly reduces the amount of calculation and communication in the two-party secure computing, thereby improving the efficiency of the two-party secure computing.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a two-party secure computing method, device, electronic device, storage medium, and product. Background Art

[0002] Users can use the privacy computing service platform to conduct collaborative data value mining without leaving the domain with private original data.

[0003] In some scenarios, it is often necessary to jointly analyze and process data from different users. During this joint analysis and processing, how to reduce the communication volume during the collaborative process while ensuring data privacy and security is an urgent issue to be addressed. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a two-party secure computing method, device, electronic device, storage medium and product to solve or partially solve the above problems.

[0005] Based on the above objectives, in a first aspect, the present application provides a two-party secure computing method, which is applied to a first party and includes:

[0006] obtaining first data;

[0007] Obtaining a plurality of first sub-data according to the first data;

[0008] Obtaining a first ciphertext generated by a second party, where the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data;

[0009] Obtaining a second ciphertext according to the plurality of first sub-data and the first ciphertext;

[0010] The second ciphertext is sent to the second party, so that the second party decrypts the second ciphertext to obtain the target data.

[0011] In a second aspect of the present application, a two-party secure computing method is provided, which is applied to a second party, and the method includes:

[0012] obtaining second data;

[0013] Segmenting the second data into n-dimensional segments to obtain a plurality of sub-vectors;

[0014] Obtaining a first ciphertext according to the multiple subvectors;

[0015] sending the first ciphertext to a first party, so that the first party obtains a second ciphertext based on the plurality of first sub-data and the first ciphertext;

[0016] The second ciphertext generated by the first party is obtained, and the target data is obtained after the second ciphertext is decrypted.

[0017] In a third aspect of the present application, a two-party secure computing device is provided, which is applied to a first party, and the device includes:

[0018] A first acquisition module is configured to acquire first data;

[0019] a first calculation module, configured to obtain a plurality of first sub-data according to the first data;

[0020] a second acquisition module configured to acquire a first ciphertext generated by a second party, wherein the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data;

[0021] a second calculation module, configured to obtain a second ciphertext according to the plurality of first sub-data and the first ciphertext;

[0022] The first sending module is configured to send the second ciphertext to the second party, so that the second party decrypts the second ciphertext to obtain target data.

[0023] In a fourth aspect of the present application, a two-party secure computing device is provided, which is applied to a second party, and the device includes:

[0024] a third acquisition module, configured to acquire second data;

[0025] a third computing module configured to segment the second data into n-dimensional segments to obtain a plurality of sub-vectors;

[0026] a fourth computing module, configured to obtain a first ciphertext according to the plurality of subvectors;

[0027] a second sending module configured to send the first ciphertext to a first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext;

[0028] The fourth acquisition module is configured to acquire the second ciphertext generated by the first party and decrypt the second ciphertext to obtain target data.

[0029] In a fifth aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect or the second aspect is implemented.

[0030] In a sixth aspect of the present application, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method described in the first aspect or the second aspect.

[0031] In a seventh aspect of the present application, a computer program product is provided, comprising computer program instructions, which, when executed on a computer, cause the computer to execute the method described in the first aspect or the second aspect.

[0032] As can be seen from the above, the present application provides a two-party secure computing method, device, electronic device, storage medium and product. The method includes: obtaining first data, obtaining multiple first sub-data based on the first data, obtaining a first ciphertext generated by a second party, the first ciphertext including multiple second sub-data, the multiple first sub-data and the multiple second sub-data being the same in number, obtaining a second ciphertext based on the multiple first sub-data and the first ciphertext, and sending the second ciphertext to the second party so that the second party decrypts the second ciphertext to obtain the target data. The above method greatly reduces the amount of computation and communication in the two-party secure computing, thereby improving the efficiency of the two-party secure computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0034] Figure 1A A schematic diagram of an exemplary system according to an embodiment of the present application is shown.

[0035] Figure 1B A schematic diagram of a calculation flow of an exemplary secure multiplication according to an embodiment of the present application is shown.

[0036] Figure 2 A flow chart of an exemplary two-party secure computing method according to an embodiment of the present application is shown.

[0037] Figure 3A A flow chart of an exemplary two-party secure computing method according to an embodiment of the present application is shown.

[0038] Figure 3B A flow chart of an exemplary two-party secure computing method according to an embodiment of the present application is shown.

[0039] Figure 4AA schematic diagram of an exemplary two-party secure computing device according to an embodiment of the present application is shown.

[0040] Figure 4B A schematic diagram of an exemplary two-party secure computing device according to an embodiment of the present application is shown.

[0041] Figure 5 A schematic diagram of an exemplary electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0042] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0043] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0044] It is understandable that before using the technical solutions of each embodiment of this application, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0045] For example, in response to receiving a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require obtaining and using the user's information. Thus, the user can independently choose whether to provide information to the electronic device, application, server, storage medium, or other software or hardware that performs the operation of the technical solution of the present application based on the prompt message.

[0046] As an optional but non-limiting implementation, in response to a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0047] It is understandable that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this application. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this application.

[0048] Figure 1A FIG. 1 is a schematic diagram of an exemplary system 100 according to an embodiment of the present application.

[0049] like Figure 1A As shown, in the two-party secure computing system 100, each participant (such as Figure 1A Participants 108 and 112 in the process can each hold local business data (e.g., data stored in databases 102 and 104) and perform calculations through homomorphic encryption, secret sharing, obfuscated circuits, and the like. During the calculation process, the two participants can communicate and calculate in a private manner, while maintaining a sharded form of the intermediate results or final business processing results obtained by each participant. Because each participant cannot disclose local private data and each holds a shard of the intermediate results, all data that needs to be exchanged during the calculation process is carried out in a secure manner.

[0050] In a bilateral secure computation between two parties (a two-party secure computation is a computation process involving two participants), each participant's original data never leaves the local machine and is not accessible to the other party throughout the computation. The two parties refer to the two participants in the secure computation, whose data is isolated from each other, for example, on different devices or even in different cities.

[0051] In secure two-party computation, data that the other party does not want to know is called private data. To protect private data, private data x can be stored on the first and second parties as shares in a ring A. For example, the first share x0 of data x is stored on the first party, and the second share x1 is stored on the second party, i.e., data x = x0 + x1 ∈ ring A.

[0052] It should be noted that a ring is an algebraic structure that can be roughly understood as a set of numbers that can be added and multiplied together. Sharding refers to splitting private data into several shards. The original data cannot be inferred from a single shard; only by combining multiple shards can the original data be inferred. For example, if data 10 is split into data 3 and data 7 (10 = 3 + 7), then data 3 and data 7 are two shards of data 10.

[0053] When the ring When the first shard data x0 and the second shard data x1 are called the arithmetic shares (Arithmetic Shares or A-shares) of data x; When the first shard x0 and the second shard x1 are Bool shares (or B-shares) of data x, they are called Bool Shares. In secure two-party computation, arithmetic shares are more suitable for performing arithmetic operations such as addition and multiplication. To securely compute the multiplication of two arithmetic shares x and y, the [Secure Multiplication] protocol can be used.

[0054] Figure 1B A schematic diagram of a calculation flow of an exemplary secure multiplication according to an embodiment of the present application is shown.

[0055] like Figure 1B As shown, the pseudo-random number generation server 126 pre-calculates (a0+a1)(b0+b1)=c0+c1, sends the calculated random numbers a0, b0, c0 to the first party 122, and sends the calculated random numbers a1, b1, c1 to the second party 124. The calculation process of secure multiplication is:

[0056] The first party 122 obtains random numbers a0, b0, c0, and the second party 124 obtains random numbers a1, b1, c1. Wherein, a0, b0, c0 and a1, b1, c1 can be obtained by a third party (e.g., Figure 1B The pseudo-random number generator server in the [ 0015 ] is used to generate and distribute the [ 0015 ] to the first party 122 and the second party 124. Alternatively, the first party 122 and the second party 124 can generate the [ 0015 ] locally. The first party 122 uses the shard data x0 and y0 it holds to calculate the perturbation results x0-a0 and y0-b0, and sends the perturbation results to the second party 124. The second party 124 uses the shard data x1 and y1 it holds to calculate the perturbation results x1-a1 and y1-b1, and sends the perturbation results to the first party 122. Furthermore, the first party 122 can calculate the shared component d x =x0-a0+x1-a1 and d y =y0-b0+y1-b1. The second party 124 can calculate the shared component d x =x0-a0+x1-a1 and d y =y0-b0+y1-b1. The first side 122 outputs the target data (d x )y0+a0(d y )+c0, the second party 124 outputs the target data (d x )y1+a1(d y )+c1. The feasibility principle is: xy=(xa)b+a(yb)+ab=((d x )b0+a0(d y )+c0)+((d x )b1+a1(d y )+c1).

[0057] During secure multiplication calculations, pre-prepared triplets can be used to assist in the completion of the calculation. These triplets are called multiplication triples (Triple). The multiplication triples can be calculated offline (Offline functionalitV) by a third party (e.g., a semi-honest third party). In some embodiments, the multiplication triples can be generated in batches using a fully homomorphic encryption mechanism (BFV).

[0058] It's important to note that offline computing involves pre-processing data before executing actual computations. Generally, offline computing doesn't require strict time constraints. Online computing involves executing actual computations, and it's generally desirable for online computing to complete as quickly as possible. Batch computing involves executing the same computation on a large amount of pre-prepared data, and it often offers more room for performance optimization.

[0059] Homomorphic encryption is a technology that allows calculations to be performed on encrypted data (i.e., ciphertext) and then decrypted to obtain the result. The result of the homomorphic encryption calculation is the same as the result of direct calculation on the original data (i.e., plaintext), but the entire calculation process is performed on the encrypted data.

[0060] Fully Homomorphic Encryption (BFV) is an encryption algorithm used to implement homomorphic encryption.

[0061] In the batch generation of multiplication triples using the fully homomorphic confidentiality mechanism, when the ring When , we can use the fully homomorphic encryption mechanism with Number Theoretic Transform Encode (NTT Encode) and Number Theoretic Transform Decode (NTTDecode) to generate multiplication triples in batches. represents a finite field.

[0062] In the process of batch generation of multiplication triplets, in some embodiments, the first party P0 may randomly generate a random number The second party P1 can randomly generate a random number The first party P0 can encode the random number a0 as m0∈R p , and generate random numbers Encode the random number u0 as w0∈R p , and encrypt, perform plaintext and ciphertext multiplication, ciphertext addition (subtraction) operation to obtain ciphertext The ciphertext Send to the second party P1. The second party P1 sends the ciphertext Decrypt and get the plaintext

[0063] The second party P1 encodes the random number a1 into plaintext m1∈R p And encrypt the plaintext m1 into the ciphertext ct=Enc(m1), and send the ciphertext ct to the first party P0.

[0064] The calculation method of random numbers b0 and b1 is the same as that of random numbers a0 and a1. The first party P0 can generate random numbers The second party P1 can get the plaintext based on the random number b0 Thus, the first party P0 holds u0 and v0, and the second party P1 holds u1 and v1. The first party P0 can calculate the value y0: = a0b0 + u0 + v0, and the second party P1 can calculate the value y1: = a1b1 + u1 + v1.

[0065] Among them, R p Represents a ring, fully homomorphic encryption mechanism in the ring and Operations are performed on the above, where n represents the power of 2 and is called the modulus of the polynomial, p is called the plaintext modulus, q is called the ciphertext modulus, and p<q.

[0066] In some application scenarios, the first party P0 may hold data a, and the second party P1 may hold data b. The first and second parties P0 use bilateral secure computing technology to query the data of the first and / or second parties P1 without exposing each other's private data. After the query is completed, only the query results are disclosed to the querying party. The first and second parties P0 can align data based on data identifiers through private intersection. After alignment, the first party P0's data is an N×2 matrix consisting of two columns, "key" and "x", and the second party P1's data is an N×1 matrix consisting of a column, "y". Where N represents the dimension of the matrix.

[0067] The first party P0 and the second party P1 can use the secure multiplication protocol to calculate the intermediate result t:=ax*by. This intermediate result is an N×1 matrix and is stored in the first party P0 and the second party P1 in the form of slices. The first party P0 and the second party P1 use the two-party secure computation technique to calculate the aggregation function sum_group_by(t, a.key) to obtain the calculation result of the aggregation function. The result is an m×1 matrix and is stored in the first party P0 and the second party P1 in the form of slices. The first party P0 and the second party P1 return the calculation result of the aggregation function to the querying party, which sums it to obtain the plaintext query result.

[0068] During the calculation process of the aggregate function, the calculation is generally performed using the following method.

[0069] The first party P0 encodes the data in the "key" column to obtain an n×m matrix K. Each row of the matrix K is an m-dimensional vector, and n represents the number of rows in the matrix. Among them, m is the number of possible value classes of key. The first party P0 and the second party P1 calculate the matrix K through the secure multiplication protocol. T t. Calculate the matrix K using the secure multiplication protocol T During the process of t, the offline communication volume is 2mN multiplication triplets, and the online communication volume is 4mN multiplication triplets. It can be seen that the communication volume is proportional to mN. Therefore, when the number of classes m increases, the communication volume increases and the system operation will slow down significantly.

[0070] In view of this, the present application provides a two-party secure computing method, device, electronic device, storage medium, and product. The method includes: obtaining first data, obtaining multiple first sub-data based on the first data, obtaining a first ciphertext generated by a second party, the first ciphertext including multiple second sub-data, the multiple first sub-data and the multiple second sub-data being the same in number, obtaining a second ciphertext based on the multiple first sub-data and the first ciphertext, and sending the second ciphertext to the second party so that the second party decrypts the second ciphertext to obtain the target data. The above method greatly reduces the amount of computation and communication required for two-party secure computing, thereby improving the efficiency of two-party secure computing.

[0071] Figure 2 A flow chart of an exemplary two-party secure computation method 200 according to an embodiment of the present application is shown.

[0072] In step 202, first data is obtained. The first data can be divided into a case where data t is unilateral private data and a case where data t is fragmented data.

[0073] In step 204, a plurality of first sub-data are obtained according to the first data.

[0074] For the case where data t is private data of a single party, in some embodiments, the first data input by the first party P0 is the first input data: The output target data is: Represents an integer ring, m represents the number of rows, and N represents the total number of columns.

[0075] The first party P0 can perform one-hot encoding on the first input data to obtain the first matrix in, Represents a dataset. It should be noted that in one-hot encoding, if a piece of data a has K possible values, it can be one-hot encoded. The encoded vector One-Hot(x) is a K-dimensional vector, in which the a-th bit is 1 and the remaining bits are 0. The dimension K of the vector can be determined according to user needs.

[0076] In some embodiments, the first party P0 may transpose the first matrix A to obtain a second matrix. The first party P0 may split the second matrix into [N / n] sub-matrices and use the [N / n] sub-matrices as the first sub-data, where the size of each sub-matrix is ​​[m, n], where m represents the number of rows of the sub-matrix, n represents the number of columns of the sub-matrix, and N represents the total number of columns of the second matrix.

[0077] For the case where the data t is sharded data, in some embodiments, the first data input by the first party P0 is the first sharded data: and first input data: columns The first party P0 performs one-hot encoding on the first input data to obtain the first matrix A. The second matrix is ​​obtained by transposing the first matrix A. The first slice data is segmented into n-dimensional segments to obtain [N / n] first slice sub-vectors, which are then used as the first sub-data.

[0078] In step 206 , a first ciphertext generated by the second party is obtained, where the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data.

[0079] The first ciphertext is generated by the second party P1, which may specifically include the following steps.

[0080] In step 201, second data is obtained. The second data can be divided into the case where data t is unilateral private data and the case where data t is fragmented data.

[0081] In step 203, a plurality of sub-vectors are obtained according to the second data.

[0082] For the case where data t is private data of a single party, in some embodiments, the second data input by the second party P1 is: The output target data is: Wherein, y0+y1=sum_group_by(t, key).sum_group_by(t, key) represents an aggregation function.

[0083] The second party P1 can divide the input second data into [N / n] segments of sub-vectors with n dimensions as a segment, which can be expressed as Among them, b0,...,bn-1 Represents [N / n] segment vector. Use [N / n] segment vector as the second sub-data

[0084] In the case where the data t is fragmented data, in some embodiments, the second data input by the second party P1 is the second fragmented data: The second party P1 may divide the input second slice data into [N / n] second slice sub-vectors with n dimensions as a segment, and use the [N / n] second slice sub-vectors as the second sub-data, where N represents the dimension of the second slice data and n represents the dimension of the second slice sub-vector.

[0085] In step 205, a first ciphertext is obtained according to the multiple sub-vectors.

[0086] For the case where data t is private data of a single party, in some embodiments, the second party P1 can encode the [N / n] segment subvectors into a ring R p The polynomial coefficients in the ring R are obtained p [N / n] polynomials in Where x is a variable of the polynomial, and i represents 1, ..., n. The second party P1 encrypts the polynomial using its own private key to obtain the first ciphertext By directly encoding the vector onto the coefficients of the polynomial, there is no need to use number theory transformation coding methods for encoding, which reduces the amount of computation and communication in the secure computing process between the two parties.

[0087] For the case where the data t is sliced ​​data, in some embodiments, the second party P1 encodes [N / n] second slice subvectors into coefficients of a polynomial to obtain [N / n] third polynomials And use the private key of the second party P1 to encrypt the third polynomial to obtain the fourth ciphertext The second party P1 sends the fourth ciphertext to the first party P0.

[0088] The first party P0 takes [N / n] first slice sub-vectors Encoded as ring R p The coefficients of the polynomial in , to get [N / n] second polynomials And use the public key of the second party P1 to encrypt the second polynomial to obtain the third ciphertext Then use the ciphertext addition function to calculate the fourth ciphertext and the third ciphertext to obtain the fifth ciphertext containing [N / n] fourth polynomials: The fifth ciphertext is used as the first ciphertext, so the first ciphertext includes [N / n] fourth polynomials. This method allows for direct homomorphic encryption of data held by a participant (e.g., the first party P0 or the second party P1) without generating multiplication triples. This eliminates the need for a third party to generate multiplication triples.

[0089] In step 207 , the first ciphertext is sent to the first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext.

[0090] The second party P1 sends the first ciphertext to the first party P0.

[0091] In step 208, a second ciphertext is obtained according to the plurality of first sub-data and the first ciphertext.

[0092] For the case where data t is unilateral private data, in some embodiments, after the first party P0 divides the second matrix into [N / n] sub-matrices, each row of each sub-matrix can be encoded as a ring R p The coefficients of the polynomial in the ring R are obtained p The m[N / n] first polynomials in And use the plaintext and ciphertext multiplication to multiply the m[N / n] first polynomials and the [N / n] fourth polynomials included in the first ciphertext to calculate the sixth ciphertext Wherein, i=0, ..., m-1.

[0093] The first party P0 accumulates the sixth ciphertext obtained from each row of each submatrix to obtain the seventh ciphertext, which can be expressed as: in, represents the sixth ciphertext, and k represents the number of sixth ciphertexts.

[0094] By summing up the multiple sixth ciphertexts obtained from each row of each submatrix, the seventh ciphertext for each submatrix can be obtained. For [N / n] submatrices, multiple seventh ciphertexts can be obtained, and each of the multiple seventh ciphertexts is stored in a single ciphertext. In some embodiments, multiple ciphertexts can be packaged into a single ciphertext to reduce communication traffic.

[0095] The first party P0 packages multiple seventh ciphertexts obtained from each submatrix into an eighth ciphertext h(x), and generates an encrypted random polynomial r(x)∈R p The random polynomial r(x) is subtracted from the eighth ciphertext h(x) to obtain the second ciphertext E(hr), which is sent to the second party P1.

[0096] In step 210, the second ciphertext is sent to a second party, so that the second party decrypts the second ciphertext to obtain target data.

[0097] The second party P1 decrypts the second ciphertext E(hr) and obtains the eighth ciphertext h(x) and the plaintext of the random polynomial r(x). The second party P1 returns the x of the random polynomial r(x). di The coefficients are calculated to obtain the target data. Where d = ceil ( ) means rounding up.

[0098] In step 209, the second ciphertext generated by the first party is obtained, and the second ciphertext is decrypted to obtain the target data.

[0099] The communication volume of the two-party secure computation method provided in the embodiment of the present application can be expressed as (N+n)cl, where c is the ciphertext expansion factor for homomorphic encryption and l = log(p). It can be seen that there is no mN term in this communication volume, indicating that the communication volume of the two-party secure computation method provided in the embodiment of the present application does not increase with the increase of the number of classes m.

[0100] Figure 3A FIG. 3 is a flow chart showing an exemplary two-party secure computing method 300 according to an embodiment of the present application. Figure 3A As shown, the method 300 can be applied to a first party (e.g., Figure 2 The first party P0) in the process may include the following steps.

[0101] In step 302, first data is acquired.

[0102] In step 304, a plurality of first sub-data are obtained according to the first data.

[0103] In some embodiments, the first data includes first input data, and obtaining multiple first sub-data based on the first data further includes: obtaining a first matrix based on the first input data; transposing the first matrix to obtain a second matrix; dividing the second matrix into [N / n] sub-matrices to obtain the multiple first sub-data, wherein N represents the total number of columns of the second matrix, and n represents the number of columns of the sub-matrix.

[0104] In some embodiments, the first data also includes first shard data, and obtaining multiple first sub-data based on the first data also includes: segmenting the first shard data into n-dimensional segments to obtain [N / n] first shard sub-vectors, and using the [N / n] first shard sub-vectors as the multiple first sub-data.

[0105] In step 306 , a first ciphertext generated by the second party is obtained, where the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data.

[0106] In some embodiments, the method further includes: encoding the [N / n] first slice subvectors into coefficients of a polynomial to obtain [N / n] second polynomials; encrypting the [N / n] second polynomials to obtain a third ciphertext, where the third ciphertext is obtained by encrypting the second polynomial using the public key of the second party; obtaining a fourth ciphertext generated by the second party; obtaining a fifth ciphertext based on the third ciphertext and the fourth ciphertext, and using the fifth ciphertext as the first ciphertext.

[0107] In step 308, a second ciphertext is obtained according to the plurality of first sub-data and the first ciphertext.

[0108] In some embodiments, the first ciphertext includes [N / n] fourth polynomials, and obtaining the second ciphertext based on the multiple first sub-data and the first ciphertext further includes: encoding each row of the [N / n] sub-matrices as a coefficient of a polynomial to obtain m[N / n] first polynomials, where m represents the number of rows of the sub-matrix; and multiplying the m[N / n] first polynomials and the [N / n] fourth polynomials accordingly to obtain the second ciphertext.

[0109] In some embodiments, multiplying the m[N / n] first polynomials and the [N / n] fourth polynomials correspondingly to obtain the second ciphertext further includes: multiplying the m[N / n] first polynomials and the [N / n] fourth polynomials correspondingly to obtain multiple sixth ciphertexts; accumulating the multiple sixth ciphertexts to obtain multiple seventh ciphertexts; and obtaining the second ciphertext based on the multiple seventh ciphertexts.

[0110] In some embodiments, obtaining the second ciphertext based on the multiple seventh ciphertexts further includes: packing the multiple seventh ciphertexts to obtain an eighth ciphertext; generating a random polynomial; and subtracting the eighth ciphertext from the random polynomial to obtain the second ciphertext.

[0111] In step 310, the second ciphertext is sent to the second party, so that the second party decrypts the second ciphertext to obtain the target data.

[0112] Figure 3B FIG. 3 is a flow chart showing an exemplary two-party secure computation method 320 according to an embodiment of the present application. Figure 3B As shown, method 320 may be applied to a second party (e.g., Figure 2The second party P1) in the embodiment may include the following steps.

[0113] In step 322, second data is acquired.

[0114] In step 324 , a plurality of sub-vectors are obtained according to the second data.

[0115] In some embodiments, the second data includes second shard data, and obtaining a plurality of sub-vectors based on the second data further includes: segmenting the second shard data into n-dimensional segments to obtain [N / n] second shard sub-vectors, and using the [N / n] second shard sub-vectors as the plurality of sub-vectors, where N represents the dimension of the second shard data and n represents the dimension of the second shard sub-vector.

[0116] In step 326, a first ciphertext is obtained according to the multiple sub-vectors.

[0117] In some embodiments, the method further includes: encoding the [N / n] second slice subvectors into coefficients of a polynomial to obtain [N / n] third polynomials; encrypting the [N / n] third polynomials to obtain a fourth ciphertext, where the fourth ciphertext is obtained by encrypting the [N / n] third polynomials using a private key; and sending the fourth ciphertext to the first party so that the first party obtains a fifth ciphertext based on the third ciphertext and the fourth ciphertext, and uses the fifth ciphertext as the first ciphertext.

[0118] In step 328, the first ciphertext is sent to the first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext.

[0119] In step 330, the second ciphertext generated by the first party is obtained, and the second ciphertext is decrypted to obtain the target data.

[0120] The present application provides a two-party secure computing method, device, electronic device, storage medium, and product. The method includes: obtaining first data, obtaining multiple first sub-data based on the first data, obtaining a first ciphertext generated by a second party, the first ciphertext including multiple second sub-data, the multiple first sub-data and the multiple second sub-data being the same in number, obtaining a second ciphertext based on the multiple first sub-data and the first ciphertext, and sending the second ciphertext to the second party so that the second party decrypts the second ciphertext to obtain the target data. The above method greatly reduces the amount of computation and communication required for two-party secure computing, thereby improving the efficiency of two-party secure computing.

[0121] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0122] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0123] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a two-party secure computing device 400.

[0124] refer to Figure 4A , the apparatus 400 may be applied to a first party and may include:

[0125] The first acquisition module 402 is configured to acquire first data.

[0126] The first calculation module 404 is configured to obtain a plurality of first sub-data according to the first data.

[0127] The first calculation module 404 is further configured to obtain a first matrix based on the first input data; transpose the first matrix to obtain a second matrix; and divide the second matrix into [N / n] sub-matrices to obtain the multiple first sub-data, where N represents the total number of columns of the second matrix and n represents the number of columns of the sub-matrix.

[0128] The first calculation module 404 is further configured to segment the first slice data into n-dimensional segments to obtain the [N / n] first slice sub-vectors, and use the [N / n] first slice sub-vectors as the multiple first sub-data.

[0129] The second acquisition module 406 is configured to acquire a first ciphertext generated by a second party, where the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data.

[0130] The second acquisition module 406 is further configured to encode the [N / n] first slice sub-vectors into coefficients of a polynomial to obtain [N / n] second polynomials; encrypt the [N / n] second polynomials to obtain a third ciphertext, where the third ciphertext is obtained by encrypting the second polynomial using the public key of the second party; obtain a fourth ciphertext generated by the second party; obtain a fifth ciphertext based on the third ciphertext and the fourth ciphertext, and use the fifth ciphertext as the first ciphertext.

[0131] The second calculation module 408 is configured to obtain a second ciphertext according to the plurality of first sub-data and the first ciphertext.

[0132] The second computing module 408 is further configured to encode each row of the [N / n] submatrices as a coefficient of a polynomial to obtain m[N / n] first polynomials, where m represents the number of rows of the submatrix; and multiply the m[N / n] first polynomials and the [N / n] fourth polynomials accordingly to obtain the second ciphertext.

[0133] The second calculation module 408 is further configured to multiply the m[N / n] first polynomials and the first ciphertext to obtain multiple sixth ciphertexts; accumulate the multiple sixth ciphertexts to obtain multiple seventh ciphertexts; and obtain the second ciphertext based on the multiple seventh ciphertexts.

[0134] The second calculation module 408 is further configured to pack the multiple seventh ciphertexts to obtain an eighth ciphertext; generate a random polynomial; and subtract the eighth ciphertext from the random polynomial to obtain the second ciphertext.

[0135] The first sending module 410 is configured to send the second ciphertext to the second party, so that the second party decrypts the second ciphertext to obtain target data.

[0136] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0137] The apparatus of the above embodiment is used to implement the corresponding method 300 in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0138] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a two-party secure computing device 420.

[0139] refer to Figure 4B , the apparatus 420 may be applied to the second party and may include:

[0140] The third acquisition module 422 is configured to acquire second data.

[0141] The third calculation module 424 is configured to obtain a plurality of sub-vectors according to the second data.

[0142] The third computing module 424 is further configured to segment the second slice data into n-dimensional segments to obtain [N / n] second slice sub-vectors, and use the [N / n] second slice sub-vectors as the multiple sub-vectors, where N represents the dimension of the second slice data and n represents the dimension of the second slice sub-vector.

[0143] The fourth calculation module 426 is configured to obtain a first ciphertext according to the multiple sub-vectors.

[0144] The fourth computing module 426 is further configured to encode the [N / n] second slice sub-vectors into coefficients of a polynomial to obtain [N / n] third polynomials; encrypt the [N / n] third polynomials to obtain a fourth ciphertext, where the fourth ciphertext is obtained by encrypting the [N / n] third polynomials using a private key; and send the fourth ciphertext to the first party so that the first party obtains a fifth ciphertext based on the third ciphertext and the fourth ciphertext, and uses the fifth ciphertext as the first ciphertext.

[0145] A second sending module 428 is configured to send the first ciphertext to the first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext;

[0146] The fourth acquisition module 430 is configured to acquire the second ciphertext generated by the first party and decrypt the second ciphertext to obtain target data.

[0147] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0148] The apparatus of the above embodiment is used to implement the corresponding method 320 in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0149] Based on the same technical concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, method 300 and / or method 320 as described in any of the above embodiments is implemented.

[0150] Figure 5A schematic diagram of an exemplary electronic device according to an embodiment of the present application is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0151] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0152] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0153] The input / output interface 1030 is used to connect an input / output module to implement information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0154] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0155] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0156] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0157] The electronic device of the above embodiment is used to implement the corresponding method 300 and / or method 320 in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0158] Based on the same technical concept, corresponding to any of the above-mentioned embodiments, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute method 300 and / or method 320 as described in any of the above embodiments.

[0159] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0160] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute method 300 and / or method 320 as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0161] Based on the same inventive concept, corresponding to method 300 and / or method 320 described in any of the above embodiments, the present application further provides a computer program product, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes method 300 and / or method 320 described in any of the above embodiments. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to execute method 300 and / or method 320. Corresponding to the execution subject corresponding to each step in each embodiment of method 300 and / or method 320, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0162] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute method 300 and / or method 320 as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0163] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. Within the scope of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0164] In addition, for simplicity of description and discussion, and in order not to make the embodiment of the application difficult to understand, the known power supply / ground connection with integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the application difficult to understand, and this also takes into account the following fact, that is, the details of the embodiment of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuit) are set forth to describe exemplary embodiments of the application, it will be apparent to those skilled in the art that the embodiment of the application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0165] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0166] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of this application.

Claims

1. A two-party secure computing method, applied to a first party, the method comprising: Acquire first data; According to the first data, a plurality of first sub-data are obtained; wherein the first data includes first input data, and the obtaining of the plurality of first sub-data according to the first data further includes: obtaining a first matrix according to the first input data; transposing the first matrix to obtain a second matrix; Acquire a first ciphertext generated by a second party, where the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data; Obtaining a second ciphertext according to the plurality of first sub-data and the first ciphertext; sending the second ciphertext to the second party, so that the second party decrypts the second ciphertext to obtain the target data; The first ciphertext includes a fourth polynomial, the plurality of first sub-data comprising sub-matrices, wherein obtaining the second ciphertext according to the plurality of first sub-data and the first ciphertext further comprises: The Each row of the submatrix is ​​encoded as the coefficient of a polynomial to obtain The first polynomial, where represents the total number of columns of the second matrix, represents the number of rows of the submatrix, represents the number of columns of the submatrix; The The first polynomial and the The fourth polynomials are correspondingly multiplied to obtain the second ciphertext.

2. The method of claim 1, wherein: The obtaining a plurality of first sub-data according to the first data further comprises: The second matrix is ​​divided into sub-matrices to obtain the plurality of first sub-data.

3. The method of claim 1, wherein: The first data further includes first fragment data, and obtaining a plurality of first sub-data according to the first data further includes: The first fragment data is Dimension is divided into segments to obtain The first slice sub-vector, and the first slice sub-vectors as the multiple first sub-data.

4. The method of claim 3, wherein: The method further comprises: The The first slice subvectors are encoded as coefficients of a polynomial to obtain The second polynomial; Regarding the encrypting the second polynomial by using the public key of the second party to obtain a third ciphertext, wherein the third ciphertext is obtained by encrypting the second polynomial by using the public key of the second party; Obtaining a fourth ciphertext generated by the second party; A fifth ciphertext is obtained according to the third ciphertext and the fourth ciphertext, and the fifth ciphertext is used as the first ciphertext.

5. The method of claim 1, wherein: The said The first polynomial and the The corresponding fourth polynomials are multiplied to obtain the second ciphertext further comprising: The The first polynomial and the Multiply the corresponding fourth polynomials to obtain multiple sixth ciphertexts; Accumulating the plurality of sixth ciphertexts to obtain a plurality of seventh ciphertexts; The second ciphertext is obtained according to the plurality of seventh ciphertexts.

6. The method of claim 5, wherein: The obtaining the second ciphertext according to the plurality of seventh ciphertexts further comprises: Packing the plurality of seventh ciphertexts to obtain an eighth ciphertext; Generate random polynomials; The eighth ciphertext and the random polynomial are subtracted to obtain the second ciphertext.

7. A two-party secure computing method, applied to a second party, the method comprising: acquiring second data; According to the second data, a plurality of sub-vectors are obtained; Obtaining a first ciphertext according to the multiple subvectors; sending the first ciphertext to a first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext; Obtaining the second ciphertext generated by the first party, and decrypting the second ciphertext to obtain target data; The second data includes second slice data, and the multiple sub-vectors include second sharding sub-vectors, wherein obtaining the first ciphertext according to the plurality of sub-vectors further comprises: The The second slice subvectors are encoded as coefficients of a polynomial to obtain A third polynomial, where represents the dimension of the second shard data, represents the dimension of the second slicing sub-vector; Regarding the The third polynomial is used for encryption to obtain the fourth ciphertext; The fourth ciphertext is sent to the first party, so that the first party obtains a fifth ciphertext according to the third ciphertext and the fourth ciphertext, and uses the fifth ciphertext as the first ciphertext.

8. The method of claim 7, wherein: The obtaining a plurality of sub-vectors according to the second data further comprises: The second fragment data is The dimension is divided into segments to obtain the The second slice sub-vector, and the second slice sub-vectors as the multiple sub-vectors.

9. The method of claim 7, wherein: The fourth ciphertext is a ciphertext encrypted using a private key. The encryption is performed using a third polynomial.

10. A two-party secure computing device, applied to a first party, the device comprising: A first acquisition module is configured to acquire first data; A first calculation module is configured to obtain a plurality of first sub-data according to the first data; wherein the first data includes first input data, and the first calculation module is further configured to obtain a first matrix according to the first input data; and transpose the first matrix to obtain a second matrix; A second acquisition module is configured to acquire a first ciphertext generated by a second party, wherein the first ciphertext includes a plurality of second sub-data, and the number of the plurality of first sub-data is the same as the number of the plurality of second sub-data; A second calculation module is configured to obtain a second ciphertext according to the plurality of first sub-data and the first ciphertext; A first sending module is configured to send the second ciphertext to the second party, so that the second party decrypts the second ciphertext to obtain target data; The first ciphertext includes a fourth polynomial, the plurality of first sub-data comprising sub-matrices, the second computing module is further configured as: The Each row of the submatrix is ​​encoded as the coefficient of a polynomial to obtain The first polynomial, where represents the total number of columns of the second matrix, represents the number of rows of the submatrix, represents the number of columns of the submatrix; The The first polynomial and the The fourth polynomials are correspondingly multiplied to obtain the second ciphertext.

11. A two-party secure computing device, applied to a second party, the device comprising: A third acquisition module is configured to acquire second data; The third computing module is configured to convert the second data into The dimension is segmented into segments to obtain multiple sub-vectors; a fourth calculation module, configured to obtain a first ciphertext according to the multiple sub-vectors; A second sending module is configured to send the first ciphertext to a first party, so that the first party obtains a second ciphertext according to the plurality of first sub-data and the first ciphertext; A fourth acquisition module is configured to acquire the second ciphertext generated by the first party, and decrypt the second ciphertext to obtain target data; The second data includes second slice data, and the multiple sub-vectors include The fourth computing module is further configured to: The The second slice subvectors are encoded as coefficients of a polynomial to obtain A third polynomial, where represents the dimension of the second shard data, represents the dimension of the second slicing sub-vector; Regarding the The third polynomial is used for encryption to obtain the fourth ciphertext; The fourth ciphertext is sent to the first party, so that the first party obtains a fifth ciphertext according to the third ciphertext and the fourth ciphertext, and uses the fifth ciphertext as the first ciphertext.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 9 is implemented.

13. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 9.

14. A computer program product, wherein: The method comprises computer program instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 9.

Images